kubeneters发生故障时候对etcd进行灾难备份恢复

最新推荐文章于 2025-10-06 06:11:16 发布

原创最新推荐文章于 2025-10-06 06:11:16 发布 · 378 阅读

0 ·

CC 4.0 BY-SA版权

服务器运维同时被 2 个专栏收录

61 篇文章

订阅专栏

容器技术(depops)

34 篇文章

订阅专栏

本文详细介绍了一种针对Kubernetes集群的灾难恢复方案，通过设置定时任务进行数据备份，确保在发生故障时能够快速恢复。文章提供了具体的CronJob配置样例，包括定时任务格式、权限调整等关键步骤。

参考文章 The Ultimate Guide to Disaster Recovery for Your Kubernetes Clusters https://medium.com/velotio-perspectives/the-ultimate-guide-to-disaster-recovery-for-your-kubernetes-clusters-94143fcc8c1e

定时任务格式参考 https://kubernetes.io/zh/docs/concepts/workloads/controllers/cron-jobs/

apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: backup
  namespace: kube-system
spec:
# activeDeadlineSeconds: 100
 schedule: "* * */1 * *"
 jobTemplate:
  spec:
   template:
    spec:
     containers:
     - name: backup
      # Same image as in /etc/kubernetes/manifests/etcd.yaml
       image: docker.io/bitnami/etcd:3.4.7
       env:
       - name: ETCDCTL_API
         value: "3"
       command: ["/bin/sh"]
       args: ["-c", "etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key snapshot save /backup/etcd-snapshot-$(date +%Y-%m-%d_%H:%M:%S_%Z).db"]
       volumeMounts:
       - name: etcd-certs
         mountPath: /etc/kubernetes/pki/etcd
         readOnly: true
       - name: backup
         mountPath: /backup
       restartPolicy: OnFailure
       hostNetwork: true
       # run only in the master onde.
       nodeSelector:
        node-role.kubernetes.io/master: ""
       tolerations:
       - key: "node-role.kubernetes.io/master"
         effect: "NoSchedule"
       volumes:
       - name: etcd-certs
         hostPath:
          path: /etc/kubernetes/pki/etcd
          type: DirectoryOrCreate
       - name: backup
         hostPath:
          path: /data/backup
          type: DirectoryOrCreate

当前使用会遇到open /etc/kubernetes/ permission denied，这是因为文件权限的。当前是root，而使用的bitnami镜像是用1001账户权限，所以这里要处理使宿主机所属用户组和容器一样。在yaml文件里面添加

       securityContext:
        runAsUser: 0 (root)
        runAsGroup: 0 (root)