Plans

Protection plans: what is protected, under which policy.

plan create

Create a protection plan.

A plan says what to protect, under which policy, with which key. It states no schedule and no retention: openstack backup policy list is the catalogue of what the operator offers, and the plan names one of them.

openstack backup plan create <name> --resource-kind <kind> --resource <id> \
    --policy <policy> [--encryption <mode>] [--consistency <level>] \
    [--exclude-disk <id[:locator]>] [--label <key=value>] \
    [--accept-partial-coverage <digest>]

Argument	Description
<name>	Plan name.
--resource-kind <kind>	Volume, instance or bucket. Required.
--resource <id>	Resource to protect (repeatable) Required.
--policy <policy>	Protection policy this plan runs under, by name or id. The policy carries the schedule, the retention ladder and the recovery objectives: they are the operator's to state and a plan names one. Required.
--encryption <mode>	Barbican: this workload gets a key of its own and its storage is kept apart from every other workload's. none: stored unencrypted, sharing storage with other unencrypted workloads. Omit to keep the existing behaviour. One of barbican, none.
--consistency <level>	Filesystem: freeze the guest before each backup. crash: do not. Omit to take this cloud's default. Not for buckets. One of crash, filesystem.
--exclude-disk <id[:locator]>	Disks NOT to protect, comma-separated, as resource-id[:locator]. An instance covers its root disk and every attached volume; naming one here leaves it out of every backup, so restoring the instance will not bring it back and every point of this plan is partial.
--label <key=value>	Advisory label, repeatable. Copied onto every point this plan writes and frozen there, so an operator deciding what to recover can see what it was for.
--accept-partial-coverage <digest>	Accept an account of a workload the service can protect only in part, by the digest the 409 or 'resource list' reported. Without it a partial workload is refused.

plan delete

Delete one or more protection plans.

The plan lands in the repository's soft-delete grace rather than going away: hidden from the listing, restorable by an operator until the grace elapses. A plan under a mandatory policy is refused.

openstack backup plan delete <plan> [<plan> ...]

Argument	Description
<plan>	Plan, by name or id. Takes one or more.

plan list

List protection plans.

openstack backup plan list [--enabled] [--resource-kind <kind>] \
    [--limit <limit>] [--project <project>]

Argument	Description
--enabled	Only enabled plans.
--resource-kind <kind>	Volume, instance or bucket.
--limit <limit>	Maximum plans returned.
--project <project>	Another project's plans (operator; needs a system-scoped token)

plan missed tick list

List the scheduled instants of a plan that produced no backup.

A tick that cannot start inside the policy's start_within is missed, not queued: a plan six hours behind must not run two backups back to back into a production cluster. The reason says whether that was the window, a policy that no longer exists, one that is retired, or one naming storage it cannot use.

openstack backup plan missed tick list <plan> [--limit <limit>]

Argument	Description
<plan>	Plan, by name or id.
--limit <limit>	Maximum missed ticks returned.

plan refusal list

List what a plan will not protect, and why.

Reported on the plan itself rather than only at creation, because a degradation such as fast-diff becoming unavailable is worth seeing every time the plan is read.

openstack backup plan refusal list <plan>

Argument	Description
<plan>	Plan, by name or id.

plan restore

Lift a plan's soft delete (operator).

What it recovers is the plan and everything still inside its grace. A plan whose grace has elapsed is gone, and this reports that rather than pretending otherwise.

openstack backup plan restore <plan>

Argument	Description
<plan>	Plan, by name or id.

plan set

Update a protection plan.

What a tenant may change is what only a tenant knows: the name, the resources, the disks to leave out, whether it is running, and which of the policies their project may name it runs under. A move to a weaker policy, and any move at all off a mandatory one, is an operator's call.

openstack backup plan set <plan> [--name <name>] [--enable] [--disable] \
    [--policy <policy>] [--consistency <level>] [--resource <id>] \
    [--exclude-disk <id[:locator]>] [--accept-partial-coverage <digest>]

Argument	Description
<plan>	Plan, by name or id.
--name <name>
--enable
--disable	Stop taking backups. Refused for a tenant when the policy is mandatory.
--policy <policy>	Protection policy this plan runs under, by name or id. The policy carries the schedule, the retention ladder and the recovery objectives: they are the operator's to state and a plan names one.
--consistency <level>	Filesystem: freeze the guest before each backup. crash: do not. Omit to take this cloud's default. Not for buckets. One of crash, filesystem.
--resource <id>	Replace the protected resource list (repeatable)
--exclude-disk <id[:locator]>	Replace the excluded-disk list. disks NOT to protect, comma-separated, as resource-id[:locator]. An instance covers its root disk and every attached volume; naming one here leaves it out of every backup, so restoring the instance will not bring it back and every point of this plan is partial. Pass an empty value to protect every disk again.
--accept-partial-coverage <digest>	Accept the partial-coverage account of the new resource set; meaningless without --resource.

plan show

Show a protection plan, its policy, and any refusals it carries.

openstack backup plan show <plan>

Argument	Description
<plan>	Plan, by name or id.

plan sla show

Show a plan's protection SLA: what the policy promised against what it did.

openstack backup plan sla show <plan>

Argument	Description
<plan>	Plan, by name or id.