kubeadm init phase

kubeadm init phase enables you to invoke atomic steps of the bootstrap process. Hence, you can let kubeadm do some of the work and you can fill in the gaps if you wish to apply customization.

kubeadm init phase is consistent with the kubeadm init workflow, and behind the scene both use the same code.

kubeadm init phase preflight

Using this command you can execute preflight checks on a control-plane node.

Run pre-flight checks

Synopsis

Run pre-flight checks for kubeadm init.

  1. kubeadm init phase preflight [flags]

Examples

  1.   # Run pre-flight checks for kubeadm init using a config file.
  2.   kubeadm init phase preflight --config kubeadm-config.yaml

Options

—config string

Path to a kubeadm configuration file.

—cri-socket string

Path to the CRI socket to connect. If empty kubeadm will try to auto-detect this value; use this option only if you have more than one CRI installed or if you have non-standard CRI socket.

—dry-run

Don’t apply any changes; just output what would be done.

-h, —help

help for preflight

—ignore-preflight-errors strings

A list of checks whose errors will be shown as warnings. Example: ‘IsPrivilegedUser,Swap’. Value ‘all’ ignores errors from all checks.

—image-repository string     Default: “registry.k8s.io”

Choose a container registry to pull control plane images from

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

kubeadm init phase kubelet-start

This phase will write the kubelet configuration file and environment file and then start the kubelet.

Write kubelet settings and (re)start the kubelet

Synopsis

Write a file with KubeletConfiguration and an environment file with node specific kubelet settings, and then (re)start kubelet.

  1. kubeadm init phase kubelet-start [flags]

Examples

  1.   # Writes a dynamic environment file with kubelet flags from a InitConfiguration file.
  2.   kubeadm init phase kubelet-start --config config.yaml

Options

—config string

Path to a kubeadm configuration file.

—cri-socket string

Path to the CRI socket to connect. If empty kubeadm will try to auto-detect this value; use this option only if you have more than one CRI installed or if you have non-standard CRI socket.

—dry-run

Don’t apply any changes; just output what would be done.

-h, —help

help for kubelet-start

—image-repository string     Default: “registry.k8s.io”

Choose a container registry to pull control plane images from

—node-name string

Specify the node name.

—patches string

Path to a directory that contains files named “target[suffix][+patchtype].extension”. For example, “kube-apiserver0+merge.yaml” or just “etcd.json”. “target” can be one of “kube-apiserver”, “kube-controller-manager”, “kube-scheduler”, “etcd”, “kubeletconfiguration”. “patchtype” can be one of “strategic”, “merge” or “json” and they match the patch formats supported by kubectl. The default “patchtype” is “strategic”. “extension” must be either “json” or “yaml”. “suffix” is an optional string that can be used to determine which patches are applied first alpha-numerically.

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

kubeadm init phase certs

Can be used to create all required certificates by kubeadm.

Certificate generation

Synopsis

This command is not meant to be run on its own. See list of available subcommands.

  1. kubeadm init phase certs [flags]

Options

-h, —help

help for certs

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

Generate all certificates

Synopsis

Generate all certificates

  1. kubeadm init phase certs all [flags]

Options

—apiserver-advertise-address string

The IP address the API Server will advertise it’s listening on. If not set the default network interface will be used.

—apiserver-cert-extra-sans strings

Optional extra Subject Alternative Names (SANs) to use for the API Server serving certificate. Can be both IP addresses and DNS names.

—cert-dir string     Default: “/etc/kubernetes/pki”

The path where to save and store the certificates.

—config string

Path to a kubeadm configuration file.

—control-plane-endpoint string

Specify a stable IP address or DNS name for the control plane.

—dry-run

Don’t apply any changes; just output what would be done.

-h, —help

help for all

—kubernetes-version string     Default: “stable-1”

Choose a specific Kubernetes version for the control plane.

—service-cidr string     Default: “10.96.0.0/12”

Use alternative range of IP address for service VIPs.

—service-dns-domain string     Default: “cluster.local”

Use alternative domain for services, e.g. “myorg.internal”.

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

Generate the self-signed Kubernetes CA to provision identities for other Kubernetes components

Synopsis

Generate the self-signed Kubernetes CA to provision identities for other Kubernetes components, and save them into ca.crt and ca.key files.

If both files already exist, kubeadm skips the generation step and existing files will be used.

  1. kubeadm init phase certs ca [flags]

Options

—cert-dir string     Default: “/etc/kubernetes/pki”

The path where to save and store the certificates.

—config string

Path to a kubeadm configuration file.

—dry-run

Don’t apply any changes; just output what would be done.

-h, —help

help for ca

—kubernetes-version string     Default: “stable-1”

Choose a specific Kubernetes version for the control plane.

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

Generate the certificate for serving the Kubernetes API

Synopsis

Generate the certificate for serving the Kubernetes API, and save them into apiserver.crt and apiserver.key files.

