So here I’m going to go through backing up etcd on a kubernetes cluster.

The reason I’ve done this before is for the Kubernetes Certified Administrator (CKA) exam where you would need to know how to do this. In managed clusters like GKE then you probably will never need to interact with etcd.

There’s a few steps involved in Backup:

1. save the snapshot Restore:
2. stop all cluster components
3. restore the snapshot
4. restart all cluster components

Setup

The first thing you’ll want to do before all this is ssh onto the master node of the cluster. The master node is where things like etcd are configured.

We’re going to be using etcdctl to back up etcd in this tutorial. You can make sure it’s installed by running etcdctl version. This will return the etcdctl version and the API version which should be the same. If this command does not work then you can either install etcdctl or even see if etcd is even running on the cluster by seeing if there’s any etcd pods running

Authentication

Another thing you may need to do before continuing on is you may need to authenticate with the cluster. If you find the etcdctl commands hanging or not completing then this is probably the reason. One way of authenticating is by passing in the certs used for etcd. These are usually stored on the master node and you can find the location by looking at the etcd.yaml file. So for example

> cat /etc/kubernetes/manifests/etcd.yaml

...
spec:
  containers:
  - command:
    - etcd
  

The aim of this doc is, as the title suggests, to load an apparmor profile to a Kubernetes node and see that it is loaded. What it is not is an explainer of AppArmor or how to create profiles. For that there are a few resources at the bottom which will be more useful.

Install the tools

I’m using the AppArmor utils to manipulate AppArmor here. First thing you will want to do is open a shell on the kubernetes node. An important thing to note here is if there are multiple nodes on your cluster then you will have to do this individually for each node so it is easiest to scale your cluster down to a single node if possible. Opening the shell is different depending on where you cluster is, I’m using GKE on Google’s cloud so I use this command to connect.

gcloud beta compute ssh --zone "<zone>" "<node_name>" --project "<project_name>"

The tools themselves are installed using the following command.

apt-get update && apt-get install -y apparmor apparmor-utils

Note: An important thing to note is this node is running ubuntu. You can use the toolbox command if it is available to use apt-get below.

Check it is working using the following which will list the profiles that already exist on the node. You may need root access using sudo su

aa-status

Setting up the Profile

AppArmor profiles are stored in the /etc/apparmor.d directory so cd into that folder and create a new file. I am using the name k8s-apparmor-deny-write. As the name suggests the profile will block all writes to