Kubernetes : Add Control Plane Node2026/05/13

Add new Control Plane Nodes to existing Kubernetes Cluster.

This example is based on the cluster environment like follows.
It adds [dlp-1.srv.world (10.0.0.31)] as Control Plane Node to this cluster.

*Note
When etcd is started on the Control Plane, the fault tolerance of etcd is 0 for 1-2 units, so in a configuration with 2 Control Planes, if one of them goes down, it will no longer be possible to connect to etcd and the cluster will not be able to be used normally.

+----------------------+   +----------------------+
|  [ ctrl.srv.world ]  |   |   [ dlp.srv.world ]  |
|     Manager Node     |   |     Control Plane    |
+-----------+----------+   +-----------+----------+
        eth0|10.0.0.25             eth0|10.0.0.30
            |                          |
------------+--------------------------+-----------
            |                          |
        eth0|10.0.0.51             eth0|10.0.0.52
+-----------+----------+   +-----------+----------+
| [ node01.srv.world ] |   | [ node02.srv.world ] |
|     Worker Node#1    |   |     Worker Node#2    |
+----------------------+   +----------------------+

[1]	On a new Node, Configure common settings to join in Cluster, refer to here.
[2]	Add proxy setting for new Control Plane on Manager Node.

root@ctrl:~#

vi /etc/nginx/nginx.conf

# add new Control Plane
stream {
    upstream k8s-api {
        server 10.0.0.30:6443;
        server 10.0.0.31:6443;
    }
    server {
        listen 6443;
        proxy_pass k8s-api;
    }
}

root@ctrl:~#

systemctl reload nginx

[3]	Confirm join command on existing Control Plane Node and also transfer certificate files to new Node with any user.

root@dlp:~#

cd /etc/kubernetes/pki

root@dlp:/etc/kubernetes/pki#

tar czvf kube-certs.tar.gz sa.pub sa.key ca.crt ca.key front-proxy-ca.crt front-proxy-ca.key etcd/ca.crt etcd/ca.key

root@dlp:/etc/kubernetes/pki#

scp kube-certs.tar.gz ubuntu@10.0.0.31:/tmp

root@dlp:/etc/kubernetes/pki#

kubeadm token create --print-join-command

kubeadm join 10.0.0.25:6443 --token m5anuo.2hwkytrv8rp4oczx --discovery-token-ca-cert-hash sha256:89e79c33d19a21e2a6f7ed22dd1dc0f9ef3660efaeefed636f33e8559f2b26ac

[4]	Run join command you confirmed on a new Node with [--control-plane] option.

# copy certificates transferred from existing Control Plane

root@dlp-1:~#

mkdir /etc/kubernetes/pki

root@dlp-1:~#

tar zxvf /tmp/kube-certs.tar.gz -C /etc/kubernetes/pki

root@dlp-1:~#

kubeadm join 10.0.0.25:6443 --token m5anuo.2hwkytrv8rp4oczx \
--discovery-token-ca-cert-hash sha256:89e79c33d19a21e2a6f7ed22dd1dc0f9ef3660efaeefed636f33e8559f2b26ac \
--control-plane

[preflight] Running pre-flight checks
[preflight] Reading configuration from the "kubeadm-config" ConfigMap in namespace "kube-system"...
[preflight] Use 'kubeadm init phase upload-config kubeadm --config your-config-file' to re-upload it.
W0513 01:04:29.538915    2963 utils.go:69] The recommended value for "bindAddress" in "KubeProxyConfiguration" is: ::; the provided value is: 0.0.0.0
[preflight] Running pre-flight checks before initializing the new control plane instance
[preflight] Pulling images required for setting up a Kubernetes cluster
[preflight] This might take a minute or two, depending on the speed of your internet connection
[preflight] You can also perform this action beforehand using 'kubeadm config images pull'

.....
.....

This node has joined the cluster and a new control plane instance was created:

* Certificate signing request was sent to apiserver and approval was received.
* The Kubelet was informed of the new secure connection details.
* Control plane label and taint were applied to the new node.
* The Kubernetes control plane instances scaled up.
* A new etcd member was added to the local/stacked etcd cluster.

To start administering your cluster from this node, you need to run the following as a regular user:

        mkdir -p $HOME/.kube
        sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
        sudo chown $(id -u):$(id -g) $HOME/.kube/config

Run 'kubectl get nodes' to see this node join the cluster.

[5]	Verify settings on Manager Node. That's OK if the status of new Node turns to [STATUS = Ready].

root@ctrl:~#

kubectl get nodes

NAME               STATUS   ROLES           AGE   VERSION
dlp-1.srv.world    Ready    control-plane   39s   v1.36.0
dlp.srv.world      Ready    control-plane   21h   v1.36.0
node01.srv.world   Ready    <none>          20h   v1.36.0
node02.srv.world   Ready    <none>          20h   v1.36.0

root@ctrl:~#

kubectl get pods -A -o wide | grep dlp-1

calico-system     calico-node-7hjc6                          1/1     Running   0             67s   10.0.0.31         dlp-1.srv.world    <none>           <none>
calico-system     csi-node-driver-drg55                      2/2     Running   0             67s   192.168.112.129   dlp-1.srv.world    <none>           <none>
kube-system       etcd-dlp-1.srv.world                       1/1     Running   0             67s   10.0.0.31         dlp-1.srv.world    <none>           <none>
kube-system       kube-apiserver-dlp-1.srv.world             1/1     Running   0             66s   10.0.0.31         dlp-1.srv.world    <none>           <none>
kube-system       kube-controller-manager-dlp-1.srv.world    1/1     Running   0             66s   10.0.0.31         dlp-1.srv.world    <none>           <none>
kube-system       kube-proxy-prdhl                           1/1     Running   0             66s   10.0.0.31         dlp-1.srv.world    <none>           <none>
kube-system       kube-scheduler-dlp-1.srv.world             1/1     Running   0             66s   10.0.0.31         dlp-1.srv.world    <none>           <none>

Matched Content