Joining an additional control plane node to an existing Kubernetes cluster
Joining an additional control plane node to an existing Kubernetes cluster involves specific steps to ensure proper synchronization between the control plane components. Below is the detailed process:
1. Pre-Requisites
Ensure the following on the new control plane node:
- Same Kubernetes Version: The new node must have the same Kubernetes version installed as the existing control plane.
kubeadm version - Kubeadm, Kubelet, and Kubectl Installed: Ensure these tools are installed and configured.
- Network Configuration: The new control plane must have network connectivity to the existing control plane nodes.
2. Retrieve the Join Command
On an existing control plane node, generate the kubeadm join command with the --control-plane flag:
kubeadm token create --print-join-command
You will get output similar to:
kubeadm join <control-plane-endpoint>:6443 --token <token> \
--discovery-token-ca-cert-hash sha256:<hash> \
--control-plane
3. Copy Certificates to the New Control Plane
The new control plane requires the certificates from the existing control plane. This can be done in two ways:
Option A: Automate with --certificate-key
Generate a certificate key on the existing control plane:
kubeadm init phase upload-certs --upload-certsThe command outputs a key like:
Certificate key: abc123abc123abc123abc123abc123abc123abc123abc123abc123abc123abc12Use the
--certificate-keyin the join command:kubeadm join <control-plane-endpoint>:6443 --token <token> \ --discovery-token-ca-cert-hash sha256:<hash> \ --control-plane --certificate-key <certificate-key>
Option B: Manually Copy Certificates
If --certificate-key isn't used, manually copy the certificate files from an existing control plane node:
- Copy the
/etc/kubernetes/pkidirectory (exceptetcd/unlessetcdis running externally) to the new node:scp -r /etc/kubernetes/pki <new-control-plane-ip>:/etc/kubernetes/ scp /etc/kubernetes/admin.conf <new-control-plane-ip>:/etc/kubernetes/
4. Run the Join Command on the New Node
Run the kubeadm join command with the appropriate options:
kubeadm join <control-plane-endpoint>:6443 --token <token> \
--discovery-token-ca-cert-hash sha256:<hash> \
--control-plane
5. Verify the New Control Plane Node
Check the status of the nodes in the cluster:
kubectl get nodesThe new control plane node should appear as
Ready.Check the pods running on the new control plane:
kubectl get pods -n kube-system -o wideEnsure critical components (e.g.,
kube-apiserver,kube-scheduler,kube-controller-manager) are running.Verify the etcd cluster:
kubectl exec -n kube-system <etcd-pod-name> -- etcdctl member listReplace
<etcd-pod-name>with the name of theetcdpod.
6. Troubleshooting
- Check Logs: If the join command fails, examine the logs on the new node:
journalctl -u kubelet -f - Verify Certificates: Ensure the
/etc/kubernetes/pkidirectory is correctly populated on the new node. - ControlPlaneEndpoint: If a load balancer isn't used, ensure the
--control-plane-endpointpoints to an active control plane node.
Let me know if you encounter specific issues or errors during the process!
댓글
댓글 쓰기