Backup Targets

This document explains the concepts of Backup Targets and Backup Target Types in Trilio, their purpose, and how they provide additional flexibility and control for backup storage management.


1. Backup Targets (BTs)

Definition:

Backup Targets are storage backends where backups are stored. These can be any of the supported storage systems such as NFS (Network File System) or S3 (Simple Storage Service). Backup Targets act as the foundational layer for storing backup data.

Key Characteristics of Backup Targets:

  • They are storage systems connected to Trilio.

  • Supported storage types include:

    • NFS: A shared file system accessible over a network.

    • S3: An object storage service typically offered by cloud providers.

  • Multiple Backup Targets can be defined within a single environment to provide storage flexibility.

How to configure Backup Target(s):

Only a default backup target is required while uploading the Trilio license. Additional backup targets can be added any time after a successful deployment — through the Horizon dashboard, the workloadmgr CLI, or the WLM REST API. Backup targets do not need to be planned exhaustively before deployment.

circle-info

How mounting works in 6.2 and later. Starting in Trilio for OpenStack 6.2, backup targets are no longer mounted statically at service startup. The actual mount/umount is performed on demand by the Dynamic Mount Service (DMS) — on the controller for metadata operations, and on a specific compute node for snapshot/restore data transfer. Targets are unmounted automatically when no job is using them.


6.2 — Configuring an S3 Backup Target

Starting in 6.2, S3 access credentials and connection options are no longer stored in the WorkloadManager configuration. They are stored as an OpenStack Barbican secret and the backup target carries a secret_ref field that points at that secret. DMS fetches the payload at mount time using the requesting job's Keystone token, so credentials are never persisted on disk on Trilio nodes.

Pre-requisites (hard requirements)

  1. One Barbican secret per S3 backup target. Each S3 backup target must have its own Barbican secret containing a valid payload. The Barbican secret URL becomes the secret_ref value of the backup target.

  2. The cloud admin user must be able to read the secret payload. DMS retrieves the payload using the requesting job's Keystone token, so the user/role triggering snapshots and restores must have secret:get permission on the secret. In default RHOSO deployments this is the admin user in the admin project; if you assign DMS use to a different user, mirror that user's ACL onto each Barbican secret.

  3. Required keys in the payload: VAULT_S3_ACCESS_KEY_ID, VAULT_S3_SECRET_ACCESS_KEY, VAULT_S3_BUCKET, VAULT_STORAGE_S3_EXPORT. The DMS server applies built-in defaults for any optional keys not present.

Generating the secret payload

You can either hand-write the JSON payload or generate it with trilio-dms-cli secret-payload create. The four examples below cover the most common S3 deployment shapes.

Example 1 — AWS S3 (no custom endpoint, publicly-trusted CA, SSL verification on):

The resulting secret.json contains:

Example 2 — S3-compatible store with a publicly-trusted CA (e.g. a Ceph RGW or MinIO endpoint whose certificate chains to a CA already in the system trust store):

The payload includes VAULT_S3_ENDPOINT_URL and keeps VAULT_S3_SSL / VAULT_S3_SSL_VERIFY set to True.

Example 3 — S3-compatible store with a self-signed certificate. Pass the CA cert as a file; --ssl-cert auto-enables --ssl and --ssl-verify and embeds the PEM content in the payload as VAULT_S3_SSL_CERT:

Example 4 — S3 endpoint with SSL verification disabled (lab / non-production only):

The payload sets VAULT_S3_SSL_VERIFY to False. Use this only in test environments — DMS will not validate the endpoint certificate.

Storing the payload in Barbican

Use the returned Secret href as the secret_ref on the backup target — either via the workloadmgr backup-target-create CLI or the API request body.


6.2 — Configuring an NFS Backup Target

NFS backup targets do not require a Barbican secret. They are defined by the NFS export path and any mount options (e.g. nolock,soft,timeo=600,intr,lookupcache=none,retrans=10); these are passed through the filesystem_export and nfs_mount_opts fields when creating the target.


Deprecated (6.1) — Static Backend Configuration

circle-exclamation

In 6.1 and earlier, backup targets had to be planned and made available before deploying Trilio. The deployment scripts populated the following entries in the workloadmgr services configuration file:

  • All enabled backup target names were defined as a comma-separated list under the DEFAULT section using the enabled_backends parameter:

where NFS_BT1, S3_BT1, S3_BT2, and S3_BT3 were unique backup target names with their own matching config sections.

  • Each backup target section was populated according to the storage type:

    • For NFS storage:

      • vault_storage_type = nfs

      • vault_storage_filesystem_export = <NFS_SHARE>

      • vault_storage_nfs_options = nolock,soft,timeo=600,intr,lookupcache=none,retrans=10

    • For S3 storage:

      • vault_storage_type = s3

      • vault_s3_endpoint_url = <S3_ENDPOINT_URL> (blank for AWS S3)

      • vault_s3_access_key_id = <S3_ACCESS_KEY_ID>

      • vault_s3_secret_access_key = <S3_SECRET_ACCESS_KEY>

      • vault_s3_bucket = <S3_BUCKET_NAME>

      • vault_storage_filesystem_export = <S3_ENDPOINT_HOSTNAME>/<S3_BUCKET_NAME> (bucket name only for AWS S3)

      • immutable = 1 if Object-Lock is enabled on the S3 bucket, otherwise 0

  • is_default = 1 was set on exactly one section to mark it as the default backup target.

