Backup Targets
This document explains the concepts of Backup Targets and Backup Target Types in Trilio, their purpose, and how they provide additional flexibility and control for backup storage management.
1. Backup Targets (BTs)
Definition:
Backup Targets are storage backends where backups are stored. These can be any of the supported storage systems such as NFS (Network File System) or S3 (Simple Storage Service). Backup Targets act as the foundational layer for storing backup data.
Key Characteristics of Backup Targets:
They are storage systems connected to Trilio.
Supported storage types include:
NFS: A shared file system accessible over a network.
S3: An object storage service typically offered by cloud providers.
Multiple Backup Targets can be defined within a single environment to provide storage flexibility.
How to configure Backup Target(s):
Only a default backup target is required while uploading the Trilio license. Additional backup targets can be added any time after a successful deployment — through the Horizon dashboard, the workloadmgr CLI, or the WLM REST API. Backup targets do not need to be planned exhaustively before deployment.
How mounting works in 6.2 and later. Starting in Trilio for OpenStack 6.2, backup targets are no longer mounted statically at service startup. The actual mount/umount is performed on demand by the Dynamic Mount Service (DMS) — on the controller for metadata operations, and on a specific compute node for snapshot/restore data transfer. Targets are unmounted automatically when no job is using them.
6.2 — Configuring an S3 Backup Target
Starting in 6.2, S3 access credentials and connection options are no longer stored in the WorkloadManager configuration. They are stored as an OpenStack Barbican secret and the backup target carries a secret_ref field that points at that secret. DMS fetches the payload at mount time using the requesting job's Keystone token, so credentials are never persisted on disk on Trilio nodes.
Pre-requisites (hard requirements)
One Barbican secret per S3 backup target. Each S3 backup target must have its own Barbican secret containing a valid payload. The Barbican secret URL becomes the
secret_refvalue of the backup target.The cloud admin user must be able to read the secret payload. DMS retrieves the payload using the requesting job's Keystone token, so the user/role triggering snapshots and restores must have
secret:getpermission on the secret. In default RHOSO deployments this is theadminuser in theadminproject; if you assign DMS use to a different user, mirror that user's ACL onto each Barbican secret.Required keys in the payload:
VAULT_S3_ACCESS_KEY_ID,VAULT_S3_SECRET_ACCESS_KEY,VAULT_S3_BUCKET,VAULT_STORAGE_S3_EXPORT. The DMS server applies built-in defaults for any optional keys not present.
Generating the secret payload
You can either hand-write the JSON payload or generate it with trilio-dms-cli secret-payload create. The four examples below cover the most common S3 deployment shapes.
Example 1 — AWS S3 (no custom endpoint, publicly-trusted CA, SSL verification on):
The resulting secret.json contains:
Example 2 — S3-compatible store with a publicly-trusted CA (e.g. a Ceph RGW or MinIO endpoint whose certificate chains to a CA already in the system trust store):
The payload includes VAULT_S3_ENDPOINT_URL and keeps VAULT_S3_SSL / VAULT_S3_SSL_VERIFY set to True.
Example 3 — S3-compatible store with a self-signed certificate. Pass the CA cert as a file; --ssl-cert auto-enables --ssl and --ssl-verify and embeds the PEM content in the payload as VAULT_S3_SSL_CERT:
Example 4 — S3 endpoint with SSL verification disabled (lab / non-production only):
The payload sets VAULT_S3_SSL_VERIFY to False. Use this only in test environments — DMS will not validate the endpoint certificate.
Storing the payload in Barbican
Use the returned Secret href as the secret_ref on the backup target — either via the workloadmgr backup-target-create CLI or the API request body.
6.2 — Configuring an NFS Backup Target
NFS backup targets do not require a Barbican secret. They are defined by the NFS export path and any mount options (e.g. nolock,soft,timeo=600,intr,lookupcache=none,retrans=10); these are passed through the filesystem_export and nfs_mount_opts fields when creating the target.
Deprecated (6.1) — Static Backend Configuration
The configuration shape described in this section applies to Trilio for OpenStack 6.1 and earlier. It is preserved here for reference for environments still running 6.1; it does not apply to 6.2+ deployments, which use Barbican-stored credentials and the Dynamic Mount Service.
In 6.1 and earlier, backup targets had to be planned and made available before deploying Trilio. The deployment scripts populated the following entries in the workloadmgr services configuration file:
All enabled backup target names were defined as a comma-separated list under the
DEFAULTsection using theenabled_backendsparameter:
where NFS_BT1, S3_BT1, S3_BT2, and S3_BT3 were unique backup target names with their own matching config sections.
Each backup target section was populated according to the storage type:
For NFS storage:
vault_storage_type = nfsvault_storage_filesystem_export = <NFS_SHARE>vault_storage_nfs_options = nolock,soft,timeo=600,intr,lookupcache=none,retrans=10
For S3 storage:
vault_storage_type = s3vault_s3_endpoint_url = <S3_ENDPOINT_URL>(blank for AWS S3)vault_s3_access_key_id = <S3_ACCESS_KEY_ID>vault_s3_secret_access_key = <S3_SECRET_ACCESS_KEY>vault_s3_bucket = <S3_BUCKET_NAME>vault_storage_filesystem_export = <S3_ENDPOINT_HOSTNAME>/<S3_BUCKET_NAME>(bucket name only for AWS S3)immutable = 1if Object-Lock is enabled on the S3 bucket, otherwise0
is_default = 1was set on exactly one section to mark it as the default backup target.
Example 6.1 configuration:
List & Show Configured BTs
Using Horizon Dashboard
Log in to the OpenStack Horizon Dashboard as an Admin user.
Navigate to the Admin-> Backups-Admin -> Backup Targets
On the page, click the Backup Targets tab to see the list of Backup Target Types.

