Documentation
¶
Overview ¶
Package backup is the platform backup format and target (ADR-0203): a generation's layout and manifest on an S3-compatible store or a directory, fencing against a second writer, and a retention ladder that needs a credential which only puts and lists. ADR-0205 runs it; ADR-0206 reads what it writes.
Index ¶
- Constants
- func Abandoned(ms []Manifest) map[GenRef]bool
- func ConditionRefused(err error) bool
- func GenDir(class Class, n uint64, timeline string) string
- func LifecycleRules(r Retention) map[string]int
- func Records(r io.Reader) func() (snapshot.Record, error)
- func TargetURL(cfg Config) (string, error)
- func WriteRecord(w io.Writer, r snapshot.Record) error
- type Class
- type Config
- type Entry
- type GenRef
- type Keys
- type Manifest
- type Opener
- type Retention
- type Seal
- type StoreFile
- type Target
- type Unseal
- type WriteOptions
Constants ¶
const Format = 1
Format is the platform manifest's format, a sequence apart from the KV manifest.json's (Decision 3).
const PartBytes = 8 << 20
PartBytes is the most bytes one part of a stored file holds (Decision 2); the sibling backups part theirs alike.
Variables ¶
This section is empty.
Functions ¶
func Abandoned ¶
Abandoned returns the generations on an abandoned branch: a parent timeline's generations numbered above the generation a restore loaded from it.
func ConditionRefused ¶
ConditionRefused reports a store refusing If-None-Match: S3's NotImplemented, or a 501.
func GenDir ¶
GenDir is a generation's directory, gen/<class>/<n>-<timeline>/, n in 10 decimal digits.
func LifecycleRules ¶
LifecycleRules is the expiry in days the operator sets per prefix (Decision 6): a class unused, or Verified 0, has none.
func Records ¶
Records reads the framing of Decision 2: io.EOF at the end, a torn record fault.Invalid.
Types ¶
type Class ¶
type Class string
Class is a generation's class: a rung of the ladder or a pin outside it (Decision 6).
type Config ¶
type Config struct {
Target, CredentialsFile, DataDir, KeyPrefix string
SingleWriter bool
Retention Retention
Logger *slog.Logger
}
Config opens a Target. KeyPrefix names the config keys in errors ("" ⇒ "backup."); DataDir is the platform data directory: a directory target on its device is no independent copy, and a run spools its cut there.
type Entry ¶
Entry is one generation a listing shows. All but At come from the key; At is the manifest's ModTime, zero while the generation is incomplete.
type Keys ¶
type Keys struct {
SecretsKey string `json:"secretsKey,omitempty"`
MasterSecret string `json:"masterSecret,omitempty"`
Recipients []string `json:"recipients,omitempty"`
}
Keys are the envelope's key records, whose values ADR-0204 defines; absent ⇒ none recorded, and no Recipients ⇒ the stores are unsealed.
type Manifest ¶
type Manifest struct {
Format int `json:"format"`
Generation uint64 `json:"generation"`
// At is when the cut began (ADR-0196's form).
At v1alpha1.Timestamp `json:"at"`
Funcd string `json:"funcd"`
// Timeline and Revision split the metastore version the cut returned.
Timeline string `json:"timeline"`
Revision uint64 `json:"revision"`
// Parent is the generation a restore loaded; nil when the timeline began at a first start.
Parent *GenRef `json:"parent,omitempty"`
Stores []StoreFile `json:"stores"`
Keys
}
Manifest is a generation's manifest.yaml (Decision 3), written last: the generation exists once it does. A new field's absence means the behavior before it; a changed meaning, framing or layout bumps Format. Readers ignore unknown fields.
type Opener ¶
Opener returns the Unseal for a manifest's recipients; ADR-0204's envelope.Opener(ids) returns one.
type Retention ¶
type Retention struct{ Hourly, Daily, Weekly, Verified int }
Retention is the ladder's lifetimes: hours, days and weeks a class is kept, and the days a gen/verified/ copy is. Daily or Weekly 0 leaves the class unused; Verified 0 sets no gen/verified/ rule (the KV, ADR-0209); ClassFor ignores Verified.
type Seal ¶
type Seal func(dst io.Writer) (io.WriteCloser, error)
Seal wraps dst in ADR-0204's envelope; nil stores the bytes as is.
type StoreFile ¶
type StoreFile struct {
Name string `json:"name"`
Parts int `json:"parts"`
Bytes int64 `json:"bytes"`
SHA256 string `json:"sha256"`
}
StoreFile is one store's file, in cut order: its parts, and the size and SHA-256 (hex) of the stored bytes.
type Target ¶
type Target interface {
// Ready takes a directory's lock and probes the target (Decision 4); Write calls it first.
