Lab 01 - Workstation setup

Goal: turn support01 into your kubectl workstation. Cheat sheet: kubectl

support01 has Docker and the NFS exports, but deliberately no kubectl and no kubeconfig. Building your own client is the first thing you do at any customer, so you may as well do it here.

# 1 - log in to the jump host (from your PC)
ssh student@192.168.56.101          # password: linux

# 2 - who am I, and can I reach the cluster nodes?
hostname -f
ip -brief address                    # note your 192.168.128.0/24 address
for n in control01 worker01 worker02 worker03; do getent hosts $n; done

If a name does not resolve, note its IP now - you will need it in step 6.

# 3 - prove there is no client yet
kubectl version                      # command not found
ls ~/.kube 2>&1                      # no such directory

Install kubectl

The client should match the cluster’s minor version (1.35). One minor version of skew in either direction is supported; more than that and you will hit odd errors.

# 4 - the package repository
sudo apt-get update
sudo apt-get install -y apt-transport-https ca-certificates curl gnupg
sudo mkdir -p /etc/apt/keyrings
curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.35/deb/Release.key \
  | sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg
echo 'deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.35/deb/ /' \
  | sudo tee /etc/apt/sources.list.d/kubernetes.list

# 5 - install and check
sudo apt-get update
sudo apt-get install -y kubectl
kubectl version --client

Get a kubeconfig

kubectl finds the cluster through ~/.kube/config: the API server address, the CA certificate, and your client certificate. On a kubeadm cluster the admin version of that file is /etc/kubernetes/admin.conf on the control plane, and it is root-only.

# 6 - on control01: make a readable copy
ssh student@control01
sudo cp /etc/kubernetes/admin.conf /home/student/kubeconfig
sudo chown student:student /home/student/kubeconfig
exit

# 7 - back on support01: put it where kubectl looks
mkdir -p ~/.kube
scp student@control01:kubeconfig ~/.kube/config
chmod 600 ~/.kube/config

# 8 - tidy up the copy on control01
ssh student@control01 'rm -f /home/student/kubeconfig'

Verify

# 9 - all three must work
kubectl cluster-info
kubectl get nodes -o wide            # control01 + worker01..03, all Ready
kubectl get pods -A                  # control plane pods in kube-system

Read the node list: the VERSION column is the kubelet version (1.35.2), and control01 carries the control-plane role. kubectl get pods -A shows what the cluster runs for itself - the API server, etcd, CoreDNS, the CNI agent.

Make life easier

# 10 - completion and a short alias, permanently
echo 'source <(kubectl completion bash)' >> ~/.bashrc
echo 'alias k=kubectl'                >> ~/.bashrc
echo 'complete -o default -F __start_kubectl k' >> ~/.bashrc
source ~/.bashrc
k get no

Tab completion is not a luxury - it completes resource names from the live cluster, so it doubles as a discovery tool.

Tip

~/.kube/config holds admin credentials for the whole cluster. chmod 600 is not decoration.