3️⃣ Networking Setup¶

Kubernetes ek distributed system hai, to uske Control Plane aur Worker Nodes ek doosre se communicate kar sakein, iske liye networking zaroori hai.

✔️ Networking Configuration: 1. Nodes ke beech communication allow karna
2. Pod-to-Pod communication allow karna (CNI Plugin)
3. Firewall aur Security Groups set karna

Kubernetes by default networking setup nahi karta, tumhe koi CNI (Container Network Interface) plugin install karna padta hai, jaise:
- Calico
- Flannel
- Cilium

Ye networking plugins Pods ke beech communication enable karte hain.

4️⃣ Container Runtime (Docker, containerd, CRI-O)¶

Kubernetes sirf containers orchestrate karta hai, lekin containers run karne ke liye ek runtime bhi chahiye.

Supported Container Runtimes:
✅ containerd (Recommended)
✅ Docker (Ab Kubernetes ka default part nahi, lekin work karta hai)
✅ CRI-O (Agar sirf Kubernetes-specific runtime chahiye to)

Tumhe pehle se container runtime install karna hoga, tabhi Kubernetes containers chala sakega.

🔐 TLS/SSL Setup using Cert-Manager in Kubernetes¶

💡 Pehle Yeh Samjho: TLS/SSL Kyon Zaroori Hai?¶

1. Default HTTP traffic secure nahi hoti → Man-in-the-middle (MITM) attacks possible hote hain.
2. TLS (Transport Layer Security) encrypt karta hai communication ko, taake data secure ho.
3. Websites ko HTTPS par chalane ke liye certificates chahiye hote hain.
4. Manually SSL certificate manage karna tedious hai → Cert-Manager automatically manage karta hai.

🚀 Cert-Manager Kya Hai?¶

Cert-Manager ek Kubernetes tool hai jo automatic TLS certificates issue & renew karta hai. Yeh Let's Encrypt ya custom CA (Certificate Authority) se free SSL certificates generate karta hai.

✅ Features:¶

• Automatic SSL Certificate Issuance (Let's Encrypt, Vault, Self-Signed, etc.)
• Certificate Renewal (Auto-renew before expiry)
• Kubernetes Native Integration (Works with Ingress)
• Multiple ACME Issuers Supported (HTTP-01, DNS-01 challenges)

📌 Step-by-Step: Installing Cert-Manager¶

Cert-Manager ko install karne ke liye kubectl apply ya Helm chart ka use hota hai.

Step 1️⃣: Install Cert-Manager using Helm¶

kubectl apply -f https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.yaml

Check if running properly:

kubectl get pods -n cert-manager

✅ Agar Cert-Manager ke pods Running state mein hain, toh installation successful hai.

📜 Step 2️⃣: Setup Let's Encrypt Issuer¶

Let's Encrypt TLS certificates issue karta hai, but uske liye Issuer ya ClusterIssuer define karna padta hai.

👉 Issuer vs. ClusterIssuer¶

🔹 Issuer Example (Namespace Specific)

🔹 ClusterIssuer Example (Cluster-Wide)

📌 Step 3️⃣: Create a TLS Certificate¶

Ab hum ek Certificate Resource create karenge jo Cert-Manager ko bolega ki ek SSL certificate issue kare.

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: example-com-cert
  namespace: default
spec:
  secretName: example-com-tls
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  dnsNames:
  - example.com
  - www.example.com

Check if Cert-Manager Issued the Certificate:

kubectl get certificate -n default

📌 Step 4️⃣: Apply TLS to Ingress¶

Ab hum Ingress configuration ko update karenge taake yeh HTTPS traffic ko support kare.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-ingress
  annotations:
    kubernetes.io/ingress.class: "nginx"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
  tls:
  - hosts:
    - example.com
    secretName: example-com-tls
  rules:
  - host: example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: backend-service
            port:
              number: 80

🔹 TLS Section Explanation:
- cert-manager.io/cluster-issuer: "letsencrypt-prod" → Cert-Manager Let's Encrypt se cert issue karega.
- secretName: example-com-tls → Yeh generated TLS cert use karega.
- host: example.com → Yeh certificate is domain par apply hoga.

✅ Final Step: Apply Everything¶

kubectl apply -f my-ingress.yaml

🎯 Summary¶

1. Cert-Manager Install Kiya
2. Let's Encrypt Issuer Setup Kiya
3. TLS Certificate Generate Kiya
4. Ingress Resource ke saath TLS Implement Kiya

💡 Benefits¶

✅ Auto-Renewal → No manual SSL renewals
✅ HTTPS Security → Secure user traffic
✅ Cloud-Native → Kubernetes friendly solution

Ab tumhara Kubernetes cluster full production-ready hai with HTTPS! 🔥

Cert-Manager Kis Machine Par Run Karein?¶

Cert-Manager Kubernetes cluster ke Control Plane nodes par run hota hai, kyunki yeh ek Kubernetes-native application hai jo APIs ko monitor karta hai aur certificates manage karta hai.

👉 Kis Machine Par Run Hoga?¶

💡 Breakdown of Deployment:¶

1. Cert-Manager → Control Plane nodes pe deploy hoga (EC2 #1 & EC2 #2)
2. Ingress Controller (e.g., NGINX) → Worker Nodes pe run karega (EC2 #3, EC2 #4, EC2 #5)
3. TLS Certificates → Cluster ke Secret Store mein store honge
4. Application Traffic → Ingress Controller handle karega, jo Worker Nodes pe hoga

🚀 Self-Managed Kubernetes on AWS (Production-Ready) – Step-by-Step Summary¶

🖥️ Total EC2 Instances: 5 (2 Control Plane + 3 Worker Nodes)

✅ Now, Your Self-Managed Kubernetes is Production-Ready! 🚀

Clarification: Kis Step Ko Konsi EC2 Machine Par Run Karna Hai?¶

Agar Control Plane ya Worker Nodes mention hain, toh iska matlab hamesha sabhi relevant machines hain (jitni control plane ya worker nodes hain). Lekin kuch specific commands sirf ek hi machine par run hoti hain.

🔰 Step-by-Step EC2 Mapping¶

📌 Key Points to Remember:¶

1. Cluster Initialization (kubeadm init) sirf pehli Control Plane Node (EC2 #1) pe chalega.
2. Worker Nodes (EC2 #3, #4, #5) pe kubeadm join individually run hoga.
3. Kubernetes Networking (CNI) aur TLS setup sirf Control Plane Node pe hoga.
4. Ingress Controller aur Persistent Storage Worker Nodes pe chalega.
5. Application Deployment aur Ingress Resource kisi bhi Worker Node pe apply ho sakti hai, because YAML is cluster-wide.

✅ Ab har step ke liye clear hai ke kis machine pe run karna hai! 🚀

Bhai, StorageClass ka kaam PV & PVC ke beech automation aur abstraction provide karna hai. Ye directly PV nahi hoti, balki PVs banane ka blueprint hoti hai.

💡 Pehle Storage Ka Flow Samjho:¶

🔹 Without StorageClass (Manual Approach):¶

1. Tum manually ek PersistentVolume (PV) create karte ho.
2. Phir koi pod jab PersistentVolumeClaim (PVC) request bhejta hai, toh us PV se manually bind hoti hai.
3. Agar storage types (EBS, NFS, etc.) change karni ho, toh naye PVs manually banane padenge.

🔹 With StorageClass (Dynamic Approach):¶

1. Tum ek StorageClass define karte ho (e.g., AWS EBS, NFS, Longhorn).
2. Jab koi pod PVC create karta hai, toh StorageClass automatically ek PV generate kar deti hai.
3. Tumhare cluster mein different storage types ka flexible management possible ho jata hai.

📌 StorageClass Kya Hai?¶

• Blueprint hai jo batati hai ki kaunsa backend storage use hoga.
• Ye dynamically PV create karne ke liye automation provide karti hai.
• Tumhare cluster mein multiple StorageClasses ho sakti hain (e.g., SSD, HDD, NFS).
• PVC jab koi storage request karega, toh StorageClass automatically usko PV allocate kar degi.

🤔 StorageClass Kis Kis Se Judi Hai?¶

📜 Example: StorageClass in Action¶

Step 1: Define StorageClass¶

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: my-ebs-storage
provisioner: kubernetes.io/aws-ebs
parameters:
  type: gp2  # SSD storage

Step 2: PVC Request Using StorageClass¶

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: my-pvc
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 10Gi
  storageClassName: my-ebs-storage

Step 3: Automatic PV Creation¶

• Kubernetes StorageClass ke basis pe AWS EBS volume create karega.
• Ye PV dynamically bind ho jayega PVC ke sath.

🔥 Conclusion:¶

✅ So, StorageClass ek automation layer hai jo PVC ki request ko PVs se bind karne ka kaam karti hai! 🚀

Haan bhai, tera confusion bilkul valid hai, aur ye confusion tab tak rahegi jab tak tu EKS cluster banane ke different methods nahi samjhega.

Pehle ye samajh le EKS cluster create karne ke multiple tareeqe hain, aur har tareeqe ka specific use case hai.

