Week 21 - Bootstrap: VMs, Certificates, etcd¶
21.1 Conceptual Core¶
- "Kubernetes the Hard Way" is Kelsey Hightower's exercise: bring up a Kubernetes cluster step by step, from raw VMs, generating certs by hand, configuring every flag explicitly. The point is not operational efficiency; it is deep understanding of every moving part.
- This curriculum's hard-way variant: bring up 3 control-plane nodes + 3 worker nodes on cloud VMs (or bare metal). Use modern toolchain (containerd, Cilium, latest stable Kubernetes).
21.2 Mechanical Detail¶
- VM provisioning: 6 VMs, ~2 vCPU 4 GB each. Cloud (AWS/GCP/Hetzner) or bare metal.
- PKI: a CA + intermediate CAs for
etcd,kube-apiserver,kubelet,front-proxy. Usecfssloreasy-rsa. Every component identifies itself with x509. - etcd cluster: 3 nodes, mTLS between peers and clients, snapshots scheduled.
- Loopback bootstrap considerations: kubelet needs a kubeconfig before the apiserver is up. Either use static-pod manifests for control-plane components (the
kubeadmapproach) or run the control plane outside the cluster on the VMs themselves.
21.3 Lab-"Bring Up etcd"¶
- Provision 3 VMs labeled
etcd-{1,2,3}. - Generate CA + per-node certs.
- Install etcd binaries; configure systemd units with mTLS.
- Bring up; verify
etcdctl member listshows healthy quorum. - Take a snapshot. Restore on a separate test machine.
21.4 Hardening Drill¶
- etcd encryption-at-rest is separate from the K8s secret encryption (next week). Configure etcd with an encryption-providers config from day one.
21.5 Operations Slice¶
- etcd backup automation:
etcdctl snapshot savecron'd to S3 every 6 hours. Verify restore weekly.