Protection groups

Disaster recovery groups and failover.

group arm

Give this region a standing delegation to act in the group's project.

A recover builds servers and volumes in the group's project, and a failback at home starts or rebuilds them there; both act through the delegation a member of the project gives here. A release, a resync, a retire and a test do not use it. Arming again replaces the previous delegation.

Arm with a token scoped to the group's project, issued to a member of it. A system-scoped token is refused (403), and a token scoped to another project does not find the group (404). The alternative to arming is an operator granting this region's service user a role in the project; readiness says which of the two a run would use.

openstack backup group arm <group> [--expires-in <duration>]

Argument	Description
<group>	Group, by name or id.
--expires-in <duration>	How long the delegation lasts, from 1h to 8784h; 90 days when not given.

group create

Create a protection group.

A group is the unit of failover: its instances come back together and to a consistent moment, in the boot order given, which is what makes it different from a set of unrelated plans that happen to run at the same time.

A group is created under a protection policy, and that policy's recovery section is the group's promise: the site it recovers to, the rung, and the recovery objectives. Every member must already be protected by a plan under that policy.

openstack backup group create <name> --policy <policy> --instance <instance> \
    [--network-map <from=to>]

Argument	Description
<name>	Group name.
--policy <policy>	Protection policy, by name or id, whose recovery section is the group's promise. Every member must already be under a plan with this policy. Required.
--instance <instance>	Instance to include (repeatable). Boot order follows the order given, which is the order they come back in. Required.
--network-map <from=to>	Network in the recovery region's point to network here, read only by a failback that rebuilds a member whose original is gone; a failover uses the registration's map (repeatable)

group delete

Delete one or more protection groups.

A recovery registration whose runs built servers, volumes, ports or floating addresses here and kept them is refused while they are still held: retire it first, or fail it back and then retire it where the workload runs here. --keep-resources deletes it anyway and leaves them to the project as they are.

openstack backup group delete <group> [<group> ...] [--keep-resources]

Argument	Description
<group>	Group, by name or id. Takes one or more.
--keep-resources	Delete a recovery registration even though objects its runs built are still held, leaving them to the project (operator)

group disarm

Withdraw the delegation a group was armed with.

openstack backup group disarm <group>

Argument	Description
<group>	Group, by name or id.

group failback bindings create

Bind the instances another region recovered back to this group's members (operator).

Run at the group's home. Each instance named in the other region's recovery record is bound to the member it came from, in the group's project, so this region reads the points taken of it there. Existing bindings are left alone.

openstack backup group failback bindings create <group> [--dry-run] \
    [--reason <reason>]

Argument	Description
<group>	Group, by name or id.
--dry-run	Show the bindings and create nothing.
--reason <reason>	Why the bindings are created, recorded with them.

group list

List protection groups.

openstack backup group list [--limit <limit>] [--project <project>] \
    [--role <role>]

Argument	Description
--limit <limit>
--project <project>	Another project's groups (operator; needs a system-scoped token)
--role <role>	Only groups created here (primary) or only recoveries of another region's groups (recovery) One of primary, recovery.

group mirror list

List a hot group's mirrored disks as this region's cluster reads them.

One row per disk: its role and status here, the peer cluster's status, the newest complete mirror snapshot, how far behind the RPO target it is, and whether either cluster reports split brain.

openstack backup group mirror list <group>

Argument	Description
<group>	Group, by name or id.

group readiness show

Show whether a group could be recovered right now, member by member.

Where the group recovers, what each member would recover to and what a recover would refuse. Where the group runs, what the recovery region last reported, and how old that report is.

openstack backup group readiness show <group>

Argument	Description
<group>	Group, by name or id.

group recover

Recover a protection group here, planned after a release or unplanned without one.

At the group's home a planned recover is the failback: each member returns to its original instance, copying only what changed where it can, and the recover refuses if an original was written after it was released. --overwrite-diverged (operator) comes home anyway: each diverged original is stopped, kept as a divergence point, and written over in full. An unplanned recover at home takes the originals back as they are.

openstack backup group recover <group> --mode <mode> [--confirm] \
    [--wait-for-release <duration>] [--recovery-point <choice>] \
    [--max-point-age <duration>] [--overwrite-diverged] [--dry-run] \
    [--reason <reason>]

Argument	Description
<group>	Group, by name or id.
--mode <mode>	Planned, after a release the recovery region can verify, or unplanned (operator) Required. One of planned, unplanned.
--confirm-primary-may-be-serving-writes, --confirm	Acknowledge that the other region may still be serving writes; required for --mode unplanned.
--wait-for-release <duration>	Planned only: wait up to this long, at most 30m, for the release to be verifiable.
--recovery-point <choice>	Aligned, the default: every member at the newest instant they all hold a point for; newest: each member's own newest point. One of aligned, newest.
--max-point-age <duration>	Refuse the recover if any member's recovery point is older than this, e.g. 2h.
--overwrite-diverged	Planned failback only (operator): come home over originals that diverged, keeping what each holds as a divergence point first.
--dry-run	Show the plan, member by member, with the point each recovers to, and start nothing.
--reason <reason>	Why the group is recovered, recorded with the run.

group register

Register this region's recovery of another region's group (operator).

