etcd备份

1、备份

在其中一台备份：

etcdctl --endpoints= https://10.30.24.107:2379 \

--cacert=/etc/ssl/etcd/ssl/ca.pem \

--key=/etc/ssl/etcd/ssl/member-master1-key.pem \

--cert=/etc/ssl/etcd/ssl/member-master1.pem \

snapshot save /root/etcd-backup/etcd-snapshot.db

 

备份脚本

 

#!/bin/bash

Date=`date +%Y-%m-%d-%H-%M`

EtcdEndpoints="https://10.30.24.107:2379"

EtcdCmd="/usr/local/bin/etcdctl"

BackupDir="/data/etcd-backup"

BackupFile="snapshot.db.$Date"

 

echo "`date` backup etcd..."

 

export ETCDCTL_API=3

$EtcdCmd --endpoints=$EtcdEndpoints --cacert=/etc/ssl/etcd/ssl/ca.pem --cert=/etc/ssl/etcd/ssl/member-master1.pem --key=/etc/ssl/etcd/ssl/member-master1-key.pem  snapshot save  $BackupDir/$BackupFile

 

find $BackupDir  -mtime 30  -name "snapshot*" -exec rm -rf {} \;

 

echo  "`date` backup done!"

 

#!/bin/bash
Date=`date +%Y-%m-%d-%H-%M`
EtcdEndpoints="https://10.30.23.57:2379"
EtcdCmd="/usr/local/bin/etcdctl"
BackupDir="/data/etcd-backup/etcd-backup"
BackupFile="snapshot.db.$Date"

echo "`date` backup etcd..."

export ETCDCTL_API=3
$EtcdCmd --endpoints=$EtcdEndpoints --cacert=/etc/ssl/etcd/ssl/ca.pem --cert=/etc/ssl/etcd/ssl/member-etcd1.pem --key=/etc/ssl/etcd/ssl/member-etcd1-key.pem  snapshot save  $BackupDir/$BackupFile

find $BackupDir  -mtime 30  -name "snapshot*" -exec rm -rf {} \;

echo  "`date` backup done!"

2、拷贝 ETCD 备份快照到其它etcd节点

scp /data/etcd-backup/snapshot.db.2021-03-21-00-00 master2:/data

scp /data/etcd-backup/snapshot.db.2021-03-21-00-00 master3:/data

 

3、恢复准备工作

• 停止所有 Master 上 kube-apiserver 服务

$ systemctl stop kube-apiserver 或者 mv /etc/kubernetes/manifests /etc/kubernetes/manifests.bak

 

       确认 kube-apiserver 服务是否停止

$ ps -ef | grep kube-apiserver

 

• 停止集群中所有 ETCD 服务

$ systemctl stop etcd 或者

 mv /etc/etcd.env /etc/etcd.env.bak && docker stop etcd1

 mv /etc/etcd.env /etc/etcd.env.bak && docker stop etcd2

 mv /etc/etcd.env /etc/etcd.env.bak && docker stop etcd3

 

• 移除所有 ETCD 存储目录下数据

$ mv /data/etcd /data/etcd.bak

 

 

4、恢复备份

# k8s-master1 机器上操作

ETCDCTL_API=3 etcdctl snapshot restore /data/etcd-backup/ snapshot.db.2021-03-21-00-00 \

--name etcd1 \

--initial-cluster "etcd1=https://10.30.24.107:2380,etcd2=https://10.30.24.108:2380,etcd3=https://10.30.24.109:2380" \

--initial-cluster-token k8s_etcd \

--initial-advertise-peer-urls https://10.30.24.107:2380 \

--data-dir=/data/etcd

 

# k8s-master2 机器上操作

 

ETCDCTL_API=3 etcdctl snapshot restore /data/ snapshot.db.2021-03-21-00-00 \

--name etcd2 \

--initial-cluster "etcd1=https://10.30.24.107:2380,etcd2=https://10.30.24.108:2380,etcd3=https://10.30.24.109:2380" \

--initial-cluster-token k8s_etcd \

--initial-advertise-peer-urls https://10.30.24.108:2380 \

--data-dir=/data/etcd

 

# k8s-master3 机器上操作

ETCDCTL_API=3 etcdctl snapshot restore /data/ snapshot.db.2021-03-21-00-00 \

--name etcd3 \

--initial-cluster "etcd1=https://10.30.24.107:2380,etcd2=https://10.30.24.108:2380,etcd3=https://10.30.24.109:2380" \