If both files already exist, kubeadm skips the generation step and existing files will be used.

  1. kubeadm init phase certs apiserver [flags]

Options

—apiserver-advertise-address string

The IP address the API Server will advertise it’s listening on. If not set the default network interface will be used.

—apiserver-cert-extra-sans strings

Optional extra Subject Alternative Names (SANs) to use for the API Server serving certificate. Can be both IP addresses and DNS names.

—cert-dir string     Default: “/etc/kubernetes/pki”

The path where to save and store the certificates.

—config string

Path to a kubeadm configuration file.

—control-plane-endpoint string

Specify a stable IP address or DNS name for the control plane.

—dry-run

Don’t apply any changes; just output what would be done.

-h, —help

help for apiserver

—kubernetes-version string     Default: “stable-1”

Choose a specific Kubernetes version for the control plane.

—service-cidr string     Default: “10.96.0.0/12”

Use alternative range of IP address for service VIPs.

—service-dns-domain string     Default: “cluster.local”

Use alternative domain for services, e.g. “myorg.internal”.

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

Generate the certificate for the API server to connect to kubelet

Synopsis

Generate the certificate for the API server to connect to kubelet, and save them into apiserver-kubelet-client.crt and apiserver-kubelet-client.key files.

If both files already exist, kubeadm skips the generation step and existing files will be used.

  1. kubeadm init phase certs apiserver-kubelet-client [flags]

Options

—cert-dir string     Default: “/etc/kubernetes/pki”

The path where to save and store the certificates.

—config string

Path to a kubeadm configuration file.

—dry-run

Don’t apply any changes; just output what would be done.

-h, —help

help for apiserver-kubelet-client

—kubernetes-version string     Default: “stable-1”

Choose a specific Kubernetes version for the control plane.

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

Generate the self-signed CA to provision identities for front proxy

Synopsis

Generate the self-signed CA to provision identities for front proxy, and save them into front-proxy-ca.crt and front-proxy-ca.key files.

If both files already exist, kubeadm skips the generation step and existing files will be used.

  1. kubeadm init phase certs front-proxy-ca [flags]

Options

—cert-dir string     Default: “/etc/kubernetes/pki”

The path where to save and store the certificates.

—config string

Path to a kubeadm configuration file.

—dry-run

Don’t apply any changes; just output what would be done.

-h, —help

help for front-proxy-ca

—kubernetes-version string     Default: “stable-1”

Choose a specific Kubernetes version for the control plane.

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

Generate the certificate for the front proxy client

Synopsis

Generate the certificate for the front proxy client, and save them into front-proxy-client.crt and front-proxy-client.key files.

If both files already exist, kubeadm skips the generation step and existing files will be used.

  1. kubeadm init phase certs front-proxy-client [flags]

Options

—cert-dir string     Default: “/etc/kubernetes/pki”

The path where to save and store the certificates.

—config string

Path to a kubeadm configuration file.

—dry-run

Don’t apply any changes; just output what would be done.

-h, —help

help for front-proxy-client

—kubernetes-version string     Default: “stable-1”

Choose a specific Kubernetes version for the control plane.

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

Generate the self-signed CA to provision identities for etcd

Synopsis

Generate the self-signed CA to provision identities for etcd, and save them into etcd/ca.crt and etcd/ca.key files.

If both files already exist, kubeadm skips the generation step and existing files will be used.

  1. kubeadm init phase certs etcd-ca [flags]

Options

—cert-dir string     Default: “/etc/kubernetes/pki”

The path where to save and store the certificates.

—config string

Path to a kubeadm configuration file.

—dry-run

Don’t apply any changes; just output what would be done.

-h, —help

help for etcd-ca

—kubernetes-version string     Default: “stable-1”

Choose a specific Kubernetes version for the control plane.

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

Generate the certificate for serving etcd

Synopsis

Generate the certificate for serving etcd, and save them into etcd/server.crt and etcd/server.key files.

Default SANs are localhost, 127.0.0.1, 127.0.0.1, ::1

If both files already exist, kubeadm skips the generation step and existing files will be used.

  1. kubeadm init phase certs etcd-server [flags]

Options

—cert-dir string     Default: “/etc/kubernetes/pki”

The path where to save and store the certificates.

—config string

Path to a kubeadm configuration file.

—dry-run

Don’t apply any changes; just output what would be done.

-h, —help

help for etcd-server

—kubernetes-version string     Default: “stable-1”

Choose a specific Kubernetes version for the control plane.

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

Generate the certificate for etcd nodes to communicate with each other

Synopsis

Generate the certificate for etcd nodes to communicate with each other, and save them into etcd/peer.crt and etcd/peer.key files.

Default SANs are localhost, 127.0.0.1, 127.0.0.1, ::1

If both files already exist, kubeadm skips the generation step and existing files will be used.

