### Verifying Kubectl Installation - Bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/02-jumpbox.md

Runs the 'kubectl version --client' command to display the installed client version of kubectl. This confirms that the installation was successful and the binary is correctly placed and executable.

```bash
kubectl version --client
```

--------------------------------

### Installing etcd Binaries (Bash)

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/07-bootstrapping-etcd.md

Moves the downloaded `etcd` server and `etcdctl` client binaries from the current directory into the standard `/usr/local/bin/` directory. This makes the etcd executables available system-wide for any user.

```bash
{ \
  mv etcd etcdctl /usr/local/bin/\
}

```

--------------------------------

### Installing Essential Utilities - Bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/02-jumpbox.md

Updates the package list and installs necessary command-line utilities including wget, curl, vim, openssl, and git on the jumpbox. These tools are fundamental prerequisites for the subsequent steps.

```bash
{
  apt-get update
  apt-get -y install wget curl vim openssl git
}
```

--------------------------------

### Starting etcd Service with Systemd (Bash)

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/07-bootstrapping-etcd.md

Reloads the systemd manager configuration to recognize the new unit file, enables the `etcd` service to ensure it starts automatically on boot, and immediately starts the running instance of the `etcd` service.

```bash
{ \
  systemctl daemon-reload\
  systemctl enable etcd\
  systemctl start etcd\
}

```

--------------------------------

### Starting Kubernetes Controller Services

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/08-bootstrapping-kubernetes-controllers.md

Reloads the systemd manager configuration, enables the kube-apiserver, kube-controller-manager, and kube-scheduler services to start on boot, and then starts these services immediately.

```bash
{
  systemctl daemon-reload

  systemctl enable kube-apiserver \
    kube-controller-manager kube-scheduler

  systemctl start kube-apiserver \
    kube-controller-manager kube-scheduler
}
```

--------------------------------

### Installing Kubectl Binary - Bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/02-jumpbox.md

Copies the downloaded 'kubectl' binary from the 'downloads/client' directory to the system's '/usr/local/bin/' directory. This makes the 'kubectl' command globally available in the shell's PATH.

```bash
{
  cp downloads/client/kubectl /usr/local/bin/
}
```

--------------------------------

### Displaying Example Machine Database File Content - bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/03-compute-resources.md

Displays the content of the `machines.txt` file which serves as a machine database for the Kubernetes cluster nodes. It shows the schema (IP, FQDN, HOST, POD_SUBNET) and example entries with masked IP addresses. This snippet confirms the file structure and content being used.

```bash
cat machines.txt
```

--------------------------------

### Installing Kubernetes Controller Binaries

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/08-bootstrapping-kubernetes-controllers.md

Moves the downloaded Kubernetes binaries (kube-apiserver, kube-controller-manager, kube-scheduler, kubectl) into the `/usr/local/bin/` directory, making them accessible in the system's PATH.

```bash
{
  mv kube-apiserver \
    kube-controller-manager \
    kube-scheduler kubectl \
    /usr/local/bin/
}
```

--------------------------------

### Starting Kubernetes Worker Services with systemctl (Bash)

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/09-bootstrapping-kubernetes-workers.md

Reloads the systemd manager configuration to recognize the new service unit files. Then, it enables the containerd, kubelet, and kube-proxy services to start automatically on boot. Finally, it immediately starts these three services to bring up the core Kubernetes worker components. Requires root privileges.

```bash
{
  systemctl daemon-reload
  systemctl enable containerd kubelet kube-proxy
  systemctl start containerd kubelet kube-proxy
}
```

--------------------------------

### Installing etcd Systemd Unit File (Bash)

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/07-bootstrapping-etcd.md

Moves the prepared `etcd.service` systemd unit file into the `/etc/systemd/system/` directory. This file defines how the etcd service should be managed by systemd, including dependencies, execution command, and restart policies.

```bash
mv etcd.service /etc/systemd/system/

```

--------------------------------

### Cloning Kubernetes The Hard Way Repo - Bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/02-jumpbox.md

Clones the 'kubernetes-the-hard-way' Git repository from GitHub with a depth of 1 to get only the latest commit. This repository contains critical configuration files and templates used throughout the tutorial.

```bash
git clone --depth 1 \
  https://github.com/kelseyhightower/kubernetes-the-hard-way.git
```

--------------------------------

### Installing Containerd Config and Service (Bash)

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/09-bootstrapping-kubernetes-workers.md

Creates the necessary `/etc/containerd/` directory, moves the `containerd-config.toml` file to this directory, and moves the `containerd.service` unit file to the systemd service directory (`/etc/systemd/system/`). This prepares containerd for configuration and management by systemd. Requires root privileges.

```bash
{
  mkdir -p /etc/containerd/
  mv containerd-config.toml /etc/containerd/config.toml
  mv containerd.service /etc/systemd/system/
}
```

--------------------------------

### Installing Kubelet Config and Service (Bash)

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/09-bootstrapping-kubernetes-workers.md

Moves the `kubelet-config.yaml` file to the `/var/lib/kubelet/` directory and the `kubelet.service` unit file to the systemd service directory (`/etc/systemd/system/`). This provides the kubelet service with its configuration and allows it to be managed by systemd. Requires root privileges.

```bash
{
  mv kubelet-config.yaml /var/lib/kubelet/
  mv kubelet.service /etc/systemd/system/
}
```

--------------------------------

### Installing Kube-Proxy Config and Service (Bash)

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/09-bootstrapping-kubernetes-workers.md

