Question

You are responsible for etcd backups on a kubeadm-provisioned cluster where etcd runs as a stacked static pod on the control-plane node. Before a risky upgrade, you must take a manual snapshot of the etcd data from the control-plane host. The etcd server certificates are located in /etc/kubernetes/pki/etcd/. Which command correctly captures a consistent snapshot?

Accepted Answer

ETCDCTL_API=3 etcdctl snapshot save /opt/etcd-backup.db --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key

Answer

ETCDCTL_API=3 etcdctl snapshot save /opt/etcd-backup.db --endpoints=https://127.0.0.1:2379 --insecure-skip-tls-verify

Answer

kubectl get etcd -n kube-system -o yaml > /opt/etcd-backup.db

Answer

cp -r /var/lib/etcd /opt/etcd-backup.db while the etcd static pod is running