  1. kubeadm init phase certs etcd-peer [flags]

Options

—cert-dir string     Default: “/etc/kubernetes/pki”

The path where to save and store the certificates.

—config string

Path to a kubeadm configuration file.

—dry-run

Don’t apply any changes; just output what would be done.

-h, —help

help for etcd-peer

—kubernetes-version string     Default: “stable-1”

Choose a specific Kubernetes version for the control plane.

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

Generate the certificate for liveness probes to healthcheck etcd

Synopsis

Generate the certificate for liveness probes to healthcheck etcd, and save them into etcd/healthcheck-client.crt and etcd/healthcheck-client.key files.

If both files already exist, kubeadm skips the generation step and existing files will be used.

  1. kubeadm init phase certs etcd-healthcheck-client [flags]

Options

—cert-dir string     Default: “/etc/kubernetes/pki”

The path where to save and store the certificates.

—config string

Path to a kubeadm configuration file.

—dry-run

Don’t apply any changes; just output what would be done.

-h, —help

help for etcd-healthcheck-client

—kubernetes-version string     Default: “stable-1”

Choose a specific Kubernetes version for the control plane.

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

Generate the certificate the apiserver uses to access etcd

Synopsis

Generate the certificate the apiserver uses to access etcd, and save them into apiserver-etcd-client.crt and apiserver-etcd-client.key files.

If both files already exist, kubeadm skips the generation step and existing files will be used.

  1. kubeadm init phase certs apiserver-etcd-client [flags]

Options

—cert-dir string     Default: “/etc/kubernetes/pki”

The path where to save and store the certificates.

—config string

Path to a kubeadm configuration file.

—dry-run

Don’t apply any changes; just output what would be done.

-h, —help

help for apiserver-etcd-client

—kubernetes-version string     Default: “stable-1”

Choose a specific Kubernetes version for the control plane.

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

Generate a private key for signing service account tokens along with its public key

Synopsis

Generate the private key for signing service account tokens along with its public key, and save them into sa.key and sa.pub files.

If both files already exist, kubeadm skips the generation step and existing files will be used.

  1. kubeadm init phase certs sa [flags]

Options

—cert-dir string     Default: “/etc/kubernetes/pki”

The path where to save and store the certificates.

-h, —help

help for sa

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

kubeadm init phase kubeconfig

You can create all required kubeconfig files by calling the all subcommand or call them individually.

Generate all kubeconfig files necessary to establish the control plane and the admin kubeconfig file

Synopsis

This command is not meant to be run on its own. See list of available subcommands.

  1. kubeadm init phase kubeconfig [flags]

Options

-h, —help

help for kubeconfig

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

Generate all kubeconfig files

Synopsis

Generate all kubeconfig files

  1. kubeadm init phase kubeconfig all [flags]

Options

—apiserver-advertise-address string

The IP address the API Server will advertise it’s listening on. If not set the default network interface will be used.

—apiserver-bind-port int32     Default: 6443

Port for the API Server to bind to.

—cert-dir string     Default: “/etc/kubernetes/pki”

The path where to save and store the certificates.

—config string

Path to a kubeadm configuration file.

—control-plane-endpoint string

Specify a stable IP address or DNS name for the control plane.

—dry-run

Don’t apply any changes; just output what would be done.

-h, —help

help for all

—kubeconfig-dir string     Default: “/etc/kubernetes”

The path where to save the kubeconfig file.

—kubernetes-version string     Default: “stable-1”

Choose a specific Kubernetes version for the control plane.

—node-name string

Specify the node name.

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

Generate a kubeconfig file for the admin to use and for kubeadm itself

Synopsis

Generate the kubeconfig file for the admin and for kubeadm itself, and save it to admin.conf file.

  1. kubeadm init phase kubeconfig admin [flags]

Options

—apiserver-advertise-address string

The IP address the API Server will advertise it’s listening on. If not set the default network interface will be used.

—apiserver-bind-port int32     Default: 6443

Port for the API Server to bind to.

—cert-dir string     Default: “/etc/kubernetes/pki”

The path where to save and store the certificates.

—config string

Path to a kubeadm configuration file.

—control-plane-endpoint string

Specify a stable IP address or DNS name for the control plane.

—dry-run

Don’t apply any changes; just output what would be done.

-h, —help

help for admin

—kubeconfig-dir string     Default: “/etc/kubernetes”

The path where to save the kubeconfig file.

—kubernetes-version string     Default: “stable-1”

Choose a specific Kubernetes version for the control plane.

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

Generate a kubeconfig file for the kubelet to use only for cluster bootstrapping purposes

Synopsis

Generate the kubeconfig file for the kubelet to use and save it to kubelet.conf file.

Please note that this should only be used for cluster bootstrapping purposes. After your control plane is up, you should request all kubelet credentials from the CSR API.

  1. kubeadm init phase kubeconfig kubelet [flags]

Options

—apiserver-advertise-address string

The IP address the API Server will advertise it’s listening on. If not set the default network interface will be used.

