How to Install Kubernetes in China Without a VPN – Step‑by‑Step Guide

Installation Environment

We use kubeadm for installation, following the official tutorial. The target platform is Alibaba Cloud VPC (virtual machines also work) with CentOS 7.3, Docker 1.12.6, and Kubernetes 1.6.*.

Host Configuration

Update the system and install Docker 1.12 (the version tested with K8S 1.6.x). Disable Docker updates by adding exclude=docker-engine* to /etc/yum.conf. Configure Docker registry mirrors in /etc/docker/daemon.json and start Docker.

Enable bridge networking required by Flannel by setting net.bridge.bridge-nf-call-iptables=1 and applying it.

Download Software

cat <<EOF > /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://packages.cloud.google.com/yum/repos/kubernetes-el7-x86_64
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://packages.cloud.google.com/yum/doc/yum-key.gpg
       https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg
EOF

yum install -y -downloadonly kubelet kubeadm kubectl kubernetes-cni

Package RPMs are then bundled and transferred back to the local network.

Download Images

#!/usr/bin/env bash
images=(
    kube-proxy-amd64:v1.6.2
    kube-controller-manager-amd64:v1.6.2
    kube-apiserver-amd64:v1.6.2
    kube-scheduler-amd64:v1.6.2
    kubernetes-dashboard-amd64:v1.6.0
    k8s-dns-sidecar-amd64:1.14.1
    k8s-dns-kube-dns-amd64:1.14.1
    k8s-dns-dnsmasq-nanny-amd64:1.14.1
    etcd-amd64:3.0.17
    pause-amd64:3.0
)
for imageName in ${images[@]}; do
    docker pull gcr.io/google_containers/$imageName
    docker tag gcr.io/google_containers/$imageName registry.cn-beijing.aliyuncs.com/bbt_k8s/$imageName
    docker push registry.cn-beijing.aliyuncs.com/bbt_k8s/$imageName
done
docker tag quay.io/coreos/flannel:v0.7.0-amd64 registry.cn-beijing.aliyuncs.com/bbt_k8s/flannel:v0.7.0-amd64
docker push registry.cn-beijing.aliyuncs.com/bbt_k8s/flannel:v0.7.0-amd64

The script pushes images to a private Alibaba Cloud registry; replace the registry address with your own if needed.

Install K8S Packages

yum install -y *.rpm

systemctl enable kubelet

Configure /etc/systemd/system/kubelet.service.d/10-kubeadm.conf with appropriate environment variables (e.g., pod network CIDR, DNS settings, and custom pause image).

Initialize Master Node

export KUBE_REPO_PREFIX="registry-vpc.cn-beijing.aliyuncs.com/bbt_k8s"
export KUBE_ETCD_IMAGE="registry-vpc.cn-beijing.aliyuncs.com/bbt_k8s/etcd-amd64:3.0.17"
kubeadm init --kubernetes-version=v1.6.2 --pod-network-cidr=10.96.0.0/12

The command creates certificates, kubeconfig files, and starts the control plane. After initialization, copy /etc/kubernetes/admin.conf to $HOME/.kube/config and set KUBECONFIG accordingly.

Deploy Network Plugin (Flannel)

# kube-flannel-rbac.yml and kube-flannel-ds.yaml are applied as follows:
kubectl create -f kube-flannel-rbac.yml
kubectl create -f kube-flannel-ds.yaml

Flannel uses the 10.96.0.0/12 pod network defined earlier.

Join Worker Nodes

export KUBE_REPO_PREFIX="registry-vpc.cn-beijing.aliyuncs.com/bbt_k8s"
export KUBE_ETCD_IMAGE="registry-vpc.cn-beijing.aliyuncs.com/bbt_k8s/etcd-amd64:3.0.17"
kubeadm join --token 1111.111111111111 *.*.*.*:6443

Use the token printed by kubeadm init to join each node.

Optional: Install kubectl and Dashboard

brew install kubectl

Copy /etc/kubernetes/admin.conf from the master to ~/.kube/config on your local machine, then run kubectl get nodes to verify the cluster.

# Dashboard deployment (kubernetes-dashboard.yaml) and RBAC (dashboard-rbac.yml)
kubectl create -f dashboard-rbac.yml
kubectl create -f kubernetes-dashboard.yaml

Expose the dashboard via a NodePort and access it with http://<NodeIP>:<NodePort>.