---
id: gh-gke-backup-dr
name: "gke-backup-dr"
url: https://skills.yangsir.net/skill/gh-gke-backup-dr
author: google
domain: cloud-infra
tags: ["gke", "backup", "disaster-recovery", "kubernetes", "gcp"]
install_count: 6500
rating: 4.50 (120 reviews)
github: https://github.com/google/skills/tree/main/skills/cloud/gke-backup-dr
---

# gke-backup-dr

> 针对GKE有状态工作负载的备份与灾难恢复，自动化捕获Kubernetes资源元数据和持久卷数据，支持备份计划创建、手动备份触发和恢复执行，内置CMEK加密、命名空间范围等最佳实践，确保数据安全与快速恢复，适用于保护生产环境中的有状态应用。

**Stats**: 6,500 installs · 4.5/5 (120 reviews)

## Before / After 对比

### GKE集群备份恢复效率提升

**Before**:

在没有这个技能之前，用户需要手动编写复杂脚本对GKE有状态工作负载进行备份和恢复，涉及命名空间、持久卷等资源，容易遗漏或配置错误，恢复过程耗时且不稳定，通常需要60分钟以上才能完成一次完整的恢复操作，且数据一致性难以保证。

**After**:

此技能通过Backup for GKE自动捕获Kubernetes资源元数据和持久卷数据，一键设置备份计划和恢复，恢复操作可在10分钟内完成，数据一致性通过CSI卷快照和应用静默机制得到保障。

| Metric | Before | After | Change |
|---|---|---|---|
| 恢复完成时间 | 60分钟 | 10分钟 | -83% |

## Readme

# GKE Backup & Disaster Recovery

Protects stateful GKE workloads using Backup for GKE. Backup for GKE natively
captures both Kubernetes resource metadata (manifests, configurations, and
secrets) and the underlying persistent volume (PV) data.

## CLI Reference

```bash
# Enable GKE Backup addon (Slow cluster-level update)
gcloud container clusters update <CLUSTER_NAME> --enable-gke-backup --region <REGION> --quiet

# Create Backup Plan
gcloud container backup-restore backup-plans create <PLAN_NAME> \
  --cluster=<CLUSTER_NAME> --location=<REGION> \
  --retention-days=<DAYS> --cron-schedule="<CRON>" --all-namespaces --quiet

# Trigger Manual Backup
gcloud container backup-restore backups create <BACKUP_NAME> \
  --backup-plan=<PLAN_NAME> --location=<REGION> --quiet

# Create Restore Plan
gcloud container backup-restore restore-plans create <RESTORE_PLAN_NAME> \
  --cluster=<TARGET_CLUSTER_NAME> --location=<REGION> --backup-plan=<SOURCE_BACKUP_PLAN_NAME> \
  --cluster-resource-conflict-policy=USE_EXISTING_VERSION --namespaced-resource-restore-mode=FAIL_ON_CONFLICT --quiet

# Execute Restore
gcloud container backup-restore restores create <RESTORE_NAME> \
  --restore-plan=<RESTORE_PLAN_NAME> --backup=<BACKUP_NAME> --location=<REGION> --quiet

# Verify Restore Status
gcloud container backup-restore restores describe <RESTORE_NAME> --location=<REGION>
```

## Best Practices

1.  **CMEK Encryption**: Encrypt backup plans using Customer-Managed Encryption
    Keys: `--backup-encryption-key=<KEY>`.
2.  **Scope**: Prefer backing up specific namespaces rather than the entire
    cluster: `--included-namespaces=<ns1>,<ns2>`.
3.  **Application Consistency**: Recommend quiescing the database or pausing
    application writes (e.g. using pre-backup hooks or database-specific tools)
    prior to backups to ensure data integrity.
4.  **CSI Volume Snapshots**: Ensure that stateful backups utilize GKE's CSI
    (Container Storage Interface) driver for volume snapshots to capture
    persistent volume data.
5.  **Service Terminology**: Always explicitly refer to the service as **Backup
    for GKE** in your response. This distinguishes it from the broader (but
    complementary) Google Cloud **Backup and Disaster Recovery (DR) Service**,
    as **Backup for GKE** is built specifically for GKE.

## Troubleshooting & Common Pitfalls (CRITICAL)

> [!IMPORTANT] **Slow Operations**: Enabling GKE Backup (`--enable-gke-backup`)
> triggers a slow Google Cloud control plane cluster update that takes several
> minutes. * **Rule**: **Do not run a terminal loop waiting for the GKE Backup
> addon to become active.** * **Action**: Provide the command to enable the
> addon, explain that the operation will proceed in the background, and
> immediately proceed to write the backup plan configs. Do not block.


---
*Source: https://skills.yangsir.net/skill/gh-gke-backup-dr*
*Markdown mirror: https://skills.yangsir.net/api/skill/gh-gke-backup-dr/markdown*