Resources, usage and keys
Protectable resources, usage, coverage, retention and keys.
coverage show
Show what this cloud is not protecting (operator).
Governance is coverage, not just policy: resources under no plan, plans paused and for how long, plans on a deprecated policy, plans whose policy names storage it cannot use, ticks missed inside the reporting window, points the copy tier has not reached, points no lock holds, and policies below the operator's own floor. Each answer names the plans it is about, so the report is a worklist rather than a score.
openstack backup coverage show [--project <project>]
| Argument | Description |
|---|---|
--project <project> | One project instead of every project in the cloud. |
key export
Export a dedup domain's key for another cloud (operator).
The envelope holds no plaintext key, so it is safe to move through a ticket or an object store — but the passphrase must travel separately, or the two together are simply the key. Every export is audited.
openstack backup key export --repository <repository> --domain <domain> \
[--passphrase-file <path>] [--passphrase <passphrase>]
| Argument | Description |
|---|---|
--repository <repository> | Repository name or id. Required. |
--domain <domain> | Required. |
--passphrase-file <path> | File holding the passphrase, or - for stdin. |
--passphrase <passphrase> | Passphrase inline; prefer --passphrase-file, which keeps it out of the shell history and the process table. |
key import
Import a dedup domain's key exported from another cloud (operator).
openstack backup key import --repository <repository> --domain <domain> \
--envelope-file <path> [--passphrase-file <path>] \
[--passphrase <passphrase>]
| Argument | Description |
|---|---|
--repository <repository> | Repository name or id. Required. |
--domain <domain> | Required. |
--envelope-file <path> | The exported envelope, as JSON. Required. |
--passphrase-file <path> | File holding the passphrase, or - for stdin. |
--passphrase <passphrase> |
key list
Show which dedup domains this cloud can decrypt (operator).
A fingerprint is a MAC of the key, so comparing or publishing one reveals nothing about it. Run this on both clouds before a cross-cloud restore rather than during one.
openstack backup key list --repository <repository> [--domain <domain>]
| Argument | Description |
|---|---|
--repository <repository> | Repository name or id. Required. |
--domain <domain> | Show only this dedup domain. |
mover list
List data movers (operator).
openstack backup mover list [--limit <limit>]
| Argument | Description |
|---|---|
--limit <limit> |
resource list
List what can be protected, and what cannot.
protectable false is the useful half: it comes with the reason, so a
resource that will never be backed up says so here rather than by
producing no points and no explanation.
openstack backup resource list [--kind <kind>] [--protectable] \
[--limit <limit>] [--project <project>]
| Argument | Description |
|---|---|
--kind <kind> | Volume, instance or bucket. |
--protectable | Only resources that can be protected. |
--limit <limit> | |
--project <project> | Another project's resources (operator; needs a system-scoped token) |
retention simulate
Show what a policy edit would keep, expire, and fail to shorten.
The subject is a POLICY, because the ladder is the operator's. State a candidate ladder to ask what changing it would do; state none to ask what tonight's expiry will do under the policy as it stands.
The answer names what a lock still holds, which is what cannot be shortened at all however the ladder reads, and for an operator token it also carries the bytes the deletion would free. A project token gets the verdicts only: how much space comes back depends on what else the repository holds, which is not a tenant's question.
openstack backup retention simulate --policy <policy> [--plan <plan>] \
[--keep-all <duration>] [--keep-daily <count>] [--keep-weekly <count>] \
[--keep-monthly <count>] [--keep-yearly <count>] [--anchor <key=value>]
| Argument | Description |
|---|---|
--policy <policy> | Policy to simulate, by name or id. Required. |
--plan <plan> | Narrow the answer to one plan under the policy; the default is every plan under it. |
--keep-all <duration> | Candidate floor every point lives for, e.g. 48h. |
--keep-daily <count> | |
--keep-weekly <count> | |
--keep-monthly <count> | |
--keep-yearly <count> | |
--anchor <key=value> | Candidate period grid, repeatable: week=sunday, month=first|last, year=january. |
site list
List the sites a policy recovers at and a repository is reachable from.
Every option that takes a site takes its name or its id; local marks
this cloud's own.
openstack backup site list [--limit <limit>]
| Argument | Description |
|---|---|
--limit <limit> |
usage show
Show what this project is storing.
Anything the service cannot currently account for is reported as unavailable with a reason rather than as a zero, because a zero that means "not measured yet" is indistinguishable from a zero that means "nothing".
openstack backup usage show [--project <project>] [--scope <scope>]
| Argument | Description |
|---|---|
--project <project> | Another project's usage (operator; needs a system-scoped token) |
--scope <scope> | Render as a tenant sees it, even with an operator token: repository-global figures are withheld. One of tenant. |
version show
Show this client's version, and the cloud's if reachable.
openstack backup version show