Backups

Backups, called points on the command line.

point create

Take a manual backup now, of a plan or of one resource into a vault.

Returns as soon as the job is queued rather than when the backup finishes; the returned job id is what to watch with openstack backup job show.

With --plan it runs under the plan's policy, into the plan's vault. Without, --resource names one server or volume, --resource-kind says which, and --vault names where it is kept; a resource in a plan whose vault is that one is backed up in the plan. --keep-until is within the vault's terms and is required into a vault, or --until-deleted where the vault offers it; on a locked repository nobody can erase the backup before its date.

openstack backup point create [--plan <plan>] [--resource <id>] \
    [--resource-kind <kind>] [--vault <vault>] [--policy <policy>] \
    [--consistency <level>] [--keep-until <timestamp>] [--until-deleted] \
    [--force-full] [--wait]

Argument	Description
--plan <plan>	Plan to run.
--resource <id>	With --plan, limit the run to these resources (repeatable); without, the one resource to back up.
--resource-kind <kind>	Without --plan: instance or volume. One of instance, volume.
--vault <vault>	Without --plan: the vault to keep it in.
--policy <policy>	Without --plan, instead of --vault: the protection policy whose vault keeps it.
--consistency <level>	Without --plan: freeze the guest or not; default this cloud's. One of filesystem, crash.
--keep-until <timestamp>	Keep until this RFC 3339 timestamp, e.g. 2027-01-31T23:59:59Z.
--until-deleted	Keep it until somebody deletes it, where the vault offers that.
--force-full	Read the whole image instead of a diff.
--wait	Wait for the backup job(s) to finish.

point delete

Delete one or more backup points.

The point lands in the repository's soft-delete grace rather than going away, and an operator can reach into it until the grace elapses. A lock never refuses this: the point leaves your backups and your usage at once, and the storage still erases it no earlier than its lock date, never sooner. A point a legal hold still holds is refused, as is one whose policy is mandatory when the caller is a tenant.

openstack backup point delete <point> [<point> ...]

Argument	Description
<point>	Point id. Takes one or more.

point document show

Show a point's recorded resource metadata.

This is what a restore rebuilds from — flavor, networks, volume layout — so it is also the answer to "what exactly would come back".

The document is read out of the repository rather than the database, which is why --repository is required: it is also what lets a cloud read the document of a point it has never seen.

openstack backup point document show <point> --repository <repository> \
    [--domain <domain>]

Argument	Description
<point>	Point id.
--repository <repository>	Repository holding the point, by name or id. Required.
--domain <domain>	Dedup domain, when it is not the default.

point list

List backup points.

openstack backup point list [--plan <plan>] [--resource <id>] \
    [--state <state>] [--limit <limit>] [--project <project>] \
    [--scope <scope>]

Argument	Description
--plan <plan>	Only points from this plan.
--resource <id>	Only points for this resource.
--state <state>	Only points in this state.
--limit <limit>	Maximum points returned.
--project <project>	Another project's points (operator; needs a system-scoped token)
--scope <scope>	Render as a tenant sees it, even with an operator token: repository-global figures are withheld. One of tenant.

point metrics show

Show what a backup cost: bytes read, bytes stored, and where the time went.

An operator token additionally gets the repository-wide figures, each labelled with the scope it was computed in. A project token does not: those numbers move with what other projects have stored, so there is no per-project equivalent to report.

openstack backup point metrics show <point> [--scope <scope>]

Argument	Description
<point>	Point id.
--scope <scope>	Render as a tenant sees it, even with an operator token: repository-global figures are withheld. One of tenant.

point show

Show a backup point.

openstack backup point show <point> [--scope <scope>]

Argument	Description
<point>	Point id.
--scope <scope>	Render as a tenant sees it, even with an operator token: repository-global figures are withheld. One of tenant.

point verify

Re-read a backup now and record what was found.

Every chunk the backup references is fetched again and re-hashed. Verification otherwise runs as a rolling background pass, and that pass never returns to a point already marked broken: this is how a point marked by a mover too old to read it gets its state back once the movers are upgraded. Nothing changes until the job has read the data. Returns as soon as the job is queued; the job id is what to watch with openstack backup job show.

openstack backup point verify <point>

Argument	Description
<point>	Point id.