How do nodes in a highly available Kubernetes configuration connect to the API server?

How do nodes in a highly available Kubernetes configuration connect to the API server?

• A. Directly to the API server with a secure certificate
• B. Through a VPN tunnel to the API server
• C. Through a load balancer
• D. By using a service mesh sidecar

Answer: (C)

In a highly available cluster, the API server runs on multiple replicas, so clients need a single, stable entry point that can reach any healthy API server. A load balancer provides that endpoint and distributes requests across the API server instances. This setup ensures no single server is a point of failure—if one API server goes down, traffic flows to the others automatically. The kubelets and other components are configured with the API server address pointing to this load balancer (often via a DNS name), and TLS certificates are used for secure authentication as requests pass to any of the API server replicas. Directly connecting to one API server would risk downtime if that instance fails. A VPN tunnel is not the standard mechanism for routine API server access in Kubernetes HA. A service mesh sidecar handles application-to-service traffic between workloads, not the control plane access pattern used by kubelets to reach the API server. Hence, the intended and common approach is through a load balancer.

In a highly available cluster, the API server runs on multiple replicas, so clients need a single, stable entry point that can reach any healthy API server. A load balancer provides that endpoint and distributes requests across the API server instances. This setup ensures no single server is a point of failure—if one API server goes down, traffic flows to the others automatically. The kubelets and other components are configured with the API server address pointing to this load balancer (often via a DNS name), and TLS certificates are used for secure authentication as requests pass to any of the API server replicas.

Directly connecting to one API server would risk downtime if that instance fails. A VPN tunnel is not the standard mechanism for routine API server access in Kubernetes HA. A service mesh sidecar handles application-to-service traffic between workloads, not the control plane access pattern used by kubelets to reach the API server. Hence, the intended and common approach is through a load balancer.