instruction: Explain Installing kubeadm
output: You are viewing documentation for Kubernetes version: v1.30
  Kubernetes v1.30 documentation is no longer actively maintained. The version you are currently viewing is a static snapshot. For up-to-date information, see the
  latest version.
  Installing kubeadm
  This page shows how to install the
  kubeadm
  toolbox.
  For information on how to create a cluster with kubeadm once you have performed this installation process,
  see the
  Creating a cluster with kubeadm
  page.
  This installation guide is for Kubernetes v1.30. If you want to use a different Kubernetes version, please refer to the following pages instead:
  Installing kubeadm (Kubernetes v1.33)
  Installing kubeadm (Kubernetes v1.32)
  Installing kubeadm (Kubernetes v1.31)
  Installing kubeadm (Kubernetes v1.29)
  Before you begin
  A compatible Linux host. The Kubernetes project provides generic instructions for Linux distributions
  based on Debian and Red Hat, and those distributions without a package manager.
  2 GB or more of RAM per machine (any less will leave little room for your apps).
  2 CPUs or more.
  Full network connectivity between all machines in the cluster (public or private network is fine).
  Unique hostname, MAC address, and product_uuid for every node. See
  here
  for more details.
  Certain ports are open on your machines. See
  here
  for more details.
  Swap configuration. The default behavior of a kubelet was to fail to start if swap memory was detected on a node.
  Swap memory management
  for more details.
  MUST
  disable swap if the kubelet is not properly configured to use swap. For example,
  sudo swapoff -a
  will disable swapping temporarily. To make this change persistent across reboots, make sure swap is disabled in
  config files like
  /etc/fstab
  systemd.swap
  , depending how it was configured on your system.
  Note:
  kubeadm
  installation is done via binaries that use dynamic linking and assumes that your target system provides
  glibc
  This is a reasonable assumption on many Linux distributions (including Debian, Ubuntu, Fedora, CentOS, etc.)
  but it is not always the case with custom and lightweight distributions which don't include
  glibc
  by default, such as Alpine Linux.
  The expectation is that the distribution either includes
  glibc
  or a
  compatibility layer
  that provides the expected symbols.
  Verify the MAC address and product_uuid are unique for every node
  You can get the MAC address of the network interfaces using the command
  ip link
  ifconfig -a
  The product_uuid can be checked by using the command
  sudo cat /sys/class/dmi/id/product_uuid
  It is very likely that hardware devices will have unique addresses, although some virtual machines may have
  identical values. Kubernetes uses these values to uniquely identify the nodes in the cluster.
  If these values are not unique to each node, the installation process
  fail
  Check network adapters
  If you have more than one network adapter, and your Kubernetes components are not reachable on the default
  route, we recommend you add IP route(s) so Kubernetes cluster addresses go via the appropriate adapter.
  Check required ports
  These
  required ports
  need to be open in order for Kubernetes components to communicate with each other.
  You can use tools like
  netcat
  to check if a port is open. For example:
  nc 127.0.0.1
  The pod network plugin you use may also require certain ports to be
  open. Since this differs with each pod network plugin, please see the
  documentation for the plugins about what port(s) those need.
  Installing a container runtime
  To run containers in Pods, Kubernetes uses a
  container runtime
  By default, Kubernetes uses the
  Container Runtime Interface
  (CRI)
  to interface with your chosen container runtime.
  If you don't specify a runtime, kubeadm automatically tries to detect an installed
  container runtime by scanning through a list of known endpoints.
  If multiple or no container runtimes are detected kubeadm will throw an error
  and will request that you specify which one you want to use.
  container runtimes
  for more information.
  Note:
  Docker Engine does not implement the
  which is a requirement for a container runtime to work with Kubernetes.
  For that reason, an additional service
  cri-dockerd
  has to be installed. cri-dockerd is a project based on the legacy built-in
  Docker Engine support that was
  removed
  from the kubelet in version 1.24.
  The tables below include the known endpoints for supported operating systems:
  Linux
  Windows
  Linux container runtimes
  Runtime
  Path to Unix domain socket
  containerd
  unix:///var/run/containerd/containerd.sock
  CRI-O
  unix:///var/run/crio/crio.sock
  Docker Engine (using cri-dockerd)
  unix:///var/run/cri-dockerd.sock
  Windows container runtimes
  Runtime
  Path to Windows named pipe
  containerd
  npipe:////./pipe/containerd-containerd
  Docker Engine (using cri-dockerd)
  npipe:////./pipe/cri-dockerd
  Installing kubeadm, kubelet and kubectl
  You will install these packages on all of your machines:
  kubeadm
  : the command to bootstrap the cluster.
  kubelet
  : the component that runs on all of the machines in your cluster
  and does things like starting pods and containers.
  kubectl
  : the command line util to talk to your cluster.
  kubeadm
  will not
  install or manage
  kubelet
  kubectl
  for you, so you will
  need to ensure they match the version of the Kubernetes control plane you want
  kubeadm to install for you. If you do not, there is a risk of a version skew occurring that
  can lead to unexpected, buggy behaviour. However,
  minor version skew between the
  kubelet and the control plane is supported, but the kubelet version may never exceed the API
  server version. For example, the kubelet running 1.7.0 should be fully compatible with a 1.8.0 API server,
  but not vice versa.