—apiserver-bind-port int32     Default: 6443

Port for the API Server to bind to.

—cert-dir string     Default: “/etc/kubernetes/pki”

The path where to save and store the certificates.

—config string

Path to a kubeadm configuration file.

—control-plane-endpoint string

Specify a stable IP address or DNS name for the control plane.

—dry-run

Don’t apply any changes; just output what would be done.

-h, —help

help for kubelet

—kubeconfig-dir string     Default: “/etc/kubernetes”

The path where to save the kubeconfig file.

—kubernetes-version string     Default: “stable-1”

Choose a specific Kubernetes version for the control plane.

—node-name string

Specify the node name.

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

Generate a kubeconfig file for the controller manager to use

Synopsis

Generate the kubeconfig file for the controller manager to use and save it to controller-manager.conf file

  1. kubeadm init phase kubeconfig controller-manager [flags]

Options

—apiserver-advertise-address string

The IP address the API Server will advertise it’s listening on. If not set the default network interface will be used.

—apiserver-bind-port int32     Default: 6443

Port for the API Server to bind to.

—cert-dir string     Default: “/etc/kubernetes/pki”

The path where to save and store the certificates.

—config string

Path to a kubeadm configuration file.

—control-plane-endpoint string

Specify a stable IP address or DNS name for the control plane.

—dry-run

Don’t apply any changes; just output what would be done.

-h, —help

help for controller-manager

—kubeconfig-dir string     Default: “/etc/kubernetes”

The path where to save the kubeconfig file.

—kubernetes-version string     Default: “stable-1”

Choose a specific Kubernetes version for the control plane.

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

Generate a kubeconfig file for the scheduler to use

Synopsis

Generate the kubeconfig file for the scheduler to use and save it to scheduler.conf file.

  1. kubeadm init phase kubeconfig scheduler [flags]

Options

—apiserver-advertise-address string

The IP address the API Server will advertise it’s listening on. If not set the default network interface will be used.

—apiserver-bind-port int32     Default: 6443

Port for the API Server to bind to.

—cert-dir string     Default: “/etc/kubernetes/pki”

The path where to save and store the certificates.

—config string

Path to a kubeadm configuration file.

—control-plane-endpoint string

Specify a stable IP address or DNS name for the control plane.

—dry-run

Don’t apply any changes; just output what would be done.

-h, —help

help for scheduler

—kubeconfig-dir string     Default: “/etc/kubernetes”

The path where to save the kubeconfig file.

—kubernetes-version string     Default: “stable-1”

Choose a specific Kubernetes version for the control plane.

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

Generate a kubeconfig file for the super-admin

Synopsis

Generate a kubeconfig file for the super-admin, and save it to super-admin.conf file.

  1. kubeadm init phase kubeconfig super-admin [flags]

Options

—apiserver-advertise-address string

The IP address the API Server will advertise it’s listening on. If not set the default network interface will be used.

—apiserver-bind-port int32     Default: 6443

Port for the API Server to bind to.

—cert-dir string     Default: “/etc/kubernetes/pki”

The path where to save and store the certificates.

—config string

Path to a kubeadm configuration file.

—control-plane-endpoint string

Specify a stable IP address or DNS name for the control plane.

—dry-run

Don’t apply any changes; just output what would be done.

-h, —help

help for super-admin

—kubeconfig-dir string     Default: “/etc/kubernetes”

The path where to save the kubeconfig file.

—kubernetes-version string     Default: “stable-1”

Choose a specific Kubernetes version for the control plane.

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

kubeadm init phase control-plane

Using this phase you can create all required static Pod files for the control plane components.

Generate all static Pod manifest files necessary to establish the control plane

Synopsis

This command is not meant to be run on its own. See list of available subcommands.

  1. kubeadm init phase control-plane [flags]

Options

-h, —help

help for control-plane

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

Generate all static Pod manifest files

Synopsis

Generate all static Pod manifest files

  1. kubeadm init phase control-plane all [flags]

Examples

  1.   # Generates all static Pod manifest files for control plane components,
  2.   # functionally equivalent to what is generated by kubeadm init.
  3.   kubeadm init phase control-plane all
  5.   # Generates all static Pod manifest files using options read from a configuration file.
  6.   kubeadm init phase control-plane all --config config.yaml

Options

—apiserver-advertise-address string

The IP address the API Server will advertise it’s listening on. If not set the default network interface will be used.

—apiserver-bind-port int32     Default: 6443

Port for the API Server to bind to.

—apiserver-extra-args <comma-separated ‘key=value’ pairs>

A set of extra flags to pass to the API Server or override default ones in form of <flagname>=<value>

—cert-dir string     Default: “/etc/kubernetes/pki”

The path where to save and store the certificates.

—config string

Path to a kubeadm configuration file.

—control-plane-endpoint string

Specify a stable IP address or DNS name for the control plane.