Ready(ctx context.Context) error
// Conditional reports, after Ready's nil, whether puts carry IfNotExist: false only when the target refused it
// and singleWriter is set.
Conditional() bool
List(ctx context.Context) ([]Entry, error)
// Write cuts the stores and writes one generation; a second writer is fault.Conflict.
Write(ctx context.Context, events, meta, runs snapshot.Source, opts WriteOptions) (Manifest, error)
// Close releases the lock and the bucket.
Close() error
}
Target is a backup target.
Directories
¶
| Path | Synopsis |
|---|---|
|
Package blobmirror mirrors the local blob store to the platform backup target (ADR-0208 Decision 4): each run freezes the store into a hard-link image, uploads the objects whose id the current epoch lacks, then an index and a manifest, written last; nothing on the target is ever read, overwritten or deleted.
|
Package blobmirror mirrors the local blob store to the platform backup target (ADR-0208 Decision 4): each run freezes the store into a hard-link image, uploads the objects whose id the current epoch lacks, then an index and a manifest, written last; nothing on the target is ever read, overwritten or deleted. |
|
Package envelope seals a backup generation to operator-held age recipients and names the keys it needs (ADR-0204 Decisions 1-3, 5): the box writes what it cannot read.
|
Package envelope seals a backup generation to operator-held age recipients and names the keys it needs (ADR-0204 Decisions 1-3, 5): the box writes what it cannot read. |
|
Package escrow holds the restore key rules over the operator's escrow set (ADR-0204 Decisions 4, 5): the secrets key and the master secret a generation names, matched by content fingerprint, and the credentials a new master changes.
|
Package escrow holds the restore key rules over the operator's escrow set (ADR-0204 Decisions 4, 5): the secrets key and the master secret a generation names, matched by content fingerprint, and the credentials a new master changes. |
|
Package plan turns recovery objectives into backup settings (ADR-0223): Derive maps them to keys, Apply splices the keys into a file's bytes, CheckConfig runs the daemon's loader on the result and CheckRTO bounds the recovery time.
|
Package plan turns recovery objectives into backup settings (ADR-0223): Derive maps them to keys, Apply splices the keys into a file's bytes, CheckConfig runs the daemon's loader on the result and CheckRTO bounds the recovery time. |
|
Package runner runs the platform backup (ADR-0205): one run at a time, on a cadence anchored on the newest complete ladder generation; a status read from the target's listing; the funcd.backup metrics; and the rpoRisk alert on the newest verified generation.
|
Package runner runs the platform backup (ADR-0205): one run at a time, on a cadence anchored on the newest complete ladder generation; a status read from the target's listing; the funcd.backup metrics; and the rpoRisk alert on the newest verified generation. |
|
Package verify checks a platform backup generation off the box and pins it under gen/verified/ (ADR-0205 Decision 6): the parts against the manifest, a full decrypt with the operator's identities, the framing and key order, and with an escrow set the keys the generation names.
|
Package verify checks a platform backup generation off the box and pins it under gen/verified/ (ADR-0205 Decision 6): the parts against the manifest, a full decrypt with the operator's identities, the framing and key order, and with an escrow set the keys the generation names. |
|
Package workload is an app owner's backup (ADR-0222): the members a BackupSchedule's scope names, one full copy of them under <target>/<ns>/<backup>-<uid>/ (Decision 4) and the reads a Restore makes of it.
|
Package workload is an app owner's backup (ADR-0222): the members a BackupSchedule's scope names, one full copy of them under <target>/<ns>/<backup>-<uid>/ (Decision 4) and the reads a Restore makes of it. |