<p>I am trying to add new master , and I copy cert and keys i.e. <strong>/etc/kubernetes/pki/apiserver-kubelet-client.crt</strong> from current master to a new one. I noticed that after I do '<strong>kubeadm init --config=config.yaml</strong>' this key (probably all of them) is changing (<em>kubeadm init</em> itself is successful).. Why is this happening and could it be a root cause of my new master being in <strong><em>NotReady</em></strong> status ?</p>

<p><strong>systemctl status kubelet</strong> shows a lot of *Failed to list <em>v1.Node: Unauthorized</em>, *Failed to list <em>v1.Secret: Unauthorized</em>..</p>

<pre><code>docker@R90HE73F:~$ kubectl get nodes
NAME STATUS ROLES AGE VERSION

k8s-master-0 Ready master 7d1h v1.13.1

k8s-master-1 Ready master 7d v1.13.1

k8s-master-2 NotReady master 104m v1.13.1

k8s-worker-0 Ready &lt;none&gt; 7d v1.13.1

k8s-worker-1 Ready &lt;none&gt; 7d v1.13.1

k8s-worker-2 Ready &lt;none&gt; 7d v1.13.1
</code></pre>

<p>Btw etcd cluster is healthy</p>

<p>To add a new master to kubernetes cluster, you need to copy four files from your existing kubernetes master certificate directory before doing <code>kubeadm init</code> on new master. Those files are <code>ca.crt, ca.key, sa.pub, sa.key</code> and copy these files to <code>/etc/kubernetes/pki</code> folder on new master. If you don't copy the <code>sa*</code> files your kubernetes master will be into <code>NotReady</code> state and will have those errors.</p>

<p>For more information on how to setup kubernetes multi master, please check out my blog on kubernetes high availability:</p>

<p><a href="https://velotio.com/blog/2018/6/15/kubernetes-high-availability-kubeadm" rel="nofollow noreferrer">https://velotio.com/blog/2018/6/15/kubernetes-high-availability-kubeadm</a></p>
