<p>There is the following topology:</p>
<img src="https://i.ibb.co/NCYzcJp/Network-Topology.png">
<p>'left-1', 'left-2', 'right-1', 'right-2', 'center' - hosts (DNS names are same).</p>
<p>&quot;Clouds&quot; - networks.</p>
<p>kubeadm, kubectl, kubelet, docker on all hosts installed correctly.</p>
<p>Kubernetes need install like: 'Master-1' on host 'left-1', 'Master-2' on host 'right-1', and workers on hosts 'left-2' and 'right-2'</p>
<p>All hosts ping each other by the domain name. All ports on all hosts are open. No firewall anywhere.</p>
<p>All hosts have access to the internet.</p>
<p>Here there is a manual to install Kubernetes:</p>
<p><a href="https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/high-availability/" rel="nofollow noreferrer">https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/high-availability/</a></p>
<p>If I install Kubernetes only on 'left-1' and 'left-2' - all works fine.</p>
<p>If I install Kubernetes only on 'right-1' and 'right-2' - all works fine.</p>
<p>But if I install on all nodes - pods from the left do not connect to pods from right, and right pods do not connect to left pods.</p>
<p>How to install Kubernetes on the left and right nodes together?</p>
<p>I use a Cilium network.</p>
<p>I installed a Cilium network with the command:</p>
<p>kubectl apply -f <a href="https://raw.githubusercontent.com/cilium/cilium/v1.6.8/install/kubernetes/quick-install.yaml" rel="nofollow noreferrer">https://raw.githubusercontent.com/cilium/cilium/v1.6.8/install/kubernetes/quick-install.yaml</a></p>
<p>When i init the first master node, i describe CIDR: 10.217.0.0/16</p>
<p>I tried to install etcd separately from kubernetes. i've got error:</p>
<p><code>2020-06-25 02:49:37.073290 I | embed: rejected connection from &quot;10.7.0.1:48422&quot; (error &quot;tls: \&quot;10.7.0.1\&quot; does not match any of DNSNames [\&quot;right-1\&quot; \&quot;localhost\&quot;]&quot;, ServerName &quot;&quot;, IPAddresses [&quot;10.8.1.1&quot; &quot;127.0.0.1&quot; &quot;::1&quot; &quot;10.8.1.1&quot;], DNSNames [&quot;right-1&quot; &quot;localhost&quot;])</code></p>
<p>10.7.0.1 - it is <code>center</code>, and center is not a part of the etcd cluster. Why etcd checks it?</p>
<pre><code>[left-1]$ traceroute right-1
traceroute to right-1 (10.8.1.1), 30 hops max, 60 byte packets
 1  center (10.7.0.1)  1.381 ms  1.252 ms  1.159 ms
 2  right-1 (10.8.1.1)  1.068 ms  0.990 ms  0.912 ms
</code></pre>

Евгений Колпаков
<p>We solved the problem.</p>
<p>Cluster must be created by command:</p>
<p><code>kubeadm init --config=kubeadm-config.yaml --upload-certs</code></p>
<p>Where kubeadm-config.yaml contains:</p>
<pre><code>apiVersion: kubeadm.k8s.io/v1beta2
kind: ClusterConfiguration
kubernetesVersion: 1.18.3
controlPlaneEndpoint: &quot;10.7.1.1:6443&quot;
networking:
  podSubnet: &quot;10.217.0.0/16&quot;
etcd:
  local:
    serverCertSANs: [&quot;10.7.1.1&quot;, &quot;10.7.2.2&quot;, &quot;10.7.0.1&quot;, &quot;10.8.1.1&quot;, &quot;10.8.2.2&quot;, &quot;10.8.0.1&quot;]
    peerCertSANs:   [&quot;10.7.1.1&quot;, &quot;10.7.2.2&quot;, &quot;10.7.0.1&quot;, &quot;10.8.1.1&quot;, &quot;10.8.2.2&quot;, &quot;10.8.0.1&quot;]
</code></pre>
<p>Pay attention to yaml-parameters: serverCertSANs, and peerCertSANs : its contain <code>10.7.0.1</code> and <code>10.8.0.1</code> - these IPs come to node in network packages as client IP and must be registered as trusted IP. If you have another IPs in inter-node interaction, it must be registered too.</p>
