K8s Cluster Management

Always use Kubespray for Kubernetes cluster installation. Kubespray playbooks are idempotent and converge to desired state.

Components (January 2026)

Component Version Purpose

Kubernetes v1.34.3 Cluster

Kubespray v2.29.1 Installer

etcd v3.5.26 Key-value store

containerd v2.2.1 Container runtime

Cilium v1.18.6 CNI + Gateway

Gateway API v1.4.0 Ingress

cert-manager v1.19.2 TLS automation

MetalLB v0.14.9 Bare metal LB

Note: For K8s v1.35.0, wait for Kubespray v2.30+.

Installation

Run from bastion server. See reference files for detailed commands:

• Kubernetes cluster: references/kubespray.md

• CNI: references/cilium.md

• Ingress: references/gateway-api.md

• TLS: references/cert-manager.md

kubectl Access

After installation, kubectl works directly from bastion:

On bastion

kubectl get nodes kubectl get pods -A

Or via VPN from any connected server:

Connect to VPN first

tailscale up --login-server https://vpn.example.com --authkey <KEY>

Then kubectl works

kubectl get nodes

Reference Files

• references/kubespray.md - Installation

• references/cilium.md - CNI

• references/gateway-api.md - Ingress

• references/cert-manager.md - TLS

• references/upgrades.md - Cluster upgrades

• references/essential-components.md - Essential components

• references/troubleshooting.md - Troubleshooting