Cluster Setup with kubeadm

kubeadm's Job

kubeadm bootstraps the minimum viable control plane. It deliberately does not install a container runtime, configure kubelet beyond a default, or deploy a CNI — those choices stay yours.

Two commands cover most use:

sudo kubeadm init --pod-network-cidr=10.244.0.0/16 \
  --control-plane-endpoint=lb.internal:6443
kubeadm join lb.internal:6443 \
  --token 9a0fj.0123456789abcdef \
  --discovery-token-ca-cert-hash sha256:<hash>

init generates the CA, writes static pod manifests for etcd, apiserver, scheduler, and controller-manager under /etc/kubernetes/manifests, and emits an admin kubeconfig. join trusts the CA, obtains a serving certificate for the new kubelet, and registers the node.

CNI, Workers, and Certificates

Until a CNI runs, nodes report NotReady and no pod receives an IP. Install one immediately after init:

kubectl apply -f https://github.com/flannel-io/flannel/releases/latest/download/kube-flannel.yml
kubectl get nodes

Add workers with the plain join command; add control-plane members with kubeadm join phase controlplane-prepare against the same endpoint (or stacked etcd joins for HA). Certificates live in /etc/kubernetes/pki — check kubeadm certs check-expiration, renew with kubeadm certs renew all, then restart the static pods. Bootstrap tokens expire after 24 hours; mint fresh ones with kubeadm token create --print-join-command.

Pitfalls and Recovery

Pitfall 1 — skipping the CNI. kubeadm init reports success while CoreDNS stays Pending; beginners then debug DNS instead of networking. The init output warns you for exactly this reason.

Pitfall 2 — a single control-plane endpoint. Without a load balancer or multiple stacked-etcd members, the API server is one failure away from downtime. For HA use --control-plane-endpoint plus kubeadm join --control-plane on additional masters for a quorum of 3.

Interview-ready: recite init → CNI → join, name the artifacts kubeadm creates (CA keys, static manifests, kubeconfigs), and walk recovery: etcd member loss restores from etcdctl snapshot (or is removed and re-added); expired certificates renew then restart the control-plane static pods.