一, 备份ETCD#

1 备份脚本#

1
cat /data/etcd_backup_dir/etcd_backup.sh
2
#!/bin/bash
3
date;
4
CACERT="/etc/ssl/etcd/ssl/ca.pem"
5
CERT="/etc/ssl/etcd/ssl/admin-${hostname}.pem" # 证书路径,因为我的文件名里有主机名这里些好吃呢个变量
6
EKY="/etc/ssl/etcd/ssl/admin-${hostname}-key.pem"
7
IP=$(hostname -I | awk '{print $1}')
8
ENDPOINTS="${IP}:2379"
9
ETCDCTL_API=3 etcdctl \
10
--cacert="${CACERT}" --cert="${CERT}" --key="${EKY}" \
11
--endpoints=${ENDPOINTS} \
12
snapshot save /data/etcd_backup_dir/etcd-snapshot-`date +%Y%m%d`.db
13
# 备份到/data/etcd_backup_dir/下
14
# 备份保留30天
15
find /data/etcd_backup_dir/ -name *.db -mtime +30 -exec rm -f {} \;

2 定时任务#

1
crontab -e
2
0 23 * * 6 sh /data/etcd_backup_dir/etcd_backup.sh

二, 使用Velero备份#

[!hint] 主要优势

部分恢复而非全集群恢复

跨集群迁移资源

更灵活的备份策略管理

选择性备份特定资源

Velero包含：在集群上运行的服务器与本地运行的命令行客户端这两部分

1 客户端安装#

选择最新版本下载

1
tar -zxvf velero-v1.16.0-linux-amd64.tar.gz
2
mv velero-v1.16.0-linux-amd64/velero /usr/bin/
3
velero version
4
Client:
5
        Version: v1.16.0
6
        Git commit: 8f31599fe4af5453dee032beaf8a16bd75de91a5
7
<error getting server version: no matches for kind "ServerStatusRequest" in version "velero.io/v1">
8
# 命令补全
9
velero completion bash >/etc/profile.d/velero.sh

2 服务端安装#

2.1 镜像准备#

1
docker pull ccr.ccs.tencentyun.com/ccops/all:velero-v1.16.0
2
docker pull ccr.ccs.tencentyun.com/ccops/all:velero-plugin-for-aws-v1.12.0

2.2 存储准备#

[!attention] 只要是符合s3协议即可,官方带了个minio部署到k8s的yaml 带的这个没做数据持久化,并且还是弱密码,修改下

1
cat velero-v1.16.0-linux-amd64/examples/minio/00-minio-deployment.yaml
2
---
3
apiVersion: v1
4
kind: Namespace
5
metadata:
6
  name: velero
7

8
---
9
apiVersion: apps/v1
10
kind: Deployment
11
metadata:
12
  namespace: velero
13
  name: minio
14
  labels:
15
    component: minio
16
spec:
17
  strategy:
18
    type: Recreate
19
  selector:
20
    matchLabels:
21
      component: minio
22
  template:
23
    metadata:
24
      labels:
25
        component: minio
26
    spec:
27
      nodeSelector:
28
        minio.storage.sys: "yes"
29
      volumes:
30
      - name: storage
31
        hostPath:
32
         path: /data/server/velero-minio/data
33
         type: DirectoryOrCreate
34
      - name: config
35
        hostPath:
36
         path: /data/server/velero-minio/config
37
         type: DirectoryOrCreate
38
      containers:
39
      - name: minio
40
        image: quay.io/minio/minio:latest
41
        imagePullPolicy: IfNotPresent
42
        args:
43
        - server
44
        - /storage
45
        - --config-dir=/config
46
        env:
47
        - name: MINIO_ACCESS_KEY
48
          value: "velero-minio"
49
        - name: MINIO_SECRET_KEY
50
          value: "1qaz@WSX"
51
        ports:
52
        - containerPort: 9000
53
        volumeMounts:
54
        - name: storage
55
          mountPath: "/storage"
56
        - name: config
57
          mountPath: "/config"
58

59
---
60
apiVersion: v1
61
kind: Service
62
metadata:
63
  namespace: velero
64
  name: minio
65
  labels:
66
    component: minio
67
spec:
68
  type: ClusterIP
69
  ports:
70
    - port: 9000
71
      targetPort: 9000
72
      protocol: TCP
73
  selector:
74
    component: minio
75

76
---
77
apiVersion: batch/v1
78
kind: Job
79
metadata:
80
  namespace: velero
81
  name: minio-setup
82
  labels:
83
    component: minio
84
spec:
85
  template:
86
    metadata:
87
      name: minio-setup
88
    spec:
89
      restartPolicy: OnFailure
90
      nodeSelector:
91
        minio.storage.sys: "yes"
92
      volumes:
93
      - name: config
94
        hostPath:
95
         path: /data/server/velero-minio/config
96
         type: DirectoryOrCreate
97
      containers:
98
      - name: mc
99
        image: quay.io/minio/mc:latest
100
        imagePullPolicy: IfNotPresent
101
        command:
102
        - /bin/sh
103
        - -c
104
        - "mc --config-dir=/config config host add velero http://minio:9000 velero-minio 1qaz@WSX && mc --config-dir=/config mb -p velero/velero"
105
        volumeMounts:
106
        - name: config
107
          mountPath: "/config"
108
# 给节点打标签
109
kubectl label nodes <node-name> minio.storage.sys=yes
110

