Install and maintain Kubernetes on Ubuntu

The AppStore Kubernetes option installs MicroK8s from latest/stable with DNS, RBAC, hostpath storage, metrics, ingress, dashboard, and cert-manager.

Before you start

• Use a clean, supported Ubuntu server with root or sudo access.
• Point app.example.com to the server before requesting a public TLS certificate.
• Replace every value written as CHANGE_ME and store the generated credentials in a password manager.
• Take a snapshot before changing an existing installation.
• A Linux user who will receive membership in the microk8s group and a mode-0600 kubeconfig.
• A dashboard hostname pointing to the server and an email address for cert-manager.

What the AppStore installation creates

• MicroK8s snap on channel latest/stable
• Add-ons: RBAC, DNS, hostpath-storage, metrics-server, ingress, dashboard, cert-manager
• Let’s Encrypt ClusterIssuer and TLS dashboard Ingress
• Admin kubeconfig and a separate high-privilege dashboard token

1. Install MicroK8s

sudo apt update
sudo apt install -y snapd
sudo snap install microk8s --classic --channel=latest/stable
sudo microk8s status --wait-ready
sudo usermod -aG microk8s ADMIN_USER
sudo install -d -o ADMIN_USER -g ADMIN_USER -m 0750 /home/ADMIN_USER/.kube
sudo microk8s config | sudo tee /home/ADMIN_USER/.kube/config >/dev/null
sudo chown ADMIN_USER:ADMIN_USER /home/ADMIN_USER/.kube/config
sudo chmod 0600 /home/ADMIN_USER/.kube/config

2. Enable the playbook add-ons

sudo microk8s enable rbac dns hostpath-storage metrics-server ingress dashboard cert-manager
sudo microk8s kubectl get pods -A
sudo microk8s kubectl -n ingress rollout status ds/nginx-ingress-microk8s-controller --timeout=300s

3. Create the certificate issuer and dashboard Ingress

Create a production ACME ClusterIssuer using admin@example.com, then create a TLS Ingress in kubernetes-dashboard for k8s.example.com with ingress class public and HTTPS backend protocol.

sudo nano /tmp/clusterissuer-letsencrypt.yaml
sudo microk8s kubectl apply -f /tmp/clusterissuer-letsencrypt.yaml
sudo nano /tmp/k8s-dashboard-ingress.yaml
sudo microk8s kubectl apply -f /tmp/k8s-dashboard-ingress.yaml
sudo microk8s kubectl -n kubernetes-dashboard get ingress,certificate,secret

4. Create dashboard access only if required

Prefer kubeconfig/OIDC access. If you reproduce the playbook’s cluster-admin service account, protect and rotate the resulting token as a root credential.

sudo microk8s kubectl apply -f /root/k8s-dashboard-admin.yaml
sudo microk8s kubectl -n kubernetes-dashboard create token admin-user --duration=1h

Important files and data

• MicroK8s data: /var/snap/microk8s/common
• Administrator kubeconfig: /home/ADMIN_USER/.kube/config
• Cluster resources: query with microk8s kubectl
• HostPath persistent volumes: inspect the storage-class and PV definitions before backup

Health checks and logs

Run these checks after installation and after each upgrade:

sudo microk8s status
sudo microk8s kubectl get nodes -o wide
sudo microk8s kubectl get pods -A
sudo microk8s kubectl get certificate,challenge,order -A

Routine maintenance

Review release notes and take a backup or snapshot before upgrading. Use the following playbook-aligned commands as the starting point:

sudo snap list microk8s
sudo microk8s inspect
# Test workload and datastore backups before changing snap channels.
sudo snap refresh microk8s --channel=latest/stable
sudo microk8s status --wait-ready

Backup scope

• MicroK8s datastore using microk8s dbctl backup where supported by the installed release
• All persistent-volume data and application-level database dumps
• Cluster manifests, secrets through an encrypted secret-management process, and kubeconfig recovery material

A usable backup needs both application files and application data. Test restoration on a separate server; an untested backup is not a recovery plan.

Troubleshooting

• Confirm DNS with dig +short app.example.com before retrying Certbot.
• Test the web-server configuration before reloading it: sudo nginx -t or sudo apache2ctl configtest.
• Check free space with df -h and listening ports with sudo ss -ltnup.
• If a service fails, inspect its systemd journal before changing configuration.
• Group membership applies at the next login; run newgrp microk8s or start a fresh session.
• If the certificate is pending, inspect cert-manager Challenge and Order objects plus public DNS/ports.
• The playbook disables UFW to avoid cluster networking conflicts; if you enable a host firewall, implement and test a MicroK8s-specific policy first.

Security notes

• Do not paste passwords, API keys, repository credentials, private keys, or access tokens into tickets or public logs.
• Expose only the documented public ports. Keep database and application backend ports bound to localhost or a private network.
• Keep SSH access working before enabling UFW, then allow only the ports this guide lists.
• Renewal can be tested safely with sudo certbot renew --dry-run where Certbot manages TLS.