Extract a Kubernetes Secret From an etcd Snapshot

Fri, 18 Oct 2024 19:26:00 -0500

Someone deleted a Secret, or overwrote it, and the only copy left is in an etcd snapshot. Restoring the whole cluster to get one object back would roll every other resource back too. This guide restores the snapshot into a scratch etcd that has nothing to do with the live cluster, reads the one key you need, and decodes it into normal Secret YAML.

Decrypt One Secret From an RKE2 etcd Snapshot

Wed, 04 Sep 2024 04:48:35 -0500

Someone deleted a Secret, or rotated a credential and lost the old value, and the only copy left is in last night’s RKE2 etcd snapshot. Restoring the whole cluster to get one object back is out of the question. This guide restores the snapshot into a scratch etcd that has nothing to do with the live cluster, reads the one key you need, and decrypts it, because on RKE2 every Secret in etcd is encrypted at rest.

Etcdutl on Support Tools

Extract a Kubernetes Secret From an etcd Snapshot

Decrypt One Secret From an RKE2 etcd Snapshot