The latest ZFSSA software release (as of this post) is OS8.8.39.
This release contains the ability to make both scheduled snapshots and manual snapshots immutable, and I will go through how this works in this post.
New Authorizations
By default non-root users are not authorized to create scheduled locked snapshots, or manual locked snapshots and you will see the message below.
There are 3 new authorizations added to support Snapshot immutability. The authorizations are
- releaseSnapRetention - This allows the role to release a snapshot from it's retention hold
- scheduleLockedSnap - This allows the role to schedule a locked snapshot
- retainSnap - This allows the role to create a manual locked snapshot
In order to show how this works I created a new role "Security_Admin" and granted this role the new authorizations.
You can see that the "Security_Admin" role has releaseSnapRetention, scheduleLockedSnap and retainSnap authorizations which reside under the "Projects and shares" scope.
Create a Manual Locked Snapshot (BUI)
First I am going to create a manual locked snapshot. Below is the window that appears when I click on the "+" to create the snapshot.
Notice below the name there is a new field "Retention policy". This can be either
- Off - There is no retention on this snapshot (normal)
- Unlocked - There is a locked retention on this snapshot
I am going to create my manual snapshot with an "unlocked" retention policy
Change the retention setting of a Snapshot (BUI)
Once I create the manual snapshot, I can see that it has an "unlocked" retention when I click on the edit button. Here I can update the snapshot and turn the retention policy to "Off" to unlock the snapshot when I am ready to delete it. I can also change the status of a snapshot without a retention to have a retention policy.
Create a Manual Locked Snapshot (CLI)
1) Navigate to the share or project you want to snapshot.
zfssim:shares NFSbackups> select NFS_immutable
zfssim:shares NFSbackups/NFS_immutable>
2) Enter snapshots
zfssim:shares NFSbackups> snapshots
zfssim:shares NFSbackups/NFS_immutable snapshots>
3) Use the snapshot command followed by a "-r" to set the retention lock, and set the new snapshot name
zfssim:shares NFSbackups/NFS_immutable snapshots> snapshot -r Save_until_Jan_1_2022
zfssim:shares NFSbackups/NFS_immutable snapshots>
4) You can use the list command to see the snapshot, and then select the snapshot
zfssim:shares objectstore> select rmanbackups
zfssim:shares objectstore/rmanbackups>
5) The "show" command will display the settings for the snapshot, and you will see that has a retentionpolicy of "unlocked"
zfssim:shares NFSbackups/NFS_immutable@Save_until_Jan_1_2022> show
Properties:
creation = Tue Nov 16 2021 20:35:25 GMT+0000 (UTC)
numclones = 0
isauto = false
retentionpolicy = unlocked
pool = generalpool1
canonical_name = generalpool1/local/NFSbackups/NFS_immutable@Save_until_Jan_1_2022
shadowsnap = false
space_unique = 0
space_data = 31K
Change the retention setting of a Snapshot (CLI)
Continuing from the previous set of commands, with the "show" I can see the status of the retention lock.
Using the "set retentionpolicy={off | unlocked}" you can change the status of a snapshot.
Below is the example when I turned the retention policy to off for the snapshot I took in the prior example.
zfssim:shares NFSbackups/NFS_immutable@Save_until_Jan_1_2022> get retentionpolicy
retentionpolicy = unlocked
zfssim:shares NFSbackups/NFS_immutable@Save_until_Jan_1_2022> set retentionpolicy=off
retentionpolicy = off (uncommitted)
zfssim:shares NFSbackups/NFS_immutable@Save_until_Jan_1_2022> get retentionpolicy
retentionpolicy = off (uncommitted)
zfssim:shares NFSbackups/NFS_immutable@Save_until_Jan_1_2022> commit
zfssim:shares NFSbackups/NFS_immutable@Save_until_Jan_1_2022> show
Properties:
creation = Tue Nov 16 2021 20:35:25 GMT+0000 (UTC)
numclones = 0
isauto = false
retentionpolicy = off
pool = generalpool1
canonical_name = generalpool1/local/NFSbackups/NFS_immutable@Save_until_Jan_1_2022
shadowsnap = false
space_unique = 0
space_data = 31K
Children:
backups => Configure Cloud Backups
targets => List snapshot parents per target
zfssim:shares NFSbackups/NFS_immutable@Save_until_Jan_1_2022>
Deleting a Manual Locked Snapshot
BUI
When you delete a manual snapshot that has a retention policy, you will receive an error screen once you click through the "are you sure" message. Below is the message that will appear if the snapshot still has a retention lock.
In order to allow the snapshot to be deleted, you need to edit the snapshot, and set the retention to "Off". Once you remove the retention lock the snapshot can be deleted.
CLI
You will receive an error when trying to delete the snapshot. You must release the lock (or in the case of a schedule snapshot) wait for it to roll off.
zfssim:shares NFSbackups/NFS_immutable@Save_until_Jan_1_2022> destroy
This will destroy all data in "Save_until_Jan_1_2022"! Are you sure? (Y/N) y
error: The action could not be completed because the target 'NFSbackups/NFS_immutable@Save_until_Jan_1_2022' is in use. It cannot be modified while it, or its children, are actively changing. Make sure no other users are editing the
share configuration and try again. If this problem persists, contact your service provider.
Enable Scheduled Locked Snapshots (BUI)
The next step is to enable scheduled locked snapshots. You will notice (highlighted below) that there is a new option to enable the retention policy for locked scheduled snapshots under the project and share.
shares --> share/project --> snapshots
Create Scheduled Locked Snapshots (BUI)
To create a schedule snapshot that is locked, you will noticed there are addition fields on the scheduling popup. You have the ability to schedule a snapshot with retention either "Off" or "Locked". When schedule with "Locked" you must also decide on how many of the "kept" snapshots will be locked. Below I am scheduling snapshots every half hour. 5 snapshots will be kept, and the most recent 3 snapshots will be locked (since I chose locked).
