Policies

Protection policies: the service levels plans run under.

policy assign

Offer a policy to domains and projects, or withdraw it (operator).

openstack backup policy assign <policy> [--project <project>] \
    [--domain <domain>] [--remove]

Argument	Description
<policy>	Policy name or id.
--project <project>	Project id (repeatable)
--domain <domain>	Domain id; every project in it may name the policy (repeatable)
--remove	Withdraw the assignment instead of adding it. Plans already under the policy keep running.

policy create

Write a protection policy (operator).

Everything a tenant used to type into a plan — the schedule, the retention, the recovery objectives — is stated here once, by the party that provisioned the capacity for it.

openstack backup policy create <name> [--description <text>] \
    [--visibility <visibility>] [--mandatory] [--verify-every <duration>] \
    [--every <duration>] [--cron <expr>] [--at <HH:MM>] \
    [--window-start <HH:MM>] [--window-end <HH:MM>] [--jitter <duration>] \
    [--start-within <duration>] [--keep-all <duration>] \
    [--keep-daily <count>] [--keep-weekly <count>] [--keep-monthly <count>] \
    [--keep-yearly <count>] [--anchor <key=value>] \
    --backup-repository <repository> [--instant-tier <repository>] \
    [--instant-within <duration>] [--copy-repository <repository>] \
    [--copy-keep <tier=value>] [--recovery-site <site>] \
    [--recovery-rung <rung>] [--transport <transport>] \
    [--rpo-target <duration>] [--rto-target <duration>] \
    [--test-every <duration>]

Argument	Description
<name>	Policy name.
--description <text>	What this service level is for.
--visibility <visibility>	Public: any project may name it. assigned: only the domains and projects it is assigned to. One of public, assigned.
--mandatory	A tenant may not pause or delete a plan under this policy, nor move it to a weaker one.
--verify-every <duration>	Cadence of verification of the newest point of each plan, e.g. 720h. Manual backups are the vault's terms, not the policy's.
--every <duration>	Cadence, 15m to 168h, e.g. 1h. A cadence under a day must divide one evenly.
--cron <expr>	Cron expression, for a cadence no interval describes, e.g. '0 2 * * 1-5'.
--at <HH:MM>	Phase for a cadence of a day or longer, site-local.
--window-start <HH:MM>	Earliest time a tick may run.
--window-end <HH:MM>	Latest time a tick may run.
--jitter <duration>	Random spread so every plan under this policy does not fire at once, e.g. 30m.
--start-within <duration>	A tick that has not started by then is recorded as missed, not queued behind the next one, e.g. 2h.
--keep-all <duration>	How long every point lives, e.g. 48h. A duration rather than a count, because the repository's lock needs a date.
--keep-daily <count>	Daily points to keep: the first point committed in each anchored period wins the daily role and lives this many periods.
--keep-weekly <count>	Weekly points to keep: the first point committed in each anchored period wins the weekly role and lives this many periods.
--keep-monthly <count>	Monthly points to keep: the first point committed in each anchored period wins the monthly role and lives this many periods.
--keep-yearly <count>	Yearly points to keep: the first point committed in each anchored period wins the yearly role and lives this many periods.
--anchor <key=value>	Period grid, repeatable: week=sunday, month=first|last, year=january.
--backup-repository <repository>	Chunk repository every point is written to. Its retention contract is the floor this policy's ladder must clear. Required.
--instant-tier <repository>	Rbd tier that keeps recent points restorable by clone.
--instant-within <duration>	How long a point stays on the instant tier, e.g. 168h.
--copy-repository <repository>	Second chunk repository every committed point is copied to.
--copy-keep <tier=value>	Ladder for the copy, repeatable: all=<duration>, daily=7, monthly=12.
--recovery-site <site>	Site the recovery promise is made about, by name or id (openstack backup site list)
--recovery-rung <rung>	Cold: the copy is readable there. warm: a standby per resource. hot: a mirror relationship. One of cold, warm, hot.
--transport <transport>	How the recoverable copy reaches the site: rbd-mirror for hot, repository for cold and warm; the rung's own when omitted. One of rbd-mirror, repository.
--rpo-target <duration>	Recovery point objective. A cold or warm rung cannot promise less than the cadence.
--rto-target <duration>	Recovery time objective, e.g. 30m.
--test-every <duration>	Cadence of test failovers into the bubble, e.g. 720h.

policy delete

Delete a policy no plan has ever named (operator).

Deleting is for a draft, not for a policy in service: one with a live plan under it, or with a plan still inside its delete grace, is refused and named. Retire it onto a successor instead.

openstack backup policy delete <policy> [<policy> ...]

Argument	Description
<policy>	Policy name or id. Takes one or more.

policy deprecate

Deprecate a policy: no new plan may name it, existing plans run on.

openstack backup policy deprecate <policy>

Argument	Description
<policy>	Policy name or id.

policy list

List protection policies.