—controller-manager-extra-args <comma-separated ‘key=value’ pairs>

A set of extra flags to pass to the Controller Manager or override default ones in form of <flagname>=<value>

—dry-run

Don’t apply any changes; just output what would be done.

—feature-gates string

A set of key=value pairs that describe feature gates for various features. Options are:
EtcdLearnerMode=true|false (BETA - default=true)
PublicKeysECDSA=true|false (DEPRECATED - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)
UpgradeAddonsBeforeControlPlane=true|false (DEPRECATED - default=false)
WaitForAllControlPlaneComponents=true|false (ALPHA - default=false)

-h, —help

help for all

—image-repository string     Default: “registry.k8s.io”

Choose a container registry to pull control plane images from

—kubernetes-version string     Default: “stable-1”

Choose a specific Kubernetes version for the control plane.

—patches string

Path to a directory that contains files named “target[suffix][+patchtype].extension”. For example, “kube-apiserver0+merge.yaml” or just “etcd.json”. “target” can be one of “kube-apiserver”, “kube-controller-manager”, “kube-scheduler”, “etcd”, “kubeletconfiguration”. “patchtype” can be one of “strategic”, “merge” or “json” and they match the patch formats supported by kubectl. The default “patchtype” is “strategic”. “extension” must be either “json” or “yaml”. “suffix” is an optional string that can be used to determine which patches are applied first alpha-numerically.

—pod-network-cidr string

Specify range of IP addresses for the pod network. If set, the control plane will automatically allocate CIDRs for every node.

—scheduler-extra-args <comma-separated ‘key=value’ pairs>

A set of extra flags to pass to the Scheduler or override default ones in form of <flagname>=<value>

—service-cidr string     Default: “10.96.0.0/12”

Use alternative range of IP address for service VIPs.

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

Generates the kube-apiserver static Pod manifest

Synopsis

Generates the kube-apiserver static Pod manifest

  1. kubeadm init phase control-plane apiserver [flags]

Options

—apiserver-advertise-address string

The IP address the API Server will advertise it’s listening on. If not set the default network interface will be used.

—apiserver-bind-port int32     Default: 6443

Port for the API Server to bind to.

—apiserver-extra-args <comma-separated ‘key=value’ pairs>

A set of extra flags to pass to the API Server or override default ones in form of <flagname>=<value>

—cert-dir string     Default: “/etc/kubernetes/pki”

The path where to save and store the certificates.

—config string

Path to a kubeadm configuration file.

—control-plane-endpoint string

Specify a stable IP address or DNS name for the control plane.

—dry-run

Don’t apply any changes; just output what would be done.

—feature-gates string

A set of key=value pairs that describe feature gates for various features. Options are:
EtcdLearnerMode=true|false (BETA - default=true)
PublicKeysECDSA=true|false (DEPRECATED - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)
UpgradeAddonsBeforeControlPlane=true|false (DEPRECATED - default=false)
WaitForAllControlPlaneComponents=true|false (ALPHA - default=false)

-h, —help

help for apiserver

—image-repository string     Default: “registry.k8s.io”

Choose a container registry to pull control plane images from

—kubernetes-version string     Default: “stable-1”

Choose a specific Kubernetes version for the control plane.

—patches string

Path to a directory that contains files named “target[suffix][+patchtype].extension”. For example, “kube-apiserver0+merge.yaml” or just “etcd.json”. “target” can be one of “kube-apiserver”, “kube-controller-manager”, “kube-scheduler”, “etcd”, “kubeletconfiguration”. “patchtype” can be one of “strategic”, “merge” or “json” and they match the patch formats supported by kubectl. The default “patchtype” is “strategic”. “extension” must be either “json” or “yaml”. “suffix” is an optional string that can be used to determine which patches are applied first alpha-numerically.

—service-cidr string     Default: “10.96.0.0/12”

Use alternative range of IP address for service VIPs.

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

Generates the kube-controller-manager static Pod manifest

Synopsis

Generates the kube-controller-manager static Pod manifest

  1. kubeadm init phase control-plane controller-manager [flags]

Options

—cert-dir string     Default: “/etc/kubernetes/pki”

The path where to save and store the certificates.

—config string

Path to a kubeadm configuration file.

—controller-manager-extra-args <comma-separated ‘key=value’ pairs>

A set of extra flags to pass to the Controller Manager or override default ones in form of <flagname>=<value>

—dry-run

Don’t apply any changes; just output what would be done.

-h, —help

help for controller-manager

—image-repository string     Default: “registry.k8s.io”

Choose a container registry to pull control plane images from

—kubernetes-version string     Default: “stable-1”

Choose a specific Kubernetes version for the control plane.

