feat(provisioning): declare default bucket encryption

CHANGELOG.md

@@ -42,6 +42,8 @@ All notable changes to RustFS Operator are documented in this file. The format i
 - Tenant `spec.tiers` for declarative S3, RustFS, and MinIO remote tiers with Secret-sourced
   credentials, rotation on Secret updates, and conflict reporting for immutable tier settings.
 - Declarative Tenant bucket versioning and Object Lock default retention with drift-aware ownership.
+- Declarative default bucket encryption (`SSE-S3` or `SSE-KMS`) with drift-aware ownership,
+  explicit removal, and validation of the Tenant SSE-S3 master key or KMS default key.
 - Helm chart `cosiDriver.enabled` to deploy the RustFS COSI (`rustfs.objectstorage.k8s.io`)
   driver alongside the upstream provisioner sidecar, with dedicated ServiceAccount/RBAC.
 - Seven built-in RustFS Grafana dashboards, published by default as sidecar-discoverable

console-web/types/api.ts

@@ -130,6 +130,7 @@ export interface ProvisioningBucket {
   objectLockConfiguration?: BucketObjectLockConfiguration
   anonymous?: "Private" | "Download" | "Upload" | "Public"
   policy?: PolicyDocumentSource
+  encryption?: BucketEncryptionSpec
   lifecycle?: BucketLifecycleSpec
   deletionPolicy?: ProvisioningDeletionPolicy
 }
@@ -154,6 +155,12 @@ export interface BucketObjectLockConfiguration {
   days?: number
 }
 
+export interface BucketEncryptionSpec {
+  state?: "Present" | "Absent"
+  mode?: "SSE-S3" | "SSE-KMS"
+  kmsKeyId?: string
+}
+
 export interface BucketLifecycleSpec {
   state: "Present" | "Absent"
   rules?: BucketLifecycleRule[]
@@ -204,6 +211,8 @@ export interface ProvisioningBucketStatus extends ProvisioningItemStatus {
   versioning?: "Unversioned" | "Enabled" | "Suspended" | null
   objectLockConfigurationDesiredHash?: string | null
   objectLockConfigurationLastAppliedHash?: string | null
+  encryptionDesiredHash?: string | null
+  encryptionLastAppliedHash?: string | null
 }
 
 export interface ProvisioningStatus {

crates/rustfs-admin/src/helpers.rs

@@ -101,6 +101,7 @@ pub(super) fn body_mentions_not_found(body: &str) -> bool {
         || body.contains("nosuchpolicy")
         || body.contains("no such policy")
         || body.contains("objectlockconfigurationnotfound")
+        || body.contains("serversideencryptionconfigurationnotfound")
         || body.contains("nosuchbucketpolicy")
         || body.contains("no such bucket policy")
         || body.contains("not found")

crates/rustfs-admin/src/lib.rs

@@ -33,6 +33,7 @@ mod pool_ops;
 #[path = "s3_ops.rs"]
 mod s3_ops;
 pub use s3_ops::{
+    BucketEncryptionAlgorithm, BucketEncryptionConfiguration,
     BucketLifecycleAbortIncompleteMultipartUpload, BucketLifecycleConfiguration,
     BucketLifecycleExpiration, BucketLifecycleNoncurrentVersionTransition, BucketLifecycleRule,
     BucketLifecycleRuleStatus, BucketLifecycleTransition, BucketObjectLockConfiguration,
@@ -257,6 +258,7 @@ pub enum RustfsClientError {
     },
     InvalidBucketVersioningResponse,
     InvalidObjectLockConfigurationResponse,
+    InvalidBucketEncryptionResponse,
     InvalidLifecycleConfigurationResponse,
     ParseResponseFailed,
     SigningFailed,
@@ -309,6 +311,9 @@ impl std::fmt::Display for RustfsClientError {
             Self::InvalidObjectLockConfigurationResponse => {
                 write!(f, "invalid bucket Object Lock configuration response")
             }
+            Self::InvalidBucketEncryptionResponse => {
+                write!(f, "invalid bucket encryption configuration response")
+            }
             Self::ParseResponseFailed => write!(f, "failed to parse AssumeRole response"),
             Self::SigningFailed => write!(f, "failed to compute request signature"),
         }
@@ -361,6 +366,7 @@ impl RustfsClientError {
             | Self::RequestBuildFailed
             | Self::InvalidBucketVersioningResponse
             | Self::InvalidObjectLockConfigurationResponse
+            | Self::InvalidBucketEncryptionResponse
             | Self::InvalidLifecycleConfigurationResponse
             | Self::SigningFailed => false,
         }