A tenant is served the policies their project may name, as sentences. An operator is served all of them; policy show is where the spec is.

openstack backup policy list [--state <state>] [--unsatisfied] \
    [--limit <limit>] [--scope <scope>]

Argument	Description
--state <state>	Active, deprecated or retired. One of active, deprecated, retired.
--unsatisfied	Only policies naming something they cannot use.
--limit <limit>	Maximum policies returned.
--scope <scope>	Render as a tenant sees it, even with an operator token: repository-global figures are withheld. One of tenant.

policy retire

Retire a policy, moving every plan under it to a successor.

Retiring needs either no plans at all or a successor that is not weaker: a shorter keep all, an unlocked repository where the old one was locked, or a lower recovery rung is refused by name. Points keep their dates through the move.

openstack backup policy retire <policy> [--successor <policy>]

Argument	Description
<policy>	Policy name or id.
--successor <policy>	Policy every plan is moved to, by name or id.

policy set

Edit a protection policy (operator).

An edit applies forward: every point already written keeps its expiry and its lock. --apply-to-existing re-derives the expiry of every unlocked point under the policy, and shortening one is a separately granted action. Run openstack backup retention simulate first to see what it frees.

openstack backup policy set <policy> [--name <name>] [--description <text>] \
    [--visibility <visibility>] [--mandatory] [--not-mandatory] \
    [--apply-to-existing] [--verify-every <duration>] [--every <duration>] \
    [--cron <expr>] [--at <HH:MM>] [--window-start <HH:MM>] \
    [--window-end <HH:MM>] [--jitter <duration>] [--start-within <duration>] \
    [--keep-all <duration>] [--keep-daily <count>] [--keep-weekly <count>] \
    [--keep-monthly <count>] [--keep-yearly <count>] [--anchor <key=value>] \
    [--backup-repository <repository>] [--instant-tier <repository>] \
    [--instant-within <duration>] [--copy-repository <repository>] \
    [--copy-keep <tier=value>] [--recovery-site <site>] \
    [--recovery-rung <rung>] [--transport <transport>] \
    [--rpo-target <duration>] [--rto-target <duration>] \
    [--test-every <duration>]

Argument	Description
<policy>	Policy name or id.
--name <name>
--description <text>
--visibility <visibility>	One of public, assigned.
--mandatory
--not-mandatory
--apply-to-existing	Re-derive the expiry of every unlocked point already under this policy, not only the ones written from now on.
--verify-every <duration>	Cadence of verification of the newest point of each plan, e.g. 720h. Manual backups are the vault's terms, not the policy's.
--every <duration>	Cadence, 15m to 168h, e.g. 1h. A cadence under a day must divide one evenly.
--cron <expr>	Cron expression, for a cadence no interval describes, e.g. '0 2 * * 1-5'.
--at <HH:MM>	Phase for a cadence of a day or longer, site-local.
--window-start <HH:MM>	Earliest time a tick may run.
--window-end <HH:MM>	Latest time a tick may run.
--jitter <duration>	Random spread so every plan under this policy does not fire at once, e.g. 30m.
--start-within <duration>	A tick that has not started by then is recorded as missed, not queued behind the next one, e.g. 2h.
--keep-all <duration>	How long every point lives, e.g. 48h. A duration rather than a count, because the repository's lock needs a date.
--keep-daily <count>	Daily points to keep: the first point committed in each anchored period wins the daily role and lives this many periods.
--keep-weekly <count>	Weekly points to keep: the first point committed in each anchored period wins the weekly role and lives this many periods.
--keep-monthly <count>	Monthly points to keep: the first point committed in each anchored period wins the monthly role and lives this many periods.
--keep-yearly <count>	Yearly points to keep: the first point committed in each anchored period wins the yearly role and lives this many periods.
--anchor <key=value>	Period grid, repeatable: week=sunday, month=first|last, year=january.
--backup-repository <repository>	Chunk repository every point is written to. Its retention contract is the floor this policy's ladder must clear.
--instant-tier <repository>	Rbd tier that keeps recent points restorable by clone.
--instant-within <duration>	How long a point stays on the instant tier, e.g. 168h.
--copy-repository <repository>	Second chunk repository every committed point is copied to.
--copy-keep <tier=value>	Ladder for the copy, repeatable: all=<duration>, daily=7, monthly=12.
--recovery-site <site>	Site the recovery promise is made about, by name or id (openstack backup site list)
--recovery-rung <rung>	Cold: the copy is readable there. warm: a standby per resource. hot: a mirror relationship. One of cold, warm, hot.
--transport <transport>	How the recoverable copy reaches the site: rbd-mirror for hot, repository for cold and warm; the rung's own when omitted. One of rbd-mirror, repository.
--rpo-target <duration>	Recovery point objective. A cold or warm rung cannot promise less than the cadence.
--rto-target <duration>	Recovery time objective, e.g. 30m.
--test-every <duration>	Cadence of test failovers into the bubble, e.g. 720h.

policy show

Show a protection policy, its sentence and anything it cannot satisfy.

openstack backup policy show <policy> [--scope <scope>]

Argument	Description
<policy>	Policy name or id.
--scope <scope>	Render as a tenant sees it, even with an operator token: repository-global figures are withheld. One of tenant.