Differences

This shows you the differences between two versions of the page.

Link to this comparison view

--- projects:k8s:k8s_setup_with_k0s_k0sctl [2026/05/27 05:24] – garfield
+++ projects:k8s:k8s_setup_with_k0s_k0sctl [2026/06/09 07:02] (current) – external edit 127.0.0.1
@@ Line 11: / Line 11: @@
   - Required prep - Ensure unique system ID. K0s cluster deployment will fail if aren't.<code>
 sudo systemd-machine-id-setup
+</code>
+  - Disable SELinux because k0sctl doesn't seem to like it<code>
+sudo setenforce 0
 </code>
   - System prep ( RPM-based distros )
@@ Line 73: / Line 76: @@
       effect: NoExecute
       controllerWorkers: false
+</code>
+  - Generate or copy your ssh keys to each target. If you're not sure how, have a look at this site: [[https://www.ssh.com/academy/ssh/keygen]]
+  - Open the firewall ports on the control plane node(s)<code>
+# Open Kubernetes API server port
+firewall-cmd --permanent --add-port=6443/tcp
+# Open Kubelet API port
+firewall-cmd --permanent --add-port=10250/tcp
+# Open default k0s internal networking ports (BGP and VXLAN)
+firewall-cmd --permanent --add-port=179/tcp
+firewall-cmd --permanent --add-port=4789/udp
+# Tell Fedora to trust all traffic on the container network bridges
+firewall-cmd --permanent --zone=trusted --add-interface=cni0
+firewall-cmd --permanent --zone=trusted --add-interface=kube-router
+# Allow pods to masquerade/NAT out to the local network
+firewall-cmd --permanent --zone=trusted --add-masquerade
+firewall-cmd --permanent --zone=trusted --add-source=10.244.0.0/16
+firewall-cmd --permanent --zone=trusted --add-source=10.96.0.0/12
+# Reload firewall to apply changes
+firewall-cmd --reload
+</code>
+  - Disable the firewall completely **on the worker nodes** since k8s doesn't like it - Ref: [[https://docs.k0sproject.io/head/networking/#firewalld-k0s|k0s networking - firewalld-k0s]]<code>
+sudo systemctl stop firewalld && sudo disable firewalld
 </code>
   - Create the cluster<code>
@@ Line 86: / Line 117: @@
 grep -i port /etc/k0s/k0s.yaml
 </code>
-  - Open the required firewall ports: <code>
-firewall-cmd --permanent --add-port={8133/tcp,2379/tcp,2380/tcp,10257/tcp,10259/tcp,9443/tcp,8132/tcp,6443/tcp,10249/tcp}
-firewall-cmd --reload
-</code>
 ==== Verify the cluster setup/deployment - Control node ====