Feedback on immutability
-
@afk the agent is as dumb as possible
also if you encrypt the backup, the agent will need to decrypt the metadata to detect the chains, thus having access to the encryption key, which need getting the encryption key out of XO and transferred to the immutability agent
I think it will be easier to provide more feedback on the immutabiltiy backup, XO has access to the chain , and / or alert when something seems to be strange
-
Where is the doc for these ? edit ok right here https://github.com/vatesfr/xen-orchestra/tree/master/%40xen-orchestra/immutable-backups , with V**m there is an option for immutability when you add the S3 bucket directly so its look like its only a flag sent at bucket creation and using the versionning/compliance feature
-
@vkeven we don't have ( for now) the feature to create bucket directly from XO. Also I think it is more secure if XO don't know at all the credits of the bucket admin
-
Indeed, because if XO is compromised, then it could disable immutability.
-
@olivierlambert We tried adding compliance( prevent any file manipulation for X period) directly into bucket but XOA could not do his backup job correctly and the logs are full of access denied probably because of file merging or manipulation refused , so how we should do this ?
-
@vkeven same problem here, we decided not to proceed with this as it would never work with an incremental delta without doing a full every few weeks. We are going to handle this with s3 and synology internal features.
-
Thanks for your feedback, we'll discuss internally if there's any other possible approach (and I'm not sure).
-
So what is the deal with these guy ?
-
O olivierlambert referenced this topic on
-
@olivierlambert
Any updates on this? We're using Backblaze buckets with compliance turned on at the bucket level, but we keep getting failures once the retention period expires and it starts to remove the old backup chains.We tried setting 28 days of retention at the bucket level, 42 in XenOrchestra, and are running a full backup every 2 weeks. I have a ticket open with support but so far a resolution hasn't been found.
-
In theory that should work
Ping @florent -
@olivierlambert
So it looks like the issue is not related to object lock or immutability but rather Backblaze not handling the merge requests very well. Not sure why this isn't impacting the other backup job without object lock, but anyways.... guess we're in the market for a different storage provider. -
Sadly, Backblaze is often having issues on S3 (timeout, not reliable etc). We are updating our doc to give a "tiering" support.