Example 6.1 configuration:

List & Show Configured BTs

Using Horizon Dashboard

  1. Log in to the OpenStack Horizon Dashboard as an Admin user.

  2. Navigate to the Admin-> Backups-Admin -> Backup Targets

  3. On the page, click the Backup Targets tab to see the list of Backup Target Types.

Using CLI

Create Backup Target:

  • Command:

  • Alias:

  • Options:

  • Example:

Delete Backup Target:

  • Command:

  • Alias:

  • Options:

  • Example:

List the available Backup Targets:

  • Command:

  • Alias:

  • Options:

  • Example:

Show Details of a Backup Target:

  • Command:

  • Alias:

  • Options:

  • Example:

Backup Target Set Default:

  • Command:

  • Alias:

  • Options:

  • Example:


2. Backup Target Types (BTTs)

Definition:

Backup Target Types are an abstraction layer over Backup Targets. They provide additional administrative controls and can be categorized based on their scope and access permissions.

Types of Backup Target Types:

  1. Public:

    • Accessible by all users and projects in the system.

    • Suitable for shared storage scenarios where multiple teams or tenants use the same backup infrastructure.

  2. Private:

    • Restricted to specific projects.

    • Private Backup Target Types can be assigned to one or multiple projects, allowing project-specific control over backup storage.

Relationship Between Backup Targets and Backup Target Types:

  • A many-to-one relationship exists between Backup Target Types and Backup Targets.

    • Multiple Backup Target Types can map to a single Backup Target.

    • This allows administrators to define different policies or access levels for a shared storage backend.

Pre-created Backup Target Types

  • Trilio creates the BTTs of all the Backup Targets that are configured during deployment with the same name as the Backup Targets.

  • It inherits the provided configuration options for each Backup Target and creates the Public Backup Target Types by default.

List Available BTTs

Using Horizon Dashboard

  1. Log in to the OpenStack Horizon Dashboard as an Admin user.

  2. Navigate to the Admin-> Backups-Admin -> Backup Targets

  3. On the page, click the Backup Target Types tab to see the list of Backup Target Types.

Using CLI

  • Command:

  • Alias:

  • Options:

  • Example:

Show Details of a BTT

Using Horizon Dashboard

  • Most of the relevant information about the BTT can be seen while Listing the BTTs.

  • Trilio does not provide a separate GUI for showing the additional details of the BTTs.

  • But, Trilio does provide a CLI command to get the additional details.

Using CLI

  • Command:

  • Alias:

  • Options:

  • Example:

Create a BTT

Using Horizon Dashboard

  1. Log in to the OpenStack Horizon Dashboard as an Admin user.

  2. Navigate to the Admin-> Backups-Admin -> Backup Targets

  3. On the page, click the Backup Target Types tab to see the list of Backup Target Types.

  4. Click on the button to open the Backup Target Type Create wizard, and follow the instructions to create the BTT.

Using CLI

  • Command:

  • Alias:

  • Options:

  • Example:

Modify a BTT

circle-info

Modification of the Default Backup Target Type is not allowed.

Using Horizon Dashboard

  1. Log in to the OpenStack Horizon Dashboard as an Admin user.

  2. Navigate to the Admin-> Backups-Admin -> Backup Targets

  3. On the page, click the Backup Target Types tab to see the list of Backup Target Types.

  4. Click on the button under the Actions column of the BTT List table of the desired BTT to open the Edit Backup Target Type wizard.

  5. Once the required changes are done, click on the Edit button on the wizard to save the changes.

Using CLI

  • Command:

  • Alias:

  • Options:

  • Example:

Assign/Unassign Project(s) to/from a BTT

circle-info

Project assignment is allowed only to the Private Backup Target Types.

Using Horizon Dashboard

  • Log in to the OpenStack Horizon Dashboard as an Admin user.

  • Navigate to the Admin-> Backups-Admin -> Backup Targets

  • On the page, click the Backup Target Types tab to see the list of Backup Target Types.

  • Click the dropdown button under the Actions column of the BTT List table of the desired Private BTT and click on the button to open the Edit Backup Target Type Access wizard.

  • Select the Projects to be assigned, unselect the projects to be unassigned, and click on the Save button on the wizard to save the changes.

Using CLI

Assigning Projects:

  • Command:

  • Alias:

Options:

Example:

Unassigning Projects:

  • Command:

  • Alias:

Options:

Example:

Add/Remove BTT Metadata

Using Horizon Dashboard

circle-exclamation

Using CLI

Adding Metadata:

  • Command:

  • Alias:

Options:

  • Example:

Removing Metadata:

  • Command:

  • Alias:

  • Options:

Example:

Delete a BTT

triangle-exclamation

Using Horizon Dashboard

  • Log in to the OpenStack Horizon Dashboard as an Admin user.

  • Navigate to the Admin-> Backups-Admin -> Backup Targets

  • On the page, click the Backup Target Types tab to see the list of Backup Target Types.

  • Click the dropdown button under the Actions column of the BTT List table of the desired Private BTT, click on the button, and confirm the deletion once prompted.

  • Deletion of multiple BTTs can be done by selecting the check boxes of the desired BTTs and then clicking the button at the top-right corner.

Using CLI

  • Command:

  • Alias:

  • Options:

  • Example:


3. User Interaction with Backup Target Types

How Users Choose Backup Storage:

  • Any user can select a Public Backup Target Type for storing backups, as these are universally accessible.

  • For Private Backup Target Types, users can only select them if the Backup Target Type is explicitly assigned to their project.

  • The user will have the option to select these Backup Target Types while creating a workload.

  • Please note that once the workload is created with the chosen Backup Target Type, it can not be modified. The user has to recreate the workload if the Backup Target Type needs to be changed.


Last updated

Was this helpful?