Moves the `kube-proxy-config.yaml` file to the `/var/lib/kube-proxy/` directory and the `kube-proxy.service` unit file to the systemd service directory (`/etc/systemd/system/`). This provides the kube-proxy service with its configuration and allows it to be managed by systemd. Requires root privileges.

```bash
{
  mv kube-proxy-config.yaml /var/lib/kube-proxy/
  mv kube-proxy.service /etc/systemd/system/
}
```

--------------------------------

### Logging into Worker Node via SSH (Bash)

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/09-bootstrapping-kubernetes-workers.md

Provides an example command to establish an SSH connection to a specific worker node (`node-0`) as the root user. This command is typically executed from the `jumpbox` to perform subsequent setup steps directly on the worker instance. Requires SSH access to the worker node.

```bash
ssh root@node-0
```

--------------------------------

### Logging into Server via SSH (Bash)

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/07-bootstrapping-etcd.md

Connects to the `server` machine remotely as the `root` user using the SSH protocol. All subsequent commands for etcd setup should be executed on this server instance after logging in.

```bash
ssh root@server

```

--------------------------------

### Installing OS Dependencies with apt-get (Bash)

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/09-bootstrapping-kubernetes-workers.md

Updates the package list for the Debian/Ubuntu-based system and installs necessary operating system dependencies required by Kubernetes components using the `apt-get` package manager. The installed packages include `socat` (for `kubectl port-forward`), `conntrack`, `ipset`, and `kmod`. Requires root privileges and internet connectivity.

```bash
{
  apt-get update
  apt-get -y install socat conntrack ipset kmod
}
```

--------------------------------

### Copying etcd Files to Server using SCP (Bash)

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/07-bootstrapping-etcd.md

Copies the etcd server binary, etcdctl client binary, and the etcd systemd unit file from local `downloads` and `units` directories to the `root` user's home directory on the remote `server` machine using SCP. This is a prerequisite before installing and configuring etcd on the server.

```bash
scp \
  downloads/controller/etcd \
  downloads/client/etcdctl \
  units/etcd.service \
  root@server:~/ novice

```

--------------------------------

### Listing etcd Cluster Members (Bash)

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/07-bootstrapping-etcd.md

Executes the `etcdctl` command-line utility to query the etcd cluster and list its current members. This command is used to verify that the etcd service has started successfully and is accessible.

```bash
etcdctl member list

```

--------------------------------

### Installing Kubernetes and Containerd Binaries (Bash)

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/09-bootstrapping-kubernetes-workers.md

Moves the previously copied Kubernetes binaries (`crictl`, `kube-proxy`, `kubelet`, `runc`) to `/usr/local/bin/` and containerd binaries (`containerd`, `containerd-shim-runc-v2`, `containerd-stress`) to `/bin/`. Also moves the CNI plugin binaries to `/opt/cni/bin/`. This makes the executables available in the system's PATH. Requires root privileges.

```bash
{
  mv crictl kube-proxy kubelet runc \
    /usr/local/bin/
  mv containerd containerd-shim-runc-v2 containerd-stress /bin/
  mv cni-plugins/* /opt/cni/bin/
}
```

--------------------------------

### Installing CNI Network Configurations (Bash)

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/09-bootstrapping-kubernetes-workers.md

Moves the previously copied CNI configuration files (`10-bridge.conf` and `99-loopback.conf`) from the home directory to the standard CNI network configuration directory `/etc/cni/net.d/`. These files define the bridge and loopback network interfaces used by pods. Requires root privileges.

```bash
mv 10-bridge.conf 99-loopback.conf /etc/cni/net.d/
```

--------------------------------

### Verifying Remote Hostname FQDN Setting - bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/03-compute-resources.md

Reads machine details from `machines.txt` to get the IP address. It then uses `ssh -n` to execute the `hostname --fqdn` command as the `root` user on the remote machine. This verifies that the fully qualified domain name has been correctly set. Requires root SSH access.

```bash
while read IP FQDN HOST SUBNET; do
  ssh -n root@${IP} hostname --fqdn
done < machines.txt
```

--------------------------------

### Enabling Root SSH Login - bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/03-compute-resources.md

Uses `sed` to edit the `/etc/ssh/sshd_config` file in-place (`-i`). It finds lines starting with optional `#*` followed by `PermitRootLogin` and replaces the entire match with `PermitRootLogin yes`, effectively enabling root SSH access. Requires root privileges.

```bash
sed -i \
  's/^#*PermitRootLogin.*/PermitRootLogin yes/' \
  /etc/ssh/sshd_config
```

--------------------------------

### Listing Kubernetes Cluster Nodes (Bash)

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/10-configuring-kubectl.md

Executes the `kubectl get nodes` command to list the nodes registered with the Kubernetes cluster. This serves as a final verification step to ensure that `kubectl` is authenticated and authorized to access cluster resources.

```bash
kubectl get nodes
```

--------------------------------

### Verifying SSH Public Key Access - bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/03-compute-resources.md

Reads each line from `machines.txt` to get the IP address. It then uses `ssh -n` to execute the `hostname` command as the `root` user on the remote machine specified by the IP. This confirms that SSH access using the distributed key is successful.

```bash
while read IP FQDN HOST SUBNET; do
  ssh -n root@${IP} hostname
done < machines.txt
```

--------------------------------

### Verifying Worker Registration with kubectl (Bash)

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/09-bootstrapping-kubernetes-workers.md

Connects to the 'server' machine (assumed to be the controller or a machine with `kubectl` configured) via SSH and executes `kubectl get nodes`. The command uses the `admin.kubeconfig` file to authenticate and interact with the Kubernetes API server, listing the nodes that have registered with the cluster to verify the worker nodes are ready. Requires SSH access to the 'server' and the specified kubeconfig file.

```bash
ssh root@server \
  "kubectl get nodes \
  --kubeconfig admin.kubeconfig"
```