🎯 AWS EKS Cluster Banane ke 3 Major Methods¶

🔹 1️⃣ eksctl – Easiest & Quickest Way¶

eksctl create cluster --name demo-cluster --region us-east-1 --fargate

🔹 2️⃣ AWS Console – GUI Based Manual Setup¶

👉 Kya hai?¶

AWS console me step by step cluster create karne ka tareeqa hai.
Yahan har resource manually configure karni hoti hai.

👉 Kaise Kaam Karta Hai?¶

1️⃣ AWS Console pe jao
2️⃣ EKS service open karo
3️⃣ New cluster create karo (VPC, IAM, etc. manually set)
4️⃣ Node group manually add karo
5️⃣ Cluster verify karo

🔹 3️⃣ Terraform / CloudFormation – Best for Production¶

👉 Kya hai?¶

Ye Infrastructure-as-Code (IaC) wale methods hain jo repeatable & automated clusters create karte hain.
- Terraform = Open-source tool jo declarative config files se AWS resources bana sakta hai.
- CloudFormation = AWS ka native IaC tool jo YAML/JSON templates se infrastructure deploy karta hai.

👉 Kaise Kaam Karta Hai?¶

Example: Terraform Script for EKS

resource "aws_eks_cluster" "example" {
  name     = "my-cluster"
  role_arn = aws_iam_role.example.arn
  vpc_config {
    subnet_ids = aws_subnet.example[*].id
  }
}

terraform apply

👉 Kab Use Karna Chahiye?¶

✅ Production clusters ke liye best
✅ Jab repeatable, scalable, & automated clusters chahiye
✅ Jab teams ek hi standardized way se EKS manage karna chahti hain

Haan bhai, eksctl ka solid command set samajh le, taake tujhe EKS cluster manage karne me poori command-line power mil jaye. 🚀

Eksctl AWS ka official CLI tool hai jo EKS cluster setup, management, aur troubleshooting ko automate karta hai.

🎯 eksctl Commands – Categorized List¶

🔥 eksctl Commands in Action¶

1️⃣ Cluster Create – Default Settings¶

eksctl create cluster --name my-cluster --region us-east-1

2️⃣ Custom Cluster – Specific Configurations¶

eksctl create cluster \
  --name custom-cluster \
  --region us-west-2 \
  --nodes 3 \
  --node-type t3.medium \
  --managed

3️⃣ Get Existing Clusters¶

eksctl get cluster

4️⃣ Delete Cluster¶

eksctl delete cluster --name my-cluster

5️⃣ Add New Managed Node Group¶

eksctl create nodegroup \
  --cluster my-cluster \
  --name extra-nodes \
  --node-type t3.medium \
  --nodes 2 \
  --managed

6️⃣ Get Node Groups¶

eksctl get nodegroup --cluster my-cluster

7️⃣ Delete Node Group¶

eksctl delete nodegroup --cluster my-cluster --name extra-nodes

8️⃣ Setup kubectl Access (Kubeconfig)¶

eksctl utils write-kubeconfig --cluster my-cluster --region us-east-1

9️⃣ Enable Logging¶

eksctl enable logging --cluster my-cluster

🎯 Conclusion¶

Agar tujhe eksctl ka full control chahiye, to ye commands teri pocket me honi chahiye! 🚀
- Quick Cluster ➝ eksctl create cluster --name demo-cluster --region us-east-1 - Advanced Cluster ➝ eksctl create cluster (with custom configs) - Cluster Management ➝ eksctl get/delete cluster - Node Management ➝ eksctl create/get/delete nodegroup - IAM & Security ➝ eksctl create iamidentitymapping - Access & Config ➝ eksctl write-kubeconfig - Troubleshooting ➝ eksctl check cluster

Ab tu expert level pe eksctl use kar sakta hai! 🔥

Manually kubeconfig Generate Karni Kyun Parti Hai?¶

Kubeconfig automatically create nahi hoti har case me. Tujhe manually generate ya copy karni pad sakti hai different scenarios me:

1️⃣ EKS (AWS Kubernetes) ya Managed Clusters
- AWS default kubeconfig nahi banata.
- eksctl ya aws eks CLI use karni parti hai.

2️⃣ Kubeadm se Kubernetes Install Kiya
- Tu control plane node pe login kar ke kubeconfig copy karega.

3️⃣ K3s ya MicroK8s Use Kiya
- K3s/MicroK8s default path par kubeconfig nahi bana ke dete.

🔥 Scenario 1: AWS EKS Cluster ke liye kubeconfig Generate Karna¶

Agar tu EKS cluster create kar chuka hai, to ye command chalale:

aws eks update-kubeconfig --region us-east-1 --name my-cluster

Ya agar eksctl use kar raha hai:

eksctl utils write-kubeconfig --cluster my-cluster --region us-east-1

🔥 Scenario 2: Kubeadm se Self-Managed Cluster ka Kubeconfig Banana¶

Agar tu kubeadm use kar raha hai to control plane node pe login kar aur ye kar:

mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

🔥 Scenario 3: K3s Kubernetes ka Kubeconfig Generate Karna¶

K3s apni algi location pe kubeconfig store karta hai:

export KUBECONFIG=/etc/rancher/k3s/k3s.yaml

echo "export KUBECONFIG=/etc/rancher/k3s/k3s.yaml" >> ~/.bashrc
source ~/.bashrc

🔥 Scenario 4: MicroK8s Kubernetes ka Kubeconfig Generate Karna¶

microk8s config > ~/.kube/config

💡 Conclusion:¶

• AWS EKS me aws eks update-kubeconfig se generate karni parti hai.
• Kubeadm me /etc/kubernetes/admin.conf se manually copy karni hoti hai.
• K3s aur MicroK8s apni different locations pe kubeconfig store karte hain, unko export karna padta hai.
• Manually generate karni padti hai agar cluster default location pe kubeconfig nahi bana raha.

Ab pura scene clear? 😎

Jani, tu bilkul sahi track pe ja raha hai, sirf terminologies ko aur refine karni ki zaroorat hai. Chal, ek baar sab kuch bilkul clear karta hoon taake koi confusion na rahe!

🔥 First, What is Kubernetes?¶

✅ Kubernetes ek platform hai jo containers ko manage karta hai (orchestrates them).
✅ Yeh automated scaling, deployment, networking, aur storage handle karta hai.
✅ Kubernetes ek standard hai, koi ek software nahi! Matlab, isko alag-alag tarikon se implement kiya ja sakta hai.

🌍 1️⃣ Kubernetes Cluster Banane ke Tools¶

⏩ Yeh tools tumhe Kubernetes cluster setup karne me madad dete hain, lekin yeh Kubernetes ka core part nahi hain.
| Tool | Purpose | Production or Learning? | |----------|------------|---------------------------| | kubeadm | Cluster manually setup karne ka official tool | Production | | Kind | Kubernetes cluster Docker containers ke andar banata hai | Learning | | Minikube | Single-node Kubernetes cluster local laptop pe chalata hai | Learning |

🛑 Samajhne wali baat: Kubernetes ek standard hai, aur in tools ka kaam sirf us standard ke mutabiq cluster setup karna hai.

🛠️ 2️⃣ Kubernetes Management Platforms¶

⏩ Yeh tools sirf cluster setup nahi karte, balki multiple clusters ko manage bhi karte hain!

🛑 Samajhne wali baat: Yeh Kubernetes ka replacement nahi hain, sirf management aur GUI provide karte hain.

🐧 3️⃣ Kubernetes Distributions (Flavors)¶

⏩ Yeh logon ne Kubernetes ko modify karke apni tarah customize kiya hai.

🛑 Samajhne wali baat: Yeh sab Kubernetes hi hain, bas thoda modify kiya gaya hai taake alag use cases ke liye better ho sake.

🚀 Final Summary: Everything is Connected!¶

1️⃣ Kubernetes ek platform hai jo container orchestration karta hai.
2️⃣ Cluster setup karne ke tools → kubeadm, Kind, Minikube.
3️⃣ Cluster management platforms → Rancher, OpenShift, Portainer.
4️⃣ Kubernetes distributions → K3s, MicroK8s, AWS EKS, GKE, AKS.

⚡ Aakhir mein: Tu galt nahi soch raha tha!¶

Jani, jo tu keh raha tha wo half-correct tha, but terminologies ko refine karna zaroori tha. Tu galat guide nahi ho raha tha, bas proper classification nahi samajh aayi thi. Ab tu clearly Kubernetes setup ka full picture samajh sakta hai.

Jani, yeh tino cheezein Kubernetes cluster ke andar container ko run karwane ke liye interconnected hain. Chal ek step-by-step flow se samajhta hain, taake sab kuch crystal clear ho jaye.

