mirror of
https://github.com/xcat2/confluent.git
synced 2026-08-04 16:37:00 +00:00
Markus Hilger
fa3d1ca388
The -x/--exclude option drops matching node and node group attributes from a dump, restore, or merge, so a backup can leave out dynamic state such as deployment.state_last_updated or data that should not travel with it. Patterns use shell-style wildcards, and a bare namespace such as net excludes every attribute below it. The node "groups" and "id.index" attributes and the node group "noderange" attribute are always retained so that a restore can still reconstruct group membership and node index assignments.
94 lines
3.8 KiB
Markdown
94 lines
3.8 KiB
Markdown
confluentdbutil(8) -- Backup or restore confluent database
|
|
=========================================================
|
|
|
|
## SYNOPSIS
|
|
|
|
`confluentdbutil [options] [dump|restore|merge] <path>`
|
|
`confluentdbutil [-u] [-v] showattrib <noderange> <attribute>...`
|
|
|
|
## DESCRIPTION
|
|
|
|
**confluentdbutil** is a utility to export/import the confluent attributes
|
|
to/from json files. The path is a directory that holds the json version.
|
|
In order to perform restore, the confluent service must not be running. It
|
|
is required to indicate how the usernames/passwords are treated in
|
|
the json files (password protected, removed from the files, or unprotected).
|
|
|
|
The `showattrib` subcommand prints the stored value of any attribute for the
|
|
given noderange, reading directly from the configuration store. Because it
|
|
does not talk to the confluent daemon, it can be used to read attribute values
|
|
even while confluent is stopped. It must be run directly on the confluent
|
|
server as root. By default, `secret.*` and `crypted.*` values are masked as
|
|
`********`, just as nodeattrib(8) shows them. With `-u`, they are revealed:
|
|
`secret.*` values decrypted to plaintext and `crypted.*` values as their
|
|
stored one-way hashes.
|
|
|
|
## OPTIONS
|
|
|
|
* `-p PASSWORD`, `--password=PASSWORD`:
|
|
If specified, information such as usernames and passwords will be encrypted
|
|
using the given password.
|
|
|
|
* `-i`, `--interactivepassword`:
|
|
Prompt for password.
|
|
|
|
* `-r`, `--redact`:
|
|
Indicates to replace usernames and passwords with a dummy string rather
|
|
than including them.
|
|
|
|
* `-u`, `--unprotected`:
|
|
With `dump`, the keys.json file will include the encryption keys without
|
|
any protection. With `showattrib`, show `secret.*` values decrypted to
|
|
plaintext and `crypted.*` values as their stored hashes rather than
|
|
masking them as `********`.
|
|
|
|
* `-s`, `--skipkeys`:
|
|
This specifies to dump the encrypted data without
|
|
dumping the keys needed to decrypt it. This is
|
|
suitable for an automated incremental backup, where an
|
|
earlier password protected dump has a protected
|
|
keys.json file, and only the protected data is needed.
|
|
Keys do not change and as such they do not require
|
|
incremental backup.
|
|
|
|
* `-x ATTRIBUTE`, `--exclude=ATTRIBUTE`:
|
|
Exclude matching node and node group attributes from `dump`, `restore`,
|
|
or `merge`.
|
|
The option may be specified multiple times. Attribute names may use
|
|
shell-style wildcards such as `net.*`.
|
|
A bare namespace such as `net` excludes all attributes below that namespace.
|
|
An exclusion omits the attribute from the data being written, it does not
|
|
preserve the value already in the database. A `restore` replaces the
|
|
database outright, so attributes excluded there are missing from the
|
|
restored configuration entirely; use `merge` to leave existing objects
|
|
untouched.
|
|
Node `groups`, node `id.index`, and node-group `noderange` are retained
|
|
so that restore can reconstruct node-group membership and preserve
|
|
node index assignments.
|
|
During merge, existing nodes and node groups are skipped as whole objects;
|
|
exclusions affect only new objects imported from the backup.
|
|
|
|
* `-y`, `--yaml`:
|
|
Use YAML instead of JSON as file format
|
|
|
|
* `-v`, `--value-only`:
|
|
With `showattrib`, print only the values, without node and attribute names
|
|
(useful for scripting).
|
|
|
|
* `-h`, `--help`:
|
|
Show help message and exit
|
|
|
|
## EXAMPLES
|
|
|
|
* Show the decrypted BMC password confluent uses for a node (run on the
|
|
server as root):
|
|
`# confluentdbutil -u showattrib n1 secret.hardwaremanagementpassword`
|
|
`n1: secret.hardwaremanagementpassword: mypassword123`
|
|
|
|
* Get just the value, for use in a script:
|
|
`# confluentdbutil -u -v showattrib n1 secret.hardwaremanagementpassword`
|
|
`mypassword123`
|
|
|
|
* Dump configuration without (dynamic) deployment state:
|
|
`# confluentdbutil -u -x 'deployment.state*' dump /root/confluent-backup`
|