  For information about installing
  kubectl
  , see
  Install and set up kubectl
  Warning:
  These instructions exclude all Kubernetes packages from any system upgrades.
  This is because kubeadm and Kubernetes require
  special attention to upgrade
  For more information on version skews, see:
  Kubernetes
  version and version-skew policy
  Kubeadm-specific
  version skew policy
  Note:
  The legacy package repositories (
  apt.kubernetes.io
  yum.kubernetes.io
  ) have been
  deprecated and frozen starting from September 13, 2023
  Using the
  new package repositories hosted at
  pkgs.k8s.io
  is strongly recommended and required in order to install Kubernetes versions released after September 13, 2023.
  The deprecated legacy repositories, and their contents, might be removed at any time in the future and without
  a further notice period. The new package repositories provide downloads for Kubernetes versions starting with v1.24.0.
  Note:
  There's a dedicated package repository for each Kubernetes minor version. If you want to install
  a minor version other than v1.30, please see the installation guide for
  your desired minor version.
  Debian-based distributions
  Red Hat-based distributions
  Without a package manager
  These instructions are for Kubernetes v1.30.
  Update the
  package index and install packages needed to use the Kubernetes
  repository:
  sudo apt-get update
  # apt-transport-https may be a dummy package; if so, you can skip that package
  sudo apt-get install -y apt-transport-https ca-certificates curl gpg
  Download the public signing key for the Kubernetes package repositories.
  The same signing key is used for all repositories so you can disregard the version in the URL:
  # If the directory `/etc/apt/keyrings` does not exist, it should be created before the curl command, read the note below.
  # sudo mkdir -p -m 755 /etc/apt/keyrings
  curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.30/deb/Release.key | sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg
  Note:
  In releases older than Debian 12 and Ubuntu 22.04, directory
  /etc/apt/keyrings
  does not exist by default, and it should be created before the curl command.
  Add the appropriate Kubernetes
  repository. Please note that this repository have packages
  only for Kubernetes 1.30; for other Kubernetes minor versions, you need to
  change the Kubernetes minor version in the URL to match your desired minor version
  (you should also check that you are reading the documentation for the version of Kubernetes
  that you plan to install).
  # This overwrites any existing configuration in /etc/apt/sources.list.d/kubernetes.list
  echo
  'deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.30/deb/ /'
  | sudo tee /etc/apt/sources.list.d/kubernetes.list
  Update the
  package index, install kubelet, kubeadm and kubectl, and pin their version:
  sudo apt-get update
  sudo apt-get install -y kubelet kubeadm kubectl
  sudo apt-mark hold kubelet kubeadm kubectl
  (Optional) Enable the kubelet service before running kubeadm:
  sudo systemctl
  enable
  --now kubelet
  Set SELinux to
  permissive
  mode:
  These instructions are for Kubernetes 1.30.
  # Set SELinux in permissive mode (effectively disabling it)
  sudo setenforce
  sudo sed -i
  's/^SELINUX=enforcing$/SELINUX=permissive/'
  /etc/selinux/config
  Caution:
  Setting SELinux in permissive mode by running
  setenforce 0
  sed ...
  effectively disables it. This is required to allow containers to access the host
  filesystem; for example, some cluster network plugins require that. You have to
  do this until SELinux support is improved in the kubelet.
  You can leave SELinux enabled if you know how to configure it but it may require
  settings that are not supported by kubeadm.
  Add the Kubernetes
  repository. The
  exclude
  parameter in the
  repository definition ensures that the packages related to Kubernetes are
  not upgraded upon running
  yum update
  as there's a special procedure that
  must be followed for upgrading Kubernetes. Please note that this repository
  have packages only for Kubernetes 1.30; for other
  Kubernetes minor versions, you need to change the Kubernetes minor version
  in the URL to match your desired minor version (you should also check that
  you are reading the documentation for the version of Kubernetes that you
  plan to install).
