Skip to content

Backup#

Mirantis strongly recommends that you regularly back up your MKE 4 clusters. In particular, you should backup your clusters anytime you make a configuration change.

Info

Backup operations do not interrupt normal cluster function.

If another maintenance operation holds the operation lock on the target controller, mkectl backup fails immediately and reports the name of that operation. To wait for the lock to release instead, run the command with --wait. The command waits up to 15 minutes.

A scheduled backup waits up to 10 minutes for the lock. If the lock is still held when that window ends, MKE skips the backup and runs it at the next scheduled time.

Limitations#

  • To restore a backup, you must use the same mkectl build that created it. Store each mkectl binary alongside the backups it creates.

  • You cannot run two backups of an MKE 4 cluster at the same time.

  • Initiating an upgrade while a backup operation is in progress can lead to unpredictable results.

  • MKE 4 may not be able to back up a cluster that has crashed.

  • The mkectl upgrade command automatically creates a pre-upgrade backup, but it uses that backup only to roll back a failed upgrade. You cannot restore the pre-upgrade backup with mkectl restore. To keep a restorable copy of the cluster state, create a backup with your currently installed mkectl binary before you upgrade. For more information, refer to Perform an MKE 4 to MKE 4+ Upgrade.

Create a backup#

Info

MKE 4 backups are saved as local tarballs.

To create an MKE 4 backup and save it to a local path, run:

unset KUBECONFIG
mkectl backup -f <config_file_path> --passphrase -

The mkectl backup command requires an explicit encryption choice. Specify one of the following flags:

  • --passphrase -: Read the encryption passphrase from standard input. The passphrase must be at least 12 bytes, which equals 12 characters if it contains only ASCII characters.
  • --no-passphrase: Create the backup without encryption.

If you omit both flags, the command fails before it creates a backup.

Warning

MKE 4 releases prior to 4.2.1 accepted the mkectl backup command with no encryption flag and produced an unencrypted archive. Now, though, the command requires either --passphrase or --no-passphrase. As such, you should update any script or runbook that directly calls mkectl backup.

You can provide a name for the backup using the --name flag. If this flag is not specified, the system will apply backup.tar as the tarball file name. If a backup with the same name already exists, the backup process will immediately fail. To use the same name, please rename the earlier backup tarball or move it to a different location.

The mkectl backup command uses the same per-controller lock as the automated operations of the etcd maintenance service. If the lock is held, the command fails immediately. To wait until the lock is released instead, pass --wait:

mkectl backup -f <config_file_path> --passphrase - --wait