Stable addresses matter before the cluster is created: an address change can affect certificates and kubelet communication. Configure each VM so that its address and settings survive a reboot. Unless a step says otherwise, run the Linux commands on all three nodes as labadmin.
Table of Contents
1. Static IP and SSH
nmcli device status
nmcli -f NAME,UUID,DEVICE connection show
ip -4 addressThe NIC and connection names in the example are ens160, ens160. If the actual list is Wired connection 1 or ens33, use those names. Because SSH may be disconnected while changing the IP, the first setup is performed in the VMware console.
# cp01의 VMware 콘솔에서 실행
CON="ens160" # 실제 연결 이름으로 수정
sudo hostnamectl set-hostname cp01
sudo nmcli connection modify "$CON" \
ipv4.method manual \
ipv4.addresses 192.168.80.10/24 \
ipv4.gateway 192.168.80.2 \
ipv4.dns "1.1.1.1 9.9.9.9" \
connection.autoconnect yes
sudo nmcli connection up "$CON"Apply wk01 / 192.168.80.11 to wk01 and wk02 / 192.168.80.12 to wk02. If the external DNS is restricted, use the allowed internal DNS. Try connecting to ssh labadmin@192.168.80.10 on Windows, and if denied, check the guest’s sshd and the SSH firewall permission status.
sudo tee -a /etc/hosts > /dev/null <<'EOF'
192.168.80.10 cp01 k8s-api.lab
192.168.80.11 wk01
192.168.80.12 wk02
EOF
getent hosts cp01 wk01 wk02 k8s-api.lab
ping -c 2 192.168.80.2
curl -I https://pkgs.k8s.ioDo not add the same name repeatedly to /etc/hosts. Edit the address if it already exists. k8s-api.lab is the fixed name to find the API server later. Naming alone does not make the control plane redundant.
2. Package update/time synchronization
sudo dnf upgrade --refresh -y
sudo dnf install -y curl vim-enhanced bash-completion chrony \
iproute iputils bind-utils conntrack-tools socat python3
sudo systemctl enable --now chronyd
chronyc tracking
chronyc sources -v
cat /etc/rocky-release
uname -rEven if you installed 9.6, you can upgrade to the supported 9.x by updating to the regular Rocky 9 repository. If the kernel and runtime are different for each node, the results may vary, so I leave the installation date and rpm -qa | sort. Also check time synchronization. For certificate verification and event time comparison, see if there is a selected source in chronyc sources.
3. Swap and boot settings
This lab disables swap to simplify memory behavior. Kubernetes also supports configurations that use swap; disabling it here is a lab choice. swapoff changes only the current state, so update the boot configuration as well to keep swap disabled after reboot.
sudo swapoff -a
sudo cp -a /etc/fstab /etc/fstab.before-k8s
sudo sed -ri '/^[[:space:]]*[^#].*[[:space:]]swap[[:space:]]/s/^/# k8s-lab /' /etc/fstab
swapon --show
systemctl list-units --type=swapswapon --show must not have any devices. If you used zram or a separate systemd swap unit, check that path as well. The check does not end with only fstab edited.
4. Kernel module and packet forwarding
sudo tee /etc/modules-load.d/k8s.conf > /dev/null <<'EOF'
overlay
br_netfilter
EOF
sudo modprobe overlay
sudo modprobe br_netfilter
sudo tee /etc/sysctl.d/99-kubernetes.conf > /dev/null <<'EOF'
net.ipv4.ip_forward = 1
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
EOF
sudo sysctl --system
stat -fc %T /sys/fs/cgroupip_forward=1 allows forwarding packets to other destinations. br_netfilter connects bridge traffic with netfilter rules, and overlay is used for the container’s layer file system. If you have a default cgroup v2 environment in Rocky 9, the last command should contain cgroup2fs. cgroups are a Linux feature that controls CPU and memory on a per-container basis.
5. Practice settings of SELinux and firewall
# 이 연재 전용 VM 세 대에서 실행
sudo setenforce 0
sudo sed -ri 's/^SELINUX=.*/SELINUX=permissive/' /etc/selinux/config
sudo systemctl disable --now firewalld
getenforceHere we use the SELinux permissive path from the kubeadm documentation. Policy violations are logged but not blocked and do not remove SELinux. Also turn off guest firewalld to reduce conflicts with Calico rules. Applies only on dedicated training VMs with restricted external access. Do not turn off Windows and the router’s firewall.
| communication | Where to use this lab |
|---|---|
| TCP 6443 → cp01 | Kubernetes API |
| TCP 2379~2380 → cp01 | etcd, not open to external users |
| TCP 10250 → node | kubelet API, API server logs, exec, etc. |
| UDP 4789 ↔ node | Calico VXLAN |
| TCP 30080 → node | 6 web apps NodePort |
The table summarizes the main paths to be checked in the series. Firewalls in your production environment must be designed separately from the Kubernetes port documentation and the actual Calico configuration. Also review origin restrictions and HostEndpoint policies. We do not believe that NetworkPolicy alone protects host ports.
6. Check after reboot
sudo reboot
# 재접속한 뒤 세 노드에서 확인
hostnamectl --static
ip -4 route
swapon --show
sysctl net.ipv4.ip_forward
getenforce
systemctl is-active chronyd
cat /etc/machine-id
sudo cat /sys/class/dmi/id/product_uuidAfter rebooting, check whether the IP, name, and swap status are maintained. Also compare the time synchronization and machine-id·product UUID of the three nodes. Once verified, shut down the VM and leave a os-ready snapshot to use when repeating the next installation.
reference material
- Pre-installation requirements for kubeadm
- Kubernetes ports and protocols
- Calico node/network requirements
- Rocky Linux NetworkManager Guide
official documents and distribution files confirmed: October 18, 2026. The output is an example to determine completion and may vary depending on the environment.
