@@ -15,9 +15,9 @@ weight: 270
15
15
## {{% heading "prerequisites" %}}
16
16
17
17
You need to have a Kubernetes cluster, and the kubectl command-line tool must
18
- be configured to communicate with your cluster. It is recommended to run this
19
- task on a cluster with at least two nodes that are not acting as control plane
20
- nodes . If you do not already have a cluster, you can create one by using
18
+ be configured to communicate with your cluster. It is recommended to follow this
19
+ guide on a cluster with at least two nodes that are not acting as control plane
20
+ nodes. If you do not already have a cluster, you can create one by using
21
21
[ minikube] ( https://minikube.sigs.k8s.io/docs/tutorials/multi_node/ ) .
22
22
23
23
<!-- steps -->
@@ -57,7 +57,7 @@ This section covers starting a single-node and multi-node etcd cluster.
57
57
58
58
### Single-node etcd cluster
59
59
60
- Use a single-node etcd cluster only for testing purpose .
60
+ Use a single-node etcd cluster only for testing purposes .
61
61
62
62
1 . Run the following:
63
63
@@ -144,8 +144,8 @@ ETCDCTL_API=3 etcdctl --endpoints 10.2.0.9:2379 \
144
144
145
145
### Limiting access of etcd clusters
146
146
147
- After configuring secure communication, restrict the access of etcd cluster to
148
- only the Kubernetes API servers. Use TLS authentication to do so .
147
+ After configuring secure communication, restrict the access of the etcd cluster to
148
+ only the Kubernetes API servers using TLS authentication.
149
149
150
150
For example, consider key pairs ` k8sclient.key ` and ` k8sclient.cert ` that are
151
151
trusted by the CA ` etcd.ca ` . When etcd is configured with ` --client-cert-auth `
@@ -160,9 +160,7 @@ flags `--etcd-certfile=k8sclient.cert`, `--etcd-keyfile=k8sclient.key` and
160
160
` --etcd-cafile=ca.cert ` .
161
161
162
162
{{< note >}}
163
- etcd authentication is not currently supported by Kubernetes. For more
164
- information, see the related issue
165
- [ Support Basic Auth for Etcd v2] ( https://github.com/kubernetes/kubernetes/issues/23398 ) .
163
+ etcd authentication is not planned for Kubernetes.
166
164
{{< /note >}}
167
165
168
166
## Replacing a failed etcd member
@@ -203,9 +201,9 @@ replace it with `member4=http://10.0.0.4`.
203
201
etcd.
204
202
205
203
1 . Stop the etcd server on the broken node. It is possible that other
206
- clients besides the Kubernetes API server is causing traffic to etcd
204
+ clients besides the Kubernetes API server are causing traffic to etcd
207
205
and it is desirable to stop all traffic to prevent writes to the data
208
- dir .
206
+ directory .
209
207
210
208
1 . Remove the failed member:
211
209
@@ -256,25 +254,25 @@ For more information on cluster reconfiguration, see
256
254
257
255
## Backing up an etcd cluster
258
256
259
- All Kubernetes objects are stored on etcd. Periodically backing up the etcd
257
+ All Kubernetes objects are stored in etcd. Periodically backing up the etcd
260
258
cluster data is important to recover Kubernetes clusters under disaster
261
259
scenarios, such as losing all control plane nodes. The snapshot file contains
262
- all the Kubernetes states and critical information. In order to keep the
260
+ all the Kubernetes state and critical information. In order to keep the
263
261
sensitive Kubernetes data safe, encrypt the snapshot files.
264
262
265
263
Backing up an etcd cluster can be accomplished in two ways: etcd built-in
266
264
snapshot and volume snapshot.
267
265
268
266
### Built-in snapshot
269
267
270
- etcd supports built-in snapshot. A snapshot may either be taken from a live
268
+ etcd supports built-in snapshot. A snapshot may either be created from a live
271
269
member with the ` etcdctl snapshot save ` command or by copying the
272
270
` member/snap/db ` file from an etcd
273
271
[ data directory] ( https://etcd.io/docs/current/op-guide/configuration/#--data-dir )
274
- that is not currently used by an etcd process. Taking the snapshot will
272
+ that is not currently used by an etcd process. Creating the snapshot will
275
273
not affect the performance of the member.