Using CLI
Create Backup Target:
Command:
Alias:
Options:
Example:

Delete Backup Target:
Command:
Alias:
Options:
Example:

List the available Backup Targets:
Command:
Alias:
Options:
Example:

Show Details of a Backup Target:
Command:
Alias:
Options:
Example:

Backup Target Set Default:
Command:
Alias:
Options:
Example:

2. Backup Target Types (BTTs)
Definition:
Backup Target Types are an abstraction layer over Backup Targets. They provide additional administrative controls and can be categorized based on their scope and access permissions.
Types of Backup Target Types:
Public:
Accessible by all users and projects in the system.
Suitable for shared storage scenarios where multiple teams or tenants use the same backup infrastructure.
Private:
Restricted to specific projects.
Private Backup Target Types can be assigned to one or multiple projects, allowing project-specific control over backup storage.
Relationship Between Backup Targets and Backup Target Types:
A many-to-one relationship exists between Backup Target Types and Backup Targets.
Multiple Backup Target Types can map to a single Backup Target.
This allows administrators to define different policies or access levels for a shared storage backend.
Pre-created Backup Target Types
Trilio creates the BTTs of all the Backup Targets that are configured during deployment with the same name as the Backup Targets.
It inherits the provided configuration options for each Backup Target and creates the Public Backup Target Types by default.
List Available BTTs
Using Horizon Dashboard
Log in to the OpenStack Horizon Dashboard as an Admin user.
Navigate to the Admin-> Backups-Admin -> Backup Targets
On the page, click the Backup Target Types tab to see the list of Backup Target Types.

Using CLI
Command:
Alias:
Options:
Example:

Show Details of a BTT
Using Horizon Dashboard
Most of the relevant information about the BTT can be seen while Listing the BTTs.
Trilio does not provide a separate GUI for showing the additional details of the BTTs.
But, Trilio does provide a CLI command to get the additional details.
Using CLI
Command:
Alias:
Options:
Example:

Create a BTT
Using Horizon Dashboard
Log in to the OpenStack Horizon Dashboard as an Admin user.
Navigate to the Admin-> Backups-Admin -> Backup Targets
On the page, click the Backup Target Types tab to see the list of Backup Target Types.
Click on the
button to open the Backup Target Type Create wizard, and follow the instructions to create the BTT.
Using CLI
Command:
Alias:
Options:
Example:

Modify a BTT
Modification of the Default Backup Target Type is not allowed.
Using Horizon Dashboard
Log in to the OpenStack Horizon Dashboard as an Admin user.
Navigate to the Admin-> Backups-Admin -> Backup Targets
On the page, click the Backup Target Types tab to see the list of Backup Target Types.
Click on the
button under the Actions column of the BTT List table of the desired BTT to open the Edit Backup Target Type wizard.Once the required changes are done, click on the Edit button on the wizard to save the changes.
Using CLI
Command:
Alias:
Options:
Example:

Assign/Unassign Project(s) to/from a BTT
Project assignment is allowed only to the Private Backup Target Types.
Using Horizon Dashboard
Log in to the OpenStack Horizon Dashboard as an Admin user.
Navigate to the Admin-> Backups-Admin -> Backup Targets
On the page, click the Backup Target Types tab to see the list of Backup Target Types.
Click the dropdown button under the Actions column of the BTT List table of the desired Private BTT and click on the
button to open the Edit Backup Target Type Access wizard.Select the Projects to be assigned, unselect the projects to be unassigned, and click on the Save button on the wizard to save the changes.

Using CLI
Assigning Projects:
Command:
Alias:
Options:
Example:

Unassigning Projects:
Command:
Alias:
Options:
Example:

Add/Remove BTT Metadata
Using Horizon Dashboard
Metadata updates are only possible through CLI
Using CLI
Adding Metadata:
Command:
Alias:
Options:
Example:

Removing Metadata:
Command:
Alias:
Options:
Example:

Delete a BTT
Removing Backup Target Types from an active Workload can lead to inconsistent behavior and potential backup operation failures.
Using Horizon Dashboard
Log in to the OpenStack Horizon Dashboard as an Admin user.
Navigate to the Admin-> Backups-Admin -> Backup Targets
On the page, click the Backup Target Types tab to see the list of Backup Target Types.
Click the dropdown button under the Actions column of the BTT List table of the desired Private BTT, click on the
button, and confirm the deletion once prompted.Deletion of multiple BTTs can be done by selecting the check boxes of the desired BTTs and then clicking the
button at the top-right corner.
Using CLI
Command:
Alias:
Options:
Example:
3. User Interaction with Backup Target Types
How Users Choose Backup Storage:
Any user can select a Public Backup Target Type for storing backups, as these are universally accessible.
For Private Backup Target Types, users can only select them if the Backup Target Type is explicitly assigned to their project.
The user will have the option to select these Backup Target Types while creating a workload.
Please note that once the workload is created with the chosen Backup Target Type, it can not be modified. The user has to recreate the workload if the Backup Target Type needs to be changed.
Last updated
Was this helpful?
