Installation
Installation
This domain tests building and validating a cluster: node prerequisites, container runtime setup, kubeadm init and join, CNI installation, and upgrade mechanics. Questions often hinge on why a node is NotReady or why kubeadm preflight fails.
Prerequisites and runtime
Disable swap; enable required kernel modules and sysctls; install a CRI-compatible runtime and configure the kubelet to use it. Ensure unique hostnames, MAC addresses, and product UUIDs, and open control-plane ports. kubeadm preflight checks catch most of these before init. An HA control plane needs a stable endpoint such as a VIP or DNS name.
kubeadm workflow
kubeadm init writes certificates, static Pod manifests, and admin kubeconfig, then prints a join command. Install a CNI plugin before expecting Pods to become Ready. kubeadm join authenticates with a bootstrap token or certificate key. Upgrades are ordered: control plane first, then kubelet and kubectl, then worker nodes; drain before upgrading a node.
Worked example
A worker joins successfully but kubectl get nodes shows NotReady. kubectl describe node worker1 reports NetworkPluginNotReady and cni config uninitialized. The node is registered, but no CNI is installed. Apply the CNI manifest on the control plane; the CNI DaemonSet schedules a Pod on the new node and kubelet becomes Ready. Reasoning: kubelet readiness depends on runtime and network readiness, not just a successful join.
Traps
Do not run kubeadm init twice without reset; use kubeadm reset first. Swap left on causes kubelet failure. Missing CNI is the most common NotReady cause. Certificate expiry can break upgrades; check kubeadm certs check-expiration.