Skip to content

Configure Recurring Backups For etcd

An XCCDF Rule

Description

Back up your clusters etcd data regularly and store in a secure location ideally outside the OpenShift Container Platform environment. Do not take an etcd backup before the first certificate rotation completes, which occurs 24 hours after installation, otherwise the backup will contain expired certificates. It is also recommended to take etcd backups during non-peak usage hours because the etcd snapshot has a high I/O cost.

For more information, follow the relevant documentation.

Rationale

While etcd automatically recovers from temporary failures, issues may arise if an etcd cluster loses more than (N-1)/2 or when an update goes wrong. Recurring backups of etcd enable you to recover from a disastrous fail.

ID
xccdf_org.ssgproject.content_rule_etcd_backup
Severity
Medium
References
Updated