--initial-cluster-token k8s_etcd \

--initial-advertise-peer-urls https://10.30.24.109:2380 \

--data-dir=/data/etcd

 

cat /etc/etcd.env   #查看集群token

启动所有etcd节点上的etcd服务

$ systemctl start etcd 或者

 mv /etc/etcd.env.bak /etc/etcd.env                && docker start etcd1  

 mv /etc/etcd.env.bak /etc/etcd.env                && docker start etcd2

 mv /etc/etcd.env.bak /etc/etcd.env                && docker start etcd3

启动所有etcd节点上的apiserver服务

systemctl start kube-apiserver 或者 mv /etc/kubernetes/manifests.bak /etc/kubernetes/manifests

确认 kube-apiserver 服务是否起来

ps -ef | grep kube-apiserver

5、常用命令

1）检查集群健康状态

 

etcdctl --endpoints= https://10.30.24.107:2379 --endpoints= https://10.30.24.108:2379 --endpoints= https://10.30.24.109:2379 --cacert=/etc/ssl/etcd/ssl/ca.pem --key=/etc/ssl/etcd/ssl/member-master1-key.pem --cert=/etc/ssl/etcd/ssl/member-master1.pem endpoint health

 

 

2）查看某一个key

 

ECTD_API=3 etcdctl --cacert=/etc/ssl/etcd/ssl/ca.pem --cert=/etc/ssl/etcd/ssl/member-master1.pem --key=/etc/ssl/etcd/ssl/member-master1-key.pem --endpoints= https://192.168.5.45:2379 get /registry/namespaces/default

 

etcdctl --endpoints=https://10.30.24.107:2379 \

--endpoints=https://10.30.24.108:2379 \

--endpoints=https://10.30.24.109:2379 \

--cacert=/etc/ssl/etcd/ssl/ca.pem \

--key=/etc/ssl/etcd/ssl/member-master1-key.pem \

--cert=/etc/ssl/etcd/ssl/member-master1.pem \

get /registry/namespaces/iaoc

 

 

3）查看etcd版本

etcdctl --endpoints= https://10.30.24.107:2379 --endpoints= https://10.30.24.108:2379 --endpoints= https://10.30.24.109:2379 --cacert=/etc/ssl/etcd/ssl/ca.pem --key=/etc/ssl/etcd/ssl/member-master1-key.pem--cert=/etc/ssl/etcd/ssl/member-master1.pem version

 

4）查看etcd列表

etcdctl --endpoints= https://10.30.24.107:2379 --endpoints= https://10.30.24.108:2379 --endpoints= https://10.30.24.109:2379 --cacert=/etc/ssl/etcd/ssl/ca.pem --key=/etc/ssl/etcd/ssl/member-master1-key.pem --cert=/etc/ssl/etcd/ssl/member-master1.pem member list

 

 

6、使用cronjob定时备份（yaml备份）

apiVersion: batch/v2alpha1kind: CronJobmetadata:

name: etcd-disaster-recovery

namespace: cronspec:

schedule: "0 22 * * *"

jobTemplate:

spec:

template:

metadata:

labels:

app: etcd-disaster-recovery

spec:

affinity:

nodeAffinity:

requiredDuringSchedulingIgnoredDuringExecution:

nodeSelectorTerms:

- matchExpressions:

- key: kubernetes.io/role

operator: In

values:

- master

containers:

- name: etcd

image: coreos/etcd:v3.0.17

command:

- sh

- -c

- "export ETCDCTL_API=3; \

etcdctl --endpoints $ENDPOINT snapshot save /snapshot/$(date +%Y%m%d_%H%M%S)_snapshot.db; \

echo etcd backup sucess"

env:

- name: ENDPOINT

value: "127.0.0.1:2379"

volumeMounts:

- mountPath: "/snapshot"

name: snapshot

subPath: data/etcd-snapshot

- mountPath: /etc/localtime

name: lt-config

- mountPath: /etc/timezone

name: tz-config

restartPolicy: OnFailure

volumes:

- name: snapshot

persistentVolumeClaim:

claimName: cron-nas

- name: lt-config

hostPath:

path: /etc/localtime

- name: tz-config

hostPath:

path: /etc/timezone

hostNetwork: true