fix: add --sse AES256 to S3 puts — bucket enforces server-side encryption

Scaleway rejects PutObject without the SSE header when the bucket has
server-side encryption configured. Only puts need the flag; gets are
unaffected (server decrypts transparently).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: 2 people

apps/openbao-init/templates/configmap-init-script.yaml

@@ -19,7 +19,7 @@ data:
     apk add --no-cache curl jq aws-cli 2>/dev/null || true
     aws configure set default.s3.signature_version s3v4 2>/dev/null || true
 
-    s3_put() { aws s3 cp "$1" "$2" --endpoint-url "${S3_ENDPOINT}"; }
+    s3_put() { aws s3 cp "$1" "$2" --endpoint-url "${S3_ENDPOINT}" --sse AES256; }
     s3_get() { aws s3 cp "$1" "$2" --endpoint-url "${S3_ENDPOINT}"; }
     s3_exists() { aws s3 ls "$1" --endpoint-url "${S3_ENDPOINT}" > /dev/null 2>&1; }