Understanding Kubernetes’ HA
Deploying our applications with HA requires a Kubernetes environment with HA. At least three replicas of etcd are required and two replicas of other control plane components. Some production architectures deploy etcd externally in dedicated hosts, while other components are deployed in additional master nodes. This isolates completely the key-value store from the rest of the control plane components, improving security, but it adds additional complexity to the environment. You will usually find three master nodes and enough worker nodes to deploy your production applications.
A Kubernetes installation configures and manages its own internal certificate authority (CA) and then deploys certificates for the different control plane and kubelet components. This ensures TLS communications between kube-apiserver and other components. The following architecture diagram shows the different Kubernetes components in a single-master node scenario:
