ACCESS TO IT INTEL GRANTED

Hot Backup etcd with Snapshot Save and Integrity Verification

TARGET_ENV: etcdctl v3.5+ on Ubuntu 22.04, Debian 12, RHEL 9
[ TAGS: etcd, snippet, backup, snapshot, disaster-recovery, encryption ]

The snapshot save command streams a consistent point-in-time copy of the etcd keyspace and metadata directly from a live member. Internally, etcd performs an MVCC read transaction at the current revision and serializes the backend to a snapshot file that includes WAL state, cluster membership, and key-values. Because it uses a consistent read, the snapshot is safe to take on a running cluster without stopping services, though it does impose read load and I/O.

In production, this is the standard mechanism for daily backups of Kubernetes control plane state (all Secrets, ConfigMaps, RBAC, CRDs). Use it before cluster upgrades (kubeadm upgrade), before destructive operations, and as part of disaster recovery drills. Store snapshots off-node in object storage, and always run snapshot status to verify the hash and integrity before trusting the file.

Security: the snapshot contains every secret in the cluster, including ServiceAccount tokens and TLS private keys. Encrypt the snapshot at rest (gpg, age, or KMS) and restrict S3 bucket ACLs. Performance pitfalls: snapshotting a 4GB backend on a busy cluster can take 30+ seconds and consume significant I/O; schedule during maintenance windows. Common pitfall: storing snapshots on the same disk as the etcd data-dir, which defeats recovery if the disk fails. Also verify etcd version compatibility before restoring across minor versions.

> System.Execute()

export ETCDCTL_API=3
export ETCDCTL_CACERT=/etc/etcd/ca.crt
export ETCDCTL_CERT=/etc/etcd/client.crt
export ETCDCTL_KEY=/etc/etcd/client.key

TS=$(date +%Y%m%d-%H%M%S)
SNAP=/var/backups/etcd/snapshot-$TS.db
mkdir -p /var/backups/etcd

etcdctl --endpoints=https://10.0.0.11:2379 snapshot save "$SNAP"
etcdctl --write-out=table snapshot status "$SNAP"

# Encrypt and ship off-node
age -r age1xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -o "$SNAP.age" "$SNAP" && rm -f "$SNAP"
aws s3 cp "$SNAP.age" s3://prod-etcd-backups/ --sse aws:kms

# Retention: keep 7 days locally
find /var/backups/etcd -name 'snapshot-*.db.age' -mtime +7 -delete

> Architecture & Security Context

Verified for Valters IT Hub. When deploying this configuration in a production homelab or enterprise environment, ensure that you monitor system resources and implement strict access controls. Administrator privileges are required.

ID: VALTERSIT-BC3975FF4551

← BACK_TO_VAULT → CVE_DATABASE