OpenStack

The OpenStack integration backs up Nova servers and Cinder volumes, and restores them to OpenStack. Restores add to what exists in the cloud rather than overwriting it: disks come back as new Cinder volumes, and the original server or volume is never modified.

The integration includes two connectors:

Both connectors support two protocols:

Requirements

• An OpenStack cloud with a Keystone v3 endpoint reachable from the machine running Plakar.
• An application credential, or a username and password, with the rights listed in permissions.

Installation

Install the OpenStack package:

$ plakar pkg add openstack

Verify installation:

$ plakar pkg show

To list, upgrade, or remove the package, see managing packages guide.

How backups work

OpenStack exposes the content of a disk through Glance, so every disk a backup reads is first snapshotted and copied to a temporary Glance image. The temporary snapshots, volumes and images are deleted once the disk has been read. Disks are read while they are in use, so a backup is crash-consistent.

Because every disk passes through Glance, it must fit within the Glance image size limit of the cloud. The limit is 1 TiB by default and can be raised by the operator of the cloud. Every backup copies the whole disk, so its duration grows with the size of the disk.

Authentication

Both protocols authenticate against Keystone, the OpenStack identity service, with one of two methods:

• Application credential (recommended): a credential created for a single project with a restricted set of roles. It is bound to that project, so no project needs to be set. It can be revoked without affecting the user account it was created from.
• Username and password: the credentials of an OpenStack user, together with the project to work in, identified by its ID or name.

When both are set, the application credential takes precedence.

Permissions

Both protocols create and delete snapshots, images and volumes in the project, so the credential needs the reader and member roles on it. This applies to the project the server or volume belongs to for a backup, and to the target project for a restore. See Managing Users and Application Credentials for how to create a user and an application credential with those roles.

Role names depend on how the OpenStack cloud is configured. The reader and member roles are default Keystone roles, but some providers define their own. Consult the documentation of the provider for the equivalent roles.

1. openstack-instance protocol

The openstack-instance protocol backs up a Nova server: its flavor and networks, its root disk, and every Cinder volume attached to it. The source location selects the server by its ID. The disks are captured one after another rather than at the same instant, so they can reflect slightly different points in time.

Servers that boot from a volume are not supported. Their root disk is a Cinder volume rather than a Nova disk, and the backup refuses them.

A destination restores a server in one of two ways, depending on its location:

• As a new server, with openstack-instance:// or openstack-instance://spawn. Plakar creates a server with the flavor, networks and security groups of the backed-up server, and recreates and reattaches each volume to its original device when it was recorded.
• Onto an existing server, with openstack-instance://<server-id>. Every backed-up disk, including the root disk, becomes a new Cinder volume attached to that server. No server is created.

When restoring as a new server, the flavor and networks are looked up by ID, then by name if the ID does not exist in the target cloud, for example when restoring to another project or region. The restore fails if neither matches. Security groups are attached by name.

Backup flow

flowchart LR

subgraph OpenStack["OpenStack Project"]
  Server["Server and
attached volumes"]
  Images["Temporary
Glance images"]
  Server -->|"snapshot"| Images
end

Plakar["Plakar"]

Transform["Encrypt & deduplicate"]

Store["Kloset Store"]

Images --> Plakar --> Transform --> Store

Restore flow

flowchart LR

Store["Kloset Store"]

Plakar["Plakar"]

Transform["Decrypt & reconstruct"]

subgraph OpenStack["OpenStack Project"]
  Images["Temporary
Glance images"]
  Volumes["New volumes"]
  Server["Existing or new
server"]
  Images --> Volumes --> Server
end

Store --> Plakar --> Transform --> Images

Shared configuration

The following options apply to both source and destination connectors using the openstack-instance protocol.

Either the application credential or openstack_username and openstack_password must be set.

Source configuration

The following extra options are available on the store connector.

Destination configuration

The following extra options are available on the destination connector.

Example

Back up a server:

$ plakar source add myserver openstack-instance://<server-id> \
  openstack_auth_url=https://keystone.example.com:5000/v3 \
  openstack_application_credential_id=<id> \
  openstack_application_credential_secret=<secret> \
  openstack_region=RegionOne

$ plakar at /var/backups backup "@myserver"

Restore a snapshot as a new server:

$ plakar destination add myserver-restore openstack-instance://spawn \
  openstack_auth_url=https://keystone.example.com:5000/v3 \
  openstack_application_credential_id=<id> \
  openstack_application_credential_secret=<secret> \
  openstack_region=RegionOne

$ plakar at /var/backups restore -to "@myserver-restore" <snapshot_id>

2. openstack-block protocol

The openstack-block protocol backs up a single Cinder volume, selected by its ID in the source location.

A destination always restores into a new, detached volume. The new volume takes the size, volume type, availability zone, description, metadata and name of the original. The volume type and availability zone must exist in the region the volume is restored to.

Backup flow

flowchart LR

subgraph OpenStack["OpenStack Project"]
  Volume["Cinder volume"]
  Image["Temporary
Glance image"]
  Volume -->|"snapshot"| Image
end

Plakar["Plakar"]

Transform["Encrypt & deduplicate"]

Store["Kloset Store"]

Image --> Plakar --> Transform --> Store

Restore flow

flowchart LR

Store["Kloset Store"]

Plakar["Plakar"]

Transform["Decrypt & reconstruct"]

subgraph OpenStack["OpenStack Project"]
  Image["Temporary
Glance image"]
  Volume["New detached
volume"]
  Image --> Volume
end

Store --> Plakar --> Transform --> Image

Shared configuration

The following options apply to both source and destination connectors using the openstack-block protocol.

Either the application credential or openstack_username and openstack_password must be set.

Source configuration

The following extra options are available on the source connector.

Destination configuration

The following extra options are available on the destination connector.

Example

Back up a volume:

$ plakar source add myvolume openstack-block://<volume-id> \
  openstack_auth_url=https://keystone.example.com:5000/v3 \
  openstack_application_credential_id=<id> \
  openstack_application_credential_secret=<secret> \
  openstack_region=RegionOne

$ plakar at /var/backups backup "@myvolume"

Restore a snapshot as a new volume:

$ plakar destination add myvolume-restore openstack-block:// \
  openstack_auth_url=https://keystone.example.com:5000/v3 \
  openstack_application_credential_id=<id> \
  openstack_application_credential_secret=<secret> \
  openstack_region=RegionOne

$ plakar at /var/backups restore -to "@myvolume-restore" <snapshot_id>

See also

• Managing Users and Application Credentials on OpenStack
• OpenStack inventory in Plakar Control Plane
• OpenStack Compute in Plakar Control Plane
• OpenStack Block Storage in Plakar Control Plane
• Managing packages