<p>I have <code>5 Vm in my GCP</code>, out of which three are supposed to be <code>master1, master2, master3</code> and other two are worker nodes <code>(worker1 &amp; worker 2)</code>. I have created a <code>TCP Loadbalancer(LB)</code> to enable load balancing for the master nodes. I have two sections in the LB:</p>
<pre><code>i)frontend ii)backend
</code></pre>
<p>In the backend, i have defined all master ips there. And the frontend, i generated a static public ip and given port <code>6443 as LB port</code>.</p>
<p>In master1, i sucessfully ran the <code>kubeadm init</code> command as follows:</p>
<pre><code>kubeadm init --control-plane-endpoint=&quot;&lt;LB_IP&gt;:6443&quot; --apiserver-advertise-address=10.128.0.2 --pod-network-cidr=10.244.0.0/16
</code></pre>
<p>where 10.128.0.2 is the master1 internal ip &amp; 10.244.0.0/16 is the network cidr for the kube-flannel.</p>
<p>The kubeadm init runs sucessfully and gives two kubeadm join commands, one to join a new control plane and other to join a new worker node.</p>
<pre><code>You can now join any number of control-plane nodes by copying certificate authorities
and service account keys on each node and then running the following as root:

  kubeadm join LB_IP:6443 --token znnlha.6Gfn1vlkunwpz36b \
    --discovery-token-ca-cert-hash sha256:dc8834a2a5b4ada38a1ab9831e4cae67e9d64cb585458a194018f3ba5a82ac4U \
    --control-plane 

Then you can join any number of worker nodes by running the following on each as root:

kubeadm join LB_IP:6443 --token znnlha.6sfn1vlkunwpz36A \
    --discovery-token-ca-cert-hash sha256:dc8834a2a5b4ada38a1ab9831e4cae68e9d64cb585458a194018f3ba5a82ac4e 
</code></pre>
<p>I am not using <code>--upload-certs</code> for transfering the certificates from one control plane to another. I am doing it manually.</p>
<p>But when I run the above <code>kubeadm join</code> command to add a new control plane, on the one of my other master nodes,say <code>master2</code>, I am getting an error like following :</p>
<pre><code>[preflight] Running pre-flight checks
[preflight] Reading configuration from the cluster...
[preflight] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
error execution phase preflight: unable to fetch the kubeadm-config ConfigMap: failed to get config map: Get &quot;https://LB_IP:6443/api/v1/namespaces/kube-system/configmaps/kubeadm-config?timeout=10s&quot;: dial tcp LB_IP:6443: connect: connection refused
</code></pre>

Bruce wayne - The Geek Killer
<p>I just came across the same issue - in my case the problem was that when hitting GCP's loadbalancer from an instance which is also a target of this loadbalancer, the request will always land on the same instance from where you sent the request.</p>
<p>Based on this:</p>
<ul>
<li>you run <code>kubeadm init</code> on <code>Node A</code> using <code>LB_IP</code>. <code>LB_IP</code> gets resolved to <code>Node A</code>. Everything works as expected, as you are creating a new cluster.</li>
<li>you run <code>kubeadm join</code> on Node B using <code>LB_IP</code>. <code>LB_IP</code> gets resolved to <code>Node B</code>, while the master you just initialized is on <code>Node A</code>. <code>Node B</code> doesn't have anything running on port 6443, thus you get connection refused error.</li>
</ul>
<p>A simple solution is to remove the instance you are running <code>kubeadm join</code> on from the loadbalancer targets. You can re-add it right after successful join.</p>