—patches string

Path to a directory that contains files named “target[suffix][+patchtype].extension”. For example, “kube-apiserver0+merge.yaml” or just “etcd.json”. “target” can be one of “kube-apiserver”, “kube-controller-manager”, “kube-scheduler”, “etcd”, “kubeletconfiguration”. “patchtype” can be one of “strategic”, “merge” or “json” and they match the patch formats supported by kubectl. The default “patchtype” is “strategic”. “extension” must be either “json” or “yaml”. “suffix” is an optional string that can be used to determine which patches are applied first alpha-numerically.

—pod-network-cidr string

Specify range of IP addresses for the pod network. If set, the control plane will automatically allocate CIDRs for every node.

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

Generates the kube-scheduler static Pod manifest

Synopsis

Generates the kube-scheduler static Pod manifest

  1. kubeadm init phase control-plane scheduler [flags]

Options

—cert-dir string     Default: “/etc/kubernetes/pki”

The path where to save and store the certificates.

—config string

Path to a kubeadm configuration file.

—dry-run

Don’t apply any changes; just output what would be done.

-h, —help

help for scheduler

—image-repository string     Default: “registry.k8s.io”

Choose a container registry to pull control plane images from

—kubernetes-version string     Default: “stable-1”

Choose a specific Kubernetes version for the control plane.

—patches string

Path to a directory that contains files named “target[suffix][+patchtype].extension”. For example, “kube-apiserver0+merge.yaml” or just “etcd.json”. “target” can be one of “kube-apiserver”, “kube-controller-manager”, “kube-scheduler”, “etcd”, “kubeletconfiguration”. “patchtype” can be one of “strategic”, “merge” or “json” and they match the patch formats supported by kubectl. The default “patchtype” is “strategic”. “extension” must be either “json” or “yaml”. “suffix” is an optional string that can be used to determine which patches are applied first alpha-numerically.

—scheduler-extra-args <comma-separated ‘key=value’ pairs>

A set of extra flags to pass to the Scheduler or override default ones in form of <flagname>=<value>

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

kubeadm init phase etcd

Use the following phase to create a local etcd instance based on a static Pod file.

Generate static Pod manifest file for local etcd

Synopsis

This command is not meant to be run on its own. See list of available subcommands.

  1. kubeadm init phase etcd [flags]

Options

-h, —help

help for etcd

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

Generate the static Pod manifest file for a local, single-node local etcd instance

Synopsis

Generate the static Pod manifest file for a local, single-node local etcd instance

  1. kubeadm init phase etcd local [flags]

Examples

  1.   # Generates the static Pod manifest file for etcd, functionally
  2.   # equivalent to what is generated by kubeadm init.
  3.   kubeadm init phase etcd local
  5.   # Generates the static Pod manifest file for etcd using options
  6.   # read from a configuration file.
  7.   kubeadm init phase etcd local --config config.yaml

Options

—cert-dir string     Default: “/etc/kubernetes/pki”

The path where to save and store the certificates.

—config string

Path to a kubeadm configuration file.

—dry-run

Don’t apply any changes; just output what would be done.

-h, —help

help for local

—image-repository string     Default: “registry.k8s.io”

Choose a container registry to pull control plane images from

—patches string

Path to a directory that contains files named “target[suffix][+patchtype].extension”. For example, “kube-apiserver0+merge.yaml” or just “etcd.json”. “target” can be one of “kube-apiserver”, “kube-controller-manager”, “kube-scheduler”, “etcd”, “kubeletconfiguration”. “patchtype” can be one of “strategic”, “merge” or “json” and they match the patch formats supported by kubectl. The default “patchtype” is “strategic”. “extension” must be either “json” or “yaml”. “suffix” is an optional string that can be used to determine which patches are applied first alpha-numerically.

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

kubeadm init phase upload-config

You can use this command to upload the kubeadm configuration to your cluster. Alternatively, you can use kubeadm config.

Upload the kubeadm and kubelet configuration to a ConfigMap

Synopsis

This command is not meant to be run on its own. See list of available subcommands.

  1. kubeadm init phase upload-config [flags]

Options

-h, —help

help for upload-config

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

Upload all configuration to a config map

Synopsis

Upload all configuration to a config map

  1. kubeadm init phase upload-config all [flags]

Options

—config string

Path to a kubeadm configuration file.

—cri-socket string

Path to the CRI socket to connect. If empty kubeadm will try to auto-detect this value; use this option only if you have more than one CRI installed or if you have non-standard CRI socket.

—dry-run

Don’t apply any changes; just output what would be done.

-h, —help

help for all

—kubeconfig string     Default: “/etc/kubernetes/admin.conf”

The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

Upload the kubeadm ClusterConfiguration to a ConfigMap

Synopsis

Upload the kubeadm ClusterConfiguration to a ConfigMap called kubeadm-config in the kube-system namespace. This enables correct configuration of system components and a seamless user experience when upgrading.

Alternatively, you can use kubeadm config.

  1. kubeadm init phase upload-config kubeadm [flags]

Examples

  1.   # upload the configuration of your cluster
  2.   kubeadm init phase upload-config --config=myConfig.yaml

Options

—config string

Path to a kubeadm configuration file.

