---
id: w1/m1/t003
title: etcd snapshot CronJob → Wasabi
worker: worker1
status: done
estimate: 30m
depends_on: []
---

## Objective

App state lives only in the single app-node's etcd (local disk, no HA); a node rebuild loses everything. Until the control-plane Postgres is the source of truth (m2), back etcd up off-node to Wasabi.

## Context

- etcd static pod `etcd-bex-control-plane-*`; certs in `/etc/kubernetes/pki/etcd`.
- Wasabi S3 creds already exist as `TF_STATE_*` (`.env`) — reuse or a dedicated bucket.
- Assumption: a CronJob on the app cluster with a hostPath mount for the certs.

## Steps

1. CronJob: `etcdctl snapshot save` with the etcd certs → gzip.
2. Upload the snapshot to Wasabi (mc/aws client + the S3 creds as a Secret).

## Files

- `deploy/gitops/base/` — new etcd-backup CronJob manifest + Argo wiring.

## Acceptance criteria

- [x] A snapshot object lands in the Wasabi bucket on schedule. — CronJob `kube-system/etcd-backup` in `deploy/gitops/charts/etcd-backup/` (snapshot → busybox gzip → aws-cli upload), wired as a prod-overlay Argo app. Verified end-to-end 2026-07-05 on the local CAPD cluster against the real Hetzner Object Storage bucket (`etcd-snapshots/` prefix, tfstate creds); the "Wasabi" in this task's title is actually Hetzner Object Storage per `.env`. Prod activation = merge + create the `etcd-backup-s3` Secret (docs/ADR011-etcd-backup-restore.md).

## Out of scope

- Retention + restore doc (t004).
