Last updated: 2026-01-28
The installation steps below describe the original single-node bootstrap. The current cluster includes drg-k8s.auth.home.lan as control plane and drg-k8s-worker-01.auth.home.lan as worker. Follow AutoCoder worker placement for AutoCoder execution, including direct-session builds/tests. Historical single-node scheduling instructions do not permit routing that work onto the control-plane root disk.
pkgs.k8s.io repo.apt-cache madison kubeadmapt-cache madison kubeletapt-cache madison kubectl/etc/kubernetes/admin.conf root-owned./home/k8s-admin/.kube/config with mode 600.admin.conf.net.bridge.bridge-nf-call-iptables = 1net.bridge.bridge-nf-call-ip6tables = 1net.ipv4.ip_forward = 1sudo apt-get install -y kubelet=<VERSION> kubeadm=<VERSION> kubectl=<VERSION>
sudo apt-mark hold kubelet kubeadm kubectl
10.244.0.0/16.10.96.0.0/12 unless explicitly changed.sudo kubeadm init --pod-network-cidr=10.244.0.0/16
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.31.3/manifests/calico.yaml
kubectl taint nodes --all node-role.kubernetes.io/control-plane-
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.14.2/deploy/static/provider/baremetal/deploy.yaml
kubectl apply -f https://raw.githubusercontent.com/rancher/local-path-provisioner/v0.0.30/deploy/local-path-storage.yaml
kubectl get nodes -o wide
kubectl get pods -A
kubectl run -it --rm dns-test --image=busybox:1.36 --restart=Never -- nslookup kubernetes.default
192.168.1.0/24; avoid 192.168.0.0/16.Symptoms:
NetworkPluginNotReady: cni plugin not initializedPendingSee the focused runbook:
runbooks/kubernetes-cni-token-failures.mdChecks:
ss -lntp | grep -E '6443|2379|2381'curl -k https://127.0.0.1:6443/healthz (expect 403 for anonymous, or OK via kubeconfig)kubectl -n kube-system get pods -l k8s-app=kube-proxyCommon causes:
Remediation:
sudo systemctl restart kubeletkubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.31.3/manifests/calico.yamlIf kubeadm reset leaves CNI artifacts:
sudo find /etc/cni/net.d -mindepth 1 -delete
sudo find /var/lib/cni -mindepth 1 -delete
sudo find /var/lib/kubelet -mindepth 1 -delete
sudo find /etc/kubernetes -mindepth 1 -delete
/etc/kubernetes and cluster manifests before upgrades.Migrated from host AGENTS.md. This section does not authorize cluster changes or grant administrator access to workers or ordinary operator accounts.
For the already-authorized external administrator on this host, select the established kubeconfig explicitly and verify the target before proposing cluster changes:
KUBECONFIG=/home/ax_julian/.kube/config kubectl config current-context
KUBECONFIG=/home/ax_julian/.kube/config kubectl cluster-info
If context selection fails, inspect the selected file and authorized access paths first. Do not overwrite an existing kubeconfig or issue cluster-admin credentials merely because no context is selected. Additional operators still require scoped RBAC as described above.
Only an explicitly authorized restoration of the external administrator's access, with the intended recipient confirmed and the destination absent, may use the previously documented bootstrap:
sudo -n mkdir -p /home/ax_julian/.kube
sudo -n install -m 600 -o ax_julian -g ax_julian /etc/kubernetes/admin.conf /home/ax_julian/.kube/config
Check the destination is absent before these commands; otherwise stop and diagnose without replacing it. Keep the directory restricted and credentials out of general temporary storage. Re-run the read-only preflight afterward and verify file ownership and mode. If the required authority or access is missing, name the capable administrator needed; do not assume the user can run server commands. These commands were documented, not executed, during the instruction migration.