<p>I am trying to create an HA cluster with HAProxy and below 3 master nodes.</p>
<p>On the proxy I am following the official documentation <a href="https://github.com/kubernetes/kubeadm/blob/master/docs/ha-considerations.md#haproxy-configuration" rel="nofollow noreferrer">High Availability Considerations/haproxy configuration</a>. I am passing the ssl verification to the Server Api <code>option ssl-hello-chk</code>.</p>
<p>Having said that I can understand that on my ~/.kube/config file I am using the wrong certificate-authority-data that I picked up from the prime master node e.g.:</p>
<pre class="lang-sh prettyprint-override"><code>apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: &lt;something-something&gt;
    server: https://ip:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: kubernetes-admin
  name: kubernetes-admin@kubernetes
current-context: kubernetes-admin@kubernetes
kind: Config
preferences: {}
users:
- name: kubernetes-admin
  user:
    client-certificate-data: &lt;something-something&gt;
    client-key-data: &lt;something-something&gt;
    token: &lt;something-something&gt;
</code></pre>
<p>I found a relevant ticket on GitHub <a href="https://github.com/kubernetes/kubectl/issues/823#issuecomment-594985664" rel="nofollow noreferrer">Unable to connect to the server: x509: certificate signed by unknown authority/onesolpark</a> which makes sense that I should extract the certificate-authority-data of the proxy.</p>
<p>On this case I assume that I should extract the certificate-authority-data from one of the certs in <code>/etc/kubernetes/pki/</code> most likely <code>apiserver.*</code>?</p>
<p>Any idea on this?</p>
<p>Thanks in advance for your time and effort.</p>

Thanos
<p>Okay I managed to figured it out.</p>
<p>When a k8s admin decides to create a HA ckuster he should have minimum one LB but ideally he should have two LB that both are able to LB towards all Master nodes (3,5 etc).</p>
<p>So when the user wants to send a request to Server API towards one of the Master nodes, the request will go through ideally through a Virtual IP and forward to one the LB. As a second step the LB will forward the request to one of the Master nodes.</p>
<p>The problem that I wanted to solve is that the Server API had no record of the IP of the LB(s).</p>
<p>In result the user will get the error <code>Unable to connect to the server: x509: certificate signed by unknown authority</code>.</p>
<p>The solution can be found on this relevant question <a href="https://devops.stackexchange.com/questions/9483/how-can-i-add-an-additional-ip-hostname-to-my-kubernetes-certificate">How can I add an additional IP / hostname to my Kubernetes certificate?</a>.</p>
<p>Straight answer is simply add the LB(s) in the kubeadm config file before launch of Master Prime node e.g.:</p>
<pre class="lang-sh prettyprint-override"><code>apiServer:
  certSANs:
  - &quot;ip-of-LB1&quot;
  - &quot;domain-of-LB1&quot;
  - &quot;ip-of-LB2&quot;
  - &quot;domain-of-LB2&quot; # etc etc
  extraArgs:
    authorization-mode: Node,RBAC
  timeoutForControlPlane: 4m0s
</code></pre>
<p>But as it is also mentioned the analytical documentation can be found here <a href="https://blog.scottlowe.org/2019/07/30/adding-a-name-to-kubernetes-api-server-certificate/" rel="nofollow noreferrer">Adding a Name to the Kubernetes API Server Certificate</a>.</p>
<p>Also if the user decides to create its own certificates and not use the default self sign certificates (populated from k8s by default) he can add the nodes manually as documented from the official site <a href="https://kubernetes.io/docs/concepts/cluster-administration/certificates/" rel="nofollow noreferrer">Certificates</a>.</p>
<p>Then if you want to copy the ca.crt is under the default dir <code>/etc/kubernetes/pki/ca.crt</code> (unless defined differently), or the user can choose to simply copy the <code>~/.kube/config</code> file for the kubectl communication.</p>
<p>Hope this helps someone else to spend less time in the future.</p>
