How to Deploy a Kubernetes Cluster on Raspberry Pi in 2026

#!/bin/bash
set -euo pipefail

# Run on ALL nodes (masters + workers)
apt update && apt upgrade -y
apt install -y curl apt-transport-https ca-certificates gnupg lsb-release jq

# Disable swap (critical for kubelet)
swapoff -a
sed -i '/ swap / s/^/#/' /etc/fstab

# Load kernel modules for CNI networking
cat <<EOF | tee /etc/modules-load.d/k8s.conf
overlay
br_netfilter
EOF
modprobe overlay
modprobe br_netfilter

# Configure sysctl for Kubernetes
cat <<EOF | tee /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-iptables  = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward                 = 1
EOF
sysctl --system

reboot

#!/bin/bash
set -euo pipefail

# On ALL nodes
apt install -y containerd.io=1.7.*

# Configure containerd for CRI (sandbox_image = pause:3.10)
mkdir -p /etc/containerd
containerd config default | sed 's/SystemdCgroup = false/SystemdCgroup = true/' | tee /etc/containerd/config.toml

# Pull ARM64 pause image
ctr image pull registry.k8s.io/pause:3.10

systemctl restart containerd
systemctl enable containerd

# Verify
ctr version | head -1
grep -q 'SystemdCgroup = true' /etc/containerd/config.toml && echo 'Config OK'

#!/bin/bash
set -euo pipefail

KUBEVER="v1.32.2"

# Add Kubernetes repo (ARM64 auto)
curl -fsSL https://pkgs.k8s.io/core:/stable:/$KUBEVER/deb/Release.key | gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg
echo 'deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/$KUBEVER/deb/ /' | tee /etc/apt/sources.list.d/kubernetes.list

apt update
apt install -y kubelet=$KUBEVER kubeadm=$KUBEVER kubectl=$KUBEVER
apt-mark hold kubelet kubeadm kubectl

systemctl enable --now kubelet
kubectl version --client

#!/bin/bash
set -euo pipefail

POD_CIDR="10.244.0.0/16"  # For Flannel
CONTROL_PLANE_ENDPOINT="192.168.1.100:6443"  # Virtual load balancer (VIP)

# Reset if needed
kubeadm reset -f

# Init with CRI=containerd, HA certs (cert-manager like)
kubeadm init \
  --pod-network-cidr $POD_CIDR \
  --control-plane-endpoint $CONTROL_PLANE_ENDPOINT \
  --cri-socket unix:///run/containerd/containerd.sock \
  --upload-certs \
  --certificate-key \
  $(kubeadm init phase upload-certs --upload-certs 2>/dev/null | tail -1) \
  --kubernetes-version v1.32.2

# Post-init
mkdir -p $HOME/.kube
cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
chown $(id -u):$(id -g) $HOME/.kube/config

# Remove taint for worker-like master
kubectl taint nodes --all node-role.kubernetes.io/control-plane-

kubectl get nodes
kubeadm token create --print-join-command

#!/bin/bash
set -euo pipefail

# Replace with output from kubeadm token create --print-join-command
JOIN_CMD="kubeadm join 192.168.1.100:6443 --token abcdef.1234567890abcdef \
    --discovery-token-ca-cert-hash sha256:1234..abcd \
    --cri-socket unix:///run/containerd/containerd.sock"

# For worker: $JOIN_CMD
# For HA master: $JOIN_CMD --control-plane --certificate-key XYZ...

kubeadm reset -f
$JOIN_CMD

# On primary master, verify
kubectl get nodes -o wide

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: flannel
  namespace: kube-system
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: flannel
  namespace: kube-system
data:
  net-conf.json: |
    {
      "Network": "10.244.0.0/16",
      "Backend": { "Type": "vxlan" }
    }
  cni-conf.json: |
    {
      "name": "cbr0",
      "cniVersion": "0.3.1",
      "plugins": [
        {"type": "flannel"},
        {"type": "portmap"},
        {"type": "bandwidth"},
        {"type": "firewall"}
      ]
    }
---
# MetalLB (LB for services)
apiVersion: v1
kind: Namespace
metadata:
  name: metallb-system
---
apiVersion: v1
kind: Secret
metadata:
  namespace: metallb-system
  name: memberlist
stringData:
  secretkey: "VeryRandomString12345678=="
---
# Apply: kubectl apply -f deploy-cni-metallb.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deploy
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.27-alpine
        resources:
          requests:
            cpu: 100m
            memory: 128Mi
          limits:
            cpu: 200m
            memory: 256Mi
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: nginx-svc
spec:
  type: LoadBalancer
  ports:
  - port: 80
    targetPort: 80
  selector:
    app: nginx
---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: nginx-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: nginx-deploy
  minReplicas: 3
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70