🔥 1️⃣ First, What is a Container Runtime?¶

✅ Container Runtime wo software hai jo actually containers ko run karta hai.
✅ Kubernetes khud directly containers run nahi karta, yeh sirf unko manage karta hai, lekin chalane ka kaam container runtime ka hota hai.
✅ Examples: - Docker (popular, lekin ab default nahi)
- containerd (lightweight, Kubernetes ke liye recommended)
- CRI-O (specifically Kubernetes ke liye optimized)

🧩 2️⃣ CRI (Container Runtime Interface) – Kubernetes ka Middleware¶

✅ Kubernetes aur container runtime ke beech ka bridge hai.
✅ Kubernetes kisi ek runtime pe dependent nahi hota, isliye usne CRI banaya.
✅ Without CRI: Pehle Kubernetes sirf Docker pe dependent tha, lekin ab CRI ka use hota hai taake multiple runtimes support ho sakein.
✅ Supported CRI implementations: - containerd (most used in Kubernetes today)
- CRI-O (lightweight & Kubernetes-optimized)

⚙️ 3️⃣ Kubelet – The Brain of the Node¶

✅ Kubelet har node pe run hota hai aur containers ko manage karta hai.
✅ Yeh Kubernetes Control Plane se orders leta hai aur CRI ke through container runtime ko instructions deta hai.
✅ Agar Kubernetes kisi pod ko schedule karta hai, to kubelet CRI ke zariye container runtime se us pod ko run karwata hai.
✅ Flow: - API Server → kubelet se baat karta hai
- kubelet → CRI se instructions leta hai
- CRI → container runtime ko batata hai container run karne ke liye

🔗 4️⃣ Connection Between CRI, Container Runtime & Kubelet¶

☑️ Kubelet → Kubernetes ka agent jo har node pe hota hai.
☑️ CRI (Container Runtime Interface) → Kubelet ko container runtime se baat karne ka tariqa deta hai.
☑️ Container Runtime → Actual containers ko run karta hai.

🔥 Real-World Analogy¶

🚗 Car Manufacturing Example:
1️⃣ Kubernetes (Control Plane) = Factory ka Manager
2️⃣ Kubelet (Node Level Controller) = Supervisor jo instructions implement karwata hai
3️⃣ CRI (Middleware) = Supervisor aur machines ke beech ka communication system
4️⃣ Container Runtime (Docker, containerd, CRI-O) = Machines jo actually car parts assemble karti hain

🚀 Final Summary¶

1️⃣ Kubelet – Orders execute karta hai.
2️⃣ CRI – Middleware hai jo Kubernetes aur container runtime ko connect karta hai.
3️⃣ Container Runtime – Containers ko actually run karta hai (Docker, containerd, CRI-O).

Yeh tino ek dusre ke bina kaam nahi kar sakte, aur milke Kubernetes cluster ka backbone banate hain!

Ibtisam, tu ne sahi point uthaya! Sirf copy-paste se kaam nahi chalega, humein samajhna zaroori hai ke ye har command kya kar rahi hai aur kyun zaroori hai. Chalo, inko breakdown karte hain ek ek karke:

1️⃣ Load Kernel Modules¶

cat <<EOF | sudo tee /etc/modules-load.d/k8s.conf
overlay
br_netfilter
EOF
sudo modprobe overlay
sudo modprobe br_netfilter

Yeh Kya Kar Rahi Hai?¶

• overlay: Yeh ek storage driver hai jo containers ke liye fast filesystem layering support karta hai.
• br_netfilter: Yeh module Linux bridge networking ko support karta hai aur Kubernetes ke network policies ko enforce karne ke liye zaroori hai.

👨‍🏫 Summary:
Yeh modules ensure karte hain ke container networking aur storage sahi se kaam karein.

2️⃣ Configure sysctl (Kernel Parameters)¶

cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-iptables  = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward                 = 1
EOF
sudo sysctl --system

Yeh Kya Kar Rahi Hai?¶

• net.bridge.bridge-nf-call-iptables = 1 → Ensures ke bridged network traffic iptables se pass ho.
• net.bridge.bridge-nf-call-ip6tables = 1 → IPv6 ke liye bhi same function perform karta hai.
• net.ipv4.ip_forward = 1 → Packet forwarding enable karta hai, jo cluster communication ke liye must hai.

👨‍🏫 Summary:
Kubernetes networking ko properly enable karta hai.

3️⃣ Install Containerd (Container Runtime)¶

sudo apt-get install -y containerd.io

Yeh Kya Kar Rahi Hai?¶

• Containerd ek lightweight container runtime hai jo Docker ke under bhi use hota hai.
• Yeh Kubernetes ke liye recommended runtime hai, kyunki yeh direct CRI (Container Runtime Interface) ko support karta hai.

👨‍🏫 Summary:
Yeh command containerd install karti hai jo containers ko run karega.

4️⃣ Configure Containerd¶

sudo mkdir -p /etc/containerd
sudo containerd config default | sudo tee /etc/containerd/config.toml

Yeh Kya Kar Rahi Hai?¶

• /etc/containerd/ directory banata hai jisme containerd ka config file hoga.
• containerd config default ek default config generate karta hai.
• tee /etc/containerd/config.toml us config file ko store karta hai.

👨‍🏫 Summary:
Yeh step containerd ka default configuration file generate kar raha hai.

5️⃣ Change Cgroup Driver to Systemd¶

sudo sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml

Yeh Kya Kar Rahi Hai?¶

• Kubernetes systemd ko cgroup manager ke taur pe prefer karta hai.
• Yeh command config file me SystemdCgroup = true set kar rahi hai.

👨‍🏫 Summary:
Yeh ensure karta hai ke Kubernetes aur containerd ek compatible cgroup driver use karein.

6️⃣ Restart Containerd¶

sudo systemctl restart containerd

Yeh Kya Kar Rahi Hai?¶

• Naye configurations apply karne ke liye containerd ko restart karta hai.

👨‍🏫 Summary:
Changes ko apply karne ke liye containerd ko restart karna zaroori hai.

7️⃣ Enable Containerd Service on Boot¶

sudo systemctl enable --now containerd

Yeh Kya Kar Rahi Hai?¶

• enable ensures ke system boot hone ke baad containerd automatically start ho.
• --now command ussi waqt containerd ko start kar deta hai.

👨‍🏫 Summary:
Ensure karta hai ke system restart hone ke baad bhi containerd chale.

8️⃣ Install runc (Low-Level Container Runtime)¶

wget https://github.com/opencontainers/runc/releases/download/v1.1.4/runc.amd64
sudo install -m 755 runc.amd64 /usr/local/sbin/runc

Yeh Kya Kar Rahi Hai?¶

• runc ek low-level runtime hai jo container process ko manage karta hai.
• Yeh actual Linux namespaces aur cgroups ko setup karta hai taake ek isolated environment mile.

👨‍🏫 Summary:
Containerd internally runc use karta hai, jo actual container ko execute karta hai.

9️⃣ Install CNI Plugins (Container Networking Interface)¶

wget https://github.com/containernetworking/plugins/releases/download/v1.2.0/cni-plugins-linux-amd64-v1.2.0.tgz
sudo mkdir -p /opt/cni/bin
sudo tar Cxzvf /opt/cni/bin cni-plugins-linux-amd64-v1.2.0.tgz

Yeh Kya Kar Rahi Hai?¶

• Kubernetes ko CNI plugins chahiye jo container networking setup karein.
• Yeh different networking models (bridge, macvlan, host-local, etc.) provide karte hain.

👨‍🏫 Summary:
Kubernetes cluster ko network communication enable karne ke liye CNI zaroori hai.

🔟 Test Containerd with ctr¶

sudo ctr images pull docker.io/library/redis:alpine
sudo ctr run docker.io/library/redis:alpine redis

Yeh Kya Kar Rahi Hai?¶

• ctr images pull → Redis ka ek lightweight image (alpine) pull kar raha hai.
• ctr run → Ek Redis container start kar raha hai.

👨‍🏫 Summary:
Test kar raha hai ke containerd sahi se kaam kar raha hai.

🌟 Final Summary:¶

1️⃣ Kernel modules load kiye for storage & networking.
2️⃣ Sysctl settings configure ki taake forwarding & iptables work karein.
3️⃣ containerd install kiya jo container runtime ka kaam karega.
4️⃣ containerd ka config file generate & modify kiya taake systemd cgroup use kare.
5️⃣ runc install kiya jo container execution ke liye zaroori hai.
6️⃣ CNI plugins install kiye jo networking enable karenge.
7️⃣ Test container pull aur run karke verify kiya ke sab kuch sahi chal raha hai.

🎯 Ab tujhe commands copy-paste nahi karni parengi, tujhe pata hoga ke ye har step kyun zaroori hai! 🚀🔥¶

🌐 Step 5: Install CNI Plugins (For Networking)¶

Kubernetes aur containerd ke beech networking establish karne ke liye CNI (Container Network Interface) zaroori hai.

# Make directory for CNI plugins
sudo mkdir -p /opt/cni/bin

# Download latest CNI plugins
wget https://github.com/containernetworking/plugins/releases/latest/download/cni-plugins-linux-amd64-v1.1.1.tgz

# Extract CNI plugins
sudo tar Cxzvf /opt/cni/bin cni-plugins-linux-amd64-v1.1.1.tgz

Nahi, containerd by default kisi bhi external port pe directly accessible nahi hota. 🚫

🔍 Why?¶

• containerd ek daemon process hai jo system ke andar gRPC socket ke zariye communication karta hai.
• Ye directly expose nahi hota kisi network port pe, balki sirf local UNIX socket (/run/containerd/containerd.sock) ke through access hota hai.

