Recovery drill: etcd

Use scripts/restore-etcd.sh from the Bex repository (pinned revision in Platform recovery rehearsals). The script restores a snapshot into a local throwaway etcd, extracts selected CR prefixes, and can apply reviewed JSON only to a kube context whose name starts with restore-. It cannot perform in-place / Path B recovery against the live control plane.

Prepare​

• Confirm a decryptable etcd snapshot object exists (or pass --snapshot s3://…).
• Install the etcd image pin you will use (--image).
• Choose an empty --output-dir for extracted manifests.

DRY_RUN​

cd /path/to/bex
DRY_RUN=1 scripts/restore-etcd.sh --snapshot latest --output-dir /tmp/etcd-drill

Review planned S3/etcd steps. Expect object-store access when resolving latest.

Extract​

scripts/restore-etcd.sh --snapshot latest --output-dir /tmp/etcd-drill

Default prefixes cover Apps, Databases, and KeyValues under /registry/app.bex.co/…. Add --prefix for additional registry paths. Extraction does not contact Kubernetes.

Optional apply​

After human review of the JSON files:

scripts/restore-etcd.sh --apply-dir /tmp/etcd-drill \
  --target-context restore-drill \
  --confirm APPLY-restore-drill

Only the reviewed files are applied, and only to a restore-* context.

Verify and clean up​

Confirm the expected CRs exist in the throwaway context, then delete that context/cluster per your local lab practice. Do not treat apply success as a live routing restore.