恢复etcd后Kubernetes集群无法执行增删改，报etcdserver超时

已完成etcd备份并恢复，但Kubernetes（v1.24.1）集群无法执行创建、更新、删除操作！严格按照官方文档执行了以下步骤：

备份etcd #

1. 保存快照

sudo ETCDCTL_API=3 etcdctl snapshot save /tmp/etcd-backup-new.db \
  --cacert /etc/kubernetes/pki/etcd/ca.crt \
  --cert /etc/kubernetes/pki/etcd/server.crt \
  --key /etc/kubernetes/pki/etcd/server.key

2. 检查快照状态

$ sudo ETCDCTL_API=3 etcdctl snapshot status /tmp/etcd-backup-new.db --write-out=table

  +----------+----------+------------+------------+
  |   HASH   | REVISION | TOTAL KEYS | TOTAL SIZE |
  +----------+----------+------------+------------+
  | d8d0da24 |  7220348 |        874 |     1.9 MB |
  +----------+----------+------------+------------+

恢复etcd #

1. 从备份创建恢复点

sudo ETCDCTL_API=3 etcdctl snapshot restore /tmp/etcd-backup-new.db \
--data-dir /var/lib/etcd-backup

2. 修改etcd静态Pod配置指定新数据目录

sudo vim /etc/kubernetes/manifests/etcd.yaml

修改内容：

- hostPath:
      path: /var/lib/etcd-backup # Changed this ONLY!
      type: DirectoryOrCreate
    name: etcd-data

kubelet自动重启静态Pod后，所有组件状态显示正常：

$ k get all -A
NAMESPACE     NAME                                 READY   STATUS    RESTARTS        AGE
kube-system   pod/coredns-6d4b75cb6d-6cmtm         1/1     Running   1 (7d23h ago)   72d
kube-system   pod/coredns-6d4b75cb6d-wchss         1/1     Running   1 (7d23h ago)   72d
kube-system   pod/etcd-master                      1/1     Running   2 (7d23h ago)   72d
kube-system   pod/kube-apiserver-master            1/1     Running   1 (7d23h ago)   39d
kube-system   pod/kube-controller-manager-master   1/1     Running   4 (7d23h ago)   72d
kube-system   pod/kube-proxy-mqzbd                 1/1     Running   1 (7d23h ago)   72d
kube-system   pod/kube-scheduler-master            1/1     Running   4 (7d23h ago)   72d
kube-system   pod/weave-net-4xtwz                  2/2     Running   3 (7d23h ago)   49d

NAMESPACE     NAME                 TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)                  AGE
default       service/kubernetes   ClusterIP   10.96.0.1    <none>        443/TCP                  72d
kube-system   service/kube-dns     ClusterIP   10.96.0.10   <none>        53/UDP,53/TCP,9153/TCP   72d

NAMESPACE     NAME                        DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR            AGE
kube-system   daemonset.apps/kube-proxy   1         1         1       1            1           kubernetes.io/os=linux   72d
kube-system   daemonset.apps/weave-net    1         1         1       1            1           <none>                   49d

NAMESPACE     NAME                      READY   UP-TO-DATE   AVAILABLE   AGE
kube-system   deployment.apps/coredns   2/2     2            2           72d

NAMESPACE     NAME                                 DESIRED   CURRENT   READY   AGE
kube-system   replicaset.apps/coredns-6d4b75cb6d   2         2         2       72d

但执行增删改操作时均报错：

$ k run test --image nginx
  Error from server: etcdserver: request timed out

或

$ k rollout restart daemonset.apps/kube-proxy -n kube-system
  error: failed to patch: etcdserver: request timed out

请问哪里操作出错了？

1. 修复etcd数据目录权限 #

恢复后的/var/lib/etcd-backup目录权限大概率不符合要求，etcd进程需要以etcd用户身份读写该目录，执行以下命令修复：

sudo chown -R etcd:etcd /var/lib/etcd-backup
sudo chmod 700 /var/lib/etcd-backup

修复后删除现有etcd Pod，让kubelet自动重建：

kubectl delete pod etcd-master -n kube-system

2. 验证etcd集群健康状态 #

执行健康检查命令，确认etcd是否正常提供写入服务：

sudo ETCDCTL_API=3 etcdctl endpoint health \
  --cacert /etc/kubernetes/pki/etcd/ca.crt \
  --cert /etc/kubernetes/pki/etcd/server.crt \
  --key /etc/kubernetes/pki/etcd/server.key

若返回unhealthy，查看etcd日志定位具体问题：

kubectl logs etcd-master -n kube-system

常见错误包括权限不足、数据目录损坏、节点身份认证失败等。

3. 补全etcd恢复的集群配置参数 #

单节点etcd恢复时，必须指定与原集群一致的节点名称、网络地址参数，这些参数可在/etc/kubernetes/manifests/etcd.yaml的容器启动参数中找到。正确的恢复命令示例：

sudo ETCDCTL_API=3 etcdctl snapshot restore /tmp/etcd-backup-new.db \
  --data-dir /var/lib/etcd-backup \
  --name master \
  --initial-advertise-peer-urls https://192.168.1.10:2380 \
  --listen-peer-urls https://192.168.1.10:2380 \
  --listen-client-urls https://127.0.0.1:2379,https://192.168.1.10:2379 \
  --advertise-client-urls https://192.168.1.10:2379

若恢复时未指定这些参数，etcd会使用默认值，导致与kube-apiserver配置不匹配，无法正常通信。

4. 检查kube-apiserver与etcd的连接状态 #

查看kube-apiserver日志，确认是否能正常连接etcd：

kubectl logs kube-apiserver-master -n kube-system | grep etcd

若出现连接超时、认证失败等日志，需核对kube-apiserver的etcd连接参数（CA证书、客户端证书、etcd端点地址）是否与恢复后的etcd一致。

内容的提问来源于stack exchange，提问作者Ali