—cri-socket string

Path to the CRI socket to connect. If empty kubeadm will try to auto-detect this value; use this option only if you have more than one CRI installed or if you have non-standard CRI socket.

—dry-run

Don’t apply any changes; just output what would be done.

-h, —help

help for kubeadm

—kubeconfig string     Default: “/etc/kubernetes/admin.conf”

The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

Upload the kubelet component config to a ConfigMap

Synopsis

Upload the kubelet configuration extracted from the kubeadm InitConfiguration object to a kubelet-config ConfigMap in the cluster

  1. kubeadm init phase upload-config kubelet [flags]

Examples

  1.   # Upload the kubelet configuration from the kubeadm Config file to a ConfigMap in the cluster.
  2.   kubeadm init phase upload-config kubelet --config kubeadm.yaml

Options

—config string

Path to a kubeadm configuration file.

—cri-socket string

Path to the CRI socket to connect. If empty kubeadm will try to auto-detect this value; use this option only if you have more than one CRI installed or if you have non-standard CRI socket.

—dry-run

Don’t apply any changes; just output what would be done.

-h, —help

help for kubelet

—kubeconfig string     Default: “/etc/kubernetes/admin.conf”

The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

kubeadm init phase upload-certs

Use the following phase to upload control-plane certificates to the cluster. By default the certs and encryption key expire after two hours.

Upload certificates to kubeadm-certs

Synopsis

Upload control plane certificates to the kubeadm-certs Secret

  1. kubeadm init phase upload-certs [flags]

Options

—certificate-key string

Key used to encrypt the control-plane certificates in the kubeadm-certs Secret. The certificate key is a hex encoded string that is an AES key of size 32 bytes.

—config string

Path to a kubeadm configuration file.

—dry-run

Don’t apply any changes; just output what would be done.

-h, —help

help for upload-certs

—kubeconfig string     Default: “/etc/kubernetes/admin.conf”

The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

—skip-certificate-key-print

Don’t print the key used to encrypt the control-plane certificates.

—upload-certs

Upload control-plane certificates to the kubeadm-certs Secret.

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

kubeadm init phase mark-control-plane

Use the following phase to label and taint the node as a control plane node.

Mark a node as a control-plane

Synopsis

Mark a node as a control-plane

  1. kubeadm init phase mark-control-plane [flags]

Examples

  1.   # Applies control-plane label and taint to the current node, functionally equivalent to what executed by kubeadm init.
  2.   kubeadm init phase mark-control-plane --config config.yaml
  4.   # Applies control-plane label and taint to a specific node
  5.   kubeadm init phase mark-control-plane --node-name myNode

Options

—config string

Path to a kubeadm configuration file.

—dry-run

Don’t apply any changes; just output what would be done.

-h, —help

help for mark-control-plane

—node-name string

Specify the node name.

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

kubeadm init phase bootstrap-token

Use the following phase to configure bootstrap tokens.

Generates bootstrap tokens used to join a node to a cluster

Synopsis

Bootstrap tokens are used for establishing bidirectional trust between a node joining the cluster and a control-plane node.

This command makes all the configurations required to make bootstrap tokens works and then creates an initial token.

  1. kubeadm init phase bootstrap-token [flags]

Examples

  1.   # Make all the bootstrap token configurations and create an initial token, functionally
  2.   # equivalent to what generated by kubeadm init.
  3.   kubeadm init phase bootstrap-token

Options

—config string

Path to a kubeadm configuration file.

—dry-run

Don’t apply any changes; just output what would be done.

-h, —help

help for bootstrap-token

—kubeconfig string     Default: “/etc/kubernetes/admin.conf”

The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

—skip-token-print

Skip printing of the default bootstrap token generated by ‘kubeadm init’.

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

kubeadm init phase kubelet-finalize

Use the following phase to update settings relevant to the kubelet after TLS bootstrap. You can use the all subcommand to run all kubelet-finalize phases.

Updates settings relevant to the kubelet after TLS bootstrap

Synopsis

Updates settings relevant to the kubelet after TLS bootstrap

  1. kubeadm init phase kubelet-finalize [flags]

Examples

  1.   # Updates settings relevant to the kubelet after TLS bootstrap"
  2.   kubeadm init phase kubelet-finalize all --config

Options

-h, —help

help for kubelet-finalize

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

Run all kubelet-finalize phases

Synopsis

Run all kubelet-finalize phases

  1. kubeadm init phase kubelet-finalize all [flags]

Examples

  1.   # Updates settings relevant to the kubelet after TLS bootstrap"
  2.   kubeadm init phase kubelet-finalize all --config

Options

—cert-dir string     Default: “/etc/kubernetes/pki”

The path where to save and store the certificates.

—config string

Path to a kubeadm configuration file.

—dry-run

Don’t apply any changes; just output what would be done.

