Lab 02 - First look at the cluster

Lab 02 - First look at the cluster

Goal: map every box of the architecture diagram to something running. Chapter: Architecture

# 1 - where am I connected, and as whom?
kubectl cluster-info
kubectl config get-contexts
kubectl config view --minify | grep server

Check config get-contexts before anything destructive. Most production accidents are the right command in the wrong cluster.

The Pod network

# 2 - which CNI runs here, and which address range do Pods get?
kubectl get pods -n calico-system -o wide     # one calico-node per node
kubectl get cm -n kube-system kubeadm-config -o yaml | grep -E 'podSubnet|serviceSubnet'
kubectl get pods -A -o wide | grep 10.244 | head -5

Calico was installed with the cluster. Every Pod gets an address from 10.244.0.0/16, Services from 10.96.0.0/12. You work with Calico itself on Day 4.

The rest of the architecture

# 3 - the machines
kubectl describe node control01 | grep -A3 Taints
kubectl describe node worker01 | grep -A6 'Allocated resources'

In describe node three blocks matter: Conditions (healthy?), Taints (what refuses to run here?) and Allocated resources (how full?).

# 4 - the control plane, as Pods
kubectl get pods -n kube-system -o wide

Find the API server, etcd, scheduler, controller manager - all on control01 - then CoreDNS and one kube-proxy per node. Calico lives in its own namespaces: tigera-operator and calico-system.

# 5 - static Pods: the kubelet starts them from files
ssh student@control01 'ls /etc/kubernetes/manifests'
kubectl get pod -n kube-system kube-apiserver-control01 \
  -o jsonpath='{.metadata.ownerReferences[0].kind}{"\n"}'     # Node

# 6 - the kubelet and the runtime are not Pods
ssh student@worker01 'systemctl is-active kubelet containerd'
ssh student@worker01 'sudo crictl ps | head -5'

crictl talks to containerd directly - the same containers kubectl shows as Pods, seen from the node.

Discovery

Task A. Which image and version does the API server run? Expected: registry.k8s.io/kube-apiserver:v1.35.2.

kubectl get pod -n kube-system kube-apiserver-control01 \
  -o jsonpath='{.spec.containers[0].image}{"\n"}'

Task B. Which Pod address block does worker02 use, and how does it reach the Pods on the other nodes?

kubectl get pods -A -o wide --field-selector spec.nodeName=worker02 | grep 10.244
ssh student@worker02 'ip route | grep 10.244'

Task C. Find the etcd data directory on control01.

kubectl get pod -n kube-system etcd-control01 -o yaml | grep -- --data-dir