(K8s) Kubernetes lab 201 Building single master Kubernetes cluster

In this lab we will practice building single master Kubernetes cluster with kubeadm

Procure two virtual machines.

In this lab we will be using two Nanode 1 GB shared CPU VM.

check https://www.sharelearn.net/practice/cloudlabs/linodelab101 to get VM on Linode cloud.

Note: we will get commission when you use above link

SSH into first node

Set hostname to master.

hostname master

Remove any previously installed docker instance

sudo apt-get remove docker docker-engine docker.io containerd runc

sudo apt-get update
sudo apt-get install \
    ca-certificates \
    curl \
    gnupg \
    lsb-release

Add Docker’s official GPG key

curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg

Use the following command to set up the stable repository. To add the nightly or test repository, add the word nightly or test (or both) after the word stable in the commands below. Learn about nightly and test channels.

echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu \
  $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

Update repository and install containerd

sudo apt-get update
sudo apt-get install containerd.io

Run below steps to use containerd as CRI runtime.

rm /etc/containerd/config.toml

cat <<EOF | sudo tee /etc/modules-load.d/containerd.conf
overlay
br_netfilter
EOF

sudo modprobe overlay
sudo modprobe br_netfilter

# Setup required sysctl params, these persist across reboots.
cat <<EOF | sudo tee /etc/sysctl.d/99-kubernetes-cri.conf
net.bridge.bridge-nf-call-iptables  = 1
net.ipv4.ip_forward                 = 1
net.bridge.bridge-nf-call-ip6tables = 1
EOF

# Apply sysctl params without reboot
sudo sysctl --system


systemctl restart containerd

Confirm containerd is running

systemctl status containerd

Disable swap in order for the kubelet to work properly.

sudo swapoff -a

Letting iptables see bridged traffic

Make sure that the br_netfilter module is loaded. This can be done by running lsmod | grep br_netfilter. To load it explicitly call sudo modprobe br_netfilter.

As a requirement for your Linux Node’s iptables to correctly see bridged traffic, you should ensure net.bridge.bridge-nf-call-iptables is set to 1 in your sysctl config, e.g.

cat <<EOF | sudo tee /etc/modules-load.d/k8s.conf
br_netfilter
EOF

cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
EOF
sudo sysctl --system

Update the apt package index and install packages needed to use the Kubernetes apt repository:

sudo apt-get update
sudo apt-get install -y apt-transport-https ca-certificates curl

Download the Google Cloud public signing key:

sudo curl -fsSLo /usr/share/keyrings/kubernetes-archive-keyring.gpg https://packages.cloud.google.com/apt/doc/apt-key.gpg

Add the Kubernetes apt repository:

echo "deb [signed-by=/usr/share/keyrings/kubernetes-archive-keyring.gpg] https://apt.kubernetes.io/ kubernetes-xenial main" | sudo tee /etc/apt/sources.list.d/kubernetes.list

Update apt package index, install kubelet, kubeadm and kubectl, and pin their version:

sudo apt-get update
sudo apt-get install -y kubelet kubeadm kubectl
sudo apt-mark hold kubelet kubeadm kubectl

Initialize kubernetes cluster with kubeadm command use 192.168.0.0/16 as subnet for pods

kubeadm init --apiserver-advertise-address <private IP of VM> --pod-network-cidr 192.168.0.0/16 --ignore-preflight-errors=NumCPU  --ignore-preflight-errors=Mem

To make kubectl work for your non-root user, run these commands, which are also part of the kubeadm init output.

mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

Alternatively, if you are the root user, you can run:

export KUBECONFIG=/etc/kubernetes/admin.conf

Check status of master node, it will be in NotReady state as CNI is not present

kubectl get nodes

Install Clico as CNI

kubectl apply -f https://projectcalico.docs.tigera.io/manifests/calico.yaml

Master server is ready confirm by running

kubectl get nodes

Node should be in ready state

SSH into second node

Set hostname to node2.

hostname node2