kubernetes集群ETCD数据备份与恢复实践

Posted 2022-07-11 mb6020154eb4caa

1、备份有证书etcd集群数据

# 首次备份，在master01节点将etcdctl工具从容器拷到master节点
docker cp <etcd containerid>:/usr/local/bin/etcdctl /usr/bin/
# etcd containerid可通过命令(docker ps | grep etcd)查询获得，拷贝成功后，授执行权限chmod +x /usr/bin/etcdctl
# 在master01节点执行备份数据命令
ETCDCTL_API=3 etcdctl --endpoints=https://0.0.0.0:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key snapshot save "snapshot-etcd-$(date +%Y%m%d).db"
# 查看已备份数据
ETCDCTL_API=3 etcdctl --write-out=table snapshot status "snapshot-etcd-$(date +%Y%m%d).db"

2、备份无证书etcd集群数据

# 首次备份，在master01节点将etcdctl工具从容器拷到master节点
docker cp <etcd containerid>:/usr/local/bin/etcdctl /usr/bin/
# etcd containerid可通过命令(docker ps | grep etcd)查询获得，拷贝成功后，授执行权限chmod +x /usr/bin/etcdctl
# 在master01节点执行备份数据命令
ETCDCTL_API=3 etcdctl --endpoints=http://0.0.0.0:2379 snapshot save "snapshot-etcd-$(date +%Y%m%d).db"
# 查看已备份数据
ETCDCTL_API=3 etcdctl --write-out=table snapshot status "snapshot-etcd-$(date +%Y%m%d).db"

3、恢复数据到单机ETCD容器

1、申请获得服务器资源，服务器已安装配置好docker服务
etcd：192.168.1.10
2、将备份数据snapshot-etcd-20220619.db上传到服务器/root目录下
3、开放端口 如果执行命令提示防火墙没运行，请启动防火墙再执行命令
firewall-cmd --get-active-zones
firewall-cmd --list-port
firewall-cmd --zone=public --permanent --add-port=2379/tcp --add-port=2380/tcp
firewall-cmd --reload
firewall-cmd --list-port

4、恢复etcd数据步骤
# 启动etcd容器
docker run --restart=always --net host -it --name etcd -d \\
-v /var/lib/etcd:/etcd-data \\
-v /etc/localtime:/etc/localtime \\
-e ETCDCTL_API=3 \\
registry.aliyuncs.com/google_containers/etcd:3.5.1-0 \\
/usr/local/bin/etcd \\
--data-dir=/etcd-data --name etcd1 \\
--auto-compaction-retention=1 --max-request-bytes=33554432 --quota-backend-bytes=8589934592 \\
--advertise-client-urls http://0.0.0.0:2379 \\
--listen-client-urls http://0.0.0.0:2379 

# 停止etcd容器
docker stop <containerid>
# 删除数据目录
rm -rf /var/lib/etcd
# 恢复数据
# 在etcd1宿主机执行恢复命令
ETCDCTL_API=3 etcdctl snapshot restore snapshot-etcd-20220619.db --data-dir=/var/lib/etcd --name etcd1 

5、验证etcd数据
# 启动etcd容器
docker start etcd1
# 确认etcd容器运行正常
docker ps 
docker logs -f --tail=200 <containerid>
# 进入容器
docker exec -it etcd1 sh
# 设置etcdctl为v3版本
export ETCDCTL_API=3
etcdctl get --prefix --keys-only=true /   # 查看所有key
注：由于etcd容器没有启用证书，进入容器后可直接使用etcdctl命令查看数据
# 数据维护参考命令
etcdctl put /learn data11
etcdctl get /learn 
etcdctl del /learn

4、恢复数据到无证书ETCD集群

1、申请获得服务器资源，每台服务器已安装配置好docker服务
etcd1：192.168.1.10
etcd2：192.168.1.11
etcd3：192.168.1.12
2、将备份数据snapshot-etcd-20220619.db上传到三台服务器/root目录下
3、开放端口 如果执行命令提示防火墙没运行，请启动防火墙再执行命令
firewall-cmd --get-active-zones
firewall-cmd --list-port
firewall-cmd --zone=public --permanent --add-port=2379/tcp --add-port=2380/tcp
firewall-cmd --reload
firewall-cmd --list-port

4、恢复etcd集群数据步骤
# 启动etcd1容器
docker run --restart=always --net host -it --name etcd1 -d \\
-v /var/lib/etcd:/etcd-data \\
-v /etc/localtime:/etc/localtime \\
-e ETCDCTL_API=3 \\
registry.aliyuncs.com/google_containers/etcd:3.5.1-0 \\
/usr/local/bin/etcd \\
--data-dir=/etcd-data --name etcd1 \\
--auto-compaction-retention=1 --max-request-bytes=33554432 --quota-backend-bytes=8589934592 \\
--listen-peer-urls http://0.0.0.0:2380 \\
--initial-advertise-peer-urls http://192.168.1.10:2380 \\
--advertise-client-urls http://0.0.0.0:2379 \\
--listen-client-urls http://0.0.0.0:2379 \\
-initial-cluster-state existing \\
-initial-cluster-token etcd-cluster \\
-initial-cluster "etcd1=http://192.168.1.10:2380,etcd2=http://192.168.1.11:2380,etcd3=http://192.168.1.12:2380"