--------------------------------

### Getting Kubernetes Service Node Port with jsonpath - Bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/12-smoke-test.md

Retrieves the assigned NodePort for the 'nginx' service using `jsonpath` output. The NodePort is stored in the `NODE_PORT` environment variable, which is required to access the service externally via a worker node's IP address.

```bash
NODE_PORT=$(kubectl get svc nginx \
  --output=jsonpath='{range .spec.ports[0]}{.nodePort}')
```

--------------------------------

### Getting Kubernetes Pod Name with jsonpath - Bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/12-smoke-test.md

Retrieves the name of the first pod found with the label `app=nginx` using `jsonpath` output formatting. The pod name is stored in the `POD_NAME` environment variable for use in subsequent commands like port-forwarding, logs, and exec.

```bash
POD_NAME=$(kubectl get pods -l app=nginx \
  -o jsonpath="{.items[0].metadata.name}")
```

--------------------------------

### Getting Kubernetes Pod Node Name with jsonpath - Bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/12-smoke-test.md

Retrieves the name of the node hosting the first pod found with the label `app=nginx` using `jsonpath`. The node name is stored in the `NODE_NAME` environment variable, needed along with the NodePort to construct the external access URL.

```bash
NODE_NAME=$(kubectl get pods \
  -l app=nginx \
  -o jsonpath="{.items[0].spec.nodeName}")
```

--------------------------------

### Viewing Binary Download List - Bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/02-jumpbox.md

Displays the contents of the architecture-specific file listing the Kubernetes component binaries to be downloaded. It uses `dpkg --print-architecture` to select the correct file.

```bash
cat downloads-$(dpkg --print-architecture).txt
```

--------------------------------

### Downloading Kubernetes Binaries - Bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/02-jumpbox.md

Downloads all Kubernetes component binaries listed in the architecture-specific file into the 'downloads' directory. Uses `wget` with options for quiet progress, HTTPS-only, timestamping, output directory, and reading URLs from the specified file.

```bash
wget -q --show-progress \
  --https-only \
  --timestamping \
  -P downloads \
  -i downloads-$(dpkg --print-architecture).txt
```

--------------------------------

### Listing Downloaded Binaries - Bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/02-jumpbox.md

Lists the contents of the 'downloads' directory, showing file ownership and human-readable sizes. This command is used to verify the successful download of the binary files.

```bash
ls -oh downloads
```

--------------------------------

### Making Binaries Executable - Bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/02-jumpbox.md

Applies execute permissions to all binary files located within the client, cni-plugins, controller, and worker subdirectories inside the 'downloads' directory. This is a necessary step before attempting to run these binaries.

```bash
{
  chmod +x downloads/{client,cni-plugins,controller,worker}/*
}
```

--------------------------------

### Extracting and Organizing Binaries - Bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/02-jumpbox.md

Extracts downloaded Kubernetes component binaries from their archives and organizes them into specific subdirectories (client, cni-plugins, controller, worker) within the 'downloads' directory. It determines the correct architecture dynamically.

```bash
{
  ARCH=$(dpkg --print-architecture)
  mkdir -p downloads/{client,cni-plugins,controller,worker}
  tar -xvf downloads/crictl-v1.32.0-linux-${ARCH}.tar.gz \
    -C downloads/worker/
  tar -xvf downloads/containerd-2.1.0-beta.0-linux-${ARCH}.tar.gz \
    --strip-components 1 \
    -C downloads/worker/
  tar -xvf downloads/cni-plugins-linux-${ARCH}-v1.6.2.tgz \
    -C downloads/cni-plugins/
  tar -xvf downloads/etcd-v3.6.0-rc.3-linux-${ARCH}.tar.gz \
    -C downloads/ \
    --strip-components 1 \
    etcd-v3.6.0-rc.3-linux-${ARCH}/etcdctl \
    etcd-v3.6.0-rc.3-linux-${ARCH}/etcd
  mv downloads/{etcdctl,kubectl} downloads/client/
  mv downloads/{etcd,kube-apiserver,kube-controller-manager,kube-scheduler} \
    downloads/controller/
  mv downloads/{kubelet,kube-proxy} downloads/worker/
  mv downloads/runc.${ARCH} downloads/worker/runc
}
```

--------------------------------

### Generating Host Entries from Machine Database - bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/03-compute-resources.md

Reads each line from `machines.txt`, extracts the IP, FQDN, and HOST. It formats these into a single line (`IP FQDN HOST`) and appends this entry to the local `hosts` file. This creates a file containing DNS entries for all cluster machines.

```bash
while read IP FQDN HOST SUBNET; do
    ENTRY="${IP} ${FQDN} ${HOST}"
    echo $ENTRY >> hosts
done < machines.txt
```

--------------------------------

### Changing to Repository Directory - Bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/02-jumpbox.md

Navigates into the newly cloned 'kubernetes-the-hard-way' directory. This directory will serve as the primary working directory for executing commands in the following labs.

```bash
cd kubernetes-the-hard-way
```

--------------------------------

### Verifying Local etc Hosts File Update - bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/03-compute-resources.md

Displays the complete content of the `/etc/hosts` file on the jumpbox. This confirms that the entries from the generated `hosts` file have been successfully appended.

```bash
cat /etc/hosts
```

--------------------------------

### Copying Kubernetes Files to Server

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/08-bootstrapping-kubernetes-controllers.md

