ETCD Backup and Restore | CKA Question 9

In this video, I am going to show you how to take an ETCD backup and then restore it back to the Kubernetes cluster again. It is a very high weightage question in the CKA exam

[@ritikamalhotra5915]

This is the best video that I have watched for Backup and Restore of ETCD Cluster. It works like a charm. Thank you!

[@InfiniteLinux]

Thank you Ritika, glad you liked it :)

[@akhilagarwal-wj3pk]

Thank you so much for this series

[@InfiniteLinux]

Welcome :)

[@akhilagarwal-wj3pk]

Hello sir today I had given CKA exam...😢but their were lot of issues like it was lagging very much i was not able to finish it . I got a question to create a network policy for the pod in a namespace to access another pods in another namespace on port 8443 ...but when i checked the pods their were no labels..

[@akhilagarwal-wj3pk]

Could you please tell me how can we do that?

[@InfiniteLinux]

@@akhilagarwal-wj3pk when you dont have lables on the pods and you need to provide access across namespaces, then you can allow for the whole namespace - the example is there in the documentation itself - kubernetes.io/docs/concepts/services-networking/network-policies/

[@abilalzengin5269]

Thank you so much

[@InfiniteLinux]

Welcome brother!!

[@raghunath8692]

Thank you for the video. I attempted CKA once, but of no luck to clear. I had etcd backup as well as restore question. In the question, they mentioned the cert and key file paths (They were under /opt/....). So, i just need to make use of them, right. In addition, I couldnt locate the restore filepath (similar to /var/lib/etcd) and hence I couldn't restore etcd at all. Could you please suggest here.

[@InfiniteLinux]

yes, if they have given the path for cert and key, use them. Since they did not give you the data directory, just use the same directory as before, or create a path of your own, that does not matter.

[@raghunath8692]

@@InfiniteLinux Thank you for the reply.

[@ahmedmasood1343]

Thank you so much for the video brother, very helpful and informative, just wondering, why do you not specify endpoints in the the snapshot save command and only on the snapshot restore?

[@InfiniteLinux]

Good question - so snapshot save command assume that you are backing up a local etcd cluster - in case you are not, I think you would have to pass the endpoint parameter even while taking the backup and same thing goes for the restore process as well

[@yeshuize]

Hi i didnot see any modification in hostpath /var/lib/etcd-backup in etcd.yaml file is that ok for restore , you just restoered to / location var/lib/ but you need to update in yaml file right

[@InfiniteLinux]

Since I used the same data directory, I didn't need to update the yaml

[@joeharyar9873]

Hi..thanks for the sharing info...if I have 3 etcd ...should I add 3 etcd IP at the endpoint parameter? Please advise. Thank you.

[@InfiniteLinux]

yes, you can add comma separated entries

[@joeharyar9873]

noted with thanks@@InfiniteLinux

[@sajjadanwer4703]

I have question, I gave first attempt last year unfortunately wasn't clear. The question I got too in Exam however they provide the --data-dir path and backup to restore not the same as backup. In that what we have to do? I didn't restore etcd snapshot from the given data-dir. Should I changed the path in ETCD.yaml file if Yes, then which locations the path would be change.

[@InfiniteLinux]

sorry I didn't understand the question but I think you are saying that they gave you a backup and a data dir right. So yes, you would have to modify the data dir in etcd.yaml file and while using etcdctl restore command you would have to use the backup they have provided

[@sajjadanwer4703]

@InfiniteLinux Thank you for your replay. Apologize for the inconvenience. Yes they have given the path and having a backup in it for the restoration. Now as in video you have run the command rm -rf /data-dir-path. If we do the same thing in exam the backup will be removed right. Just confirm we need to follow 2 steps. 1) Update the data-dir path according to given one in etcd.yaml file. 2) Move the backup to any location before running that rm -rf command. Then, restore it finally. Am I correct?

[@InfiniteLinux]

@@sajjadanwer4703 data-dir is basically where etcd stores its data and backup you can take at any location using the etcdctl snapshot command

[@user-el6kt1ek4l]

Hi if i did all other questions and something got wrong when i did the restore at the last will it cause me to fail with all other questions wrong

[@InfiniteLinux]

for that particular cluster - yes

[@nithinjohn135]

Also will the question ask to do it on base node and then SCP to master node , also what to do when that command is not installed

[@InfiniteLinux]

@@nithinjohn135 so you will have access to a workstation node, from which you can ssh onto any node (master or worker) using the ssh command - I don't think there would be a scenario where a command you want is not present

[@Techtips200]

A big fan since the linux boot process video ,you posted long back.... any chance of getting a K8 series

[@InfiniteLinux]

what do you want me to cover in that series, im not doing kubernetes because every tom dick and harry is creating content on it :)

[@sameerhamid453]

Do we need to ssh to node or we are doing this from local computer.

[@InfiniteLinux]

For etcd backup and store - you need to ssh on to the kubernetes master node

[@sameerhamid453]

@InfiniteLinux if i need to ssh node.. the. Do I still need to use endpoint. Thanks for replying... Somewhere i saw in question mentioned there was no need to change any context configuration and and need to exit from master node.

[@InfiniteLinux]

@@sameerhamid453 endpoint is basically a way of telling where the etcd cluster is running, in this case we were running it locally, so I think even if you don't give the endpoint, that should work but in actual system, etcd is mostly run outside the cluster so you need to tell etcdctl about the endpoint

[@flesz_]

restore command in the documentation doesn't specify all the details for cert names etc It says ETCDCTL_API=3 etcdctl snapshot restore --data-dir snapshotdb So that should be sufficient

[@InfiniteLinux]

Nope, because you need to authenticate with ETCD cluster, that command would work if there is no authentication required.

[@flesz_]

@@InfiniteLinux ah , makes sense. Thanks

[@flesz_]

@@InfiniteLinux actually I found another answer to that question. So it appears it is not necessary to use certificates for restore as it doesn't connect to the etcd server Note that for restore on single etcd node clusters such as those found in the exam, it is not necessary to use the certificate arguments, since all the restore is doing is creating a directory. It does not need to communicate with the etcd server - which may even not be running if the exam deliberately sets it up with a corrupt database. You would only use certs and some additional arguments when restoring a broken node into what is left of a multi-node etcd, which is beyond the scope of CKA.

[@user-ec1iv4vd7l]

In the exam when you get the restore question, you also have to modify etcd manifest for it to read from the restored backup location? or just restore to a specific dir will suffice?

[@InfiniteLinux]

yes, you have to modify the etcd manifest as well