mkectl backup
mkectl backup#
Create a backup of the MKE 4 Kubernetes management cluster.
Synopsis#
Create a backup of the MKE 4 Kubernetes management cluster.
This command captures the state of the management plane, including cluster configuration, certificates, and other persistent control plane data. The backup can be used to recover the management cluster in the event of failure.
The archive is written on the machine running mkectl, not on the cluster nodes. The etcd snapshot is taken on a controller and streamed back here, so the file lands wherever you ran the command (--name, default backup.tar). The MkeBackup record for the run reports status.location: Client for that reason.
Scheduled backups are the in-cluster path: they run on the controllers via etcd-maintenance-service, write to spec.backup.schedule.path on each controller, and their records report status.location: Node.
An archive can only be restored by the mkectl build that wrote it: restore compares the version and commit recorded inside the archive against its own and refuses a mismatch. Keep the binary alongside the backups it took, and keep taking fresh backups after an upgrade - archives from before an upgrade need the earlier mkectl to restore, and that applies to scheduled archives on the controllers too.
mkectl backup [flags]
Options#
--config-snapshot-fallback string Which configuration to bundle when the operator's config snapshot is not current: auto (the path's own policy), none (refuse any substitution), last-known-good (the last fully reconciled snapshot), or local (the client-supplied config) (default "auto")
--config-sync-timeout duration How long to wait for the operator to finish reconciling before applying the fallback policy (default 2m0s)
--disable-pre-backup-cluster-validation Skip cluster validation prior to taking a backup
-h, --help help for backup
--include-logs Write a sidecar <name>.log next to the backup capturing the backup run's operation log (the log is not encrypted)
--lease-adopt-stale if true, matching stale lease would be adopted instead of failing with error
--lease-renew-interval duration lease renew interval for cluster-wide/node operations, should be < leaseTTL (default 20s)
--lease-ttl duration lease TTL for cluster-wide/node operations (default 1m0s)
--name string Name of the snapshot to create (default "backup.tar")
--no-passphrase Opt out to encrypt the tar file with a passphrase (not recommended)
--passphrase string Encrypt the tar file with a passphrase (at least 12 characters). Use "-" to read it from stdin instead of the command line
--progress-bars Enable progress bars during snapshot creation (default true)
--temp-dir string Directory on the controller where k0s stages the etcd snapshot while the backup is taken; it needs free space at least the size of the etcd database. Overrides spec.backup.tempDir; when both are empty k0s uses /tmp
--wait If the node's etcd-maintenance operation lock is held by another operation (defrag, cleanup, quota recovery, or a scheduled backup), wait for it to be released instead of failing fast
Options inherited from parent commands#
-f, --file string path to the config file. Not needed for restore where config is loaded from the backup (default "mke4.yaml")
--kubeconfig string path to the kubeconfig file of the existing or restored cluster. DO NOT USE when creating a new cluster (default "/home/runner/.mke/mke.kubeconf")
-l, --logLevel string specify a log level (info, warn, debug, trace, error) (default "info")
--no-color when provided, disables colored output
--no-pretty-print when provided, disables pretty print output formatting
--version version[=true] --version, --version=raw prints version information and quits; --version=vX.Y.Z... sets the reported version