Copies Kubernetes binaries (kube-apiserver, kube-controller-manager, kube-scheduler, kubectl) and systemd unit files/configuration (kube-apiserver.service, kube-controller-manager.service, kube-scheduler.service, kube-scheduler.yaml, kube-apiserver-to-kubelet.yaml) from the jumpbox to the root directory of the server machine.

```bash
scp \
  downloads/controller/kube-apiserver \
  downloads/controller/kube-controller-manager \
  downloads/controller/kube-scheduler \
  downloads/client/kubectl \
  units/kube-apiserver.service \
  units/kube-controller-manager.service \
  units/kube-scheduler.service \
  configs/kube-scheduler.yaml \
  configs/kube-apiserver-to-kubelet.yaml \
  root@server:~/
```

--------------------------------

### Cleaning Up Download Archives - Bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/02-jumpbox.md

Removes the compressed archive files (.tar.gz and .tgz) from the 'downloads' directory. This step cleans up the working space after the binaries have been extracted.

```bash
rm -rf downloads/*gz
```

--------------------------------

### Creating Kubernetes Configuration Directory

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/08-bootstrapping-kubernetes-controllers.md

Creates the directory `/etc/kubernetes/config` where Kubernetes configuration files will be stored. The `-p` flag ensures parent directories are created if they don't exist.

```bash
mkdir -p /etc/kubernetes/config
```

--------------------------------

### Configuring etcd Directories and Copying Certificates (Bash)

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/07-bootstrapping-etcd.md

Creates the necessary directories for etcd configuration (`/etc/etcd`) and data storage (`/var/lib/etcd`), ensuring the data directory has restricted permissions (700). It then copies the required CA certificate and the Kubernetes API server key/certificate pair into the etcd configuration directory for secure communication.

```bash
{ \
  mkdir -p /etc/etcd /var/lib/etcd\
  chmod 700 /var/lib/etcd\
  cp ca.crt kube-api-server.key kube-api-server.crt \
    /etc/etcd/\
}

```

--------------------------------

### Verify OS Version using Bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/01-prerequisites.md

This snippet uses the `cat` command to display the contents of the `/etc/os-release` file on a Linux system. This is used to verify that the operating system meets the required Debian 12 (bookworm) specification for the tutorial. It assumes a standard Unix-like file system structure.

```bash
cat /etc/os-release
```

--------------------------------

### Logging into Jumpbox via SSH - Bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/02-jumpbox.md

Connects to the 'jumpbox' machine using SSH as the root user. This command is the initial step to access the administration machine designated for the tutorial.

```bash
ssh root@jumpbox
```

--------------------------------

### Copying Worker Binaries and Units via SCP (Bash)

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/09-bootstrapping-kubernetes-workers.md

Iterates through the worker hostnames (node-0, node-1) and copies essential Kubernetes and containerd binaries, configuration files, and systemd unit files from local download and config directories to the root user's home directory on each worker node using SCP. This includes executables, configuration files for containerd, kube-proxy, and CNI, and systemd service definitions.

```bash
for HOST in node-0 node-1; do
  scp \
    downloads/worker/* \
    downloads/client/kubectl \
    configs/99-loopback.conf \
    configs/containerd-config.toml \
    configs/kube-proxy-config.yaml \
    units/containerd.service \
    units/kubelet.service \
    units/kube-proxy.service \
    root@${HOST}:~/
done
```

--------------------------------

### Listing Generated Certificate Files - Bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/04-certificate-authority.md

This bash command lists all files in the current directory with `.crt` (certificate), `.key` (private key), and `.csr` (certificate signing request) extensions, providing a summary of the files generated by the previous steps for the CA and all specified Kubernetes components and users.

```bash
ls -1 *.crt *.key *.csr
```

--------------------------------

### Displaying Generated Local Hosts File - bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/03-compute-resources.md

Displays the complete content of the locally generated `hosts` file. This allows verification of the generated host entries before they are appended to the system's `/etc/hosts` files.

```bash
cat hosts
```

--------------------------------

### Configuring Kubernetes API Server Data Directory

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/08-bootstrapping-kubernetes-controllers.md

Creates the `/var/lib/kubernetes/` directory and moves necessary certificates (ca.crt, ca.key), keys (kube-api-server.key, kube-api-server.crt, service-accounts.key, service-accounts.crt), and the encryption configuration file (encryption-config.yaml) into it.

```bash
{
  mkdir -p /var/lib/kubernetes/

  mv ca.crt ca.key \
    kube-api-server.key kube-api-server.crt \
    service-accounts.key service-accounts.crt \
    encryption-config.yaml \
    /var/lib/kubernetes/
}
```

--------------------------------

### Creating Kubernetes Directories (Bash)

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/09-bootstrapping-kubernetes-workers.md

Creates the required directory structure on the worker node file system where Kubernetes components, configurations, and state will be stored. This includes directories for CNI configurations and binaries, kubelet and kube-proxy state, shared Kubernetes data, and containerd/kubernetes runtime sockets. Uses `mkdir -p` to create parent directories if necessary.

```bash
mkdir -p \
  /etc/cni/net.d \
  /opt/cni/bin \
  /var/lib/kubelet \
  /var/lib/kube-proxy \
  /var/lib/kubernetes \
  /var/run/kubernetes
```

--------------------------------

### Checking API Server Detailed Status

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/08-bootstrapping-kubernetes-controllers.md

Provides a detailed status overview for the `kube-apiserver` service using `systemctl status`, including process information, recent logs, and loaded unit file details.

```bash
systemctl status kube-apiserver
```

--------------------------------

### Adding Header to Local Hosts File - bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/03-compute-resources.md

Appends a comment line `# Kubernetes The Hard Way` to the `hosts` file. This comment helps identify the purpose of the entries that will be added subsequently.

```bash
echo "# Kubernetes The Hard Way" >> hosts
```

--------------------------------

### Viewing API Server Logs

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/08-bootstrapping-kubernetes-controllers.md

