About Kubernetes
Kubernetes (K8s) is an open source container orchestration platform developed by Google. It automates the deployment, scaling and management of containerized applications across clusters of machines. This tutorial guides you from installation to production.
Prerequisites
Machines: A minimum of 2 servers (1 control plane + 1 worker) with 2 CPUs and 2 GB of RAM each
Operating system: Ubuntu 22.04 LTS or Debian 12 (recommended)
Network: Full network connectivity between all machines in the cluster
Container runtime: containerd or Docker Engine installed on each node
Privileges: Root or sudo access on all machines
Open ports: 6443 (API), 2379-2380 (etcd), 10250-10252 (kubelet/scheduler/controller)
Kubernetes Architecture
Understanding the architecture of Kubernetes is essential before starting the installation. A K8s cluster consists of two types of nodes.
Control Plane (Master node)
kube-apiserver: The entry point for all REST requests. It is the central component that exposes the Kubernetes API.
etcd: A distributed key-value database that stores the complete state of the cluster (configurations, secrets, pod state).
kube-scheduler: Assigns pods to nodes based on available resources, constraints and affinities.
kube-controller-manager: Runs the control loops that monitor the state of the cluster and make the necessary corrections.
Worker Nodes
kubelet: The agent that runs on each worker node and ensures that the containers defined in the pods are running.
kube-proxy: Manages the network rules on each node to route traffic to the correct pods.
Container Runtime: The container execution engine (containerd, CRI-O).
Good to know
In production, it is recommended to have at least 3 control plane nodes for the high availability of etcd and the API server.
Premium Content
This advanced tutorial is reserved for premium members.
Cybersecurity and Linux administration expert. I share my knowledge through free tutorials and training to help system administrators and developers secure their infrastructures.
What is the difference between Kubernetes and Docker Swarm?
Kubernetes is a more complete and complex container orchestrator than Docker Swarm. K8s offers auto-scaling, advanced rolling updates, fine-grained network management with Ingress, RBAC, and a very rich plugin ecosystem. Docker Swarm is simpler to set up but less suited to large-scale production environments.
How many nodes does a Kubernetes cluster need at a minimum?
A functional Kubernetes cluster requires at least one control plane node and one worker node. In production, it is recommended to have 3 control plane nodes for high availability and at least 2 worker nodes for workload redundancy.
Why must swap be disabled for Kubernetes?
Kubernetes requires swap to be disabled because the scheduler must know precisely the amount of memory available on each node. Swap distorts the metrics and can cause unpredictable behavior in managing the resource limits of pods. Since version 1.28, experimental swap support exists via the NodeSwap feature gate.
How do you upgrade a Kubernetes cluster without service interruption?
Use the rolling update strategy by configuring maxUnavailable and maxSurge in your Deployment. Kubernetes will progressively replace the old pods with new ones. For upgrades of the cluster itself, drain the nodes one by one with kubectl drain, update kubeadm/kubelet/kubectl, then bring the node back with kubectl uncordon.
What is the difference between a PersistentVolume and a PersistentVolumeClaim?
A PersistentVolume (PV) represents a physical storage resource in the cluster, provisioned by an administrator or dynamically via a StorageClass. A PersistentVolumeClaim (PVC) is a storage request made by a pod. The PVC automatically binds to a PV that is compatible in terms of size and access mode.
How do you secure a Kubernetes cluster in production?
Enable RBAC to control access, apply NetworkPolicies to isolate pods, use PodSecurityAdmission to restrict container privileges, encrypt Secrets at rest with EncryptionConfiguration, audit API calls, and keep the cluster up to date with the latest security patches.
Comments