How to Build a Kubernetes Cluster from Scratch: Step‑by‑Step Guide

1. Planning the K8s Environment

Define whether to use a single‑master or multi‑master architecture and draw the network topology.

2. Server Hardware Requirements

CentOS 7.x (x86_64) on one or more servers

At least 2 GB RAM, 2 CPU cores, 30 GB disk per node

All machines must have network connectivity

External network access for pulling images

Swap must be disabled

3. Deployment Methods

Two production‑grade approaches are described:

kubeadm : quick initialization with kubeadm init and kubeadm join Binary packages: manual download and installation of each component for deeper learning and control

4. kubeadm Cluster Setup

4.1 System Initialization

Disable firewalld: systemctl stop firewalld && systemctl disable firewalld Disable SELinux permanently: sed -i 's/enforcing/disabled/' /etc/selinux/config && reboot or temporarily with setenforce 0 Turn off swap: sed -ri 's/.*swap.*/#&/' /etc/fstab && swapoff -a && reboot Set hostnames for each node (e.g., hostnamectl set-hostname k8s-master) and update /etc/hosts with all node IPs.

Configure bridge networking and IP forwarding via /etc/sysctl.d/k8s.conf and load the br_netfilter module.

Synchronize time using yum install ntpdate -y && ntpdate time.windows.com.

4.2 Install Docker

wget https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo -O /etc/yum.repos.d/docker-ce.repo
yum -y install docker-ce-18.06.3.ce-3.el7
systemctl enable docker && systemctl start docker
mkdir -p /etc/docker
cat <<'EOF' > /etc/docker/daemon.json
{
  "exec-opts": ["native.cgroupdriver=systemd"],
  "registry-mirrors": ["https://b9pmyelo.mirror.aliyuncs.com"]
}
EOF
systemctl daemon-reload
systemctl restart docker

4.3 Install kubeadm, kubelet, kubectl

yum install -y kubelet-1.18.0 kubeadm-1.18.0 kubectl-1.18.0
vim /etc/sysconfig/kubelet   # set KUBELET_EXTRA_ARGS="--cgroup-driver=systemd"
systemctl enable kubelet

4.4 Initialize the Master

kubeadm init \
  --apiserver-advertise-address=192.168.217.100 \
  --image-repository registry.aliyuncs.com/google_containers \
  --kubernetes-version v1.18.0 \
  --service-cidr=10.96.0.0/12 \
  --pod-network-cidr=10.244.0.0/16

Copy the admin kubeconfig:

mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

4.5 Add Worker Nodes

kubeadm join 192.168.217.100:6443 --token 4016im.eg4e10yamcbxjm59 \
  --discovery-token-ca-cert-hash sha256:ce2111ce594e5189255144a72268250e5eedda87470cc3a1f69f8c973927699e

Tokens expire after 24 h; generate a new one with kubeadm token create --print-join-command or a never‑expiring token with kubeadm token create --ttl 0.

4.6 Deploy CNI (Flannel)

wget https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml
kubectl apply -f kube-flannel.yml

5. Binary Package Cluster (Full Manual Installation)

5.1 Prepare Environment

Reuse the same hardware and system settings as in section 4.

5.2 Deploy etcd Cluster

Install cfssl tools and generate a self‑signed CA.

Create ca-config.json and ca-csr.json, then run cfssl gencert -initca ca-csr.json | cfssljson -bare ca.

Generate server certificates for each etcd node with the CA.

Download etcd v3.4.9 binary, extract to /opt/etcd/bin, and create /opt/etcd/cfg/etcd.conf with member and clustering settings (names, data dir, peer/client URLs, initial cluster list, token, state).

Create a systemd unit /usr/lib/systemd/system/etcd.service that references the config and certificates, then enable and start etcd on all three nodes.

5.3 API Server Certificates

Repeat the CA generation steps in a separate ~/TLS/k8s directory, then create a server CSR that lists all master and node IPs, and sign it with the CA.

5.4 Deploy Master Components

Download Kubernetes server binaries (v1.18.10) and copy kube-apiserver, kube-controller-manager, kube-scheduler to /opt/kubernetes/bin.

Create configuration files ( kube-apiserver.conf, kube-controller-manager.conf, kube-scheduler.conf) with detailed flags (log settings, etcd endpoints, network ranges, admission plugins, TLS files, audit logs, etc.).

Copy the generated CA and server certificates to /opt/kubernetes/ssl.

Set up a bootstrap token file ( /opt/kubernetes/cfg/token.csv) for TLS bootstrapping.

Create systemd units for each component ( kube-apiserver.service, kube-controller-manager.service, kube-scheduler.service) and enable them.

5.5 Deploy Node Components

Create /opt/kubernetes/bin on each node and copy kubelet and kube-proxy binaries.

Generate bootstrap.kubeconfig and kube-proxy.kubeconfig on the master using a helper script that creates the necessary cluster, user, and context entries.

Copy the kubeconfigs to each node under /opt/kubernetes/cfg.

Create kubelet.conf on each node with flags for logging, hostname override, CNI networking, kubeconfig paths, certificate directory, and pause image.

Create kube-proxy.conf on each node with similar logging flags and the proxy kubeconfig.

Define systemd units for kubelet and kube-proxy, enable and start them.

5.6 Deploy CNI on Nodes

Follow the same Flannel deployment steps as in section 4.6.

5.7 Certificate Signing Requests (CSR) for New Nodes

List pending CSRs with kubectl get csr, approve them using kubectl certificate approve <NAME>, and verify node registration.

6. Verify Cluster Health

kubectl get cs
kubectl get nodes
kubectl get pods -n kube-system

All core components should report Ready and the cluster should be operational.