Setup Kubernetes Cluster Using Kubeadm
Kubeadm Setup Prerequisites
Following are the prerequisites for Kubeadm Kubernetes cluster setup.
- Minimum two Ubuntu nodes [One master and one worker node]. You can have more worker nodes as per your requirement.
- The master node should have a minimum of 2 vCPU and 2GB RAM.
- For the worker nodes, a minimum of 1vCPU and 2 GB RAM is recommended.
- 10.X.X.X/X network range with static IPs for master and worker nodes. We will be using the 192.x.x.x series as the pod network range that will be used by the Calico network plugin. Make sure the Node IP range and pod IP range don't overlap.
On cp1:
sudo hostnamectl set-hostname cp1
On worker1:
sudo hostnamectl set-hostname w1
On worker2:
sudo hostnamectl set-hostname w2
Add entries to /etc/hosts on all nodes:
sudo nano /etc/hosts
Add the following to the end of the file, replacing with your IP addresses:
10.0.0.10 cp1 10.0.0.11 w1 10.0.0.12 w2
This allows nodes to address each other by name rather than by IP address.
1. General system preparation (all nodes)
1.1. Updating packages
sudo apt update sudo apt upgrade -y
We are simply updating the system to avoid bugs caused by old packages.
1.2. Disable swap (required for kubeadm)
On all nodes:
sudo swapoff -a sudo sed -i '/ swap / s/^\(.*\)$/#\1/g' /etc/fstab
Verification:
free -h
1.3. Kernel modules and sysctl (for the grid)↵↵On each node:
cat <<EOF | sudo tee /etc/modules-load.d/containerd.conf overlay br_netfilter EOF
sudo modprobe overlay sudo modprobe br_netfilter
Now sysctl:
cat <<EOF | sudo tee /etc/sysctl.d/kubernetes.conf net.bridge.bridge-nf-call-ip6tables = 1 net.bridge.bridge-nf-call-iptables = 1 net.ipv4.ip_forward = 1 EOF
sudo sysctl --system
This includes correct traffic handling through the Linux bridge and forwarding — mandatory for CNI (Calico).
1.4. (For lab) Disable UFW
If UFW is enabled and this is a clean lab:
sudo ufw disable
In Prod, of course, it is better to open the necessary ports, but for the first build it is easier without a firewall.
2. Install containerd (all nodes)
At each node:
sudo apt install -y containerd
Generate default configuration:
sudo mkdir -p /etc/containerd sudo containerd config default | sudo tee /etc/containerd/config.toml > /dev/null
Restart and switch on:
sudo systemctl restart containerd sudo systemctl enable containerd sudo systemctl status containerd
SystemdCgroup = true → kubelet and containerd use the same cgroup driver (systemd). This is now considered best practice.
3. Install kubeadm/kubelet/kubectl 1.34 (all nodes)
According to the official documentation for v1.34:
3.1. Repo packages
At each node:
sudo apt-get update sudo apt-get install -y apt-transport-https ca-certificates curl gpg
3.2. GPG key and pkgs.k8s.io repository (v1.34)↵↵Ubuntu 22.04 already has /etc/apt/keyrings, but if it doesn't:
sudo mkdir -p -m 755 /etc/apt/keyrings
Repository key:
curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.34/deb/Release.key \
| sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg
Add repo specifically for Kubernetes 1.34:
echo "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.34/deb/ /" \
| sudo tee /etc/apt/sources.list.d/kubernetes.list
3.3. Installing kubeadm/kubelet/kubectl
sudo apt-get update sudo apt-get install -y kubelet kubeadm kubectl sudo apt-mark hold kubelet kubeadm kubectl
Repository v1.34 ensures that branch 1.34.x is installed. apt-mark hold will prevent accidental updates to other minor versions during apt upgrade.
(Not required, but you can enable kubelet immediately; it will run and wait for kubeadm init / join):
sudo systemctl enable --now kubelet
5. Control-plane initialisation (cp1 only)
Now we create a cluster on cp1.
5.1. kubeadm init with pod-CIDR for Calico
Calico uses 192.168.0.0/16 by default. For convenience, we will use the same:
On cp1:
sudo kubeadm init \ --apiserver-advertise-address=10.0.0.10 \ --pod-network-cidr=192.168.0.0/16
--apiserver-advertise-address— IP cp1, which everyone will use to access the API.--pod-network-cidr— The IP range for pods that Calico will use.
At the end, kubeadm will output:
- message about successful initialisation;
- The command kubeadm join ... — be sure to copy it somewhere (we will use it on the workers).