✅ Kaise Check Karein?¶

Agar aap verify karna chahte ho ke containerd chal raha hai, toh systemd status check karo:

sudo systemctl status containerd

ss -l | grep containerd

u_str  LISTEN  0  4096  /run/containerd/containerd.sock

🛠️ Kya containerd ko kisi port pe expose kar sakte hain?¶

Haan, agar aap containerd ko kisi TCP port pe expose karna chahte ho, toh configuration change karni padegi:

1. Config file open karo:

   sudo nano /etc/containerd/config.toml
   

2. disabled_plugins ke andar cri ko disable mat karo:

   disabled_plugins = []
   

3. GRPC server ka address update karo:

   [grpc]
   address = "tcp://0.0.0.0:5000"
   

4. Restart containerd:

   sudo systemctl restart containerd
   

5. Ab check karo ke port open hai ya nahi:
   

   ss -tulnp | grep containerd
   

⚠️ Warning: Agar aap containerd ko kisi port pe expose karte ho, toh security ka khayal rakhna zaroori hai! Normally, kubernetes aur containerd sirf local communication (UNIX socket) use karte hain, is liye port expose karna zaroori nahi hota.

Understanding kubeadm init in Depth 🚀¶

📌 What is kubeadm init?¶

kubeadm init is the command used to initialize a Kubernetes control plane. This is the first step in setting up a Kubernetes cluster using kubeadm. It:
1. Sets up the control plane components (API Server, Controller Manager, Scheduler).
2. Generates required certificates for secure communication.
3. Bootstraps the cluster and configures networking.
4. Creates the admin config file (/etc/kubernetes/admin.conf) to allow kubectl to interact with the cluster.
5. Outputs a kubeadm join command to add worker nodes later.

📌 What Happens When You Run kubeadm init?¶

1️⃣ Pre-checks:
- Ensures the system is ready (checks firewall, swap, network, etc.).
- Verifies if the required ports are open.
- Checks if necessary system components (like containerd) are running.

2️⃣ Generates Certificates:
- Creates TLS certificates for API Server authentication.
- Stores them in /etc/kubernetes/pki/.
- Ensures secure communication within the cluster.

3️⃣ Configures the Control Plane:
- Deploys the API Server, Controller Manager, and Scheduler as static pods in /etc/kubernetes/manifests/.
- These pods run under kubelet.

4️⃣ Sets up Networking:
- Enables iptables rules for networking.
- Configures network policies.

5️⃣ Creates the admin.conf File:
- Allows kubectl to communicate with the cluster.
- Located at /etc/kubernetes/admin.conf.
- Must be copied to the user’s home directory for easy access.

6️⃣ Outputs kubeadm join Command:
- This command is used to add worker nodes to the cluster.
- Looks like this:

kubeadm join <master-ip>:6443 --token <TOKEN> --discovery-token-ca-cert-hash sha256:<HASH>

📌 Running kubeadm init¶

Now, execute:

sudo kubeadm init --pod-network-cidr=192.168.0.0/16

📌 Post kubeadm init Steps¶

1️⃣ Setup kubectl for your user:

mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

2️⃣ Deploy a Network Add-on (e.g., Flannel):

kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml

3️⃣ Verify the Cluster is Running:

kubectl get nodes
kubectl get pods -n kube-system

📌 Summary¶

✅ kubeadm init sets up the control plane.
✅ It generates certificates, deploys components, and configures networking.
✅ After initialization, you must install a networking add-on.
✅ kubeadm join command is used to add worker nodes later.

🚀 Let me know if you need more details!

📌 Step 2: Installing a CNI (Pod Network)¶

What this means?¶

• Kubernetes does not automatically set up networking for pods.
• You need to deploy a CNI (Container Network Interface) plugin like Calico or Flannel.
• Without a CNI, your pods won't be able to communicate with each other.

What to do next?¶

Run the command to install a CNI plugin:

Flannel CNI:¶

kubectl apply -f https://raw.githubusercontent.com/flannel-io/flannel/master/Documentation/kube-flannel.yml

Calico CNI:¶

kubectl apply -f https://docs.projectcalico.org/manifests/calico.yaml

🔍 Analysis of Your Cluster Status¶

You're running these commands to check the status of your Kubernetes cluster:

kubectl get all

kubectl get pods -n kube-system

📌 1. kubectl get all Output¶

NAME                 TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE
service/kubernetes   ClusterIP   10.96.0.1    <none>        443/TCP   19m

✅ What This Means:¶

• Only one service (kubernetes) is running.
• This is the API Server service that allows kubectl to communicate with the cluster.
• It is assigned a ClusterIP (10.96.0.1), meaning it is accessible only within the cluster.
• No other services or workloads are running yet.

📌 2. kubectl get pods -n kube-system Output¶

You have multiple pods running in the kube-system namespace.

✅ Running Pods¶

✅ These are critical system components that are working properly.

⚠️ Issue: calico-node Pods Not Fully Running¶

calico-node-m6bxv       0/1     Running   0          11m
calico-node-snkkr       0/1     Running   0          2m12s
calico-node-zzrj7       0/1     Running   0          2m55s

🚀 Next Steps to Fix Calico Issue¶

Run this command to check why Calico pods are failing:

kubectl logs -n kube-system -l k8s-app=calico-node

This will show logs for all calico-node pods.

Common Causes of Calico Node Failure¶

1. IP Forwarding is Disabled
   Check if IP forwarding is enabled on all nodes:

   sysctl net.ipv4.conf.all.forwarding
   

   If it returns 0, enable it:

   sudo sysctl -w net.ipv4.conf.all.forwarding=1
   

2. Mismatch in pod-network-cidr
   Verify that the --pod-network-cidr in kubeadm init matches Calico's config:

   kubectl get ippools -o yaml
   

   If it's wrong, you may need to delete and reapply the correct CNI configuration.

3. Firewall Rules Blocking Traffic
   Run this on all nodes:

   sudo iptables -L -v -n
   

   If you see blocks, try flushing iptables:

   sudo iptables --flush
   

4. Missing Kernel Modules
   Run:

   lsmod | grep ip_tables
   

   If it's missing, load it:

   sudo modprobe ip_tables
   

🎯 Final Checklist¶

✅ Master Node Setup: Everything looks good except for Calico issues.
✅ Worker Nodes Joined: kube-proxy is running, meaning nodes joined successfully.
🚨 Fix Calico Issues: Debug logs and check networking settings.

🚀 Try these steps and let me know the logs if the issue persists!¶

Dono commands ka connection CNI (Container Network Interface) se hai, lekin inka purpose different hai.
TL;DR:
1. CNI plugins (cni-plugins-linux-amd64-v1.6.2.tgz) → Kubernetes ke networking backend ke liye zaroori binaries install karta hai.
2. Calico manifest (calico.yaml) → Calico CNI ko deploy karta hai, jo Kubernetes ke networking aur network policies ko manage karta hai.

🔹 1. CNI Plugins Tarball (cni-plugins-linux-amd64-v1.6.2.tgz)¶

🔹 Yeh kab install karni hoti hai?
✔ Jab aap kubeadm se manually cluster setup kar rahe hain.
✔ Jab aapko CNI binaries manually install karni ho, taake Calico, Flannel, Weave, ya koi aur CNI plugin properly work kare.
✔ Yeh Kubernetes ka part nahi hoti, balki networking ke liye extra dependencies provide karti hai.

🔹 Iska function kya hai?
- CNI plugins ka tarball sirf CNI binaries install karta hai, jo /opt/cni/bin/ mein save hoti hain.
- Kubernetes ki networking plugins (jaise Flannel, Calico, etc.) in binaries ka use karti hain taake networking properly configure ho sake.
- Bina CNI binaries ke, aapka CNI plugin work nahi karega.

🔹 Command example:

wget https://github.com/containernetworking/plugins/releases/download/v1.6.2/cni-plugins-linux-amd64-v1.6.2.tgz
sudo mkdir -p /opt/cni/bin
sudo tar -C /opt/cni/bin -xzf cni-plugins-linux-amd64-v1.6.2.tgz

🔹 2. Calico Manifest (calico.yaml)¶

🔹 Yeh kab install karni hoti hai?
✔ Jab aap Kubernetes cluster setup kar chuke hain, aur ab networking configure karni hai.
✔ Jab aap Calico as a CNI plugin use karna chahte hain.
✔ Jab aapko network policies enforce karni hain, jaise pod-to-pod communication restrict karna.

🔹 Iska function kya hai?
- Calico Kubernetes ke liye ek full networking solution hai, jo BGP routing, network security policies, aur overlay/underlay networking provide karta hai.
- kubectl apply -f calico.yaml command Calico ke CRDs, DaemonSet, aur network policies deploy karti hai.
- Yeh cluster ke andar Pods ka networking model setup karta hai.

🔹 Command example:

kubectl apply -f https://docs.projectcalico.org/manifests/calico.yaml

🔹 Dono ka Connection?¶

✔ Pehle CNI binaries install hoti hain (cni-plugins-linux-amd64-v1.6.2.tgz) taake Kubernetes CNI system ko use kar sake.
✔ Phir Calico (calico.yaml) apply hota hai, jo Kubernetes networking ko manage karta hai.
✔ Agar CNI plugins install na hoon, toh Calico work nahi karega, kyunki Calico internally CNI plugins ko call karta hai.

⚡ Conclusion: Konsi Command Kab Chalani Hai?¶

🚀 Best Practice:
1️⃣ Pehle CNI plugins install karein
2️⃣ Phir Calico deploy karein
3️⃣ kubectl get pods -n kube-system check karein ke sab kuch properly running hai ya nahi.

Agar aap CNI plugins (cni-plugins-linux-amd64-v1.6.2.tgz) install nahi karte, toh aapke Kubernetes cluster mein networking issues aayengi, aur Calico ya koi bhi CNI plugin properly work nahi karega.

🚨 Problems Without CNI Plugins¶

Agar aap CNI plugins install nahi karte, toh yeh issues ho sakti hain:

❌ 1. kubectl get nodes shows "Not Ready"`¶

• Aapka Kubernetes node "Ready" state mein nahi aayega, kyunki networking initialize nahi hogi.
• Command:

  kubectl get nodes
  

  Output kuch is tarah ho sakta hai:

  NAME    STATUS     ROLES    AGE   VERSION
  node-1  NotReady   master   5m    v1.28.0
  

  🚨 Reason: Kubelet CNI ko initialize karne ki koshish karega, lekin bina CNI plugins ke fail ho jayega.

❌ 2. kubectl get pods -n kube-system shows CNI-related errors¶

• Kubernetes ke networking-related pods CrashLoopBackOff ya ContainerCreating state mein atke rahenge.
• Command:

  kubectl get pods -n kube-system
  

  Output kuch is tarah ho sakta hai:

  NAME                                       READY   STATUS              RESTARTS   AGE
  calico-kube-controllers-xxxx               0/1     CrashLoopBackOff    5          3m
  calico-node-xxxx                           0/1     CreateContainerError 0          3m
  kube-proxy-xxxx                            1/1     Running             0          5m
  

  🚨 Reason: Calico CNI plugins binaries ko /opt/cni/bin/ se load karne ki koshish karta hai, jo exist nahi karti.

❌ 3. journalctl -u kubelet shows "no CNI plugin found"¶

• Agar aap logs check karenge, toh kubelet complain karega ke CNI plugin available nahi hai.
• Command:

  journalctl -u kubelet | grep CNI
  

  Output kuch is tarah ho sakta hai:

  kubelet[1234]: networkPlugin cni failed to set up pod "mypod_default" network: no CNI plugin found in /opt/cni/bin/
  

❌ 4. Pods Will Not Be Able to Communicate¶

• Agar networking initialize nahi hoti, toh pods ek dusre se communicate nahi kar sakte.
• Agar aap kubectl get pods -A chalayein, toh pods ya toh pending rahenge ya running nahi honge.

✅ Solution: Install CNI Plugins Before Calico¶

Agar aapko yeh issues avoid karni hain, toh pehle CNI plugins install karein, phir Calico apply karein:

# Install CNI Plugins
wget https://github.com/containernetworking/plugins/releases/download/v1.6.2/cni-plugins-linux-amd64-v1.6.2.tgz
sudo mkdir -p /opt/cni/bin
sudo tar -C /opt/cni/bin -xzf cni-plugins-linux-amd64-v1.6.2.tgz

# Apply Calico CNI
kubectl apply -f https://docs.projectcalico.org/manifests/calico.yaml

🎯 Conclusion: CNI Plugins Install Karna Zaroori Hai!¶

✔ Bina CNI Plugins ke: Cluster networking fail ho jayegi.
✔ Agar pehle install kar dein: Calico ya koi bhi CNI plugin properly work karega.

🚀 Best Practice: Hamesha CNI plugins pehle install karein, phir CNI manifest (Calico, Flannel, etc.) apply karein.

Nahi, CNI plugins (cni-plugins-linux-amd64-v1.6.2.tgz) sirf containerd ki dependency nahi hain. Yeh Kubernetes networking ke liye zaroori hain, chahe aap container runtime containerd use kar rahe ho ya CRI-O ya Docker.

🚀 CNI Plugins ka Role Kya Hai?¶

CNI (Container Network Interface) plugins Kubernetes pods ko network assign karne ke liye use hote hain. Jab Kubernetes koi pod start karta hai, toh yeh CNI plugins ko call karta hai taake pod ko ek IP assign ho aur networking setup ho sake.

💡 Containerd sirf containers ko run karne ka kaam karta hai, magar networking manage nahi karta.

Agar aap sirf containerd + runc install karte hain aur CNI plugins install nahi karte, toh pod network create nahi hoga, aur kubelet errors dega.

🚨 Bina CNI Plugins ke Kya Issues Honge?¶

Agar aap CNI plugins install nahi karte, toh yeh problems ho sakti hain:

❌ 1. Pods ko IP nahi milegi, aur wo stuck ho jayenge¶

kubectl get pods -A

NAMESPACE     NAME                                       READY   STATUS              RESTARTS   AGE
kube-system   calico-node-xxxxx                         0/1     CreateContainerError 0          5m
kube-system   calico-kube-controllers-xxxxx            0/1     CrashLoopBackOff    5          5m

❌ 2. journalctl -u kubelet logs show missing CNI plugin errors¶

journalctl -u kubelet | grep CNI

networkPlugin cni failed to set up pod "mypod_default" network: no CNI plugin found in /opt/cni/bin/

❌ 3. kubectl get nodes will show "NotReady"¶

kubectl get nodes

NAME    STATUS     ROLES    AGE   VERSION
node-1  NotReady   master   10m   v1.28.0

🎯 Final Answer: Calico CNI Plugins Automatically Install Nahi Karta¶

Calico sirf network policies aur IP routing manage karta hai, magar CNI plugins (cni-plugins-linux-amd64-v1.6.2.tgz) install nahi karta.

✅ Agar aap CNI plugins install karenge, toh Calico properly work karega.
❌ Agar nahi karenge, toh Calico aur networking fail ho jayegi.

Calico and Flannel are CNI plugins, not CNIs themselves.

Understanding CNI vs. CNI Plugin¶

🔹 CNI (Container Network Interface):
CNI is just a standard (a set of specifications) that defines how networking should be implemented in containerized environments. It doesn't provide networking itself.

🔹 CNI Plugin:
A CNI plugin is an actual implementation of the CNI standard. Calico, Flannel, Cilium, Weave, etc., are CNI plugins that follow the CNI specification to provide networking for Kubernetes clusters.

How It Works¶

When Kubernetes needs to set up networking for a pod, it calls the CNI interface, which then invokes the configured CNI plugin (Calico, Flannel, etc.) to handle networking tasks.

Example of CNI Plugins¶

Would you like a deeper dive into the technical differences between Calico and Flannel? 🚀

CNI Interface – What Is It?¶

The CNI (Container Network Interface) interface is a standardized API that allows Kubernetes (or any container runtime) to communicate with networking plugins. It acts as a bridge between the container runtime (like containerd or CRI-O) and networking solutions (like Calico, Flannel, etc.).

How It Works¶

1️⃣ Kubernetes (Kubelet) needs to create a pod
- It calls the container runtime (e.g., containerd).

2️⃣ Container runtime requests network setup
- The runtime calls the CNI interface, passing details like pod name, namespace, and container ID.

3️⃣ CNI Interface triggers the configured CNI plugin
- This could be Calico, Flannel, Cilium, etc.

4️⃣ CNI Plugin configures networking
- It sets up interfaces, IPs, routes, and any necessary firewall rules for the pod.

5️⃣ Networking is ready
- The pod gets connected to the cluster network.

CNI Interface vs. CNI Plugin¶

CNI Interface in Action¶

📌 In Kubernetes, the CNI interface is typically located at:

/etc/cni/net.d/

📌 The CNI plugins themselves are stored in:

/opt/cni/bin/

Analogy: CNI Interface as a Power Socket 🔌¶

• CNI Interface = A standardized power socket that ensures all electrical devices can be plugged in.
• CNI Plugin (Calico, Flannel, etc.) = Different power adapters that convert the electricity to the right format.

Would you like an example of how a CNI plugin (like Flannel) is configured via the CNI interface? 🚀

Yes, exactly! ✅

When you extract cni-plugins-linux-amd64-v1.6.2.tgz, it places all the CNI plugins into /opt/cni/bin/.

How It Works?¶

1️⃣ Extracting the package:

sudo tar -C /opt/cni/bin -xzf cni-plugins-linux-amd64-v1.6.2.tgz

2️⃣ Now, depending on your configuration, Kubernetes (or any container runtime) picks a specific plugin from this directory based on your config in /etc/cni/net.d/.

3️⃣ When a pod starts, Kubernetes looks at the CNI configuration file (e.g., Flannel, Calico) and executes the corresponding plugin binary from /opt/cni/bin/.

Example: Configuring Flannel as the CNI Plugin¶

After extracting the plugins, you would place a Flannel-specific configuration file in /etc/cni/net.d/, like this:

{
  "cniVersion": "0.3.1",
  "name": "flannel-net",
  "plugins": [
    {
      "type": "flannel",
      "delegate": {
        "type": "bridge",
        "bridge": "cni0",
        "isGateway": true,
        "ipMasq": true,
        "hairpinMode": true,
        "ipam": {
          "type": "host-local",
          "subnet": "10.244.0.0/16",
          "routes": [{ "dst": "0.0.0.0/0" }]
        }
      }
    }
  ]
}

Once this is done, Kubernetes will execute /opt/cni/bin/flannel whenever it needs to configure networking for a new pod.

Key Takeaway¶

• /opt/cni/bin/ contains all CNI plugin binaries.
• /etc/cni/net.d/ contains CNI configuration files that tell Kubernetes which plugin to use.
• Kubernetes picks the right binary from /opt/cni/bin/ based on the configuration file in /etc/cni/net.d/.

Would you like a breakdown of another CNI plugin, such as Calico? 🚀

Not necessarily. /etc/cni/net.d/ can contain multiple CNI configuration files at the same time.

How Kubernetes Handles Multiple CNI Configs in /etc/cni/net.d/¶

• The first configuration file (sorted alphabetically) is used as the primary CNI plugin.
• Additional configuration files may be used for chaining (e.g., adding extra network features).
• If multiple configurations exist, Kubernetes (or CRI) selects the first matching one.

Example 1: Single Plugin (Flannel Only)¶

If /etc/cni/net.d/ contains only one configuration file:

ls /etc/cni/net.d/
10-flannel.conflist

Example 2: Multiple Plugins (Flannel + Bandwidth Control)¶

You might have multiple config files:

ls /etc/cni/net.d/
10-flannel.conflist
20-bandwidth.conf

How it works:
- The primary CNI plugin (Flannel) handles pod networking.
- The secondary plugin (Bandwidth) applies network restrictions.

Example 3: Using Chained CNI Plugins in a Single Config File¶

Instead of separate files, you can also define multiple plugins inside one file using the "plugins" array:

{
  "cniVersion": "0.3.1",
  "name": "multus-network",
  "plugins": [
    {
      "type": "flannel"
    },
    {
      "type": "bandwidth",
      "ingressRate": 1000000,
      "egressRate": 1000000
    }
  ]
}

Final Answer:¶

• Yes, there can be multiple CNI config files in /etc/cni/net.d/.
• Kubernetes will use the first matching config (alphabetically sorted).
• Plugins can also be chained inside a single .conflist file.

Would you like an example of a Multus CNI setup (which allows multiple CNIs per pod)? 🚀

No worries! Since you've installed Calico but haven't explicitly opened its required ports, let's go over it again.

📌 Why Do You Need to Open Ports for Calico?¶

Calico is a CNI plugin that enables networking for Kubernetes Pods. It runs its own components, such as the Felix agent, BGP, and Typha, which require specific ports to be open for proper communication.

🚀 Required Ports for Calico¶

You need to ensure that the following ports are open on all Kubernetes nodes (control plane & worker nodes):

1️⃣ Calico Node-to-Node Communication (BGP & VXLAN/IP-in-IP)¶

• Which mode are you using?
• Default: IP-in-IP → Open 6081/UDP
• If using VXLAN → Open 4789/UDP
• If using BGP Peering → Open 179/TCP

2️⃣ Felix Agent & Typha (For Large Clusters)¶

👉 Action: Open the relevant ports based on your networking mode.

🚀 How to Open These Ports?¶

If your firewall is enabled, run the following commands to allow the required ports:

For UFW (Ubuntu/Debian)¶

sudo ufw allow 179/tcp    # BGP
sudo ufw allow 4789/udp   # VXLAN (if using)
sudo ufw allow 6081/udp   # IP-in-IP (if using)
sudo ufw allow 9091/tcp   # Felix metrics (optional)
sudo ufw allow 5473/tcp   # Typha (if using)
sudo ufw reload

For Firewalld (RHEL/CentOS)¶

sudo firewall-cmd --permanent --add-port=179/tcp
sudo firewall-cmd --permanent --add-port=4789/udp
sudo firewall-cmd --permanent --add-port=6081/udp
sudo firewall-cmd --permanent --add-port=9091/tcp
sudo firewall-cmd --permanent --add-port=5473/tcp
sudo firewall-cmd --reload

🚀 How to Verify If Ports Are Open?¶

Run:

sudo netstat -tulnp | grep -E '179|4789|6081|9091|5473'

sudo ss -tulnp | grep -E '179|4789|6081|9091|5473'

📌 Final Steps: Restart Calico¶

After opening the ports, restart Calico to apply the changes:

kubectl rollout restart ds calico-node -n calico-system

Now, your Kubernetes nodes should communicate properly using Calico networking! Let me know if you need further clarification. 🚀

You're right! To determine which encapsulation mode Calico is using, I asked for the output of:

kubectl get ippools -o yaml

📌 What to Look For?¶

The output will contain a section like this:

apiVersion: crd.projectcalico.org/v1
kind: IPPool
metadata:
  name: default-ipv4-ippool
spec:
  cidr: 192.168.0.0/16
  ipipMode: Always
  vxlanMode: Never
  natOutgoing: true

📌 Based on Your Output:¶

• If ipipMode: Always → You are using IP-in-IP (Default Mode)
  → You must allow Protocol 4 in your firewall.
• If vxlanMode: Always → You are using VXLAN Mode
  → You must open UDP 4789.
• If both are Never, then Calico is using BGP
  → You must open TCP 179.

📌 What You Need to Do?¶

If You Are Using IP-in-IP (Default)¶

sudo ufw allow proto 4
sudo firewall-cmd --permanent --add-protocol=4
sudo firewall-cmd --reload

If You Are Using VXLAN¶

sudo ufw allow 4789/udp
sudo firewall-cmd --permanent --add-port=4789/udp
sudo firewall-cmd --reload

If You Are Using BGP¶

sudo ufw allow 179/tcp
sudo firewall-cmd --permanent --add-port=179/tcp
sudo firewall-cmd --reload

After applying the changes, restart Calico:

kubectl rollout restart ds calico-node -n calico-system

Now, if you run:

kubectl get nodes -o wide

Bhai, tu ne kubeconfig ka poora landscape explore karna shuru kar diya, jo zabardast baat hai. Chal, ek ek karke in sab scenarios ko discuss karte hain.

1️⃣ Kubeconfig File Kis Machine Pe Zaroori Hai?¶

Kubeconfig file sirf us machine pe zaroori hai jahan se tum kubectl use kar rahe ho.
Matlab: - Master Node / Control Plane pe ho to wahan bhi ho sakti hai. - Worker Nodes pe zaroori nahi hoti (kyunki worker nodes sirf workloads run karte hain). - Developer ki local machine pe honi zaroori hai agar wo remote cluster ko access kar raha hai.

✅ Golden Rule:
Agar tum kisi machine se kubectl chala rahe ho aur tumhe cluster access chahiye, to us machine pe kubeconfig file ka hona zaroori hai.

2️⃣ Kubeadm Se Cluster Banane Ke Baad Kya Hota Hai?¶

Jab tum kubeadm se cluster banate ho, to end par kubeadm yeh bolta hai:

mkdir -p $HOME/.kube
cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
chown $(id -u):$(id -g) $HOME/.kube/config

🔹 Agar tum kisi doosri machine se cluster access karna chahte ho (jaise developer laptop), to tumhe /etc/kubernetes/admin.conf ko wahan copy karna padega ya fir admin user ke liye ek naya kubeconfig generate karna padega.

scp user@master:/etc/kubernetes/admin.conf ~/.kube/config

¶

3️⃣ Minikube & Kind Ka Scenario¶

✅ Minikube aur Kind already tumhari local machine pe ek temporary cluster chalate hain, aur inka kubeconfig automatic configure ho jata hai.

Agar tum kubectl config get-contexts chalao, to dekhoge ke Minikube aur Kind ka context already wahan present hoga.

• Minikube ke liye
  

  minikube start
  kubectl config use-context minikube
  

  Minikube automatically ~/.kube/config me entry bana deta hai.

• Kind ke liye
  

  kind create cluster --name my-cluster
  kubectl config use-context kind-my-cluster
  

  Iska kubeconfig bhi automatic update hota hai, lekin tum manually bhi export kar sakte ho:

  kind get kubeconfig --name my-cluster
  

⚠️ Important:
Minikube aur Kind single-machine clusters hote hain, is wajah se ye kubeconfig sirf tumhari local machine ke liye bana hota hai. Kisi aur machine se access karna ho to manually kubeconfig export karna padega.

4️⃣ AWS EKS, Managed Kubernetes Services Ka Scene¶

✅ Managed Kubernetes Services (EKS, GKE, AKS) ka control plane cloud provider ke paas hota hai. Tumhari machine par koi kubeconfig file by default nahi hoti, lekin tum kubectl ke through cluster ko tab access kar sakte ho jab tum cloud provider se kubeconfig generate kar lo.

AWS EKS Ke Liye¶

AWS CLI se kubeconfig generate karne ka tareeqa:

aws eks update-kubeconfig --region us-east-1 --name my-eks-cluster

Agar tum kubectl config get-contexts dekho ge to wahan tumhara EKS cluster ka context bhi dikhega.

5️⃣ Multiple Clusters Ka Scenario¶

Jab tum naya cluster add karte ho, to kubeconfig file automatically update nahi hoti (except Minikube & Kind). Tumhe manually new cluster ka config add karna padta hai.

✅ Tum multiple clusters ko ek hi kubeconfig file me merge bhi kar sakte ho.

Agar Multiple Clusters Hain to Contexts Kaise Handle Karein?¶

Tum kubectl config get-contexts se check kar sakte ho ke tumhare paas kon kon se clusters hain:

kubectl config get-contexts

kubectl config use-context my-cluster

Multiple Clusters Ko Merge Karna¶

Agar tumhare paas 2 ya zyada kubeconfig files hain, to unko merge karke ek file bana sakte ho:

export KUBECONFIG=/path/to/config1:/path/to/config2
kubectl config view --merge --flatten > ~/.kube/config

🔥 Final Summary¶

1. Kubeconfig sirf us machine pe chahiye jahan se tum kubectl se cluster access kar rahe ho.
2. Kubeadm clusters me ye file /etc/kubernetes/admin.conf hoti hai, jo manually copy karni parti hai.
3. Minikube aur Kind apni kubeconfig ko automatically update kar dete hain.
4. AWS EKS, GKE, AKS jaise managed clusters ke liye kubeconfig manually fetch karna padta hai (AWS me aws eks update-kubeconfig).
5. Multiple clusters ko ek hi kubeconfig me manage kiya ja sakta hai using contexts.

Bhai, abhi koi confusion hai ya sab clear ho gaya? 😎

Bro, kubeconfig file ka kaam kubectl ko bataana hota hai ke:
1. Kis API Server se connect karna hai? (Cluster endpoint)
2. Kaunse credentials use karne hain? (Authentication)
3. Kaunsa namespace ya context use karna hai? (Default behavior)

Ab isko step-by-step deconstruct karte hain.

🔥 Kubeconfig Ka Basic Concept¶

Jab bhi tum kubectl get pods chalate ho, to kubectl: 1. Kubeconfig file read karta hai (~/.kube/config by default). 2. Usme cluster details dhundta hai. 3. Cluster ke API Server se connect hota hai. 4. API Server credentials check karta hai (authentication). 5. Authorization ke baad tumhara command execute hota hai.

Matlab:
✅ Kubeconfig = Connection Information for kubectl
✅ API Server = Main Gateway jo requests handle karta hai

🛠 Kubeconfig Ki Anatomy (Structure Samajhna)¶

Ek normal kubeconfig file kuch aisi dikhti hai:

apiVersion: v1
kind: Config
clusters:
- name: my-cluster
  cluster:
    server: https://192.168.1.100:6443
    certificate-authority: /etc/kubernetes/pki/ca.crt

contexts:
- name: my-context
  context:
    cluster: my-cluster
    user: admin-user
    namespace: default

users:
- name: admin-user
  user:
    client-certificate: /etc/kubernetes/pki/admin.crt
    client-key: /etc/kubernetes/pki/admin.key

current-context: my-context

Ye file 4 major sections pe based hoti hai:

1️⃣ Clusters Section¶

clusters:
- name: my-cluster
  cluster:
    server: https://192.168.1.100:6443
    certificate-authority: /etc/kubernetes/pki/ca.crt

2️⃣ Users Section¶

users:
- name: admin-user
  user:
    client-certificate: /etc/kubernetes/pki/admin.crt
    client-key: /etc/kubernetes/pki/admin.key

3️⃣ Contexts Section¶

contexts:
- name: my-context
  context:
    cluster: my-cluster
    user: admin-user
    namespace: default

4️⃣ Current Context (Active Cluster)¶

current-context: my-context

🚀 Kubeconfig Aur API Server Ka Connection¶

✅ Jab bhi tum koi kubectl command chalate ho, jaise:

kubectl get pods

1. Kubeconfig file check karega
2. ~/.kube/config ko read karega.
3. current-context dekhega.

4. Us context ke andar cluster ka API Server dhoondega.

5. API Server se Connection Establish Karega

6. server: https://192.168.1.100:6443 pe request bhejega.

7. TLS Certificate se secure connection verify karega.

8. Authentication & Authorization Karega

9. User (admin-user) ke client certificate aur key check karega.

10. Agar user authorized hai, to query process hogi.

11. API Server Response Dega

12. API Server etcd se data fetch karega.
13. Response return karega.
14. kubectl output print karega.

🔥 Real-World Example¶

Agar tumhari kubeconfig file delete ho jaye, to tum kubectl use nahi kar sakoge:

mv ~/.kube/config ~/.kube/config.bak
kubectl get pods

error: cannot find kubeconfig file

Solution: Tum manually API Server ka kubeconfig phir se fetch kar sakte ho.
Agar cluster kubeadm se bana hai, to:

cp /etc/kubernetes/admin.conf ~/.kube/config

aws eks update-kubeconfig --region us-east-1 --name my-eks-cluster

🔍 Final Summary¶

✅ Kubeconfig file ka kaam hai:
- API Server ka address store karna
- Authentication & authorization ke liye credentials rakhna
- Active cluster aur context ko define karna

✅ API Server ka role hai:
- kubectl se requests receive karna
- Authentication & authorization check karna
- etcd se data fetch karke response dena

✅ Jab tak kubeconfig file nahi hogi, kubectl API Server se connect nahi kar sakta.

Bro, ab koi confusion hai ya full clarity mil gayi? 🚀

Architecture¶

Bro, Kubernetes Architecture ka end-to-end flow yahan explain kar raha hoon:

1️⃣ Jab Tum kubectl Run Karte Ho, Kya Hota Hai?¶

Let's say tum ye command run karte ho:

kubectl get pods

1. kubectl -> Kubeconfig
2. kubectl tumhari kubeconfig file (~/.kube/config) ko read karta hai.
3. Ye file decide karti hai ke kaunsa API server access karna hai aur authentication kaise hogi.

4. Example:

   current-context: my-cluster
   clusters:
   - cluster:
       server: https://API_SERVER_IP
       certificate-authority-data: LS0tLS1...
   users:
   - name: my-user
     user:
       token: abc123
   

5. kubectl -> API Server

6. kubectl API server (kube-apiserver) se request bhejta hai:

   GET /api/v1/pods
   

7. Ye request authentication & authorization se guzarti hai:

   1. Authentication (token, certificates, ya aws eks get-token)
   2. Authorization (RBAC roles check hoti hain)
   3. Admission Controllers (Security policies validate hoti hain)

8. API Server -> etcd (for Data Storage)

9. API Server etcd se data fetch karta hai.

10. etcd is like Kubernetes ka database jo sari cluster ki state store karta hai (pods, services, deployments).

11. API Server -> Response to kubectl

12. API Server response return karta hai, aur tumhare terminal me pod ka output aata hai.

2️⃣ Kubernetes Ke Architecture Components (Pods)¶

✅ Kubernetes Control Plane Components
✅ Kubernetes Worker Node Components
✅ Konse Components Sirf Control Plane Pe Hain?
✅ Konse Worker Nodes Pe Hain?

📌 Control Plane Ke Components (Only on Control Plane Nodes)¶

🚀 Yeh sab components sirf Control Plane nodes pe run hotay hain.
Run karne ka command:

kubectl get pods -n kube-system -o wide

NAME                                      READY   STATUS    NODE
etcd-master-node                          1/1     Running   master-node
kube-apiserver-master-node                1/1     Running   master-node
kube-controller-manager-master-node       1/1     Running   master-node
kube-scheduler-master-node                1/1     Running   master-node

📌 Worker Node Ke Components (Only on Worker Nodes)¶

🚀 Yeh sab components sirf Worker Nodes pe hote hain.
Example:

kubectl get pods -n kube-system -o wide

kube-proxy-node-1                           1/1     Running   worker-node-1
kube-proxy-node-2                           1/1     Running   worker-node-2

📌 Konse Components Control Plane & Worker Dono Pe Hote Hain?¶

✅ CNI (Container Network Interface) Plugin
- Agar tum Cilium, Calico, Flannel ya koi bhi networking plugin use kar rahe ho, to ye sare nodes pe chalega.
- Example:

cilium-agent-node-1                       1/1     Running   worker-node-1
cilium-agent-node-2                       1/1     Running   worker-node-2

✅ Metrics Server (for Monitoring) - Agar tum metrics-server install karte ho to ye kisi bhi node pe run ho sakta hai.

