Repositories

Where backup data is stored. Operator only.

repository create

Register a repository.

Two kinds, and they are not interchangeable. chunk is deduplicated, encrypted object storage — the thing that holds backups. rbd is a tier of Ceph images used to make recent restores fast; it stores no chunks and takes none of the object-storage options.

openstack backup repository create <name> --kind <kind> --site <site> \
    [--driver <driver>] [--endpoint <url>] [--bucket <bucket>] \
    [--region <region>] [--object-prefix <prefix>] [--chunk-size <bytes>] \
    [--access-key <key>] [--secret-key <key>] [--environment-credentials] \
    [--ceph-conf <path>] [--ceph-user <user>] [--pool <pool>] \
    [--namespace <namespace>] [--reachable-from-site <site>] \
    [--replica-of <repository>] [--lock-mode <mode>] \
    [--lock-min-retention <duration>] [--lock-max-retention <duration>] \
    [--lock-changeable-until <RFC3339>] [--soft-delete-grace <duration>]

Argument	Description
<name>	Repository name.
--kind <kind>	Chunk or rbd. Required. One of chunk, rbd.
--site <site>	The locality domain movers share with it. Required.
--driver <driver>	S3, rados or posix.
--endpoint <url>
--bucket <bucket>
--region <region>
--object-prefix <prefix>	Key prefix inside the bucket, or the filesystem root for the posix driver.
--chunk-size <bytes>
--access-key <key>
--secret-key <key>	Sealed by the key manager before storage; never readable back through the API.
--environment-credentials	A repository at another site is listed from here before it is saved; this skips that, because this cloud's own environment supplies the credential.
--ceph-conf <path>
--ceph-user <user>
--pool <pool>
--namespace <namespace>
--reachable-from-site <site>	A site that can read this repository, by name or id; repeat for each. Repeatable.
--replica-of <repository>	The repository this one is a near-replica of, by name or id.
--lock-mode <mode>	Compliance: nothing deletes an object before its retain-until date. governance: an operator with bypass can, which a tenant is told in so many words. Stating a mode is what makes this repository locked. One of compliance, governance.
--lock-min-retention <duration>	The floor every object written here is held for, e.g. 720h. A policy whose ladder is shorter than this is refused, not clamped.
--lock-max-retention <duration>	Optional ceiling; omit or 0 for none.
--lock-changeable-until <RFC3339>	How long the contract stays correctable. Default on registration is three days out, because a registration is where typos live; after it the floor only increases and the block cannot be removed.
--soft-delete-grace <duration>	How long a point or plan a tenant deletes stays reachable by an operator, e.g. 336h. 0 means delete means delete.

repository delete

Delete one or more repositories.

A repository still holding an object under lock is refused: the contract outlives the registration that stated it.

openstack backup repository delete <repository> [<repository> ...]

Argument	Description
<repository>	Takes one or more.

repository list

List repositories.

openstack backup repository list [--kind <kind>] [--limit <limit>]

Argument	Description
--kind <kind>	Chunk or rbd. One of chunk, rbd.
--limit <limit>

repository set

Update a repository, including its retention contract.

Only the fields that can change without stranding data: an endpoint that moved, a rotated credential. What a repository IS — its driver, bucket and chunk size — describes where every object already written lives, so those are fixed at registration.

The contract is the exception that has its own rules. Inside the grace anything about it may change, because a registration is where typos live. After the grace the floor only increases, the mode is fixed and the block cannot be removed — each refusal naming the grace date that has passed.

openstack backup repository set <repository> [--endpoint <url>] \
    [--region <region>] [--access-key <key>] [--secret-key <key>] \
    [--environment-credentials] [--reachable-from-site <site>] \
    [--replica-of <repository>] [--clear-reachable-from-sites] \
    [--clear-replica-of] [--lock-mode <mode>] \
    [--lock-min-retention <duration>] [--lock-max-retention <duration>] \
    [--lock-changeable-until <RFC3339>] [--soft-delete-grace <duration>] \
    [--clear-object-lock]

Argument	Description
<repository>	Repository name or id.
--endpoint <url>
--region <region>
--access-key <key>
--secret-key <key>
--environment-credentials	Do not list a repository at another site with new keys, endpoint or region before saving them.
--reachable-from-site <site>	A site that can read this repository, by name or id; repeat for each. Repeatable.
--replica-of <repository>	The repository this one is a near-replica of, by name or id.
--clear-reachable-from-sites	No other site can read this repository. --reachable-from-site replaces the whole list.
--clear-replica-of	This repository is no longer a replica of another.
--lock-mode <mode>	Compliance: nothing deletes an object before its retain-until date. governance: an operator with bypass can, which a tenant is told in so many words. Stating a mode is what makes this repository locked. One of compliance, governance.
--lock-min-retention <duration>	The floor every object written here is held for, e.g. 720h. A policy whose ladder is shorter than this is refused, not clamped.
--lock-max-retention <duration>	Optional ceiling; omit or 0 for none.
--lock-changeable-until <RFC3339>	How long the contract stays correctable. Default on registration is three days out, because a registration is where typos live; after it the floor only increases and the block cannot be removed.
--soft-delete-grace <duration>	How long a point or plan a tenant deletes stays reachable by an operator, e.g. 336h. 0 means delete means delete.
--clear-object-lock	Remove the retention contract entirely, which only the grace permits.

repository show

Show a repository and any warnings.

openstack backup repository show <repository>

Argument	Description
<repository>	Repository name or id.

repository usage show

Show what a repository is actually storing (operator).

Repository-global: physical bytes, the cross-tenant dedup margin, sweep state and a row per tenant. None of it is scoped to one project, which is why it needs a system-scoped token. openstack backup usage is the tenant-facing question.

openstack backup repository usage show <repository>

Argument	Description
<repository>	Repository name or id.