Displays the logs for the `kube-apiserver` service from the systemd journal using `journalctl -u`. Useful for troubleshooting issues.

```bash
journalctl -u kube-apiserver
```

--------------------------------

### Distributing Controller-manager, Scheduler, and Admin Kubeconfig Files to Server - Bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/05-kubernetes-configuration-files.md

This bash script distributes the generated `admin`, `kube-controller-manager`, and `kube-scheduler` kubeconfig files to the server machine. It uses `scp` to copy these three files from the current location to the home directory of the `root` user on the `server` host.

```bash
scp admin.kubeconfig \
  kube-controller-manager.kubeconfig \
  kube-scheduler.kubeconfig \
  root@server:~/
```

--------------------------------

### Viewing OpenSSL CA Configuration - Bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/04-certificate-authority.md

This command displays the contents of the `ca.conf` file, which contains the configuration details used by OpenSSL to generate certificates for different Kubernetes components and the CA itself. Reviewing this file provides insight into the certificate properties and extensions used.

```bash
cat ca.conf
```

--------------------------------

### Moving API Server Systemd Unit File

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/08-bootstrapping-kubernetes-controllers.md

Moves the downloaded `kube-apiserver.service` systemd unit file into the standard systemd system directory (`/etc/systemd/system/`), enabling systemd to manage the API server service.

```bash
mv kube-apiserver.service \
  /etc/systemd/system/kube-apiserver.service
```

--------------------------------

### Moving Scheduler Configuration File

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/08-bootstrapping-kubernetes-controllers.md

Moves the `kube-scheduler.yaml` configuration file into the `/etc/kubernetes/config/` directory.

```bash
mv kube-scheduler.yaml /etc/kubernetes/config/
```

--------------------------------

### Copying Worker Configs via SCP (Bash)

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/09-bootstrapping-kubernetes-workers.md

Iterates through the worker hostnames (node-0, node-1), generates node-specific configuration files (`10-bridge.conf`, `kubelet-config.yaml`) by replacing a subnet placeholder, and copies these files to the root user's home directory on each worker node using SCP. Requires `machines.txt` and template configuration files in the `configs` directory.

```bash
for HOST in node-0 node-1; do
  SUBNET=$(grep ${HOST} machines.txt | cut -d " " -f 4)
  sed "s|SUBNET|$SUBNET|g" \
    configs/10-bridge.conf > 10-bridge.conf

  sed "s|SUBNET|$SUBNET|g" \
    configs/kubelet-config.yaml > kubelet-config.yaml

  scp 10-bridge.conf kubelet-config.yaml \
  root@${HOST}:~/
done
```

--------------------------------

### Distributing Kubelet and Kube-proxy Kubeconfig Files to Worker Nodes - Bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/05-kubernetes-configuration-files.md

This bash script distributes the generated `kubelet` and `kube-proxy` kubeconfig files to the worker nodes (node-0 and node-1). It iterates through the hosts, creates necessary directories (`/var/lib/kube-proxy`, `/var/lib/kubelet`) via SSH, and then uses `scp` to copy the respective kubeconfig files to the designated locations on each worker.

```bash
for host in node-0 node-1; do
  ssh root@${host} "mkdir -p /var/lib/{kube-proxy,kubelet}"

  scp kube-proxy.kubeconfig \
    root@${host}:/var/lib/kube-proxy/kubeconfig \

  scp ${host}.kubeconfig \
    root@${host}:/var/lib/kubelet/kubeconfig
done
```

--------------------------------

### Distributing Certificates to Worker Nodes - SCP Bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/04-certificate-authority.md

This bash loop iterates through the `node-0` and `node-1` hosts. For each host, it creates the `/var/lib/kubelet/` directory via SSH and then securely copies the CA certificate (`ca.crt`) and the host's specific kubelet certificate and key (`<host>.crt` and `<host>.key`, renamed to `kubelet.crt` and `kubelet.key`) to that directory using SCP.

```bash
for host in node-0 node-1; do
  ssh root@${host} mkdir /var/lib/kubelet/

  scp ca.crt root@${host}:/var/lib/kubelet/

  scp ${host}.crt \
    root@${host}:/var/lib/kubelet/kubelet.crt

  scp ${host}.key \
    root@${host}:/var/lib/kubelet/kubelet.key
done
```

--------------------------------

### Moving Scheduler Kubeconfig

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/08-bootstrapping-kubernetes-controllers.md

Moves the `kube-scheduler.kubeconfig` file into `/var/lib/kubernetes/`, which is used by the Scheduler to authenticate with the API server.

```bash
mv kube-scheduler.kubeconfig /var/lib/kubernetes/
```

--------------------------------

### Moving Scheduler Systemd Unit File

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/08-bootstrapping-kubernetes-controllers.md

Moves the `kube-scheduler.service` systemd unit file into `/etc/systemd/system/`, enabling systemd management for the Scheduler service.

```bash
mv kube-scheduler.service /etc/systemd/system/
```

--------------------------------

### Logging into the Server Machine

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/08-bootstrapping-kubernetes-controllers.md

Connects to the server machine using SSH as the root user. Subsequent commands in this section are intended to be executed on this server.

```bash
ssh root@server
```

--------------------------------

### Copying CNI Plugins via SCP (Bash)

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/09-bootstrapping-kubernetes-workers.md

Iterates through the worker hostnames (node-0, node-1) and copies all CNI plugin binaries from the local `downloads/cni-plugins` directory to a newly created `~/cni-plugins` directory on each worker node using SCP. These plugins are necessary for the container network interface.

```bash
for HOST in node-0 node-1; do
  scp \
    downloads/cni-plugins/* \
    root@${HOST}:~/cni-plugins/
done
```

