Karbor: OpenStack Data Protection as a Service – Architecture, Resources, APIs, and Plugins

Karbor (formerly Smaug) is an OpenStack project that provides Data Protection as a Service (DPaaS), enabling vendors to integrate backup, replication, and migration capabilities into OpenStack through a unified standard interface.

The project, led by Huawei and several data‑protection companies, has become an official OpenStack project and addresses the long‑standing lack of standardized backup interfaces for virtual machines and other resources.

Karbor protects a wide range of resources—including VMs, volumes, virtual networks, projects, and images—organized into three application layers (Web, basic applications, databases). Protection is performed by resource‑specific plugins that are loaded by a plugin engine.

Key protectable resources are:

Volumes: read‑write storage devices attached to VMs.

Virtual machines: metadata‑driven deployment units.

Virtual networks: communication networks for VMs.

Projects (referred to as "工程"): groups of VMs, volumes, images, and networks.

Images: virtual boot images or software packages.

Vendors implement standard APIs and workflow definitions by providing Plugins and Providers; administrators configure which Providers (and associated Banks) are visible to each tenant, and each Bank stores protection metadata and transaction history.

Karbor defines a set of standard APIs for the entire protection lifecycle: Resource (protectable) API, Protection Plan API, Provider API, Checkpoints API (for snapshots and restores), and Schedule Operation API (to trigger and manage protection tasks).

The system follows a modular architecture: the API Service aggregates the various API modules, the Operation Schedule Service coordinates execution of protection plans and records operations in the Karbor database, and the Protection Service handles actual protection, recovery, verification, and bank management.

Karbor integrates with OpenStack’s Freezer backup service, using Freezer plugins to create checkpoints, schedule backup jobs, and store backup data in Swift, thereby extending DPaaS capabilities to Windows, Linux, databases, and other workloads.