276
274
277
- Below is an example for taking a snapshot of the keyspace served by
275
+ Below is an example for creating a snapshot of the keyspace served by
278
276
` $ENDPOINT ` to the file ` snapshot.db ` :
279
277
280
278
``` shell
@@ -298,19 +296,19 @@ ETCDCTL_API=3 etcdctl --write-out=table snapshot status snapshot.db
298
296
### Volume snapshot
299
297
300
298
If etcd is running on a storage volume that supports backup, such as Amazon
301
- Elastic Block Store, back up etcd data by taking a snapshot of the storage
299
+ Elastic Block Store, back up etcd data by creating a snapshot of the storage
302
300
volume.
303
301
304
302
### Snapshot using etcdctl options
305
303
306
- We can also take the snapshot using various options given by etcdctl. For example
304
+ We can also create the snapshot using various options given by etcdctl. For example:
307
305
308
306
``` shell
309
307
ETCDCTL_API=3 etcdctl -h
310
308
```
311
309
312
- will list various options available from etcdctl. For example, you can take a snapshot by specifying
313
- the endpoint, certificates etc as shown below:
310
+ will list various options available from etcdctl. For example, you can create a snapshot by specifying
311
+ the endpoint, certificates and key as shown below:
314
312
315
313
``` shell
316
314
ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 \
@@ -324,7 +322,7 @@ where `trusted-ca-file`, `cert-file` and `key-file` can be obtained from the des
324
322
Scaling out etcd clusters increases availability by trading off performance.
325
323
Scaling does not increase cluster performance nor capability. A general rule
326
324
is not to scale out or in etcd clusters. Do not configure any auto scaling
327
- groups for etcd clusters. It is highly recommended to always run a static
325
+ groups for etcd clusters. It is strongly recommended to always run a static
328
326
five-member etcd cluster for production Kubernetes clusters at any officially
329
327
supported scale.
330
328
@@ -337,7 +335,7 @@ for information on how to add members into an existing cluster.
337
335
338
336
etcd supports restoring from snapshots that are taken from an etcd process of
339
337
the [ major.minor] ( http://semver.org/ ) version. Restoring a version from a
340
- different patch version of etcd also is supported. A restore operation is
338
+ different patch version of etcd is also supported. A restore operation is
341
339
employed to recover the data of a failed cluster.
342
340
343
341
Before starting the restore operation, a snapshot file must be present. It can
@@ -358,12 +356,12 @@ export ETCDCTL_API=3
358
356
etcdctl --data-dir < data-dir-location> snapshot restore snapshot.db
359
357
```
360
358
361
- If ` <data-dir-location> ` is the same folder as before, delete it and stop etcd process before restoring the cluster. Else change etcd configuration and restart the etcd process after restoration to make it use the new data directory.
359
+ If ` <data-dir-location> ` is the same folder as before, delete it and stop the etcd process before restoring the cluster. Otherwise, change etcd configuration and restart the etcd process after restoration to have it use the new data directory.
362
360
363
361
For more information and examples on restoring a cluster from a snapshot file, see
364
362
[ etcd disaster recovery documentation] ( https://etcd.io/docs/current/op-guide/recovery/#restoring-a-cluster ) .
365
363
366
- If the access URLs of the restored cluster is changed from the previous
364
+ If the access URLs of the restored cluster are changed from the previous
367
365
cluster, the Kubernetes API server must be reconfigured accordingly. In this
368
366
case, restart Kubernetes API servers with the flag
369
367
` --etcd-servers=$NEW_ETCD_CLUSTER ` instead of the flag
@@ -408,9 +406,9 @@ For more details on etcd maintenance, please refer to the [etcd maintenance](htt
408
406
{{% thirdparty-content single="true" %}}
409
407
410
408
{{< note >}}
411
- Defragmentation is an expensive operation, so it should be executed as infrequent
409
+ Defragmentation is an expensive operation, so it should be executed as infrequently
412
410
as possible. On the other hand, it's also necessary to make sure any etcd member
413
- will not run out of the storage quota. The Kubernetes project recommends that when
411
+ will not exceed the storage quota. The Kubernetes project recommends that when
414
412
you perform defragmentation, you use a tool such as [ etcd-defrag] ( https://github.com/ahrtr/etcd-defrag ) .
415
413
416
414
You can also run the defragmentation tool as a Kubernetes CronJob, to make sure that
0 commit comments