--------------------------------

### Verifying Cluster Info with Kubectl

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/08-bootstrapping-kubernetes-controllers.md

Uses `kubectl cluster-info` with the `admin.kubeconfig` to verify that the Kubernetes control plane is accessible and running, typically showing the address of the API server.

```bash
kubectl cluster-info \
  --kubeconfig admin.kubeconfig
```

--------------------------------

### Moving Controller Manager Kubeconfig

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/08-bootstrapping-kubernetes-controllers.md

Moves the `kube-controller-manager.kubeconfig` file into the `/var/lib/kubernetes/` directory, which is used by the Controller Manager to authenticate with the API server.

```bash
mv kube-controller-manager.kubeconfig /var/lib/kubernetes/
```

--------------------------------

### Clearing or Creating Local Hosts File - bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/03-compute-resources.md

Creates a new file named `hosts` or clears its content if it already exists. This prepares the file to receive the generated host entries for the Kubernetes cluster machines.

```bash
echo "" > hosts
```

--------------------------------

### Generating SSH Key Pair - bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/03-compute-resources.md

Initiates the process of creating a new SSH public/private key pair. The command prompts for the file location and an optional passphrase. The resulting keys (`id_rsa` and `id_rsa.pub`) are typically stored in the user's `.ssh` directory.

```bash
ssh-keygen
```

--------------------------------

### Creating Encryption Config File (Bash)

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/06-data-encryption-keys.md

Creates the encryption-config.yaml file by reading a template file (configs/encryption-config.yaml) and substituting environment variables (such as ENCRYPTION_KEY) using the envsubst command. The processed content is written to the encryption-config.yaml file in the current directory.

```bash
envsubst < configs/encryption-config.yaml \
  > encryption-config.yaml
```

--------------------------------

### Creating Kubernetes Deployment - Bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/12-smoke-test.md

Creates a Kubernetes deployment named 'nginx' using the `nginx:latest` container image. This deployment manages a set of identical pods running the nginx web server, used for testing deployment functionality and network access.

```bash
kubectl create deployment nginx \
  --image=nginx:latest
```

--------------------------------

### Generating Kubelet Kubeconfig Files - Bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/05-kubernetes-configuration-files.md

This bash script generates kubeconfig files for the kubelet on each worker node (node-0 and node-1). It iterates through the specified hosts, uses `kubectl config` to set the cluster information, configure user credentials (`system:node:<host>`) with embedded client certificates and keys, set the default context, and finally activate the default context. Requires `kubectl` and previously generated TLS certificates (ca.crt, <host>.crt, <host>.key).

```bash
for host in node-0 node-1; do
  kubectl config set-cluster kubernetes-the-hard-way \
    --certificate-authority=ca.crt \
    --embed-certs=true \
    --server=https://server.kubernetes.local:6443 \
    --kubeconfig=${host}.kubeconfig

  kubectl config set-credentials system:node:${host} \
    --client-certificate=${host}.crt \
    --client-key=${host}.key \
    --embed-certs=true \
    --kubeconfig=${host}.kubeconfig

  kubectl config set-context default \
    --cluster=kubernetes-the-hard-way \
    --user=system:node:${host} \
    --kubeconfig=${host}.kubeconfig

  kubectl config use-context default \
    --kubeconfig=${host}.kubeconfig
done
```

--------------------------------

### Checking Kubelet Service Status with systemctl (Bash)

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/09-bootstrapping-kubernetes-workers.md

Checks the active state of the `kubelet` systemd service. This command verifies whether the kubelet service is currently running successfully. The expected output for a running service is 'active'. Requires root privileges.

```bash
systemctl is-active kubelet
```

--------------------------------

### Moving Controller Manager Systemd Unit File

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/08-bootstrapping-kubernetes-controllers.md

Moves the `kube-controller-manager.service` systemd unit file into `/etc/systemd/system/`, allowing systemd to manage the Controller Manager service.

```bash
mv kube-controller-manager.service /etc/systemd/system/
```

--------------------------------

### Verifying Swap Status with swapon (Bash)

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/09-bootstrapping-kubernetes-workers.md

Executes the `swapon --show` command to list active swap partitions. This is used to verify if swap memory is enabled on the system. An empty output indicates that swap is disabled, which is the desired state for Kubernetes worker nodes.

```bash
swapon --show
```

--------------------------------

### Loading and Enabling br-netfilter Module (Bash)

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/09-bootstrapping-kubernetes-workers.md

Loads the `br-netfilter` kernel module using `modprobe`, which is essential for Kubernetes network policies (`NetworkPolicy`) and `iptables` to process network traffic across CNI bridges. Appends `br-netfilter` to `/etc/modules-load.d/modules.conf` to ensure the module is loaded automatically at boot time. Requires root privileges.

```bash
{
  modprobe br-netfilter
  echo "br-netfilter" >> /etc/modules-load.d/modules.conf
}
```

--------------------------------

### Defining Certificate List - Bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/04-certificate-authority.md

This bash snippet defines an array named `certs` containing the names of the various Kubernetes components and users for which TLS certificates will be generated. This array is iterated over in subsequent steps to automate the certificate generation process.

```bash
certs=(
  "admin" "node-0" "node-1"
  "kube-proxy" "kube-scheduler"
  "kube-controller-manager"
  "kube-api-server"
  "service-accounts"
)
```

--------------------------------

### Appending Hosts Entries to Local etc Hosts - bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/03-compute-resources.md

Appends the entire content of the generated `hosts` file to the `/etc/hosts` file on the machine where the command is executed (the jumpbox). This makes the cluster machines resolvable by hostname from the jumpbox. Requires root or appropriate permissions to modify `/etc/hosts`.

```bash
cat hosts >> /etc/hosts
```

