From Single-Master Lab to Production-Style Kubernetes: HA, Backups, Active Directory and Gateway API

Description and use

A kubeadm cluster on VMware was migrated to a production‑style Kubernetes platform with HA control plane, external etcd, automated backups, AD integration, and Gateway API ingress, enabling safe team use.

Problem

A single‑master kubeadm cluster on VMware lacked high availability, backups, time sync, and integrated identity management, making it unsafe for team use.

Outcome

The lab cluster was transformed into a production‑style Kubernetes platform with HA control plane, external etcd, automated backups, AD‑based identity, and Gateway API ingress, enabling safe team use on plain VMware VMs.

Workflow

• 01-access: create least‑privilege deployer ServiceAccount and kubeconfig
• 02-ha-control-plane: prepare new managers, migrate to VIP in three steps, test failover, roll back if needed
• 03-time-sync: configure chrony against domain controllers
• 04-backups: set up Velero, S3 gateway, weekly timer, and perform restore drill
• 05-dns: use PowerShell to create A and PTR records with conflict detection
• 06-active-directory: join DNS, realm, Kerberos SSH, Dex OIDC, API‑server auth config, RBAC for kubectl
• 07-gateway: deploy MetalLB, HAProxy Unified Gateway, shared Gateway, and demo app with HTTPRoute

Evidence

Our on‑prem lab cluster was a typical kubeadm build on VMware: one control‑plane node, no backups, local accounts on every host, and clocks drifting by up to six minutes.

Source

High availability: 3 control‑plane nodes behind a floating API VIP (kube‑vip, ARP mode). The running cluster was migrated from a single‑node endpoint to the VIP, with automatic rollback. Measured failover: about 1 second.

Source

Backups and DR: Velero (including volume data) to a self‑hosted S3 store, plus etcd snapshots, on a weekly systemd timer. A scripted restore drill proves the backups actually restore.

Source

Active Directory for Linux: Every node joined to AD (realmd/SSSD), AD‑group‑based SSH and sudo, Kerberos SSO between nodes.

Source

Ingress: MetalLB (L2) plus HAProxy Unified Gateway with Gateway API. One shared Gateway, wildcard TLS, and users publish apps with a single HTTPRoute.

Source