<p>So I know how to add a worker node to an existing Kubernetes 1.14 cluster (that was set up with <code>kubeadm</code>): <a href="https://stackoverflow.com/questions/32322038/adding-node-to-existing-cluster-in-kubernetes"><code>kubeadm token create --print-join-command</code></a> will print a valid <code>kubeadm join</code> command with correct values for arguments <code>--token</code> and <code>--discovery-token-ca-cert-hash</code>.</p>

<p>I currently understand that for adding another node to the control plane (master node) <a href="https://kubernetes.io/docs/setup/independent/high-availability/#stacked-control-plane-and-etcd-nodes" rel="nofollow noreferrer"><code>kubeadm join</code></a> requires the additional arguments <code>--experimental-control-plane</code> (w/o value) and <code>--certificate-key</code>. This is for stacked control plane and etcd nodes.</p>

<p>How (in which file) can I obtain the correct value for <code>--certificate-key</code> for an existing cluster?</p>

<p><strong>UPDATE</strong> My first (and currently only) master node was created without the argument <code>--experimental-upload-certs</code> to <code>kubeadm init</code> (but by <code>kubeadm init --pod-network-cidr=10.244.0.0/16</code> instead). Therefore <a href="https://kubernetes.io/docs/setup/independent/high-availability/#manual-certs" rel="nofollow noreferrer">manual certificate distribution</a> should apply and a possible sequence of steps could thus be:</p>

<ol>
<li>copy certificates and keys in <code>/etc/kubernetes/pki/{ca.*,sa.*,front-proxy-sa.*,etcd/ca.*}</code> from the first to the new master node</li>
<li>run <code>kubeadm token create --print-join-command</code> on the first master node</li>
<li>run printed <code>kubeadm join</code> command with the additional argument <code>--experimental-control-plane</code> on the new master node</li>
</ol>

<p>Is this the correct procedure?</p>

<p>An alternative to answers given is to use <code>kubeadm</code> to manage certificates by uploading the certificates as a secret to <code>kube-system</code> (it will expire in 2 hours). There is no need to pass a certificate key in the init phase</p>

<p>So you can do</p>

<pre><code>kubeadm init --control-plane-endpoint "LOAD_BALANCER_DNS:LOAD_BALANCER_PORT"
</code></pre>

<p>And then at a later time</p>

<pre><code>kubeadm init phase upload-certs --upload-certs
</code></pre>

<p>That command will output the certificate key you can use for the secret created</p>

<pre><code>kubeadm join LOAD_BALANCER_DNS:LOAD_BALANCER_PORT --token &lt;token&gt; \     
--discovery-token-ca-cert-hash &lt;hash&gt; \
--control-plane \
--certificate-key &lt;key from previous commmand&gt;
</code></pre>
