Setting up a Kubernetes cluster with kubeadm

A walkthrough for setting up a 2-node Kubernetes cluster using kubeadm. Both nodes here are Ubuntu Server 20.04 LTS. The same flow works for larger clusters — you just join more workers at the end.

Prep both nodes

Disable swap

Kubernetes requires swap to be off. There's a flag to ignore swap, but it's not recommended. Disable swap on every node in the cluster:

1swapoff -a2sudo rm /swap.img3swapon --show

To make it permanent, also remove the swap entry from /etc/fstab.

Network and iptables

Load br_netfilter and tell iptables to see bridged traffic. (See the official kubeadm install docs for the canonical version.) Run on both nodes:

1cat <<EOF | sudo tee /etc/modules-load.d/k8s.conf2br_netfilter3EOF45cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf6net.bridge.bridge-nf-call-ip6tables = 17net.bridge.bridge-nf-call-iptables = 18EOF

Install containerd

Containerd is the container runtime Kubernetes will talk to.

1cat <<EOF | sudo tee /etc/modules-load.d/containerd.conf2overlay3br_netfilter4EOF56modprobe overlay7modprobe br_netfilter89cat <<EOF | sudo tee /etc/sysctl.d/99-kubernetes-cri.conf10net.bridge.bridge-nf-call-iptables  = 111net.ipv4.ip_forward                 = 112net.bridge.bridge-nf-call-ip6tables = 113EOF1415sysctl --system1617apt-get update18apt-get upgrade -y19apt-get install containerd -y20mkdir -p /etc/containerd21containerd config default | tee /etc/containerd/config.toml22systemctl restart containerd

Install kubeadm, kubelet, kubectl

1apt-get update2apt-get install -y apt-transport-https ca-certificates curl3curl -fsSLo /usr/share/keyrings/kubernetes-archive-keyring.gpg https://packages.cloud.google.com/apt/doc/apt-key.gpg4echo "deb [signed-by=/usr/share/keyrings/kubernetes-archive-keyring.gpg] https://apt.kubernetes.io/ kubernetes-xenial main" | sudo tee /etc/apt/sources.list.d/kubernetes.list5apt-get update6apt-get install -y kubelet kubeadm kubectl7apt-mark hold kubelet kubeadm kubectl

apt-mark hold pins the versions so a routine apt upgrade doesn't yank Kubernetes out from under you.

The repo URL apt.kubernetes.io was retired in 2023 — newer installs should use pkgs.k8s.io with a per-minor-version repo. Check the current docs for the latest paths.

Init the control-plane node

Run this on the master only — not on the workers.

Pull the images first:

1kubeadm config images pull

Now bring up the control plane:

1kubeadm init --pod-network-cidr=172.16.0.0/16 \2  --apiserver-advertise-address=192.168.10.40 \3  --control-plane-endpoint=192.168.10.40

What the flags mean:

• --pod-network-cidr — subnet for the pod network. Has to match what your CNI plugin expects.
• --apiserver-advertise-address — IP the API server will advertise. Optional, but useful when the host has multiple NICs.
• --control-plane-endpoint — endpoint clients use to reach the API server (a DNS name or IP). Set this even on a single-master cluster — it's a pain to add later if you ever add more masters.

Configure kubectl access

1mkdir -p $HOME/.kube2cp -i /etc/kubernetes/admin.conf $HOME/.kube/config3chown $(id -u):$(id -g) $HOME/.kube/config

Verify:

1kubectl get nodes

Join the worker

kubeadm init printed a kubeadm join command at the end of its output. Copy that and run it on the worker node — it'll register and join the cluster.

If you've lost the join command, regenerate it on the master with kubeadm token create --print-join-command.

Install a CNI plugin

Out of the box, the nodes are NotReady because there's no pod network. Install Calico:

1curl https://docs.projectcalico.org/manifests/calico-typha.yaml -o calico.yaml2kubectl apply -f calico.yaml

Once Calico's pods are up, the node statuses flip to Ready and the cluster is usable.

That's it 🙂

References

• Installing Kubernetes Cluster with deployment tools