Kubernetes the Hard Way

Goal

Bootstrap a working Kubernetes cluster with no installers, no kubeadm, no managed service — every certificate, config file, and systemd unit written by hand. The tutorial is optimized for learning, not production: what it proves is that you can name every component in the architecture diagram and say what breaks without it.

Subject: full brief & instructions

Practices

• Kubernetes & containers deep dive — the control plane, kubelet, and reconciliation loop, assembled rather than assumed.
• Cloud fundamentals — provisioning the machines, networks, and firewall rules the cluster lives on.
• Networking fundamentals — pod CIDRs, routes, and DNS are configured by hand here, not by a CNI plugin.

Milestones

1. Provision the fleet — a jumpbox plus server and worker machines (local VMs or cloud instances), SSH access, hostnames, and a machine database you'll script against. Shippable: ssh into every node by name.
2. PKI from scratch — generate a CA, then a certificate per component (apiserver, kubelet per node, controller-manager, scheduler, service accounts) and distribute them. Shippable: every cert verifies against your CA.
3. Kubeconfigs & encryption config — one kubeconfig per component pointing at the right endpoint with the right cert, plus the at-rest encryption config for Secrets.
4. etcd up — install and start etcd on the server, verify with etcdctl member list. This is the cluster's entire memory; everything else is stateless.
5. Control plane — apiserver, controller-manager, scheduler as systemd units; RBAC for apiserver→kubelet. Shippable: kubectl get componentstatuses from the jumpbox.
6. Workers — containerd, kubelet, kube-proxy, and CNI config on each worker. Shippable: kubectl get nodes shows them Ready.
7. Pod network & smoke tests — add inter-node routes for the pod CIDRs, then prove the cluster: a Deployment, port-forward, logs, exec, a NodePort Service, and a Secret read back encrypted from etcd.
8. Teardown and re-do — destroy everything and rebuild from your own notes alone. The second pass, without the tutorial open, is the actual exam.

Stretch goals

• Make the control plane highly available: three servers, stacked etcd, a load balancer in front of the apiserver.
• Replace the static routes with a real CNI plugin and explain what it automated.
• Rebuild with kubeadm and diff what it generated against what you wrote by hand.

Related

• Kubernetes the Hard Way — subject — the standalone work statement: assignment, environment options, and per-stage verification checks.
• Kubernetes & containers deep dive — the concept note this drills; its Practice section cites this exercise.
• Build your own container runtime — the same demystification one layer down: what kubelet asks containerd to do.
• Distributed consensus — etcd, the one stateful piece you stood up.