✅ CoreDNS (for DNS Resolution) - Ye Control Plane nodes pe hota hai, lekin kabhi kabhi worker pe bhi deploy ho sakta hai.

3️⃣ Cluster Me Kitne Pods Honge?¶

Agar tumhare paas: - 3 Control Plane nodes hain - 5 Worker nodes hain

To total pods honge:

🔹 Total Pods: ~41 (depending on setup)

4️⃣ kubelet Kis Jagah Fit Hota Hai?¶

❓ Kya kubelet ka koi pod hota hai?¶

Nahi!
- kubelet ek system-level process hai, jo har node pe run hota hai, kisi pod ke andar nahi hota.
- Check karne ke liye:

ps aux | grep kubelet

root       1456  2.0  1.2  185400  56732 ?  Ssl  10:32   2:13 /usr/bin/kubelet --config=/var/lib/kubelet/config.yaml

🛠 kubelet ka Kaam Kya Hai?¶

• Ye worker node ka agent hai.
• Ye API server se instructions leta hai aur ensure karta hai ke required pods run ho rahe hain.
• Jab tum kubectl apply -f pod.yaml chalate ho:
• kubectl API server se baat karta hai.
• API server etcd me entry store karta hai.
• Kube-scheduler decide karta hai kaunsa node assign hoga.
• kubelet us node pe pod start karne ka process initiate karta hai.

🔄 kubelet vs API Server¶

🔥 Summary¶

✅ kubectl command API Server se request bhejta hai, jo etcd se data fetch karta hai.
✅ Control Plane pe API Server, etcd, Scheduler, Controller Manager hote hain.
✅ Worker nodes pe kubelet, kube-proxy, aur Container Runtime hota hai.
✅ kubelet pod nahi hai, balki ek system process hai, jo har node pe chalta hai.
✅ Cluster size pe depend karta hai ke kitne pods run honge.

Ab samajh aaya? Koi aur sawal hai to batao bro! 🚀

Bro, woh galti thi! kubelet ka koi pod nahi hota, ye ek system-level process hai, jo har node pe as a service run karta hai.

Table mein maine galti se kubelet ko pods ke count mein likh diya tha, jo incorrect tha. Correction yeh hai:

🔥 Correction:¶

🚀 kubelet ek process hai, pod nahi!
🚀 Har node pe ek kubelet process run karta hai, par ye kisi pod ke andar nahi hota.

Tera spot-on observation tha! Mazaa aaya! 🔥 Koi aur question ho to batao. 🚀

🔥 CoreDNS ke Pods Kab Bante Hain?¶

Jab Kubernetes cluster create hota hai, tab CoreDNS ke pods automatically bante hain, magar sirf tab jab cluster ke liye DNS service enable ho.

Ye kubeadm, Minikube, Kind, EKS, GKE, AKS sab me default hota hai, jab tak explicitly disable na kiya ho.

✅ CoreDNS Running Pe Lany Ke Liye Kya Chahiye?¶

Agar CoreDNS run nahi ho raha, to ye cheezein check karni chahiye:

1. Kube-Proxy theek chal raha ho (kyunki ye DNS requests ko route karta hai).
   

   kubectl get pods -n kube-system | grep kube-proxy
   

   ✅ Har node pe ek kube-proxy pod run hona chahiye.

2. CNI Plugin sahi se install ho (Networking ke bina CoreDNS communicate nahi karega).
   

   kubectl get pods -n kube-system | grep calico  # ya jo bhi CNI ho
   

   ✅ CNI Plugin ke pods running hone chahiye.

3. CoreDNS ka ConfigMap theek ho
   

   kubectl get cm -n kube-system
   

   ✅ Isme coredns ka ConfigMap hona chahiye.

4. Cluster ka DNS Service Running ho
   

   kubectl get svc -n kube-system | grep kube-dns
   

   ✅ kube-dns service exist karni chahiye.

🔍 CoreDNS Ek Alag Pod Hai, Ya Koi Aur Component Isko Banata Hai?¶

• CoreDNS ka pod alag se exist karta hai, magar ye kube-controller-manager ke under Deployment ke طور پر create hota hai.
• Yeh ek Deployment hota hai, na ke static pod.
• Kubeadm, Minikube, Kind, aur Managed Kubernetes services automatically isko deploy karte hain.

👀 CoreDNS Pods Dekhne ka Tarika¶

kubectl get pods -n kube-system | grep coredns

coredns-123abc   Running   1/1   15m
coredns-456def   Running   1/1   15m

🛠️ Agar CoreDNS Nahi Chal Raha, To Fix Karne Ka Tarika¶

1️⃣ CNI Plugin check karo

kubectl get pods -n kube-system | grep calico  # ya jo bhi CNI ho

2️⃣ CoreDNS Deployment check karo

kubectl get deployment -n kube-system | grep coredns

kubectl apply -f https://raw.githubusercontent.com/kubernetes/kubernetes/master/cluster/addons/dns/coredns/coredns.yaml

3️⃣ DNS Service check karo

kubectl get svc -n kube-system | grep kube-dns

🔥 Bottom Line¶

1. CoreDNS cluster create hone pe auto deploy hota hai.
2. Yeh ek Deployment hota hai, static pod nahi.
3. Agar network ya kube-proxy sahi nahi chal raha, to ye fail ho sakta hai.
4. Agar chal nahi raha, to CNI, ConfigMap, aur kube-proxy check karna zaroori hai.

Samajh aaya? 😎 Ya aur deep dive chahiye? 🚀

Bohat zabardast question kiya hai! Kubernetes ke andar kon se pods Deployment ke results hain aur kon se Static Pods hain, ye samajhna architecture ko deeply samajhne ke liye bohat zaroori hai.

🔥 Static Pods vs. Deployment Pods in Kubernetes¶

• Static Pods: Yeh directly Kubelet manage karta hai, aur yeh kubectl apply ya Deployment se control nahi hotay.
• Deployment Pods: Yeh kube-controller-manager ke under control hotay hain, aur kubectl apply ya helm se manage hote hain.

🤖 Control Plane ke Components & Unke Pods¶

✅ Control Plane me sirf 4 static pods hain:
- kube-apiserver
- kube-controller-manager
- kube-scheduler
- etcd

💡 Baqi sab deployments ya DaemonSet hote hain!

⚡ Worker Nodes ke Components & Unke Pods¶

✅ Worker nodes me sirf ek process hota hai jo pod nahi hota → Kubelet.
✅ CNI Plugin aur kube-proxy DaemonSet hote hain jo har node pe run hotay hain.
✅ User applications sirf Worker Nodes pe run hoti hain (unless explicitly control plane pe deploy karein).

🔥 Summary¶

• Static Pods sirf Control Plane pe hotay hain, aur Kubelet inko /etc/kubernetes/manifests/ se uthata hai.
• Deployment wale pods Control + Worker dono pe ho sakte hain, lekin inko kube-controller-manager manage karta hai.
• Kubelet ek system process hai, pod nahi.
• Worker nodes sirf CNI, kube-proxy, aur user applications chalate hain.

💡 Agar cluster me 3 control plane nodes aur 5 worker nodes hain, to kitne total system pods chalain gay? 😏

Tumhara doubt valid hai! Kya kube-proxy sirf worker nodes pe chalta hai ya control plane pe bhi? Yeh confusion aksar hoti hai, aur iska jawab cluster ke setup per depend karta hai.

🔥 Kya kube-proxy sirf Worker Nodes pe chalta hai?¶

💡 Default Kubernetes Cluster Setup:
✅ kube-proxy har node pe chalta hai, chahe wo control plane ho ya worker node.
✅ Yeh ek DaemonSet hota hai, jo sabhi nodes pe ek pod schedule karta hai.

❌ Agar kube-proxy sirf worker nodes pe ho, to problem kya hogi?¶

• Agar control plane nodes pe kube-proxy na ho, to control plane se kisi service ka access mushkil ho sakta hai.
• Example: Agar API server kisi service ko call kare jo worker nodes pe chal rahi hai, to uska connection masla karega.

✅ Kya aisa setup ho sakta hai jisme kube-proxy sirf worker nodes pe ho?¶

• Agar taqreeban sabhi workloads sirf worker nodes pe hain, aur Control Plane nodes sirf management ke liye hain, to kube-proxy sirf worker nodes pe deploy kiya ja sakta hai.
• Manually taqreeban har CNI plugin me ye setting hoti hai jisse kube-proxy sirf worker nodes pe chalaya ja sakta hai.

🔥 Table Fix¶

✅ By default, kube-proxy control plane + worker nodes dono pe hota hai.
✅ Agar sirf worker nodes pe chahiye, to DaemonSet ki NodeSelector ya Taints ka use karna padega.

🔥 Final Answer¶

Tumhari soch bilkul sahi thi! kube-proxy sirf worker nodes pe bhi ho sakta hai, lekin by default har node pe hota hai, including control plane. 😎

Follow me on LinkedIn: www.linkedin.com/comm/mynetwork/discovery-see-all?usecase=PEOPLE_FOLLOWS&followMember=ibtisam-iq