From Single-Master Lab to Production-Style Kubernetes: HA, Backups, Active Directory and Gateway API

说明与用途

将 VMware 上的 kubeadm 集群迁移为生产级 Kubernetes 平台，具备高可用控制平面、外部 etcd、自动备份、Active Directory 集成和 Gateway API 入站，支持团队安全使用。

问题

A single‑master kubeadm cluster on VMware lacked high availability, backups, time sync, and integrated identity management, making it unsafe for team use.

结果

The lab cluster was transformed into a production‑style Kubernetes platform with HA control plane, external etcd, automated backups, AD‑based identity, and Gateway API ingress, enabling safe team use on plain VMware VMs.

工作流

• 01-access: create least‑privilege deployer ServiceAccount and kubeconfig
• 02-ha-control-plane: prepare new managers, migrate to VIP in three steps, test failover, roll back if needed
• 03-time-sync: configure chrony against domain controllers
• 04-backups: set up Velero, S3 gateway, weekly timer, and perform restore drill
• 05-dns: use PowerShell to create A and PTR records with conflict detection
• 06-active-directory: join DNS, realm, Kerberos SSH, Dex OIDC, API‑server auth config, RBAC for kubectl
• 07-gateway: deploy MetalLB, HAProxy Unified Gateway, shared Gateway, and demo app with HTTPRoute

证据

Our on‑prem lab cluster was a typical kubeadm build on VMware: one control‑plane node, no backups, local accounts on every host, and clocks drifting by up to six minutes.

来源

High availability: 3 control‑plane nodes behind a floating API VIP (kube‑vip, ARP mode). The running cluster was migrated from a single‑node endpoint to the VIP, with automatic rollback. Measured failover: about 1 second.

来源

Backups and DR: Velero (including volume data) to a self‑hosted S3 store, plus etcd snapshots, on a weekly systemd timer. A scripted restore drill proves the backups actually restore.

来源

Active Directory for Linux: Every node joined to AD (realmd/SSSD), AD‑group‑based SSH and sudo, Kerberos SSO between nodes.

来源

Ingress: MetalLB (L2) plus HAProxy Unified Gateway with Gateway API. One shared Gateway, wildcard TLS, and users publish apps with a single HTTPRoute.

来源