<commit_before>// Module included in the following assemblies:
//
// * disaster_recovery/backing-up-etcd.adoc

[id="backing-up-etcd-data_{context}"]
= Backing up etcd data

Follow these steps to back up etcd data by creating an etcd snapshot and backing up the resources for the static Pods. This backup can be saved and used at a later time if you need to restore etcd.

You should only save a backup from a single master host. You do not need a backup from each master host in the cluster.

.Prerequisites

* SSH access to a master host.

.Procedure

. Access a master host.

. If the cluster-wide proxy is enabled, be sure that you have exported the `NO_PROXY`, `HTTP_PROXY`, and `HTTPS_PROXY` environment variables.
+
[TIP]
====
You can check whether the proxy is enabled by reviewing the output of `oc get proxy cluster -o yaml`. The proxy is enabled if the `httpProxy`, `httpsProxy`, and `noProxy` fields have values set.
====

. Run the `cluster-backup.sh` script and pass in the location to save the backup to.
+
Be sure to pass in the `-E` flag to `sudo` so that environment variables are properly passed to the script.
+
----
$ sudo -E /usr/local/bin/cluster-backup.sh ./assets/backup
1bf371f1b5a483927cd01bb593b0e12cff406eb8d7d0acf4ab079c36a0abd3f7
etcdctl version: 3.3.18
API version: 3.3
found latest kube-apiserver-pod: /etc/kubernetes/static-pod-resources/kube-apiserver-pod-7
found latest kube-controller-manager-pod: /etc/kubernetes/static-pod-resources/kube-controller-manager-pod-8
found latest kube-scheduler-pod: /etc/kubernetes/static-pod-resources/kube-scheduler-pod-6
found latest etcd-pod: /etc/kubernetes/static-pod-resources/etcd-pod-2
Snapshot saved at /var/home/core/assets/backup/snapshot_2020-03-18_220218.db
snapshot db and kube resources are successfully saved to /var/home/core/assets/backup
----
+
In this example, two files are created in the `./assets/backup/` directory on the master host:

* `snapshot_<datetimestamp>.db`: This file is the etcd snapshot.
* `static_kuberesources_<datetimestamp>.tar.gz`: This file contains the resources for the static Pods. If etcd encryption is enabled, it also contains the encryption keys for the etcd snapshot.
+
[NOTE]
====
If etcd encryption is enabled, it is recommended to store this second file separately from the etcd snapshot for security reasons. However, this file is required in order to restore from the etcd snapshot.
====<commit_msg>Clarifying that etcd encryption only encrypts values<commit_after>// Module included in the following assemblies:
//
// * disaster_recovery/backing-up-etcd.adoc

[id="backing-up-etcd-data_{context}"]
= Backing up etcd data

Follow these steps to back up etcd data by creating an etcd snapshot and backing up the resources for the static Pods. This backup can be saved and used at a later time if you need to restore etcd.

You should only save a backup from a single master host. You do not need a backup from each master host in the cluster.

.Prerequisites

* SSH access to a master host.

.Procedure

. Access a master host.

. If the cluster-wide proxy is enabled, be sure that you have exported the `NO_PROXY`, `HTTP_PROXY`, and `HTTPS_PROXY` environment variables.
+
[TIP]
====
You can check whether the proxy is enabled by reviewing the output of `oc get proxy cluster -o yaml`. The proxy is enabled if the `httpProxy`, `httpsProxy`, and `noProxy` fields have values set.
====

. Run the `cluster-backup.sh` script and pass in the location to save the backup to.
+
Be sure to pass in the `-E` flag to `sudo` so that environment variables are properly passed to the script.
+
----
$ sudo -E /usr/local/bin/cluster-backup.sh ./assets/backup
1bf371f1b5a483927cd01bb593b0e12cff406eb8d7d0acf4ab079c36a0abd3f7
etcdctl version: 3.3.18
API version: 3.3
found latest kube-apiserver-pod: /etc/kubernetes/static-pod-resources/kube-apiserver-pod-7
found latest kube-controller-manager-pod: /etc/kubernetes/static-pod-resources/kube-controller-manager-pod-8
found latest kube-scheduler-pod: /etc/kubernetes/static-pod-resources/kube-scheduler-pod-6
found latest etcd-pod: /etc/kubernetes/static-pod-resources/etcd-pod-2
Snapshot saved at /var/home/core/assets/backup/snapshot_2020-03-18_220218.db
snapshot db and kube resources are successfully saved to /var/home/core/assets/backup
----
+
In this example, two files are created in the `./assets/backup/` directory on the master host:

* `snapshot_<datetimestamp>.db`: This file is the etcd snapshot.
* `static_kuberesources_<datetimestamp>.tar.gz`: This file contains the resources for the static Pods. If etcd encryption is enabled, it also contains the encryption keys for the etcd snapshot.
+
[NOTE]
====
If etcd encryption is enabled, it is recommended to store this second file separately from the etcd snapshot for security reasons. However, this file is required in order to restore from the etcd snapshot.

Keep in mind that etcd encryption only encrypts values, not keys. This means that resource types, namespaces, and object names are unencrypted.
====
{'fraction_non_alphanumeric': 0.08644674085850557, 'fraction_numerical': 0.02344992050874404, 'mean_word_length': 4.354255319148936, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 7, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '205352', 'n_tokens_mistral': 1585, 'n_tokens_neox': 1506, 'n_words': 624}