...

# The following command accepts several arguments, but for building a small test cluster let's run it without them
$ kubeadm init <args>
.
.
.

# At the end of the procedure, an output similar to this will appear
Your Kubernetes control-plane has initialized successfully!

To start using your cluster, you need to run the following as a regular user:
  mkdir -p $HOME/.kube
  sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
  sudo chown $(id -u):$(id -g) $HOME/.kube/config

You should now deploy a Pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
  /docs/concepts/cluster-administration/addons/

You can now join any number of machines by running the following on each node
as root:
  kubeadm join <control-plane-host>:<control-plane-port> --token <token> --discovery-token-ca-cert-hash sha256:<hash>

The output shown above gives us 3 information:

...

To remove administrator privileges, simply follow the simple steps in the previous output. Repeat the same commands as root if you also want to use the cluster in administrator mode.

As  As for the second point in the list, there are multiple CNI (Container Network Interfaces) to generate our Pod network. Here we use Calico (official guide here), but obviously there are valid alternatives listed at the address shown in the command above (we report the link here). So let's run the command (check the version)

$ kubectl apply -f https://docs.projectcalico.org/v3.17/manifests/calico.yaml
# Flannel is an alternative
$ kubectl apply -f https://raw.githubusercontent.com/flannel-io/flannel/master/Documentation/kube-flannel.yml

Now let's finally expand our cluster by adding worker nodes. Let's connect to the nodes via SSH and take administrator privileges. Now we paste the command, saved previously, returned to us by kubeadm init

$ kubeadm join <control-plane-host>:<control-plane-port> --token <token> --discovery-token-ca-cert-hash sha256:<hash>
.
.
.

This node has joined the cluster:
* Certificate signing request was sent to apiserver and a response was received.
* The Kubelet was informed of the new secure connection details.

Run 'kubectl get nodes' on the control-plane to see this node join the cluster.

To retrieve the token later, type the command

...

$ kubectl get nodes
NAME                   STATUS   ROLES    AGE   VERSION
mycentos-0.novalocal   Ready    master   30h   v1.1921.21
mycentos-1.novalocal   Ready    <none>   25h   v1.1921.21
mycentos-2.novalocal   Ready    <none>   24h   v1.1921.21

The output should list the nodes that are part of the cluster.

Upgrading kubeadm clusters

To update the cluster, follow cluster follow the instructions in the official guide, that explains how to upgrade a Kubernetes cluster created with kubeadm. The upgrade workflow at high level is the following:

...