CKA — Initialize Control Plane

kubeadm init

Run kubeadm init on the control plane node only to bootstrap the cluster.

sudo kubeadm init \
  --pod-network-cidr=192.168.0.0/16 \
  --apiserver-advertise-address=<CONTROL_PLANE_IP> \
  --kubernetes-version=v1.30.0

Key Flags

Flag	Purpose	Example
–pod-network-cidr	CIDR range for Pod networking (must match CNI)	192.168.0.0/16 (Calico)
–apiserver-advertise-address	IP the API server advertises	192.168.1.10
–kubernetes-version	Specific K8s version	v1.30.0
–control-plane-endpoint	Shared endpoint for HA clusters	lb.example.com:6443
–service-cidr	CIDR for Service ClusterIPs	10.96.0.0/12 (default)

What kubeadm init Does

Step	What Happens
1. Preflight checks	Validates swap, ports, modules, resources
2. Generate certificates	Creates CA, API server, kubelet, and other certs in /etc/kubernetes/pki/
3. Generate kubeconfig files	Creates admin, controller-manager, scheduler configs in /etc/kubernetes/
4. Generate static Pod manifests	Writes YAML files to /etc/kubernetes/manifests/
5. Start kubelet	kubelet picks up manifests and starts control plane Pods
6. Apply RBAC rules	Sets up default ClusterRoles and bindings
7. Generate bootstrap token	Creates the token for worker nodes to join
8. Install addons	Deploys CoreDNS and kube-proxy

Configure kubectl

After kubeadm init completes, configure kubectl for the admin user:

mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

Verify:

kubectl get nodes
# NAME           STATUS     ROLES           AGE   VERSION
# controlplane   NotReady   control-plane   30s   v1.30.0

The node shows NotReady because no CNI plugin is installed yet — this is expected.

Certificate Locations

ls /etc/kubernetes/pki/

Certificate	Purpose
ca.crt / ca.key	Cluster Certificate Authority
apiserver.crt / apiserver.key	API server identity
apiserver-kubelet-client.crt	API server to kubelet auth
apiserver-etcd-client.crt	API server to etcd auth
etcd/ca.crt / etcd/server.crt	etcd Certificate Authority and server
front-proxy-ca.crt	API aggregation CA
sa.key / sa.pub	ServiceAccount signing keys

Kubeconfig Files

ls /etc/kubernetes/*.conf

File	Used By
admin.conf	Cluster administrator (full access)
controller-manager.conf	kube-controller-manager
scheduler.conf	kube-scheduler
kubelet.conf	kubelet (on control plane node)

High Availability Considerations

For production clusters, use –control-plane-endpoint to point to a load balancer:

sudo kubeadm init \
  --control-plane-endpoint "lb.example.com:6443" \
  --upload-certs \
  --pod-network-cidr=192.168.0.0/16

Then join additional control plane nodes with:

sudo kubeadm join lb.example.com:6443 \
  --token <token> \
  --discovery-token-ca-cert-hash sha256:<hash> \
  --control-plane \
  --certificate-key <cert-key>

Exam tip: The CKA exam typically uses a single control plane node. But understanding HA setup shows deeper knowledge and may appear in troubleshooting scenarios.

---

Next: Join Worker Nodes →