etcd backup
- Docker & Kubernetes course
- Expert
- Lesson 38/47
- 4 min
Learn to take an etcd snapshot.
Backing up etcd
etcd is the key-value store holding all of Kubernetes's state. etcdctl snapshot save takes a consistent snapshot. Connecting needs etcd's address and TLS certificates (in kubeadm clusters, /etc/kubernetes/pki/etcd/):
ETCDCTL_API=3 etcdctl snapshot save /yedek/etcd-$(date +%F-%H%M).db \
--endpoints=https://127.0.0.1:2379 \
--cacert=/etc/kubernetes/pki/etcd/ca.crt \
--cert=/etc/kubernetes/pki/etcd/server.crt \
--key=/etc/kubernetes/pki/etcd/server.keyIn managed clusters (EKS, GKE, AKS), etcd is with the provider; there, object backups are taken with Velero.
Verifying the snapshot
The file taken is checked for corruption; then it is copied outside the cluster:
$ etcdutl snapshot status /yedek/etcd-2026-11-03-1000.db -w table
+----------+----------+------------+------------+
| HASH | REVISION | TOTAL KEYS | TOTAL SIZE |
+----------+----------+------------+------------+
| 7c3a91e2 | 812344 | 2140 | 46 MB |
+----------+----------+------------+------------+
$ aws s3 cp /yedek/etcd-2026-11-03-1000.db s3://yedek-eu/etcd/ --sse aws:kmsPractice Back up etcd
Write two commands: etcdctl snapshot save /yedek/etcd.db with --endpoints=https://127.0.0.1:2379, --cacert=/etc/kubernetes/pki/etcd/ca.crt, --cert=/etc/kubernetes/pki/etcd/server.crt, --key=/etc/kubernetes/pki/etcd/server.key (on one line). Then etcdutl snapshot status /yedek/etcd.db -w table.
Starter code
# buraya yazSample solution
etcdctl snapshot save /yedek/etcd.db --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key
etcdutl snapshot status /yedek/etcd.db -w tableExpected output
Snapshot saved at /yedek/etcd.db +----------+----------+------------+------------+ | HASH | REVISION | TOTAL KEYS | TOTAL SIZE | +----------+----------+------------+------------+ | 7c3a91e2 | 812344 | 2140 | 46 MB | +----------+----------+------------+------------+
Questions and answers
Review the lesson questions together with their answers. To test yourself, solve the lesson interactively.
1 What kind of information makes an etcd snapshot sensitive?
- Image layers
- Node hardware
- The Secrets inside (often just base64) Correct answer
- Pod logs
Explanation: The snapshot must be stored encrypted and with restricted access.
2 Take an etcd snapshot.
etcdctl snapshot ____ /yedek/etcd.db --endpoints=https://127.0.0.1:2379etcdctl snapshot save /yedek/etcd.db --endpoints=https://127.0.0.1:2379Explanation: snapshot save writes a consistent image.
3 Match.
| Term | Meaning |
|---|---|
snapshot save |
Take snapshot |
snapshot status |
Verify snapshot |
--cacert |
CA certificate |
--sse aws:kms |
Encrypted upload |