Kubernetes 备份与恢复etcdetcd 3.6 将备份与恢复功能拆分etcdctl负责在线备份etcdutl负责恢复。一、准备 etcdctl 和 etcdutl 二进制从 etcd 镜像中提取# 创建临时容器 docker create --name demo reg.westos.org/k8s/etcd:3.6.6-0 # 从容器拷贝二进制到本机 docker cp demo:/usr/local/bin/etcdctl /usr/local/bin docker cp demo:/usr/local/bin/etcdutl /usr/local/bin # 拷贝到 master 节点 scp /usr/local/bin/etcdctl k8s-master:/usr/local/bin/ scp /usr/local/bin/etcdutl k8s-master:/usr/local/bin/二、备份 etcd在 master 节点执行mkdir -p /backup/etcd ETCDCTL_API3 etcdctl \ --cacert/etc/kubernetes/pki/etcd/ca.crt \ --cert/etc/kubernetes/pki/apiserver-etcd-client.crt \ --key/etc/kubernetes/pki/apiserver-etcd-client.key \ --endpoints https://127.0.0.1:2379 \ snapshot save /backup/etcd/etcd-$(date %Y-%m-%d-%H-%M-%S).bak三、查看快照状态ETCDCTL_API3 etcdutl snapshot status --write-outtable \ /backup/etcd/etcd-2026-09-27-11-26-04.bak四、模拟故障删除资源kubectl delete deployments.apps nginx-server五、恢复 etcd1. 停止所有核心组件cd /etc/kubernetes/manifests/ mv * /mnt/ # 移走静态 Pod 清单对应容器自动停止2. 备份原数据目录mv /var/lib/etcd /mnt/3. 从快照恢复ETCDCTL_API3 etcdutl snapshot restore \ --data-dir /var/lib/etcd \ /backup/etcd/etcd-2026-09-27-11-26-04.bak4. 重启所有组件mv /mnt/*.yaml /etc/kubernetes/manifests/ # 移回清单容器自动启动六、验证恢复kubectl get deployments.apps nginx-server # NAME READY UP-TO-DATE AVAILABLE AGE # nginx-server 3/3 3 3 4h53m kubectl get pod -l appnginx # 三个 Pod 均 Running说明资源已恢复Kubernetes 集群升级本实验Kubernetes v1.35.8 → v1.36.5升级方式kubeadm官方文档升级 kubeadm 集群 | Kubernetes版本偏差策略版本偏差策略 | Kubernetes修改各节点的 Kubernetes 安装源# vim /etc/yum.repos.d/kubernetes.repo[kubernetes] nameKubernetes baseurlhttps://mirrors.aliyun.com/kubernetes-new/core/stable/v1.36/rpm/ enabled1 gpgcheck0# yum makecache fast升级 Kubernetes Master 节点升级 kubeadm# yum install -y kubeadm # kubeadm version确认版本为v1.36.5提前下载 K8s 升级镜像# kubeadm config images pull --image-repository registry.aliyuncs.com/google_containers查看 v1.36.5 所需镜像# kubeadm config images list --kubernetes-version v1.36.5然后根据实验环境将镜像上传到 Harborreg.westos.org修改 containerd 配置# vim /etc/containerd/config.toml修改sandbox_image reg.westos.org/k8s/pause:3.10.2重启# systemctl restart containerd.service验证升级计划# kubeadm upgrade plan执行升级# kubeadm upgrade apply v1.36.5等待升级完成。升级 kubelet 和 kubectl# yum install -y kubelet kubectl重启 kubelet# systemctl daemon-reload # systemctl restart kubelet解除节点保护# kubectl uncordon k8s1验证# kubectl get node例如NAME STATUS ROLES VERSION k8s1 Ready control-plane v1.36.5 k8s2 Ready worker v1.35.8 k8s3 Ready worker v1.35.8升级工作节点工作节点需要逐个升级。修改 containerd# vim /etc/containerd/config.tomlsandbox_image reg.westos.org/k8s/pause:3.10.1# systemctl restart containerd.service升级 kubeadm# yum install -y kubeadm # kubeadm version确认v1.36.5执行升级# kubeadm upgrade node腾空节点在 Master 节点执行# kubectl drain k8s2 --ignore-daemonsets如果提示emptyDir# kubectl drain k8s2 --ignore-daemonsets --delete-emptydir-data升级 kubelet 和 kubectl在k8s2上# yum install -y kubelet kubectl重启# systemctl daemon-reload # systemctl restart kubelet解除节点保护在 Master 节点执行# kubectl uncordon k8s2其他工作节点k8s3按照相同步骤操作# kubectl drain k8s3 --ignore-daemonsets在k8s3# yum install -y kubeadm # kubeadm upgrade node # yum install -y kubelet kubectl # systemctl daemon-reload # systemctl restart kubelet回到 Master# kubectl uncordon k8s3最后验证集群# kubectl get node最终NAME STATUS ROLES VERSION k8s1 Ready control-plane v1.36.5 k8s2 Ready worker v1.36.5 k8s3 Ready worker v1.36.5再检查 Pod# kubectl get pod -A确保没有Pending CrashLoopBackOff ImagePullBackOff ErrImagePull