Part 2 — Install Kubernetes with kubeadm

Run on both master and worker nodes

# 1. Disable swap (K8s requirement)
sudo swapoff -a
sudo swapon --show     # should print nothing

# 2. Enable kernel modules
cat <<EOF | sudo tee /etc/modules-load.d/k8s.conf
overlay
br_netfilter
EOF
sudo modprobe overlay
sudo modprobe br_netfilter

# 3. Sysctl needed for pod networking
cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-iptables  = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward                 = 1
EOF
sudo sysctl --system

# 4. Install CRI-O container runtime
sudo apt-get update -y
sudo apt-get install -y software-properties-common curl apt-transport-https ca-certificates gpg
sudo mkdir -p /etc/apt/keyrings
sudo curl -fsSL https://pkgs.k8s.io/addons:/cri-o:/prerelease:/main/deb/Release.key \
  | sudo gpg --dearmor -o /etc/apt/keyrings/cri-o-apt-keyring.gpg
echo "deb [signed-by=/etc/apt/keyrings/cri-o-apt-keyring.gpg] https://pkgs.k8s.io/addons:/cri-o:/prerelease:/main/deb/ /" \
  | sudo tee /etc/apt/sources.list.d/cri-o.list
sudo apt-get update -y
sudo apt-get install -y cri-o
sudo systemctl enable --now crio

# 5. Install kubeadm, kubelet, kubectl (pinned to 1.29)
curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.29/deb/Release.key \
  | sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg
echo 'deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.29/deb/ /' \
  | sudo tee /etc/apt/sources.list.d/kubernetes.list
sudo apt-get update -y
sudo apt-get install -y kubelet="1.29.0-*" kubectl="1.29.0-*" kubeadm="1.29.0-*" jq
sudo systemctl enable --now kubelet

Only on the master

sudo kubeadm config images pull
sudo kubeadm init

# Make kubectl work as ubuntu user
mkdir -p "$HOME/.kube"
sudo cp -i /etc/kubernetes/admin.conf "$HOME/.kube/config"
sudo chown "$(id -u):$(id -g)" "$HOME/.kube/config"

# Install Calico for pod networking
kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.26.0/manifests/calico.yaml

# Print the join command — COPY IT
kubeadm token create --print-join-command

You'll get something like:

kubeadm join 172.31.8.22:6443 --token abc.xyz --discovery-token-ca-cert-hash sha256:xxxxx

On each worker

sudo kubeadm reset pre-flight checks
sudo <paste-the-join-command> --v=5

Verify on master

kubectl get nodes

Expected:

NAME           STATUS   ROLES           AGE   VERSION
k8s-master     Ready    control-plane   3m    v1.29.0
k8s-worker-1   Ready    <none>          1m    v1.29.0
k8s-worker-2   Ready    <none>          1m    v1.29.0

Test with a pod

kubectl run web --image=nginx --port=80
kubectl expose pod web --type=NodePort --port=80
kubectl get svc web       # note the NodePort e.g. 32000
# curl http://<any-node-public-ip>:32000

Common issues (jump to K8s Troubleshooting series)

• Nodes stuck NotReady → Calico pods not running (check kubectl -n kube-system get pods).
• Join fails: firewall closes 6443 or 10250. Check the SG.
• API server unreachable → time not in sync between nodes (sudo timedatectl status).