Backup and Restore

Everything Kubernetes knows, every deployment, every secret, every setting, lives in et see dee. If it is lost, and you have no backup, the cluster forgets everything. Backups are the most important operational habit. In this lesson, we take a real snapshot, and discuss what to back up.

• etcd holds all cluster state
• Lose it, lose the cluster
• Snapshots are the safety net

What to back up

There are three things to protect. First, et see dee, which holds the state of the cluster. Second, the persistent volumes, which hold your application data. Et see dee does not contain the contents of your volumes. And third, your manifests, in Git, which can rebuild everything else. Tools like Velero back up both the objects, and the volumes. Remember, a backup you have never restored, is only a hope. Practise restoring.

The snapshot command

Here is the command that takes an et see dee snapshot. We run the et see dee control tool, inside the et see dee pod. It needs to prove who it is, so we pass the certificate authority, the client certificate, and the key. The last part says, snapshot save, and a file name. On a self managed cluster, you would run this regularly, copy the file off the machine, and keep several generations.

kubectl -n kube-system exec etcd-k8s -- etcdctl \
  --cacert=/var/lib/minikube/certs/etcd/ca.crt \
  --cert=/var/lib/minikube/certs/etcd/server.crt \
  --key=/var/lib/minikube/certs/etcd/server.key \
  snapshot save /tmp/backup.db

Taking a snapshot

Now we run it. First a health check, to confirm that et see dee is well. It answers, healthy, and how long a test write took. Then the snapshot is saved. That single file contains the complete state of the cluster at that moment. To recover, you stop the control plane, restore the snapshot into a new data folder, and start again. It is rare, but the day you need it, you will be very glad.

kubectl -n kube-system exec etcd-k8s -- etcdctl <certificate flags> endpoint health
127.0.0.1:2379 is healthy: successfully committed proposal: took = 7.42075ms
kubectl -n kube-system exec etcd-k8s -- etcdctl <certificate flags> snapshot save /tmp/backup.db
{"level":"info","ts":"2026-10-30T20:56:04.425767Z","caller":"snapshot/v3_snapshot.go:121","msg":"saved","path":"/tmp/backup.db"}

Summary