# 停止etcd1容器
docker stop etcd1
# 删除数据目录
rm -rf /var/lib/etcd
# 恢复数据
# 在etcd1宿主机执行恢复命令
ETCDCTL_API=3 etcdctl snapshot restore snapshot-etcd-20220619.db --data-dir=/var/lib/etcd \\
--name etcd1 \\
--initial-cluster etcd1=http://192.168.1.10:2380,etcd2=http://192.168.1.11:2380,etcd3=http://192.168.1.12:2380 \\
--initial-cluster-token etcd-cluster \\
--initial-advertise-peer-urls http://192.168.1.10:2380

5、恢复etcd2集群节点
# 启动etcd2容器
docker run --restart=always --net host -it --name etcd2 -d \\
-v /var/lib/etcd:/etcd-data \\
-v /etc/localtime:/etc/localtime \\
-e ETCDCTL_API=3 \\
registry.aliyuncs.com/google_containers/etcd:3.5.1-0 \\
/usr/local/bin/etcd \\
--data-dir=/etcd-data --name etcd2 \\
--auto-compaction-retention=1 --max-request-bytes=33554432 --quota-backend-bytes=8589934592 \\
--listen-peer-urls http://0.0.0.0:2380 \\
--initial-advertise-peer-urls http://192.168.1.11:2380 \\
--advertise-client-urls http://0.0.0.0:2379 \\
--listen-client-urls http://0.0.0.0:2379 \\
-initial-cluster-state existing \\
-initial-cluster-token etcd-cluster \\
-initial-cluster "etcd1=http://192.168.1.10:2380,etcd2=http://192.168.1.11:2380,etcd3=http://192.168.1.12:2380"

# 停止etcd2容器
docker stop etcd2
# 删除数据目录
rm -rf /var/lib/etcd
# 恢复数据
# 在etcd2宿主机执行恢复命令
ETCDCTL_API=3 etcdctl snapshot restore snapshot-etcd-20220619.db --data-dir=/var/lib/etcd \\
--name etcd2 \\
--initial-cluster etcd1=http://192.168.1.10:2380,etcd2=http://192.168.1.11:2380,etcd3=http://192.168.1.12:2380 \\
--initial-cluster-token etcd-cluster \\
--initial-advertise-peer-urls http://192.168.1.11:2380

6、恢复etcd3集群节点
# 启动etcd3容器
docker run --restart=always --net host -it --name etcd3 -d \\
-v /var/lib/etcd:/etcd-data \\
-v /etc/localtime:/etc/localtime \\
-e ETCDCTL_API=3 \\
registry.aliyuncs.com/google_containers/etcd:3.5.1-0 \\
/usr/local/bin/etcd \\
--data-dir=/etcd-data --name etcd3 \\
--auto-compaction-retention=1 --max-request-bytes=33554432 --quota-backend-bytes=8589934592 \\
--listen-peer-urls http://0.0.0.0:2380 \\
--initial-advertise-peer-urls http://192.168.1.12:2380 \\
--advertise-client-urls http://0.0.0.0:2379 \\
--listen-client-urls http://0.0.0.0:2379 \\
-initial-cluster-state existing \\
-initial-cluster-token etcd-cluster \\
-initial-cluster "etcd1=http://192.168.1.10:2380,etcd2=http://192.168.1.11:2380,etcd3=http://192.168.1.12:2380"

# 停止etcd3容器
docker stop etcd3
# 删除数据目录
rm -rf /var/lib/etcd
# 恢复数据
# 在etcd3宿主机执行恢复命令
ETCDCTL_API=3 etcdctl snapshot restore snapshot-etcd-20220619.db --data-dir=/var/lib/etcd \\
--name etcd3 \\
--initial-cluster etcd1=http://192.168.1.10:2380,etcd2=http://192.168.1.11:2380,etcd3=http://192.168.1.12:2380 \\
--initial-cluster-token etcd-cluster \\
--initial-advertise-peer-urls http://192.168.1.12:2380

7、验证etcd集群
# 同时启动三个节点etcd容器，执行以下命令
docker ps -a | grep etcd | cut -d  -f 1 | xargs -n 1 docker start
# 确认三个节点etcd容器运行正常
docker ps 
docker logs -f --tail=200 <containerid>
# 进入容器
docker exec -it etcd1 sh
# 设置etcdctl为v3版本
export ETCDCTL_API=3
etcdctl get --prefix --keys-only=true /   # 查看所有key
注：由于集群没有启用证书，进入容器后可直接使用etcdctl命令查看集群数据
# 查看集群
etcdctl member list
etcdctl endpoint health
etcdctl endpoint status 
# 数据维护参考命令
etcdctl put /learn data22
etcdctl get /learn 
etcdctl del /learn

5、同理恢复数据到有证书ETCD集群

6、更多k8s学习资料

​​1、kubernetes原理精讲【基础原理+实践篇】​​

​​2、kubernetes原理精讲【自签证书原理+实践篇】​​