Installation Guide¶

Quick Start¶

Download and run the installation script:

curl -fsSL https://github.com/MuNeNiCK/setup-k8s/releases/latest/download/setup-k8s.sh | sudo sh -s -- init

Manual download, checksum verification, and inspection:

curl -fsSLO https://github.com/MuNeNiCK/setup-k8s/releases/latest/download/setup-k8s.sh
curl -fsSLO https://github.com/MuNeNiCK/setup-k8s/releases/latest/download/setup-k8s.sh.sha256
sha256sum -c setup-k8s.sh.sha256
less setup-k8s.sh
sudo sh setup-k8s.sh init

Pin a specific release by replacing latest/download with download/<version>:

curl -fsSL https://github.com/MuNeNiCK/setup-k8s/releases/download/v0.1.0/setup-k8s.sh | sudo sh -s -- init

setup-k8s.sh is a single file that contains every module. Check the version with sh setup-k8s.sh --version.

Cluster Initialization¶

Basic setup with default containerd:

curl -fsSL https://github.com/MuNeNiCK/setup-k8s/releases/latest/download/setup-k8s.sh | sudo sh -s -- init

Setup with CRI-O runtime:

curl -fsSL https://github.com/MuNeNiCK/setup-k8s/releases/latest/download/setup-k8s.sh | sudo sh -s -- \
  init \
  --cri crio

Advanced setup:

curl -fsSL https://github.com/MuNeNiCK/setup-k8s/releases/latest/download/setup-k8s.sh | sudo sh -s -- \
  init \
  --kubernetes-version 1.37.2 \
  --cri containerd \
  --pod-network-cidr 192.168.0.0/16 \
  --apiserver-advertise-address 192.168.1.10 \
  --service-cidr 10.96.0.0/12

Setup with IPVS mode for existing IPVS-based environments:

curl -fsSL https://github.com/MuNeNiCK/setup-k8s/releases/latest/download/setup-k8s.sh | sudo sh -s -- \
  init \
  --proxy-mode ipvs \
  --pod-network-cidr 192.168.0.0/16

Kubernetes 1.35+ deprecates kube-proxy IPVS mode. Prefer nftables for new clusters.

The default proxy mode auto uses nftables on Kubernetes 1.33+ with Linux 5.13+ and iptables otherwise. Force iptables for CNI plugins or tools that expect iptables rules:

curl -fsSL https://github.com/MuNeNiCK/setup-k8s/releases/latest/download/setup-k8s.sh | sudo sh -s -- \
  init \
  --proxy-mode iptables \
  --pod-network-cidr 192.168.0.0/16

Joining a Cluster¶

Obtain join information from the control-plane node:

# Run on control-plane node
kubeadm token create --print-join-command

Join as a worker node:

curl -fsSL https://github.com/MuNeNiCK/setup-k8s/releases/latest/download/setup-k8s.sh | sudo sh -s -- \
  join <address> \
  --cri containerd \
  --token <token> \
  --discovery-token-ca-cert-hash <hash>

Join as a control-plane node (HA cluster):

curl -fsSL https://github.com/MuNeNiCK/setup-k8s/releases/latest/download/setup-k8s.sh | sudo sh -s -- \
  join <address> \
  --control-plane \
  --certificate-key <key> \
  --token <token> \
  --discovery-token-ca-cert-hash <hash>

Note: The joining node must use the same CRI as the existing cluster.

Preflight Checks¶

Before initializing or joining a cluster, you can run preflight checks to verify system requirements:

curl -fsSL https://github.com/MuNeNiCK/setup-k8s/releases/latest/download/setup-k8s.sh | sudo sh -s -- preflight

Check for join mode with specific options:

curl -fsSL https://github.com/MuNeNiCK/setup-k8s/releases/latest/download/setup-k8s.sh | sudo sh -s -- \
  preflight \
  --mode join \
  --cri crio \
  --proxy-mode ipvs

Preview what checks will be performed:

curl -fsSL https://github.com/MuNeNiCK/setup-k8s/releases/latest/download/setup-k8s.sh | sudo sh -s -- preflight --dry-run

Certificate Renewal¶

Renew kubeadm-managed certificates before they expire (default: 1 year). See Certificates for detailed usage.

# Check certificate expiration
curl -fsSL https://github.com/MuNeNiCK/setup-k8s/releases/latest/download/setup-k8s.sh | sudo sh -s -- \
  renew --check-only

# Renew all certificates
curl -fsSL https://github.com/MuNeNiCK/setup-k8s/releases/latest/download/setup-k8s.sh | sudo sh -s -- renew

Installation Guide¶

Quick Start¶

Cluster Initialization¶

Joining a Cluster¶

Preflight Checks¶

Certificate Renewal¶

Prerequisites¶

System Requirements¶

Access Requirements¶