The group's members, boot order and promise come from the group document its home wrote into a repository this region reads; openstack backup recovery group list shows the ones read so far. Registering binds every member to the target project, with a standby in --standby-pool when the group's policy promises the warm rung, and follows the document as members are added at home. A member already bound to another project is refused with binding_conflict.

openstack backup group register <group-uid> --repository <repository> \
    [--origin-cloud <cloud>] --target-project <project> \
    [--target-domain <domain>] --policy <policy> [--name <name>] \
    [--mapping-profile <profile>] [--bubble-policy <bubble-policy>] \
    [--test-every <duration>] [--standby-pool <pool>] \
    [--standby-site <site>] [--standby-prefix <prefix>] \
    [--accept-gap <element>] [--network-map <from=to>]

Argument	Description
<group-uid>	The group's uid, as its home minted it.
--repository <repository>	Repository the group's document was read from, by name or id. Required.
--origin-cloud <cloud>	Cloud that wrote the document; refused if the document names another.
--target-project <project>	Project here the group recovers into. Required.
--target-domain <domain>	Domain of the target project; needed only when the service cannot look the project up.
--policy <policy>	This region's policy, by name or id, whose recovery site is the group's home. Required.
--name <name>	Name here; defaults to the group's name.
--mapping-profile <profile>	Recovery profile, by name or id, that translates the home's flavors and networks.
--bubble-policy <bubble-policy>	Bubble policy, by name or id, tests of the group run in.
--test-every <duration>	Test cadence, e.g. 720h; defaults to the cadence the group's policy promised.
--standby-pool <pool>	Pool the members' standbys live in; required for a warm group.
--standby-site <site>	Site the standbys live at, by name or id; defaults to this cloud's own.
--standby-prefix <prefix>	Prefix for the standbys' image names.
--accept-gap <element>	Unresolved mapping element a recovery may leave unmapped, e.g. network:net-1 (repeatable)
--network-map <from=to>	Home network to network here (repeatable)

group release

Release a protection group where it runs: stop it, take its last copy and hand it over.

The members' plans pause, each instance is locked and stopped, a final point of each is taken and copied, and the release record the recovery region verifies is written. Until that record is written, a failure starts the instances again and resumes the plans.

openstack backup group release <group> [--reason <reason>] \
    [--override-recovery-readiness] [--dry-run]

Argument	Description
<group>	Group, by name or id.
--reason <reason>	Why the group is released, recorded with the run.
--override-recovery-readiness	Release even without a fresh readiness report from the recovery region (operator)
--dry-run	Show what the release would stop and the recovery region's last report, and start nothing.

group resync

Discard this region's divergence after backing it up (operator).

The members are locked and stopped, what they wrote since the other region recovered the group is kept as a backup labelled with the point it diverged from, and this region becomes standby under the other region's custody.

openstack backup group resync <group> [--confirm] [--skip-divergence-point] \
    [--dry-run] [--reason <reason>]

Argument	Description
<group>	Group, by name or id.
--confirm-discard-local-writes, --confirm	Acknowledge that the writes made here since the other region took over are discarded; required.
--skip-divergence-point	Stop the members without first backing up what diverged here.
--dry-run	Show which members diverged and the other region's record, and start nothing.
--reason <reason>	Why the group is resynced, recorded with the run.

group retire

Remove what a superseded recovery left in this region.

The stopped servers are deleted and their volumes unmanaged, not deleted: the data stays in the storage pool and leaves the cloud's inventory. The ports and floating IPs the recovery created are deleted.

openstack backup group retire <group> [--dry-run] [--reason <reason>]

Argument	Description
<group>	Group, by name or id.
--dry-run	Show what would be removed and start nothing.
--reason <reason>	Why the group is retired, recorded with the run.

group run abort

Stop a run past its point of no return, leaving everything as it is (operator).

openstack backup group run abort <group> <run>

Argument	Description
<group>	Group, by name or id.
<run>	Run id.

group run cancel

Cancel a run before its point of no return; what it built is torn down.

openstack backup group run cancel <group> <run>

Argument	Description
<group>	Group, by name or id.
<run>	Run id.

group run list

List a group's runs: releases, recovers, tests, resyncs and retires.

openstack backup group run list <group> [--limit <limit>]

Argument	Description
<group>	Group, by name or id.
--limit <limit>

group run resume

Resume a halted run where its journal left off.

openstack backup group run resume <group> <run>

Argument	Description
<group>	Group, by name or id.
<run>	Run id.

group run show

Show one run, optionally with its journal and its ledger.

openstack backup group run show <group> <run> [--actions] [--resources]

Argument	Description
<group>	Group, by name or id.
<run>	Run id.
--actions	Include the run's journal of steps.
--resources	Include the run's ledger of what it created.

group show

Show a protection group.

openstack backup group show <group>

Argument	Description
<group>	Group, by name or id.

group sla show

Show a group's recovery objectives against what it actually achieves.

openstack backup group sla show <group>

Argument	Description
<group>	Group, by name or id.

group split brain acknowledge

Keep this region's copy after a split brain; the other region must resync (system administrator).

Both regions ran the group. Acknowledging says this region's copy survives: the group here is protected again at a newer custody epoch, and the other region refuses to run its copy until a resync there. The opposite choice is a resync here.

openstack backup group split brain acknowledge <group> [--confirm] \
    [--reason <reason>]

Argument	Description
<group>	Group, by name or id.
--confirm-other-region-discarded, --confirm	Acknowledge that the other region's copy, and what it wrote since it recovered, is the one discarded; required.
--reason <reason>	Why this region's copy is kept, recorded with the acknowledgement.

group test

Test a protection group's recovery in an isolated bubble, then tear it down.

openstack backup group test <group> [--bubble-policy <bubble-policy>] \
    [--dry-run] [--reason <reason>]

Argument	Description
<group>	Group, by name or id.
--bubble-policy <bubble-policy>	Bubble policy, by name or id, the test runs inside; defaults to the one the group's registration names, and a test with neither is refused.
--dry-run	Show the plan, member by member, with the bubble it would be built under, and start nothing.
--reason <reason>	Why the test is run, recorded with the run.