111
kubectl apply -f velero-v1.16.0-linux-amd64/examples/minio/00-minio-deployment.yaml
112
namespace/velero created
113
deployment.apps/minio created
114
service/minio created
115
job.batch/minio-setup created
116

117
kubectl get pod -n velero
118
NAME                    READY   STATUS      RESTARTS   AGE
119
minio-cd47fcf59-sm2gn   1/1     Running     0          103s
120
minio-setup-smb9p       0/1     Completed   0          103s

2.3 安装服务端#

[!attention] 建议存到文件里网上都是直接命令行,如果以后升级不好维护,建议存储到文件里

1
cat velero-install.sh
2

3
#!/bin/bash
4
cat > credentials-velero << EOF
5
[default]
6
aws_access_key_id = velero-minio
7
aws_secret_access_key = 1qaz@WSX
8
EOF
9

10
velero install    \
11
   --image ccr.ccs.tencentyun.com/ccops/all:velero-v1.16.0  \
12
   --plugins ccr.ccs.tencentyun.com/ccops/all:velero-plugin-for-aws-v1.12.0  \
13
   --provider aws   \
14
   --bucket velero   \
15
   --namespace velero  \
16
   --secret-file ./credentials-velero  \
17
   --use-volume-snapshots=false   \
18
   --backup-location-config region=minio,s3ForcePathStyle="true",s3Url=http://minio.velero:9000
19

20
sh velero-install.sh
21
CustomResourceDefinition/backuprepositories.velero.io: attempting to create resource
22
CustomResourceDefinition/backuprepositories.velero.io: attempting to create resource client
23
CustomResourceDefinition/backuprepositories.velero.io: created
24
......
25
Deployment/velero: attempting to create resource client
26
Deployment/velero: created
27
Velero is installed! ⛵ Use 'kubectl logs deployment/velero -n velero' to view the status.
28
# 看到这行说明安装没问题
29
kubectl get pod -n velero
30
NAME                      READY   STATUS      RESTARTS   AGE
31
minio-cd47fcf59-sm2gn     1/1     Running     0          36m
32
minio-setup-smb9p         0/1     Completed   0          36m
33
velero-76454754b9-fqqnw   1/1     Running     0          86s

3 测试#

3.1 安装测试nginx#

[!attention] 建议存到文件里官网测试的nginx例子pull不下来镜像,自己需要手动改下

1
kubectl apply -f velero-v1.16.0-linux-amd64/examples/nginx-app/base.yaml
2
kubectl get pod -n nginx-example
3
NAME                                READY   STATUS    RESTARTS   AGE
4
nginx-deployment-7f796bc6dc-hxqqd   1/1     Running   0          37s
5
nginx-deployment-7f796bc6dc-pjzxp   1/1     Running   0          21s

3.2 备份#

1
velero backup create nginx-backup --selector app=nginx
2
Backup request "nginx-backup" submitted successfully.
3
Run `velero backup describe nginx-backup` or `velero backup logs nginx-backup` for more details.

3.3 还原#

3.3.1 模拟丢失配置#

1
kubectl delete namespace nginx-example
2
kubectl get ns nginx-example
3
Error from server (NotFound): namespaces "nginx-example" not found

3.3.2 还原#

1
velero restore create --from-backup nginx-backup
2
Restore request "nginx-backup-20250423165832" submitted successfully.
3
Run `velero restore describe nginx-backup-20250423165832` or `velero restore logs nginx-backup-20250423165832` for more details.
4
# 查看还原
5
velero restore get
6
NAME                          BACKUP         STATUS      STARTED                         COMPLETED                       ERRORS   WARNINGS   CREATED                         SELECTOR
7
nginx-backup-20250423165832   nginx-backup   Completed   2025-04-23 16:58:32 +0800 CST   2025-04-23 16:58:33 +0800 CST   0        1   2025-04-23 16:58:32 +0800 CST   <none>
8
# 查看恢复的pod
9
kubectl get pod -n nginx-example
10
NAME                                READY   STATUS    RESTARTS   AGE
11
nginx-deployment-7f796bc6dc-hxqqd   1/1     Running   0          23s
12
nginx-deployment-7f796bc6dc-pjzxp   1/1     Running   0          23s

4 高级备份功能#

1
# 每天1点备份一次nginx-example空间资源
2
velero schedule create nginx-daily --schedule="0 1 * * *" --include-namespaces nginx-example
3
# 备份除"backup=ignore"这个标签的所有资源
4
velero backup create nginx-backup --selector 'backup notin (ignore)'
5
# 每周日0点备份一次所有集群资源，并且设置保留时间2160小时
6
velero create schedule cluster-all --schedule="0 0 * * 0" --ttl 2160h

一, 备份ETCD#

1 备份脚本#

2 定时任务#

二, 使用Velero备份#

1 客户端安装#

2 服务端安装#

2.1 镜像准备#

2.2 存储准备#

2.3 安装服务端#

3 测试#

3.1 安装测试nginx#

3.2 备份#

3.3 还原#

3.3.1 模拟丢失配置#

3.3.2 还原#

4 高级备份功能#

文章分享

评论区

音乐

文章目录

如何安全的备份Kubernetes

一, 备份ETCD#

1 备份脚本#

2 定时任务#

二, 使用Velero备份#

1 客户端安装#

2 服务端安装#

2.1 镜像准备#

2.2 存储准备#

2.3 安装服务端#

3 测试#

3.1 安装测试nginx#

3.2 备份#

3.3 还原#

3.3.1 模拟丢失配置#

3.3.2 还原#

4 高级备份功能#

文章分享

评论区

音乐

文章目录