Hands-on Lab·Certified Kubernetes Administrator
Highly Available Control Planes and etcd Quorum
A three-node control plane built from scratch: keepalived and haproxy in front, stacked etcd behind, and a controlPlaneEndpoint that has to exist before the first init. Then the two failures worth rehearsing, a VIP moving and quorum lost.
Cluster Architecture and Configuration Guide 21 of 103 Advanced
- Kubernetes1.36.4
- etcd3.6.8
- keepalived + haproxydistribution packages
- CNICalico v3.32.1
- TimeAbout 75 min
- Reviewed21 August 2026
Written against the versions above. Stacked etcd, the default kubeadm HA topology. An external etcd cluster is the other option and changes the join procedure but not the quorum arithmetic.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA2001 | 192.168.0.181 | Ubuntu 26.04 LTS | Control Plane Node | 2 Core | 4 GB | 50 GB |
| CKA2001-NODE01 | 192.168.0.182 | Ubuntu 26.04 LTS | Control Plane Node | 2 Core | 4 GB | 50 GB |
| CKA2001-NODE02 | 192.168.0.183 | Ubuntu 26.04 LTS | Control Plane Node | 2 Core | 4 GB | 50 GB |
Before you start
- The kubeadm cluster install guide, since this is that procedure with one flag added.
- The etcd guides, because quorum is the whole subject.
- Three machines with kubeadm, kubelet and a container runtime installed, and a free address on their subnet for the VIP.
-
Three, not two, and why
-
The endpoint has to exist before the first init
-
init with --control-plane-endpoint and --upload-certs
-
Joining the other two
-
What three control planes actually look like
-
The VIP moves, and kubectl does not notice
-
Losing one member, and the health-check window
-
Losing two: quorum gone, and it reports Forbidden