--------------------------------

### Testing SSH Connectivity via Hostname - bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/03-compute-resources.md

Iterates through a predefined list of hostnames (`server`, `node-0`, `node-1`). For each hostname, it attempts to SSH as `root` and execute the `hostname` command. This verifies that the `/etc/hosts` entry allows resolving the hostname and that passwordless SSH via key is working using the hostname.

```bash
for host in server node-0 node-1
   do ssh root@${host} hostname
done
```

--------------------------------

### Verify Server Routing Table (Bash)

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/11-pod-network-routes.md

Executes the `ip route` command via SSH on the `server` node to display its current routing table. This command is used to verify that the routes added in the previous step for reaching the worker node Pod CIDR ranges are correctly configured.

```bash
ssh root@server ip route
```

--------------------------------

### Logging into Server for RBAC Configuration

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/08-bootstrapping-kubernetes-controllers.md

Connects to the server machine using SSH as the root user. This snippet indicates that the following RBAC commands should be run on the server.

```bash
ssh root@server
```

--------------------------------

### Copying Encryption Config to Server (Bash)

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/06-data-encryption-keys.md

Copies the generated encryption-config.yaml file from the local machine to the home directory of the root user on a specified remote server using the Secure Copy (scp) protocol. This step is necessary to make the configuration available on the Kubernetes controller instances.

```bash
scp encryption-config.yaml root@server:~/
```

--------------------------------

### Switching User to Root - bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/03-compute-resources.md

Changes the current user to the `root` user. This is necessary to perform subsequent administrative tasks like editing the SSH daemon configuration file. It requires the root password or appropriate sudo privileges.

```bash
su - root
```

--------------------------------

### Verifying Kubectl Configuration by Checking Version (Bash)

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/10-configuring-kubectl.md

Runs the `kubectl version` command to confirm that `kubectl` is correctly configured and can successfully communicate with the remote Kubernetes API server. It displays both the client and server versions.

```bash
kubectl version
```

--------------------------------

### Applying RBAC ClusterRole for Kubelet Authorization

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/08-bootstrapping-kubernetes-controllers.md

Applies the Kubernetes `ClusterRole` definition from the `kube-apiserver-to-kubelet.yaml` file using `kubectl apply`. This configures RBAC permissions allowing the API Server to access Kubelet APIs.

```bash
kubectl apply -f kube-apiserver-to-kubelet.yaml \
  --kubeconfig admin.kubeconfig
```

--------------------------------

### Generating CA Certificate and Private Key - OpenSSL Bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/04-certificate-authority.md

These OpenSSL commands generate the Certificate Authority's private key and self-signed root certificate. The `genrsa` command creates a 4096-bit RSA private key, and the `req` command generates a new X.509 certificate using the private key, signing it as a CA, with a 10-year validity, based on the settings in the `ca.conf` file.

```bash
{
  openssl genrsa -out ca.key 4096
  openssl req -x509 -new -sha512 -noenc \
    -key ca.key -days 3653 \
    -config ca.conf \
    -out ca.crt
}
```

--------------------------------

### Configuring Hostnames and etc Hosts on Remote Machines - bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/03-compute-resources.md

Reads machine details from `machines.txt`. For each machine, it executes three commands remotely via SSH: updates the `127.0.1.1` entry in `/etc/hosts` to include the FQDN and short hostname, sets the system hostname using `hostnamectl`, and restarts `systemd-hostnamed`. Requires root SSH access.

```bash
while read IP FQDN HOST SUBNET; do
    CMD="sed -i 's/^127.0.1.1.*/127.0.1.1\t${FQDN} ${HOST}/' /etc/hosts"
    ssh -n root@${IP} "$CMD"
    ssh -n root@${IP} hostnamectl set-hostname ${HOST}
    ssh -n root@${IP} systemctl restart systemd-hostnamed
done < machines.txt
```

--------------------------------

### Generating Kube-scheduler Kubeconfig File - Bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/05-kubernetes-configuration-files.md

This bash script generates the kubeconfig file for the `kube-scheduler` service. It uses `kubectl config` to set cluster information, configure credentials for the `system:kube-scheduler` user with embedded client certificates and keys, set the default context, and activate the default context. Requires `kubectl` and previously generated TLS certificates (ca.crt, kube-scheduler.crt, kube-scheduler.key).

```bash
{
  kubectl config set-cluster kubernetes-the-hard-way \
    --certificate-authority=ca.crt \
    --embed-certs=true \
    --server=https://server.kubernetes.local:6443 \
    --kubeconfig=kube-scheduler.kubeconfig

  kubectl config set-credentials system:kube-scheduler \
    --client-certificate=kube-scheduler.crt \
    --client-key=kube-scheduler.key \
    --embed-certs=true \
    --kubeconfig=kube-scheduler.kubeconfig

  kubectl config set-context default \
    --cluster=kubernetes-the-hard-way \
    --user=system:kube-scheduler \
    --kubeconfig=kube-scheduler.kubeconfig

  kubectl config use-context default \
    --kubeconfig=kube-scheduler.kubeconfig
}
```

--------------------------------

### Generating Kube-controller-manager Kubeconfig File - Bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/05-kubernetes-configuration-files.md

