<p>I'm trying to configure an HA kubernetes cluster within AWS, and I've been having no luck using an ELB for the control plane (right now an NLB with a TLS listener, but have tried with an ALB and HTTPS as well). No matter what I do, it always fails on the wait-control-plane step. If I bump up the verbosity of the output, I can see it curl my load balancer endpoint every second during this step, and after 4 minutes it fails out. There isn't any indication on what the response is from the load balancer, here's an example of the output I'm seeing:</p>

<pre><code>curl -k -v -XGET  -H "Accept: application/json, */*" -H "User-Agent: kubeadm/v1.17.3 (linux/amd64) kubernetes/06ad960" 'https://&lt;load-balancer-dns&gt;:443/healthz?timeout=10s'
I0408 13:51:07.899477   27075 round_trippers.go:443] GET https://&lt;load-balancer-dns&gt;:443/healthz?timeout=10s  in 4 milliseconds
I0408 13:51:07.899497   27075 round_trippers.go:449] Response Headers:
</code></pre>

<p>(There is nothing after response headers).</p>

<p>The odd thing is that while init is running, I can pull up that /healthz endpoint in a browser, which results in just a page saying "ok". I can also curl it from another terminal window and I get an HTTP 200 and everything looks good.</p>

<p>Further details - after init fails, there are no crashed docker containers. Kubeadm suggests checking the kubelet service status and journal, and I'm seeing lines like this:</p>

<pre><code>E0408 14:50:36.738997   11649 reflector.go:153] k8s.io/client-go/informers/factory.go:135: Failed to list *v1beta1.CSIDriver: Get https://&lt;load-balancer-dns&gt;:443/apis/storage.k8s.io/v1beta1/csidrivers?limit=500&amp;resourceVersion=0: x509: certificate signed by unknown authority
</code></pre>

<p>Curling that address does not give me any certificate errors, though it does give me a 403. The certificate should be trusted as it's chain is (I believe) imported correctly. So I'm not sure why kubelet is complaining about it.</p>

<p>The problem seems related somehow to the --control-plane-endpoint flag I'm using. <em>If I instead just let it default to the IP of the single instance</em>, <code>kubeadm init</code> will complete successfully and the cluster is initialized and I'm able to join workers to it, etc.</p>

<p>FWIW, my init command looks like this:</p>

<pre><code>kubeadm init --control-plane-endpoint "&lt;load-balancer-dns&gt;:&lt;port&gt;" --ignore-preflight-errors=ImagePull --apiserver-bind-port=30400 --v=10
</code></pre>

<p>What can I check to try to identify exactly what the problem is?</p>

Dan Potter
<p>I answered a similar question here: <a href="https://stackoverflow.com/a/70799078/9284676">https://stackoverflow.com/a/70799078/9284676</a></p>
<p>When using ELB for your <code>--control-plane-endpoint</code> in a HA master scenario, you need to create a <code>Target Group</code> using type <code>IP addresses</code> and not <code>Instances</code>. The text is helpful when creating the Target Group:</p>
<p>&quot;Facilitates routing to multiple IP addresses and network interfaces on the same instance.&quot;</p>
<p>I was then able to successfully init my cluster using this setup:</p>
<pre><code>kubeadm init --control-plane-endpoint &quot;&lt;myELBname&gt;:6443&quot; --upload-certs
</code></pre>
