CKA etcd Backup & Restore Cheat Sheet

Context: kubeadm-managed cluster, etcd as a static pod on the control plane node, using etcdctl v3.

1. Exact etcd Backup Command

Run this on the control plane node (usually via SSH):

sudo ETCDCTL_API=3 etcdctl \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key \
  snapshot save /tmp/etcd-snapshot.db

Remember:

ETCDCTL_API=3 is required for snapshot commands.
Paths under /etc/kubernetes/pki/etcd/ are standard for kubeadm.
You can change /tmp/etcd-snapshot.db to any writable path.

2. Exact etcd Restore Command

Restore the snapshot into a fresh data directory:

sudo ETCDCTL_API=3 etcdctl snapshot restore /tmp/etcd-snapshot.db \
  --data-dir=/var/lib/etcd

Important: The restore command alone is not enough in a kubeadm cluster. You must also perform the steps below.

3. Required Post-Restore Steps (kubeadm static pod)

Step 1 — Move old etcd data

sudo mv /var/lib/etcd /var/lib/etcd.broken.$(date +%s)

Step 2 — Fix ownership

sudo chown -R etcd:etcd /var/lib/etcd

Step 3 — Restart kubelet (restarts etcd static pod)

sudo systemctl restart kubelet

Step 4 — Verify etcd health

sudo ETCDCTL_API=3 etcdctl \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key \
  endpoint health

Exam tip: After a successful restore, also verify the cluster:

kubectl get nodes
kubectl get pods -A

4. Quick Memory Hooks

Backup: snapshot save with TLS flags and ETCDCTL_API=3.
Restore: snapshot restore into /var/lib/etcd.
Always: move old data, fix ownership, restart kubelet, check endpoint health.

janelle vos 3:53 PM (2 minutes ago) to me


ETCD backup / restore


Where?
Who trusts?
Who am I?
What's my key?



--endpoints=
--cacert=
--cert=
--key=


E C C K


Endpoint
 CA Cert
 Client Cert
 Key

My Exam Shortcut

I would memorize only:

etcdctl snapshot save backup.db


sudo cat /etc/kubernetes/manifests/etcd.yaml


and literally copy/paste these:


--trusted-ca-file=
--cert-file=
--key-file=

INTO:

--cacert=
--cert=
--key=

So the mental process becomes:

SAVE
|
Find certs
|
Copy paths




ETCD

backup:
snapshot save

restore:
snapshot restore

certs:
ca.crt
server.crt
server.key

ECCK
Endpoint
CA
Cert
Key