This bash script generates the kubeconfig file for the `kube-controller-manager` service. It uses `kubectl config` to set cluster information, configure credentials for the `system:kube-controller-manager` user with embedded client certificates and keys, set the default context, and activate the default context. Requires `kubectl` and previously generated TLS certificates (ca.crt, kube-controller-manager.crt, kube-controller-manager.key).

```bash
{
  kubectl config set-cluster kubernetes-the-hard-way \
    --certificate-authority=ca.crt \
    --embed-certs=true \
    --server=https://server.kubernetes.local:6443 \
    --kubeconfig=kube-controller-manager.kubeconfig

  kubectl config set-credentials system:kube-controller-manager \
    --client-certificate=kube-controller-manager.crt \
    --client-key=kube-controller-manager.key \
    --embed-certs=true \
    --kubeconfig=kube-controller-manager.kubeconfig

  kubectl config set-context default \
    --cluster=kubernetes-the-hard-way \
    --user=system:kube-controller-manager \
    --kubeconfig=kube-controller-manager.kubeconfig

  kubectl config use-context default \
    --kubeconfig=kube-controller-manager.kubeconfig
}
```

--------------------------------

### Distributing Certificates to Server Node - SCP Bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/04-certificate-authority.md

This SCP command securely copies the CA certificate and key (`ca.crt`, `ca.key`), the kube-api-server certificate and key (`kube-api-server.crt`, `kube-api-server.key`), and the service-accounts certificate and key (`service-accounts.crt`, `service-accounts.key`) from the jumpbox to the root user's home directory on the `server` machine.

```bash
scp \
  ca.key ca.crt \
  kube-api-server.key kube-api-server.crt \
  service-accounts.key service-accounts.crt \
  root@server:~/
```

--------------------------------

### Generating Encryption Key (Bash)

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/06-data-encryption-keys.md

Generates a 32-byte random encryption key using the /dev/urandom device, base64 encodes it, and stores the result in the ENCRYPTION_KEY environment variable. This key will be used subsequently in the encryption configuration file.

```bash
export ENCRYPTION_KEY=$(head -c 32 /dev/urandom | base64)
```

--------------------------------

### Restarting SSH Daemon - bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/03-compute-resources.md

Restarts the SSH daemon service (`sshd`) using `systemctl`. This action applies the changes made to the `/etc/ssh/sshd_config` file, such as enabling `PermitRootLogin`. Requires root privileges.

```bash
systemctl restart sshd
```

--------------------------------

### Verifying API Server Access via Curl

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/08-bootstrapping-kubernetes-controllers.md

Makes an HTTPS request to the Kubernetes API Server's version endpoint (`/version`) using `curl` from the jumpbox. It uses the CA certificate (`ca.crt`) for secure communication and hostname verification.

```bash
curl --cacert ca.crt \
  https://server.kubernetes.local:6443/version
```

--------------------------------

### Verify Node-0 Routing Table (Bash)

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/11-pod-network-routes.md

Executes the `ip route` command via SSH on `node-0` to display its current routing table. This command helps confirm that the route to `NODE_1_SUBNET` via `NODE_1_IP` was successfully added, which is essential for inter-node pod communication.

```bash
ssh root@node-0 ip route
```

--------------------------------

### Configuring Kubeconfig for Admin User (Bash)

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/10-configuring-kubectl.md

Executes a series of `kubectl config` commands to create and configure a kubeconfig file for the `admin` user. It sets the cluster details, the user's credentials using client certificates and keys, defines a context linking the cluster and user, and finally selects that context for use.

```bash
{
  kubectl config set-cluster kubernetes-the-hard-way \
    --certificate-authority=ca.crt \
    --embed-certs=true \
    --server=https://server.kubernetes.local:6443

  kubectl config set-credentials admin \
    --client-certificate=admin.crt \
    --client-key=admin.key

  kubectl config set-context kubernetes-the-hard-way \
    --cluster=kubernetes-the-hard-way \
    --user=admin

  kubectl config use-context kubernetes-the-hard-way
}
```

--------------------------------

### Generating Kube-proxy Kubeconfig File - Bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/05-kubernetes-configuration-files.md

This bash script generates the kubeconfig file for the `kube-proxy` service. It uses `kubectl config` to set cluster information, configure credentials for the `system:kube-proxy` user with embedded client certificates and keys, set the default context, and activate the default context. Requires `kubectl` and previously generated TLS certificates (ca.crt, kube-proxy.crt, kube-proxy.key).

```bash
{
  kubectl config set-cluster kubernetes-the-hard-way \
    --certificate-authority=ca.crt \
    --embed-certs=true \
    --server=https://server.kubernetes.local:6443 \
    --kubeconfig=kube-proxy.kubeconfig

  kubectl config set-credentials system:kube-proxy \
    --client-certificate=kube-proxy.crt \
    --client-key=kube-proxy.key \
    --embed-certs=true \
    --kubeconfig=kube-proxy.kubeconfig

  kubectl config set-context default \
    --cluster=kubernetes-the-hard-way \
    --user=system:kube-proxy \
    --kubeconfig=kube-proxy.kubeconfig

  kubectl config use-context default \
    --kubeconfig=kube-proxy.kubeconfig
}
```

--------------------------------

### Generating Client/Server Certificates - OpenSSL Bash

Source: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/04-certificate-authority.md

This bash loop iterates through the list of defined certificate names. For each name, it generates a 4096-bit RSA private key, creates a certificate signing request (CSR) using the key and the specified section from `ca.conf`, and then signs the CSR with the CA's private key and certificate to produce the final TLS certificate. Certificates are valid for 10 years.

```bash
for i in ${certs[*]}; do
  openssl genrsa -out "${i}.key" 4096

  openssl req -new -key "${i}.key" -sha256 \
    -config "ca.conf" -section ${i} \
    -out "${i}.csr"

  openssl x509 -req -days 3653 -in "${i}.csr" \
    -copy_extensions copyall \
    -sha256 -CA "ca.crt" \
    -CAkey "ca.key" \
    -CAcreateserial \
    -out "${i}.crt"
done
```