CKA — etcd Backup & Restore Lab

1 minute read

Lab Overview

Take an etcd backup, simulate data loss, and restore the cluster from the backup.

Task 1: Create Test Resources

kubectl create namespace backup-test
kubectl -n backup-test create deployment web --image=nginx --replicas=3
kubectl -n backup-test create configmap app-config --from-literal=env=production
kubectl -n backup-test get all

Task 2: Take an etcd Backup

ETCDCTL_API=3 etcdctl \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key \
  snapshot save /opt/etcd-backup-lab.db

Verify:

ETCDCTL_API=3 etcdctl snapshot status /opt/etcd-backup-lab.db --write-out=table

Task 3: Simulate Data Loss

kubectl delete namespace backup-test
kubectl get namespace backup-test
# Expected: namespace not found

Task 4: Restore the Backup

ETCDCTL_API=3 etcdctl snapshot restore /opt/etcd-backup-lab.db \
  --data-dir=/var/lib/etcd-restored

Task 5: Update etcd Manifest

sudo vi /etc/kubernetes/manifests/etcd.yaml

Change these three locations:

  1. --data-dir=/var/lib/etcd -> --data-dir=/var/lib/etcd-restored
  2. mountPath: /var/lib/etcd -> mountPath: /var/lib/etcd-restored
  3. path: /var/lib/etcd -> path: /var/lib/etcd-restored

Task 6: Verify Restoration

Wait 30-60 seconds, then:

# Check if etcd is running
sudo crictl ps | grep etcd

# Check cluster
kubectl get nodes

# Verify restored data
kubectl -n backup-test get all
# The backup-test namespace and all its resources should be back

Practice Questions

Q1: Write the complete command to take an etcd snapshot and save it to /opt/cluster-backup.db.

Show Answer 
ETCDCTL_API=3 etcdctl \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key \
  snapshot save /opt/cluster-backup.db

Always verify: ETCDCTL_API=3 etcdctl snapshot status /opt/cluster-backup.db --write-out=table

Q2: After restoring an etcd snapshot to /var/lib/etcd-new, what three changes must you make in the etcd manifest?

Show Answer

Edit /etc/kubernetes/manifests/etcd.yaml:

  1. Command flag: --data-dir=/var/lib/etcd-new
  2. Volume mount: mountPath: /var/lib/etcd-new
  3. Host path: path: /var/lib/etcd-new

After saving, the kubelet automatically restarts the etcd Pod.

Q3: How do you find the etcd certificate file paths?

Show Answer

Check the etcd static Pod manifest:

cat /etc/kubernetes/manifests/etcd.yaml | grep -E "cert-file|key-file|trusted-ca"

Default paths:

  • CA: /etc/kubernetes/pki/etcd/ca.crt
  • Cert: /etc/kubernetes/pki/etcd/server.crt
  • Key: /etc/kubernetes/pki/etcd/server.key

Q4: Verify that an etcd backup at /tmp/backup.db is valid.

Show Answer 
ETCDCTL_API=3 etcdctl snapshot status /tmp/backup.db --write-out=table

No TLS certificates needed — it reads the local file only.

Q5: etcd uses –endpoints=https://10.0.1.5:2379. The backup command with 127.0.0.1 fails. What should you change?

Show Answer

Update --endpoints to match the etcd configuration:

ETCDCTL_API=3 etcdctl \
  --endpoints=https://10.0.1.5:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key \
  snapshot save /opt/backup.db

Find the correct endpoint: cat /etc/kubernetes/manifests/etcd.yaml | grep listen-client-urls

etcd Backup & Restore <- Next: RBAC & Security ->

Updated:

You may also enjoy