etcdctl

What it does

How to write it

ETCDCTL_API=3 etcdctl --endpoints=URL --cacert=CA --cert=CRT --key=KEY COMMAND
etcdutl snapshot restore FILE --data-dir DIR

Main parts

Commands

endpoint health / endpoint status

Is etcd healthy? Who is leader?

member list

Cluster members.

snapshot save FILE

Make a backup.

snapshot status FILE (etcdutl)

Check a backup.

snapshot restore FILE (etcdutl)

Restore into a new data folder.

get KEY [--prefix --keys-only]

Read keys.

put KEY VALUE / del KEY

Write / delete (never on a Kubernetes etcd by hand).

defrag

Free space after compaction.

alarm list / alarm disarm

Space alarms.

Most used

Nothing matches this filter.

$ run as a normal user# run as root (or with sudo)

1. 1Set the TLS flags once (kubeadm)

   #export ETCDCTL_API=3
   #export ETCDCTL_ENDPOINTS=https://127.0.0.1:2379 ETCDCTL_CACERT=/etc/kubernetes/pki/etcd/ca.crt ETCDCTL_CERT=/etc/kubernetes/pki/etcd/server.crt ETCDCTL_KEY=/etc/kubernetes/pki/etcd/server.key

2. 2Health and members

   #etcdctl endpoint health
   #etcdctl endpoint status -w table
   #etcdctl member list -w table

3. 3Back up (CKA)

   #etcdctl snapshot save /opt/backup/etcd-$(date +%F).db
   #etcdutl snapshot status /opt/backup/etcd-2026-10-27.db -w table

4. 4Find the cert paths from the static pod

   #grep -E "cert-file|key-file|trusted-ca-file|listen-client-urls" /etc/kubernetes/manifests/etcd.yaml

5. 5Restore (CKA)

   #etcdutl snapshot restore /opt/backup/etcd-2026-10-27.db --data-dir /var/lib/etcd-restore
   #vim /etc/kubernetes/manifests/etcd.yaml
       - hostPath: { path: /var/lib/etcd-restore, type: DirectoryOrCreate }
   #crictl ps | grep etcd
   $kubectl get pods -A

6. 6See how Kubernetes stores objects

   #etcdctl get /registry/namespaces --prefix --keys-only | head

7. 7Check that Secrets are encrypted at rest

   #etcdctl get /registry/secrets/shop/db | hexdump -C | head -3

   You should see k8s:enc:aescbc:v1: or k8s:enc:kms, not clear text.

8. 8Fix a full database (NOSPACE alarm)

   #etcdctl alarm list
   #etcdctl defrag
   #etcdctl alarm disarm

9. 9Back up every night with a timer

   #cat /usr/local/bin/etcd-backup.sh
   #!/bin/bash
   etcdctl snapshot save /opt/backup/etcd-$(date +%F).db && find /opt/backup -name 'etcd-*.db' -mtime +7 -delete

10. 10k3s with embedded etcd

    #k3s etcd-snapshot save --name manual

Nothing matches this filter.

Files

/var/lib/etcd/

Data folder (kubeadm).

/etc/kubernetes/manifests/etcd.yaml

Static pod (kubeadm).

/etc/kubernetes/pki/etcd/

Certificates.

Exit codes