Docker & Kubernetes
etcd backup
Learn to take an etcd snapshot.
Backing up etcd
etcd is the key-value store holding all of Kubernetes's state. etcdctl snapshot save takes a consistent snapshot. Connecting needs etcd's address and TLS certificates (in kubeadm clusters, /etc/kubernetes/pki/etcd/):
ETCDCTL_API=3 etcdctl snapshot save /yedek/etcd-$(date +%F-%H%M).db \
--endpoints=https://127.0.0.1:2379 \
--cacert=/etc/kubernetes/pki/etcd/ca.crt \
--cert=/etc/kubernetes/pki/etcd/server.crt \
--key=/etc/kubernetes/pki/etcd/server.key
In managed clusters (EKS, GKE, AKS), etcd is with the provider; there, object backups are taken with Velero.
Verifying the snapshot
The file taken is checked for corruption; then it is copied outside the cluster:
$ etcdutl snapshot status /yedek/etcd-2026-11-03-1000.db -w table
+----------+----------+------------+------------+
| HASH | REVISION | TOTAL KEYS | TOTAL SIZE |
+----------+----------+------------+------------+
| 7c3a91e2 | 812344 | 2140 | 46 MB |
+----------+----------+------------+------------+
$ aws s3 cp /yedek/etcd-2026-11-03-1000.db s3://yedek-eu/etcd/ --sse aws:kms
Exercise Back up etcd
Write two commands: etcdctl snapshot save /yedek/etcd.db with --endpoints=https://127.0.0.1:2379, --cacert=/etc/kubernetes/pki/etcd/ca.crt, --cert=/etc/kubernetes/pki/etcd/server.crt, --key=/etc/kubernetes/pki/etcd/server.key (on one line). Then etcdutl snapshot status /yedek/etcd.db -w table.
Show example solution
etcdctl snapshot save /yedek/etcd.db --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key
etcdutl snapshot status /yedek/etcd.db -w table
Test yourself
-
What kind of information makes an etcd snapshot sensitive?
- Image layers
- Node hardware
- The Secrets inside (often just base64)
- Pod logs
Show answer
The Secrets inside (often just base64) — The snapshot must be stored encrypted and with restricted access.
-
Take an etcd snapshot.
etcdctl snapshot ____ /yedek/etcd.db --endpoints=https://127.0.0.1:2379
Show answer
etcdctl snapshot save /yedek/etcd.db --endpoints=https://127.0.0.1:2379
-
Match.
- snapshot save
- Take snapshot
- snapshot status
- Verify snapshot
- --cacert
- CA certificate
- --sse aws:kms
- Encrypted upload
Next lesson: Velero
