Build a Kubernetes Cluster with kubeadm

Arch (AUR):

yay -S kubeadm kubelet kubectl-bin
sudo systemctl enable kubelet

Step 3 — Initialize the Control Plane

Run this only on the control-plane node. Choose a Pod CIDR that does not overlap your node network; the example below suits Calico. For Cilium, any non-overlapping CIDR works.

sudo kubeadm init \
  --pod-network-cidr=192.168.0.0/16 \
  --control-plane-endpoint="$(hostname -f):6443" \
  --upload-certs

On success, kubeadm prints a kubeadm join command with a token and CA hash. Save it. Then configure kubectl for your user:

mkdir -p $HOME/.kube
sudo cp /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

Step 4 — Install a CNI Plugin

Nodes stay in NotReady until a CNI plugin is running. Pick one and apply it to the control plane before joining workers.

Calico (stable, widely deployed)

kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.28.0/manifests/tigera-operator.yaml
kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.28.0/manifests/custom-resources.yaml

Confirm Calico pods reach Running before proceeding:

kubectl get pods -n calico-system --watch

Cilium (eBPF-based, richer observability)

CILIUM_CLI_VERSION=$(curl -s https://raw.githubusercontent.com/cilium/cilium-cli/main/stable.txt)
curl -L --fail --remote-name-all \
  "https://github.com/cilium/cilium-cli/releases/download/${CILIUM_CLI_VERSION}/cilium-linux-amd64.tar.gz"
sudo tar xzvf cilium-linux-amd64.tar.gz -C /usr/local/bin
cilium install --version 1.15.5
cilium status --wait

Cilium requires Linux kernel 5.4 or later for its eBPF dataplane. Check with uname -r before choosing it.

Step 5 — Join Worker Nodes

On each worker, run the join command printed by kubeadm init. It looks like:

sudo kubeadm join 203.0.113.10:6443 \
  --token abcdef.0123456789abcdef \
  --discovery-token-ca-cert-hash sha256:<hash>

Tokens expire after 24 hours. Generate a new one on the control plane if needed:

kubeadm token create --print-join-command

Verify all nodes are Ready from the control plane:

kubectl get nodes -o wide

Step 6 — Harden kubelet

The default kubelet configuration is permissive. Apply these settings by patching the kubelet config on every node.

# View current kubelet config
kubectl get --raw /api/v1/nodes/$(hostname)/proxy/configz | python3 -m json.tool

Create a KubeletConfiguration drop-in. Edit /etc/kubernetes/kubelet-hardening.yaml on each node:

cat <

sudo mkdir -p /etc/systemd/system/kubelet.service.d
cat <

# Update the repo to v1.31, then:
sudo apt-get update && sudo apt-get install -y kubeadm=1.31.0-1.1
sudo kubeadm upgrade plan
sudo kubeadm upgrade apply v1.31.0
sudo apt-get install -y kubelet=1.31.0-1.1 kubectl=1.31.0-1.1
sudo systemctl daemon-reload && sudo systemctl restart kubelet

# From the control plane, drain the node first:
kubectl drain worker-01 --ignore-daemonsets --delete-emptydir-data

# Then on the worker itself:
sudo apt-get update && sudo apt-get install -y kubeadm=1.31.0-1.1
sudo kubeadm upgrade node
sudo apt-get install -y kubelet=1.31.0-1.1 kubectl=1.31.0-1.1
sudo systemctl daemon-reload && sudo systemctl restart kubelet

# Back on the control plane, uncordon:
kubectl uncordon worker-01

kubectl get nodes
kubectl get pods -A
kubectl cluster-info

kubectl run nginx --image=nginx --port=80
kubectl expose pod nginx --type=NodePort --port=80
kubectl get svc nginx