-h, —help

help for all

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

Enable kubelet client certificate rotation

Synopsis

Enable kubelet client certificate rotation

  1. kubeadm init phase kubelet-finalize experimental-cert-rotation [flags]

Options

—cert-dir string     Default: “/etc/kubernetes/pki”

The path where to save and store the certificates.

—config string

Path to a kubeadm configuration file.

—dry-run

Don’t apply any changes; just output what would be done.

-h, —help

help for experimental-cert-rotation

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

kubeadm init phase addon

You can install all the available addons with the all subcommand, or install them selectively.

Install required addons for passing conformance tests

Synopsis

This command is not meant to be run on its own. See list of available subcommands.

  1. kubeadm init phase addon [flags]

Options

-h, —help

help for addon

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

Install all the addons

Synopsis

Install all the addons

  1. kubeadm init phase addon all [flags]

Options

—apiserver-advertise-address string

The IP address the API Server will advertise it’s listening on. If not set the default network interface will be used.

—apiserver-bind-port int32     Default: 6443

Port for the API Server to bind to.

—config string

Path to a kubeadm configuration file.

—control-plane-endpoint string

Specify a stable IP address or DNS name for the control plane.

—dry-run

Don’t apply any changes; just output what would be done.

—feature-gates string

A set of key=value pairs that describe feature gates for various features. Options are:
EtcdLearnerMode=true|false (BETA - default=true)
PublicKeysECDSA=true|false (DEPRECATED - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)
UpgradeAddonsBeforeControlPlane=true|false (DEPRECATED - default=false)
WaitForAllControlPlaneComponents=true|false (ALPHA - default=false)

-h, —help

help for all

—image-repository string     Default: “registry.k8s.io”

Choose a container registry to pull control plane images from

—kubeconfig string     Default: “/etc/kubernetes/admin.conf”

The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

—kubernetes-version string     Default: “stable-1”

Choose a specific Kubernetes version for the control plane.

—pod-network-cidr string

Specify range of IP addresses for the pod network. If set, the control plane will automatically allocate CIDRs for every node.

—service-cidr string     Default: “10.96.0.0/12”

Use alternative range of IP address for service VIPs.

—service-dns-domain string     Default: “cluster.local”

Use alternative domain for services, e.g. “myorg.internal”.

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

Install the CoreDNS addon to a Kubernetes cluster

Synopsis

Install the CoreDNS addon components via the API server. Please note that although the DNS server is deployed, it will not be scheduled until CNI is installed.

  1. kubeadm init phase addon coredns [flags]

Options

—config string

Path to a kubeadm configuration file.

—dry-run

Don’t apply any changes; just output what would be done.

—feature-gates string

A set of key=value pairs that describe feature gates for various features. Options are:
EtcdLearnerMode=true|false (BETA - default=true)
PublicKeysECDSA=true|false (DEPRECATED - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)
UpgradeAddonsBeforeControlPlane=true|false (DEPRECATED - default=false)
WaitForAllControlPlaneComponents=true|false (ALPHA - default=false)

-h, —help

help for coredns

—image-repository string     Default: “registry.k8s.io”

Choose a container registry to pull control plane images from

—kubeconfig string     Default: “/etc/kubernetes/admin.conf”

The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

—kubernetes-version string     Default: “stable-1”

Choose a specific Kubernetes version for the control plane.

—print-manifest

Print the addon manifests to STDOUT instead of installing them

—service-cidr string     Default: “10.96.0.0/12”

Use alternative range of IP address for service VIPs.

—service-dns-domain string     Default: “cluster.local”

Use alternative domain for services, e.g. “myorg.internal”.

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

Install the kube-proxy addon to a Kubernetes cluster

Synopsis

Install the kube-proxy addon components via the API server.

  1. kubeadm init phase addon kube-proxy [flags]

Options

—apiserver-advertise-address string

The IP address the API Server will advertise it’s listening on. If not set the default network interface will be used.

—apiserver-bind-port int32     Default: 6443

Port for the API Server to bind to.

—config string

Path to a kubeadm configuration file.

—control-plane-endpoint string

Specify a stable IP address or DNS name for the control plane.

—dry-run

Don’t apply any changes; just output what would be done.

-h, —help

help for kube-proxy

—image-repository string     Default: “registry.k8s.io”

Choose a container registry to pull control plane images from

—kubeconfig string     Default: “/etc/kubernetes/admin.conf”

The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

—kubernetes-version string     Default: “stable-1”

Choose a specific Kubernetes version for the control plane.

—pod-network-cidr string

Specify range of IP addresses for the pod network. If set, the control plane will automatically allocate CIDRs for every node.

—print-manifest

Print the addon manifests to STDOUT instead of installing them

Options inherited from parent commands

—rootfs string

[EXPERIMENTAL] The path to the ‘real’ host root filesystem.

For more details on each field in the v1beta3 configuration you can navigate to our API reference pages.

What’s next