Why is Kubernetes so important in the cloud-native world?
Kubernetes (K8s) is the operating system of the modern cloud. It orchestrates your containers, automates deployments, scales your applications on demand – and ensures that everything runs stably, even if individual parts fail.

In a world where software is constantly becoming faster, more distributed, and more dynamic, Kubernetes offers exactly what you need: self-healing, scalability, portability – and all of this platform-independently, whether in the cloud or on-premises.

Cloud-native means: flexible, robust, automated – and Kubernetes is the foundation for it. It makes you independent of cloud providers, gives you full control over your infrastructure, and opens the door to a huge ecosystem of modern tools like Prometheus, Helm, or GitOps.

Let’s get started!

1. Prerequisites

1. Three Ubuntu servers (VMs or physical) with Ubuntu Server and root privileges
2. SSH access to all hosts (password or SSH key)
3. Local machine with Git installed

1.2. Set up Ubuntu Server with SSH Server

1.2.1 Prerequisites

• Ubuntu 20.04, 22.04 or newer (Server or Desktop)
• Root access or a user with sudo privileges

1.2.2 Install OpenSSH Server

sudo apt update

sudo apt install openssh-server -y

1.2.3 Check if the SSH service is running

sudo systemctl status ssh

You should see an output like:

● ssh.service - OpenBSD Secure Shell server

   Active: active (running)

If not:

sudo systemctl enable --now ssh

1.2.4 Determine the server’s IP address

So you can connect later:

ip a

Or:

hostname -I

Note down the IP address of the network interface, e.g., 192.168.1.100

1.2.5 Securely configure the SSH server (optional, but recommended)

The configuration file is located at:

sudo nano /etc/ssh/sshd_config

Here is a secure basic set of settings:

PermitRootLogin no

PasswordAuthentication no

PermitEmptyPasswords no

ChallengeResponseAuthentication no

UsePAM yes

X11Forwarding no

AllowUsers andrej

💡 Important: Only set PasswordAuthentication no if public key login is working, otherwise you will lock yourself out.

Apply changes:

sudo systemctl reload ssh

1.2.6 Configure firewall (UFW – if active)

sudo ufw allow OpenSSH

sudo ufw enable

🔒 This allows incoming connections on port 22 (the default for SSH).

1.2.7 Test connection

On your local machine (Linux, macOS, or Git-Bash / PuTTY on Windows):

ssh kubernete@192.168.1.100

If everything is set up correctly, you should be connected directly – either via password or SSH key.

1.2.8 Bonus: Change port (for security through obscurity)

Change in /etc/ssh/sshd_config:

Port 2222

Then:

sudo ufw allow 2222/tcp

sudo systemctl restart ssh

And connect like this in the future:

ssh -p 2222 andrej@192.168.1.100

1.2.9 Security Tips

1.3. Clone Repository and Prepare Environment

Before we can begin the installation, we need to clone the K3Nova repository. This contains the pre-compiled binary as well as all the necessary configuration files required for setting up the cluster.

To do this, execute the following commands:

# Clone the K3Nova repository

git clone https://github.com/AndrejSchefer/K3Nova.git

cd K3Nova

In the K3Nova directory, you will find:

• the K3Nova binaries, with which you can control the cluster installation via the command line.
• The prepared configuration files (e.g., config/k3nova-config.json.tpl), with which you can individually customize your cluster’s setup

1.4. Customize Configuration

Create a file config/k3nove-config.json from the template config/k3nova-config.json.tpl and enter the access data for one master and two workers. Example:

{
  "masters": [
    {
      "ip": "192.168.56.10",        # Master node IP address
      "ssh_user": "ubuntu",         # SSH user for master
      "ssh_pass": "yourpassword",    # SSH password for master
      "cluster_init": false
    }
  ],
  "workers": [
    {
      "ip": "192.168.56.11",         # Worker node 1 IP address
      "ssh_user": "ubuntu",          # SSH user for worker
      "ssh_pass": "yourpassword",    # SSH password for worker
      "cluster_init": false
    },
    {
      "ip": "192.168.56.12",        # Worker node 2 IP address
      "ssh_user": "ubuntu",         # SSH user for worker
      "ssh_pass": "yourpassword",    # SSH password for worker
      "cluster_init": false
    }
  ],
  "k3s_token_file": "master-node-token",  # Path to token file
  "docker_registry": {
    "url": "registry.local",
    "pvc_storagy_capacity": "10Gi",
    "pass": "123456",
    "user": "registry",
    "local": true
  },
  "redis": {
    "url": "redis.local",
    "pvc_storage_capacity": "10Gi",
    "pass": "123456",
    "user": "registry",
    "image": "redis:8.0.2",
    "local": true
  },
  "nfs": {
    "network_CIDR": "192.168.179.0/24",
    "nfs_server": "192.168.179.12",
    "nfs_user": "kubernetes",
    "nfs_pass": "123456",
    "server": "10.0.0.10",
    "export": "/mnt/k3s-nfs-localstorage",
    "capacity": "100Gi"
    },
    "email": "public@andrejschefer.de",
    "domain": "igneos.cloud",
    "cluster_issuer_name": "letsencrypt-prod"
}

2. Install a Control Plane and two workers

After you have successfully cloned the repository, you can now make the K3Nova binary for your operating system executable and run it. In the following example, we show how to set up the Linux version (k3nova-linux-amd64):

# Using Linux as an example

mv k3nova-linux-amd64 k3nova 

chmod +x k3nova

./k3nova

• First, the downloaded binary is renamed to make it easier to execute by command (mv).
• Then, the file is made executable with chmod +x.
• With ./k3nova, you start the tool directly in the terminal.

