Access control
The service authorises requests using oslo.policy rules and the caller's Keystone token. Project
roles grant access within a project. Operator actions require a system-scoped token with the
admin role. These actions include managing repositories, policies, vaults, quotas and data
across projects.
Get a system-scoped token
Grant your operator user the admin role on the system once:
openstack role add --system all --user <operator-user> admin
Then request a token scoped to the system:
unset OS_PROJECT_NAME OS_PROJECT_ID OS_PROJECT_DOMAIN_NAME OS_PROJECT_DOMAIN_ID
export OS_SYSTEM_SCOPE=all
openstack token issue
If an operator action returns 403, check the token's scope and role assignments. The error names
the denied action, such as repository:register, policy:write, vault:write, quota:write or
coverage:read.
In the console, a user with a system role sees This whole cloud when choosing a scope after signing in. The Operator section also appears in the sidebar. In the OpenStack dashboard, Admin › Backup › Backup opens the console in operator scope.
The operator CLI
Operators use ferry, the service's own command line. It ships in the manager and mover images. Copy
it out of one onto the host you administer from:
id=$(docker create ghcr.io/osie/ferry-manager:0.16.1)
docker cp "$id:/usr/local/bin/ferry" /usr/local/bin/ferry
docker rm "$id"
It authenticates like every OpenStack client, with OS_* variables, clouds.yaml and --os-cloud. It
finds the service in the catalog under the type backup. Flags may precede or follow positional
arguments. ferry version shows the release of the CLI and the connected service.
Permissions by role
| Action | Default rule |
|---|---|
| Read plans, backups, restores, tasks, policies, vaults, usage and quota of a project | reader in the project |
| Create and change plans, take, verify and delete backups, restore, attach, cancel tasks | member (also _member_ or admin) in the project |
| Register repositories and change their retention contract | system admin |
| Write, assign and retire policies; shorten retention of backups already written | system admin |
| Write vaults and quotas | system admin |
| Pause a plan under a mandatory policy | system admin |
| Read coverage, other projects' data, and deleted plans and backups; bring them back | system admin |
| Restore one project's backup into another project | system admin |
| Place and lift legal holds; offboard a project | system admin |
Scrape /metrics on the API port | system admin |
Change a rule
Write overrides in a policy file. Rules you do not name keep their defaults. For example, to require a second role before anyone can shorten the retention of backups already written:
"policy:shorten": "rule:system_admin and role:data_security"
The manager reads the file named by policy.file in its configuration. On kolla-ansible that takes two
steps. Mount the file into the manager container with ferry_manager_extra_volumes. Then set
policy.file to its path inside the container in /etc/kolla/config/ferry/manager.yaml. Place the
file before restarting. A policy.file that names a missing path stops the manager from starting.
From release 0.12.0, each manager re-reads the file every minute (policy.reload_interval), so an edit
takes effect within that time. A file that does not parse is ignored and the rules already in force
stay. Earlier releases read it only at start. On those, restart the managers after each change.
The separate plan:pause:mandatory rule controls changes to plans under mandatory policies.
Changing plan:update or plan:delete alone preserves that restriction.
A restore needs a password login
A restore creates volumes and servers in the project on the user's behalf, through a Keystone trust. Keystone does not let an application credential create a trust. So a restore requested with an application-credential token is refused with "an application credential cannot authorise a restore". Tenants restore with a password login. An operator can run the restore for them.