Kubernetes: Installing and Deploying Clusters

Devops

Difficulty: Advanced

2 min read 12/02/2026

A complete guide to installing Kubernetes with kubeadm, deploying containerized applications and administering your clusters in production.

Back to tutorials

Key takeaways

Every node has to be prepared before kubeadm: swapoff -a plus swap commented out in /etc/fstab (the scheduler needs exact memory metrics), the overlay and br_netfilter modules, then net.bridge.bridge-nf-call-iptables=1 and net.ipv4.ip_forward=1. Budget at least 2 vCPU and 2 GB of RAM per machine.
The containerd trap: after containerd config default, you must flip SystemdCgroup = false to true in /etc/containerd/config.toml so the runtime matches the systemd cgroup driver kubelet expects, then restart containerd.
After kubeadm init --pod-network-cidr=10.244.0.0/16, nodes stay NotReady until a CNI is deployed: Flannel to move fast, Calico when you need NetworkPolicies. Write down the kubeadm join command printed at the end of the init, it carries the worker token.
A Deployment updates without downtime through strategy.rollingUpdate (maxUnavailable: 1, maxSurge: 1) combined with a readinessProbe: kubectl set image deployment/webapp webapp=nginx:1.27 triggers the rollout, kubectl rollout status follows it and kubectl rollout undo rolls it back.
Kubernetes Secrets are base64-encoded, not encrypted: turn on encryption at rest with EncryptionConfiguration (or move to Vault / Sealed Secrets), and back it up with RBAC, deny-all NetworkPolicies and the pod-security.kubernetes.io/enforce: restricted label on sensitive namespaces.

About Kubernetes
Kubernetes (K8s) is an open source container orchestration platform developed by Google. It automates the deployment, scaling and management of containerized applications across clusters of machines. This tutorial guides you from installation to production.

Prerequisites

Machines: A minimum of 2 servers (1 control plane + 1 worker) with 2 CPUs and 2 GB of RAM each
Operating system: Ubuntu 22.04 LTS or Debian 12 (recommended)
Network: Full network connectivity between all machines in the cluster
Container runtime: containerd or Docker Engine installed on each node
Privileges: Root or sudo access on all machines
Open ports: 6443 (API), 2379-2380 (etcd), 10250-10252 (kubelet/scheduler/controller)

Kubernetes Architecture

Understanding the architecture of Kubernetes is essential before starting the installation. A K8s cluster consists of two types of nodes.

Control Plane (Master node)

kube-apiserver: The entry point for all REST requests. It is the central component that exposes the Kubernetes API.
etcd: A distributed key-value database that stores the complete state of the cluster (configurations, secrets, pod state).
kube-scheduler: Assigns pods to nodes based on available resources, constraints and affinities.
kube-controller-manager: Runs the control loops that monitor the state of the cluster and make the necessary corrections.

Worker Nodes

kubelet: The agent that runs on each worker node and ensures that the containers defined in the pods are running.
kube-proxy: Manages the network rules on each node to route traffic to the correct pods.
Container Runtime: The container execution engine (containerd, CRI-O).

Good to know
In production, it is recommended to have at least 3 control plane nodes for the high availability of etcd and the API server.

Premium Content

This advanced tutorial is reserved for premium members.

9,90€ / month

All advanced tutorials
New content every week
Progress tracking
Cancel anytime

Written by

Morgann Riu

Cybersecurity and Linux administration expert. I share my knowledge through free tutorials and training to help system administrators and developers secure their infrastructures.

My profile LinkedIn GitHub

Frequently asked questions

What is the difference between Kubernetes and Docker Swarm?

Kubernetes is a more complete and complex container orchestrator than Docker Swarm. K8s offers auto-scaling, advanced rolling updates, fine-grained network management with Ingress, RBAC, and a very rich plugin ecosystem. Docker Swarm is simpler to set up but less suited to large-scale production environments.

How many nodes does a Kubernetes cluster need at a minimum?

A functional Kubernetes cluster requires at least one control plane node and one worker node. In production, it is recommended to have 3 control plane nodes for high availability and at least 2 worker nodes for workload redundancy.

Why must swap be disabled for Kubernetes?

Kubernetes requires swap to be disabled because the scheduler must know precisely the amount of memory available on each node. Swap distorts the metrics and can cause unpredictable behavior in managing the resource limits of pods. Since version 1.28, experimental swap support exists via the NodeSwap feature gate.

How do you upgrade a Kubernetes cluster without service interruption?

Use the rolling update strategy by configuring maxUnavailable and maxSurge in your Deployment. Kubernetes will progressively replace the old pods with new ones. For upgrades of the cluster itself, drain the nodes one by one with kubectl drain, update kubeadm/kubelet/kubectl, then bring the node back with kubectl uncordon.

What is the difference between a PersistentVolume and a PersistentVolumeClaim?

A PersistentVolume (PV) represents a physical storage resource in the cluster, provisioned by an administrator or dynamically via a StorageClass. A PersistentVolumeClaim (PVC) is a storage request made by a pod. The PVC automatically binds to a PV that is compatible in terms of size and access mode.

How do you secure a Kubernetes cluster in production?

Enable RBAC to control access, apply NetworkPolicies to isolate pods, use PodSecurityAdmission to restrict container privileges, encrypt Secrets at rest with EncryptionConfiguration, audit API calls, and keep the cluster up to date with the latest security patches.

Share this tutorial

X LinkedIn WhatsApp

Did you enjoy this article?

Was this article helpful?

Thanks for your feedback!

Comments

Recommended for you

Blog · DevOps

In-depth article on the topic

Checklist Sécurité Linux

30 points essentiels pour sécuriser un serveur Linux. Recevez aussi les nouveaux tutoriels par email.

Pas de spam. Désabonnement en 1 clic.