After starting, K3Nova guides you through the cluster installation interactively or based on a configuration. Make sure that the corresponding config/k3nova-config.json is in the same directory – it defines how the cluster should be built (e.g., Control Planes, Workers, NFS, Registry, Monitoring, etc.).

2.1 Install K3s Master (Control Plane)

2.1.1 Manual Installation of the K3s Control Plane (Single-Node)

On the first master node (192.168.56.10), we install K3s in the role of a standalone Control Plane. For this, we use the official installation script from K3s and specifically pass parameters to increase the security and usability of the environment:

curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="--write-kubeconfig-mode=644 --secrets-encryption" sh -s - server    

Important parameters in the command above:

• --write-kubeconfig-mode=644 allows non-root users on the master to read the generated kubeconfig (/etc/rancher/k3s/k3s.yaml). This allows you to work with kubectl as a normal user later without root privileges.
• --secrets-encryption activates the encryption of Kubernetes Secrets (in etcd/SQLite) on the server. k3s automatically generates an AES key and an encryption config that is passed to the API server (Secrets Encryption | K3s). This setting ensures that confidential data (Secrets) is also stored encrypted in the etcd storage.

2.1.2 Alternative: K3s Master Installation with K3Nova

Instead of installing the K3s control plane manually with the official script, the setup can also be fully automated using the CLI tool K3Nova. This tool was developed to install both simple and high-availability K3s clusters quickly, reproducibly, and securely.

To install a K3s master node on 192.168.56.10 and simultaneously set up the kube-config on your local machine (/home/user/.kube/config) for immediate kubectl access, please select the menu item „Install Kubernetes Master“ in K3Nova. K3Nova automatically executes the commands you ran manually above.

2.1.2.1 Installation Process

After starting the installer with:

./K3Nova

an interactive terminal menu opens. There you can choose whether you want to:

• install a single master
• set up a complete cluster with master, worker, monitoring, registry, and storage components
• or configure a high-availability K3s cluster with multiple control-plane nodes

As soon as you select the option “Install Kubernetes Master” in the tool, K3Nova automatically starts the installation process. A secure SSH connection is established to the target server, through which all necessary commands are executed remotely.

In the background, K3Nova uses almost the same command as in a manual K3s installation – with one crucial difference: Instead of the default Traefik Ingress controller, K3Nova sets up an advanced Traefik variant that supports both TCP and UDP Ingress. For this reason, Traefik is first disabled via the parameter --disable=traefik:

curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="--write-kubeconfig-mode=644 --secrets-encryption --disable=traefik" sh -s - server

This configuration ensures that the generated kubeconfig is readable by non-root users and that secrets are stored encrypted in the cluster.

2.1.2.2 What does “Advanced Traefik” mean in K3Nova?

By default, K3s automatically installs a simple Traefik configuration as an Ingress controller during setup. This is sufficient for many web applications, but is limited to HTTP(S) Ingress. As soon as you want to secure or publish services like Redis, PostgreSQL, MQTT, or other protocols on a TCP/UDP basis, this standard installation reaches its limits.

K3Nova deliberately goes a step further here – and relies on an extended (“advanced”) Traefik installation, which offers the following advantages:

~/.kube/config

kubectl get nodes

# On the Master Node (192.168.56.10): Read the token
cat /var/lib/rancher/k3s/server/node-token
# Example output (do not use for real):
K1066b9f4e97c2e87ea47d6facf56e76828e62198e1f908d58e29cce355956f9c::server:37c672b9c9d3f9f4dce7f297bef856d1

# Execute on the worker node (insert Master IP and Token):
curl -sfL https://get.k3s.io | K3S_URL="https://<MASTER_IP>:6443" K3S_TOKEN="<TOKEN>" sh -s - agent

# Back on the master (with KUBECONFIG set):

kubectl get nodes -o wide

curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="server --cluster-init --write-kubeconfig-mode=644 --secrets-encryption" sh -

sudo cat /var/lib/rancher/k3s/server/token

curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="server \
  --server https://192.168.56.10:6443 \
  --token <TOKEN> \
  --write-kubeconfig-mode=644 \
  --secrets-encryption" sh -

kubectl get nodes

{
  "control_planes": [
    {
        "ip": "192.168.179.10",
        "ssh_user": "kubernetes",
        "ssh_pass": "123456",
        "cluster_init": true          # set true for init
    },
    {
        "ip": "192.168.179.11",
        "ssh_user": "kubernetes",
        "ssh_pass": "123456",
        "cluster_init": false
    },
    {
        "ip": "192.168.179.14",
        "ssh_user": "kubernetes",
        "ssh_pass": "123456",
        "cluster_init": false
    }
],
  "workers": [
    {
      "ip": "192.168.56.11",        
      "ssh_user": "kubernetes",         
      "ssh_pass": "123456",
      "cluster_init": false
    },
    {
      "ip": "192.168.56.12",       
      "ssh_user": "ubuntu",        
      "ssh_pass": "yourpassword",  
      "cluster_init": false
    }
  ],
}

kubectl get nodes