Practice YAML · Download configuration file ZIP · Do not apply the entire file at once, but follow each step in order.
This is a 10-part series on creating three Rocky Linux VMs and installing Kubernetes on VMware Workstation on Windows 11. Distribution, communication, storage, permissions, fault diagnosis and restoration are carried out through the same app. The reason for each setting and the status to be checked are written down, so you can refer to them when looking at the operation process after installation.
Practice environment and reading order
Start with the Rocky Linux 9.6 x86_64 installation media and use supported Rocky 9.x after security updates. The documentation-based combination is Kubernetes 1.36.5, containerd 2.x, and Calico 3.33.0. It has 1 CP and 2 workers, and uses node band 192.168.80.0/24, pod band 10.244.0.0/16, and service band 10.96.0.0/12. If you are at a different point in choosing a package, double-check official compatibility with the repository list.
For Windows hosts, we recommend 32 GB of RAM and at least 150 GB of free SSD. It’s easy to follow if you know the basics of the Linux shell, sudo, and file editing. Bash runs on Linux and PowerShell runs on Windows. Operations that apply only to specific nodes are indicated in the corresponding step.
| order | content | What you can do after finishing |
|---|---|---|
| 01 | Windows 11·VMware and Rocky Linux lab environment | Prepare the VMware NAT network, VM resources and IP plan, then install Rocky Linux 9.6. The 3 VMs form the lab used throughout the Kubernetes series. |
| 02 | Rocky Linux static IP/time/kernel settings | Point out the meaning of static IP, name resolution, swap, kernel module, and SELinux, and match the common conditions of the three nodes. Complete reboot verification before installation. |
| 03 | Installing containerd 2.x and kubeadm | Let’s look at the structure of running a container with containerd without Docker, and match the systemd cgroup and Kubernetes RPM versions on three nodes. |
| 04 | Cluster configuration and Calico connection | Configure a 3-node cluster with kubeadm init and join. Check the Ready status by connecting the roles of the API server, etcd, and the controller to Calico VXLAN. |
| 05 | Deployment Deployment and rolling update | We deploy unprivileged NGINX and practice requests·limits, readiness·liveness, scheduler filtering and scoring, and rolling updates. |
| 06 | Service·DNS and connection path on Windows | Connect ClusterIP·NodePort·EndpointSlice to trace the request path. We’ll also look at the boundaries when changing web pages with ConfigMap and dealing with Secrets. |
| 07 | Leave a file with local PV/PVC | Practice file survival by connecting a local PersistentVolume and PVC. Understand WaitForFirstConsumer, node dependencies, and the difference between Retain and Backup. |
| 08 | RBAC·NetworkPolicy·Pod execution permission | Create a read-only ServiceAccount and Role and restrict access with Calico NetworkPolicy. Connects Pod Security Admission and token management. |
| 09 | Pod fault diagnosis and node drain | Learn the order of reading events, logs, and termination reasons, and recover from intentional scheduling failures. Leave the PDB and safely drain and return workers. |
| 10 | etcd·File restoration and patch upgrade | Practice saving etcd snapshots and isolated single control plane recovery. Connects local file backup, patch upgrade sequence, and even certificate checking. |
Where to stack files
Practice files are collected in ~/k8s-lab/app of cp01. The web-deployment.yaml from Part 5 continues to be used with the addition of ConfigMap from Part 6 and the token mount settings from Part 8. YAML fragments are merged into an existing file rather than applied separately. The local-data PVC and wk01 files from Part 7 are saved until the last backup.
Verification scope and operational boundaries
We verified availability of official documentation, RPM repositories, Calico distribution files, and images, and reviewed YAML/shell syntax. This is not a ground truth record of running the entire procedure on three Windows 11, VMware, and Rocky VMs. I did not use the example output as an actual execution screen. The status of each step must be checked on the equipment being used.
This environment is for learning purposes only. Single control plane, SELinux permissive, guest firewalld disabled, node dependency on local PV intentionally exposed. When moving to production servers, access control, high availability, storage and data consistency, and external backup must be designed separately. Administrator kubeconfig·token·PKI·etcd backups are not placed in public repositories or web directories.
In what order should I learn it?
Parts 1 to 4 prepare nodes and Pod DNS, and parts 5 to 7 cover distribution, communication, and storage of web apps. Parts 8 to 10 are about permissions, fault diagnosis, and backup/restore. If an error remains, check that step before executing any more commands in the following article. You must complete the cleanup command for the Test Pod in Part 7 and the Policy in Part 8 before you can continue with the drain practice.
document reference date: October 18, 2026. If you find a technical error, please leave a comment with the article number, version used, and an error message excluding sensitive information.