5.2. Configuring kubectl for the sadmin user (cp1)
Currently, kubeconfig is located in /etc/kubernetes/admin.conf and belongs to root.
On cp1 under sadmin:
mkdir -p $HOME/.kube sudo cp /etc/kubernetes/admin.conf $HOME/.kube/config sudo chown $(id -u):$(id -g) $HOME/.kube/config
Verification:
kubectl get nodes
Until the network is up, the node may be NotReady — this is normal.
6. Install Calico 3.31 (cp1 only)
We take the latest Calico 3.31.1 from the official on-prem instructions.
6.1. Tigera Operator + CRD
On cp1:
kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.31.1/manifests/operator-crds.yaml kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.31.1/manifests/tigera-operator.yaml
This sets the Calico operator, which then rolls out the necessary components across the nodes itself.
6.2. Calico configuration (custom-resources)
By default, we use iptables-dataplane (without eBPF, so as not to complicate things for now).
On cp1:
curl -O https://raw.githubusercontent.com/projectcalico/calico/v3.31.1/manifests/custom-resources.yaml kubectl create -f custom-resources.yaml
(If you want eBPF in the future, there is also custom-resources-bpf.yaml.)
6.3. Verify that Calico has started
On cp1:
watch kubectl get tigerastatus
We are waiting until everything is AVAILABLE=True:
NAME AVAILABLE PROGRESSING DEGRADED SINCE calico True False False ... ippools True False False ... ...
And let's look at the pods:
kubectl get pods -n calico-system kubectl get pods -n kube-system kubectl get nodes
cp1 should transition to Ready status.
7. Make the control plane "clean" (without workload pods)
By default, in 1.34, the control plane can accept normal pods (taint is not set automatically).
You don't need this, so let's set taint right away:
On cp1:
kubectl taint nodes cp1 node-role.kubernetes.io/control-plane=:NoSchedule
Verification:
kubectl describe node cp1 | grep -i Taint
It should be something like:
Taints: node-role.kubernetes.io/control-plane:NoSchedule
Now the scheduler will NOT place regular pods on cp1. Only system components will remain there (kube-apiserver, etcd, kube-controller-manager, scheduler, Calico DaemonSet, etc.).
8. Connect worker1 and worker2
8.1. Obtain the join command (if lost)
If you did not save the output of kubeadm init, on cp1:
sudo kubeadm token create --print-join-command
Example:
kubeadm join 10.0.0.10:6443 --token abcdef.0123456789abcdef \
--discovery-token-ca-cert-hash sha256:xxxxxxxx...
8.2. Perform a join on worker1 / worker2↵↵On worker1:
sudo kubeadm join 10.0.0.10:6443 --token abcdef.0123456789abcdef \
--discovery-token-ca-cert-hash sha256:xxxxxxxx...
On worker2:
sudo kubeadm join 10.0.0.10:6443 --token abcdef.0123456789abcdef \
--discovery-token-ca-cert-hash sha256:xxxxxxxx...
Here, a token and CA hash are used to enable workers to securely join the cluster.
After that, on cp1:
kubectl get nodes
Expected result:
NAME STATUS ROLES AGE VERSION cp1 Ready control-plane 20m v1.34.x worker1 Ready <none> 5m v1.34.x worker2 Ready <none> 3m v1.34.x
If workers are NotReady for some time, wait until kube-proxy + Calico catch up and start.
9. Verification: only on worker nodes
Let's create a test deployment:
On cp1:
kubectl create deployment nginx --image=nginx --replicas=3 kubectl expose deployment nginx --port=80 --type=NodePort
Let's see:
kubectl get pods -o wide
All nginx pods should be on worker1 and worker2, but not on cp1.↵↵If you see a pod on cp1, it means that taint did not apply → once again:
kubectl taint nodes cp1 node-role.kubernetes.io/control-plane=:NoSchedule --overwrite kubectl rollout restart deploy nginx
✅ 1. How to delete these pods (Deployment + Service)
You created:
- Deployment: nginx
- Service: nginx
To remove:
kubectl delete service nginx
Remove Deployment:
kubectl delete deployment nginx
Let's check:
kubectl get pods kubectl get svc
📌 If you want to remove EVERYTHING related to nginx with a single command:
kubectl delete deploy,svc nginx
Установить пакет bash-completion (если ещё нет)
sudo apt install bash-completion -y
Активировать автодополнение в текущей сессии:
source /etc/bash_completion
Включить autocomplete для kubectl
echo "source <(kubectl completion bash)" >> ~/.bashrc source ~/.bashrc