Add SFTP as a Kopia repository storage backend

Summary

Add SFTP as a storage backend for Kopia repositories, enabling snapshotMoveData and fs-backup to store deduplicated volume data on SFTP servers.

Motivation

Velero currently supports S3, Azure Blob, GCS, and local filesystem as Kopia backends. Users with on-premise or self-hosted infrastructure often use SFTP-accessible storage (e.g. Hetzner Storage Box, Synology NAS, any SSH server) and cannot use any of the existing backends without an S3 proxy.

Kopia already has a native SFTP blob storage implementation (repo/blob/sftp) — it just needs to be wired through Velero's repository abstraction layer.

This was requested in:

• #8707 (Support multiple transmission protocols)
• #7364 (SFTP restic support)

Use Case

• Self-hosted Kubernetes clusters backing up to Hetzner Storage Box (SFTP on port 23)
• On-premise environments backing up to NAS devices via SFTP
• Air-gapped environments where cloud object storage is not available

Implementation

The change is minimal (~170 lines across 7 files):

1. pkg/repository/config/config.go — add SFTPBackend type, extend IsBackendTypeValid()
2. pkg/repository/udmrepo/repo_options.go — add StorageTypeSftp and SFTP config constants
3. pkg/repository/provider/unified_repo.go — add SFTP case in getStorageType(), getStorageVariables(), getStorageCredentials()
4. pkg/repository/udmrepo/kopialib/backend/sftp.go — new Store implementation using kopia/repo/blob/sftp
5. pkg/repository/udmrepo/kopialib/repo_init.go — register SFTP in backendStores

BSL Configuration

apiVersion: velero.io/v1
kind: BackupStorageLocation
metadata:
  name: default
spec:
  provider: sftp
  objectStorage:
    bucket: velero-backups
  config:
    sftpHost: backup.example.com
    sftpPort: "23"
    sftpUsername: user
    sftpPassword: secret
    sftpPath: /backups/velero
    sftpKnownHostsData: "[backup.example.com]:23 ssh-ed25519 AAAA..."

Companion Plugin

An ObjectStore plugin registered as velero.io/sftp is required for storing backup metadata (K8s resource tarballs). A reference implementation is available at Freshost/velero-plugin-for-sftp.

Testing

Tested end-to-end on a K3s cluster with:

• Proxmox CSI snapshots → Velero data mover → SFTP (Hetzner Storage Box)
• Backup Completed, data verified on SFTP server
• Kopia encryption (AES-256-GCM) works correctly over SFTP

PR

PR with implementation: #9619