World map

 

BM

World K9: Cluster Admin

kubeadm: how a cluster is born

You will learn: what kubeadm init builds, and how a new stall joins with a token.

Checked with Kubernetes 1.37 on 1 Nov 2026

The problem

You are here: cluster kind-dev namespace default

kind built this food court in about a minute. On three bare machines, nobody does it for you. Who builds the manager’s office?

Watch

The builder is kubeadm: The builder of a food court: it sets up the manager's office on the first machine and lets new stalls join.. kubeadm init turns the first machine into the manager’s office. Tap each step it takes.

Tap each point on the timeline.

Try it

See what the builder left behind. Type docker exec -it dev-control-plane bash. Then ls /etc/kubernetes.

You are here: cluster kind-dev namespace default
dev-control-planeOpenManager

No trays here.

dev-workerOpen

No trays here.

dev-worker2Open

No trays here.

Time: +0s (sped up)

Check

Where did kubeadm put each file? Sort them.

Drag a card into a box. Or tap the card, then tap the box.

        Try it

        kubeadm left a master key on the office machine: admin.conf: The master key kubeadm leaves on the control-plane node: a kubeconfig with full admin rights.. Use it on purpose. Type kubectl --kubeconfig /etc/kubernetes/admin.conf get nodes.

        You are here: cluster kind-dev namespace default
        dev-control-planeOpenManager

        No trays here.

        dev-workerOpen

        No trays here.

        dev-worker2Open

        No trays here.

        Time: +0s (sped up)

        You are inside node dev-control-plane. Type exit to go back to your laptop.

        Try it

        A new stall joins with a ticket: a join token (bootstrap token): A short-lived ticket a new stall shows to join the food court. It lasts 24 hours by default.. Build the join command.

        Tap the pieces in the right order.

        …

        Predict

        Your join command is from yesterday morning. Thirty hours have passed. What now?

        Check

        Put the whole build in order.

        First step at the top. Put these in order. Use the arrows, or drag.

        • Install a container runtime, kubeadm and the kubelet on every machine
        • Run kubeadm init on the first machine
        • Copy admin.conf so kubectl can reach the office
        • Run kubeadm join on each worker
        • Install one Pod network add-on
        • Check that every stall shows up: kubectl get nodes

        You did it!

        You can now explain how kubeadm builds a cluster and how stalls join.

        Go deeper (optional)

        kubeadm adds no Pod network. You install one yourself, and only one per cluster. CoreDNS will not start before a network is there. The join token is a secret: anyone holding it can add machines.

        Real mission

        1. kubectl config current-context
        2. docker exec dev-control-plane ls /etc/kubernetes
        3. docker exec dev-control-plane kubeadm token create --print-join-command
        4. docker exec dev-control-plane kubeadm token list

        0 of 4 steps done · Your ticks are saved.