@@ -19,28 +19,38 @@ This procedure requires API downtime.
1919+
2020[source,terminal]
2121----
22- $ oc patch -n clusters hostedclusters/<hosted _cluster_name > -p '{"spec":{"pausedUntil":"true"}}' -- type=merge
22+ $ oc patch -n clusters hostedclusters/<hosted _cluster_name > \
23+ -p '{"spec":{"pausedUntil":"true"}}' -- type=merge
2324----
2425
2526. Stop all etcd-writer deployments by entering the following command:
2627+
2728[source,terminal]
2829----
29- $ oc scale deployment -n <hosted _cluster_namespace > -- replicas=0 kube-apiserver openshift-apiserver openshift-oauth-apiserver
30+ $ oc scale deployment -n <hosted _cluster_namespace > -- replicas=0 \
31+ kube-apiserver openshift-apiserver openshift-oauth-apiserver
3032----
3133
3234. To take an etcd snapshot, use the `exec` command in each etcd container by entering the following command:
3335+
3436[source,terminal]
3537----
36- $ oc exec -it <etcd _pod_name > -n <hosted _cluster_namespace > -- env ETCDCTL_API=3 /usr/bin/etcdctl -- cacert /etc/etcd/tls/etcd-ca/ca.crt -- cert /etc/etcd/tls/client/etcd-client.crt -- key /etc/etcd/tls/client/etcd-client.key -- endpoints=localhost:2379 snapshot save /var/lib/data/snapshot.db
38+ $ oc exec -it <etcd _pod_name > -n <hosted _cluster_namespace > -- \
39+ env ETCDCTL_API=3 /usr/bin/etcdctl \
40+ -- cacert /etc/etcd/tls/etcd-ca/ca.crt \
41+ -- cert /etc/etcd/tls/client/etcd-client.crt \
42+ -- key /etc/etcd/tls/client/etcd-client.key \
43+ -- endpoints=localhost:2379 \
44+ snapshot save /var/lib/data/snapshot.db
3745----
3846
3947. To check the snapshot status, use the `exec` command in each etcd container by running the following command:
4048+
4149[source,terminal]
4250----
43- $ oc exec -it <etcd _pod_name > -n <hosted _cluster_namespace > -- env ETCDCTL_API=3 /usr/bin/etcdctl -w table snapshot status /var/lib/data/snapshot.db
51+ $ oc exec -it <etcd _pod_name > -n <hosted _cluster_namespace > -- \
52+ env ETCDCTL_API=3 /usr/bin/etcdctl -w table snapshot status \
53+ /var/lib/data/snapshot.db
4454----
4555
4656. Copy the snapshot data to a location where you can retrieve it later, such as an S3 bucket. See the following example.
@@ -78,15 +88,17 @@ oc exec -it etcd-0 -n ${HOSTED_CLUSTER_NAMESPACE} -- curl -X PUT -T "/var/lib/da
7888+
7989[source,terminal]
8090----
81- $ oc get hostedcluster <hosted_cluster_name> -o=jsonpath='{.spec.secretEncryption.aescbc}'
91+ $ oc get hostedcluster <hosted_cluster_name> \
92+ -o=jsonpath='{.spec.secretEncryption.aescbc}'
8293{"activeKey":{"name":"<hosted_cluster_name>-etcd-encryption-key"}}
8394----
8495
8596.. Save the secret encryption key by entering the following command:
8697+
8798[source,terminal]
8899----
89- $ oc get secret <hosted_cluster_name>-etcd-encryption-key -o=jsonpath='{.data.key}'
100+ $ oc get secret <hosted_cluster_name>-etcd-encryption-key \
101+ -o=jsonpath='{.data.key}'
90102----
91103+
92104 You can decrypt this key when restoring a snapshot on a new cluster.
@@ -95,14 +107,16 @@ You can decrypt this key when restoring a snapshot on a new cluster.
95107+
96108[source,terminal]
97109----
98- $ oc scale deployment -n <control _plane_namespace > -- replicas=3 kube-apiserver openshift-apiserver openshift-oauth-apiserver
110+ $ oc scale deployment -n <control _plane_namespace > -- replicas=3 \
111+ kube-apiserver openshift-apiserver openshift-oauth-apiserver
99112----
100113
101114. Resume the reconciliation of the hosted cluster by entering the following command:
102115+
103116[source,terminal]
104117----
105- $ oc patch -n <hosted _cluster_namespace > -p '[\{"op": "remove", "path": "/spec/pausedUntil"}]' -- type=json
118+ $ oc patch -n <hosted _cluster_namespace > \
119+ -p '[\{"op": "remove", "path": "/spec/pausedUntil"}]' -- type=json
106120----
107121
108122.Next steps
0 commit comments