Viewing retention status of scheduled snapshots (BUI)
Using the schedule from above (5 snapshots, 3 of which are locked), below is what I am seeing after it has been executing for awhile. I chose one of the 3 most recent snapshots and I can see that it has a status of "locked" and I am unable to change that status.
Deleting locked scheduled snapshots (BUI) - Not allowed
Now I am going to try to delete the schedule that contains locked snapshots. I click on the delete button and hit apply. I get a message saying the snaps will be converted to manual snapshots.
If I try to change the schedule to have the snapshots no longer be "Locked", I get the same message.
Enable Scheduled Locked Snapshots (CLI)
I navigated through the CLI and got to the share that I wanted to create a scheduled, locked snapshot for. I first need to make sure the property "snap" is set. In my case it wasn't so I set the value and committed the change.
zfssim:shares NFSbackups/nfstest> get snapret_enabled
snapret_enabled = false (inherited)
zfssim:shares NFSbackups/nfstest> set snapret_enabled=true
snapret_enabled = true (uncommitted)
zfssim:shares NFSbackups/nfstest> commit
zfssim:shares NFSbackups/nfstest> get snapret_enabled
snapret_enabled = true
zfssim:shares NFSbackups/nfstest>
Create Schedule Locked Snapshots (CLI)
Navigate to the share --> snapshots --> automatic
Once there create a new snapshot, and set the properties for the snapshot.
In order to make this a locked snapshot, you need to set the property "retentionpolicy" to "locked".
Below is the steps I followed to create a daily snapshot, kept for 35 days, and immutable for 30 days.
zfssim:shares NFSbackups/nfstest>
zfssim:shares NFSbackups/nfstest> snapshots
zfssim:shares NFSbackups/nfstest snapshots> automatic
zfssim:shares NFSbackups/nfstest snapshots automatic> create
zfssim:shares NFSbackups/nfstest snapshots automatic-000 (uncommitted)> show
Properties:
frequency = (unset)
day = (unset)
hour = (unset)
minute = (unset)
keep = 0
retentionhold = 0
retentionpolicy = off
zfssim:shares NFSbackups/nfstest snapshots automatic-000 (uncommitted)> set frequency=day
frequency = day (uncommitted)
zfssim:shares NFSbackups/nfstest snapshots automatic-000 (uncommitted)> set hour=06
hour = 06 (uncommitted)
zfssim:shares NFSbackups/nfstest snapshots automatic-000 (uncommitted)> set minute=00
minute = 00 (uncommitted)
zfssim:shares NFSbackups/nfstest snapshots automatic-000 (uncommitted)> set keep=35
keep = 35 (uncommitted)
zfssim:shares NFSbackups/nfstest snapshots automatic-000 (uncommitted)> set retentionhold=30
retentionhold = 30 (uncommitted)
zfssim:shares NFSbackups/nfstest snapshots automatic-000 (uncommitted)> set retentionpolicy=locked
retentionpolicy = locked (uncommitted)
zfssim:shares NFSbackups/nfstest snapshots automatic-000 (uncommitted)> show
Properties:
frequency = day (uncommitted)
day = (unset)
hour = 06 (uncommitted)
minute = 00 (uncommitted)
keep = 35 (uncommitted)
retentionhold = 30 (uncommitted)
retentionpolicy = locked (uncommitted)
zfssim:shares NFSbackups/nfstest snapshots automatic-000 (uncommitted)>
zfssim:shares NFSbackups/nfstest snapshots automatic-000 (uncommitted)> commit
zfssim:shares NFSbackups/nfstest snapshots automatic> show
Properties:
convert = false
Automatics:
NAME FREQUENCY DAY HH:MM KEEP
automatic-000 day - 06:00 35
Viewing retention status of scheduled snapshots (CLI)
Below I listed out the snapshots that were automatically created. I can see that the snapshot chose has a "retentionpolicy" of "locked" and this lock will be removed according to the schedule.
zfssim:shares NFSbackups/zfsshare> snapshots
zfssim:shares NFSbackups/zfsshare snapshots> list
.auto-Bihourly_snapshots-20211116T193000UTC
.auto-Bihourly_snapshots-20211116T200000UTC
.auto-Bihourly_snapshots-20211116T203000UTC
.auto-Bihourly_snapshots-20211116T210000UTC
.auto-Bihourly_snapshots-20211116T213000UTC
zfssim:shares NFSbackups/zfsshare snapshots> select .auto-Bihourly_snapshots-20211116T203000UTC
zfssim:shares NFSbackups/zfsshare@.auto-Bihourly_snapshots-20211116T203000UTC> show
Properties:
creation = Tue Nov 16 2021 20:30:00 GMT+0000 (UTC)
numclones = 0
isauto = true
retentionpolicy = locked
pool = generalpool1
canonical_name = generalpool1/local/NFSbackups/zfsshare@.auto-Bihourly_snapshots-20211116T203000UTC
shadowsnap = false
space_unique = 0
space_data = 1.22G
Children:
backups => Configure Cloud Backups
targets => List snapshot parents per target
zfssim:shares NFSbackups/zfsshare@.auto-Bihourly_snapshots-20211116T203000UTC>
BONUS :
In the audit logs you can see the changes occur, and who made them.. I highlighted where I changed status of one of the shares from Unlocked to OFF and from Off to Unlocked.