  # This overwrites any existing configuration in /etc/yum.repos.d/kubernetes.repo
  <<EOF | sudo tee /etc/yum.repos.d/kubernetes.repo
  [kubernetes]
  name=Kubernetes
  baseurl=https://pkgs.k8s.io/core:/stable:/v1.30/rpm/
  enabled=1
  gpgcheck=1
  gpgkey=https://pkgs.k8s.io/core:/stable:/v1.30/rpm/repodata/repomd.xml.key
  exclude=kubelet kubeadm kubectl cri-tools kubernetes-cni
  Install kubelet, kubeadm and kubectl:
  sudo yum install -y kubelet kubeadm kubectl --disableexcludes
  kubernetes
  (Optional) Enable the kubelet service before running kubeadm:
  sudo systemctl
  enable
  --now kubelet
  Install CNI plugins (required for most pod network):
  CNI_PLUGINS_VERSION
  "v1.3.0"
  ARCH
  "amd64"
  DEST
  "/opt/cni/bin"
  sudo mkdir -p
  $DEST
  curl -L
  "https://github.com/containernetworking/plugins/releases/download/
  CNI_PLUGINS_VERSION
  /cni-plugins-linux-
  ARCH
  CNI_PLUGINS_VERSION
  .tgz"
  | sudo tar -C
  $DEST
  Define the directory to download command files:
  Note:
  DOWNLOAD_DIR
  variable must be set to a writable directory.
  If you are running Flatcar Container Linux, set
  DOWNLOAD_DIR="/opt/bin"
  DOWNLOAD_DIR
  "/usr/local/bin"
  sudo mkdir -p
  $DOWNLOAD_DIR
  Install crictl (required for kubeadm / Kubelet Container Runtime Interface (CRI)):
  CRICTL_VERSION
  "v1.30.0"
  ARCH
  "amd64"
  curl -L
  "https://github.com/kubernetes-sigs/cri-tools/releases/download/
  CRICTL_VERSION
  /crictl-
  CRICTL_VERSION
  -linux-
  ARCH
  .tar.gz"
  | sudo tar -C
  $DOWNLOAD_DIR
  Install
  kubeadm
  kubelet
  and add a
  kubelet
  systemd service:
  RELEASE
  curl -sSL https://dl.k8s.io/release/stable.txt
  ARCH
  "amd64"
  $DOWNLOAD_DIR
  sudo curl -L --remote-name-all https://dl.k8s.io/release/
  RELEASE
  /bin/linux/
  ARCH
  kubeadm,kubelet
  sudo chmod +x
  kubeadm,kubelet
  RELEASE_VERSION
  "v0.16.2"
  curl -sSL
  "https://raw.githubusercontent.com/kubernetes/release/
  RELEASE_VERSION
  /cmd/krel/templates/latest/kubelet/kubelet.service"
  | sed
  "s:/usr/bin:
  DOWNLOAD_DIR
  | sudo tee /usr/lib/systemd/system/kubelet.service
  sudo mkdir -p /usr/lib/systemd/system/kubelet.service.d
  curl -sSL
  "https://raw.githubusercontent.com/kubernetes/release/
  RELEASE_VERSION
  /cmd/krel/templates/latest/kubeadm/10-kubeadm.conf"
  | sed
  "s:/usr/bin:
  DOWNLOAD_DIR
  | sudo tee /usr/lib/systemd/system/kubelet.service.d/10-kubeadm.conf
  Note:
  Please refer to the note in the
  Before you begin
  section for Linux distributions
  that do not include
  glibc
  by default.
  Install
  kubectl
  by following the instructions on
  Install Tools page
  Optionally, enable the kubelet service before running kubeadm:
  sudo systemctl
  enable
  --now kubelet
  Note:
  The Flatcar Container Linux distribution mounts the
  /usr
  directory as a read-only filesystem.
  Before bootstrapping your cluster, you need to take additional steps to configure a writable directory.
  See the
  Kubeadm Troubleshooting guide
  to learn how to set up a writable directory.
  The kubelet is now restarting every few seconds, as it waits in a crashloop for
  kubeadm to tell it what to do.
  Configuring a cgroup driver
  Both the container runtime and the kubelet have a property called
  "cgroup driver"
  , which is important
  for the management of cgroups on Linux machines.
  Warning:
  Matching the container runtime and kubelet cgroup drivers is required or otherwise the kubelet process will fail.
  Configuring a cgroup driver
  for more details.
  Troubleshooting
  If you are running into difficulties with kubeadm, please consult our
  troubleshooting docs
  What's next
  Using kubeadm to Create a Cluster
  Was this page helpful?
  Thanks for the feedback. If you have a specific, answerable question about how to use Kubernetes, ask it on
  Stack Overflow
  Open an issue in the
  GitHub Repository
  if you want to
  report a problem
  suggest an improvement
  Last modified May 29, 2024 at 10:41 AM PST:
  Bump cri-tools version to v1.30.0 (102df83e40)