CKA High Availability Cluster Study Guide

Objective

Build a Kubernetes HA cluster consisting of:

• 3 Control Plane Nodes
• 2 Worker Nodes
• HAProxy Load Balancer
• Keepalived Virtual IP (VIP)
• kubectl configured on every Control Plane node

Architecture

                    Virtual IP (VIP)
                         |
                   +-------------+
                   |   HAProxy   |
                   +-------------+
                    /     |     \
                   /      |      \
                cp1      cp2     cp3

                  |         |
               worker1   worker2

Step 1 - Prepare All Nodes

Set hostnames:

hostnamectl set-hostname cp1
hostnamectl set-hostname cp2
hostnamectl set-hostname cp3
hostnamectl set-hostname worker1
hostnamectl set-hostname worker2

Add hosts file entries:

192.168.1.11 cp1
192.168.1.12 cp2
192.168.1.13 cp3
192.168.1.21 worker1
192.168.1.22 worker2

Disable swap:

swapoff -a
sed -i '/swap/d' /etc/fstab

Step 2 - Install CRI and Kubernetes Tools

wget https://raw.githubusercontent.com/sandervanvugt/cka/master/install-cri.sh

chmod +x install-cri.sh

./install-cri.sh

Run on ALL Kubernetes nodes.

Step 3 - Configure HAProxy

frontend kubernetes
    bind *:6443
    default_backend kubeapi

backend kubeapi
    balance roundrobin
    server cp1 192.168.1.11:6443 check
    server cp2 192.168.1.12:6443 check
    server cp3 192.168.1.13:6443 check

Restart service:

systemctl restart haproxy
systemctl enable haproxy

Verify:

ss -tlnp | grep 6443

Step 4 - Configure Keepalived

Example Virtual IP:

192.168.1.100

Verify VIP assignment:

ip addr

Step 5 - Initialize First Control Plane

kubeadm init \
--control-plane-endpoint "192.168.1.100:6443" \
--upload-certs \
--pod-network-cidr=192.168.0.0/16

Step 6 - Configure kubectl on cp1

mkdir -p $HOME/.kube

sudo cp /etc/kubernetes/admin.conf \
$HOME/.kube/config

sudo chown $(id -u):$(id -g) \
$HOME/.kube/config

Verify:

kubectl get nodes

Step 7 - Save Join Commands

Regenerate Worker Join:

kubeadm token create --print-join-command

Regenerate Control Plane Certificate Key:

kubeadm init phase upload-certs --upload-certs

Step 8 - Join cp2 and cp3

kubeadm join 192.168.1.100:6443 \
--token <token> \
--discovery-token-ca-cert-hash sha256:<hash> \
--control-plane \
--certificate-key <certificate-key>

Expected Result:

kubectl get nodes

cp1 Ready
cp2 Ready
cp3 Ready

Step 9 - Configure kubectl on cp2 and cp3

Run on BOTH cp2 and cp3:

mkdir -p $HOME/.kube

sudo cp /etc/kubernetes/admin.conf \
$HOME/.kube/config

sudo chown $(id -u):$(id -g) \
$HOME/.kube/config

Verify:

kubectl get nodes

Step 10 - Join Worker Nodes

kubeadm join 192.168.1.100:6443 \
--token <token> \
--discovery-token-ca-cert-hash sha256:<hash>

Run on:

• worker1
• worker2

Step 11 - Install Calico

kubectl apply -f calico.yaml

Verify:

kubectl get nodes

Final Verification

kubectl get nodes

Exam Day Checklist

• ✅ Load Balancer configured
• ✅ VIP configured
• ✅ First control plane initialized
• ✅ Used --control-plane-endpoint
• ✅ cp2 joined as control plane
• ✅ cp3 joined as control plane
• ✅ worker1 joined
• ✅ worker2 joined
• ✅ Calico installed
• ✅ kubectl works on cp1
• ✅ kubectl works on cp2
• ✅ kubectl works on cp3