How to fix error execution phase preflight in Kubernetes

KubernetesINTERMEDIATEHIGHUpdated Dec 5, 2025· 267 views

kubeadm init fails during the preflight validation phase when system prerequisites are not met. This safety check validates container runtime, port availability, swap status, and cgroup configuration before cluster initialization.

Quick fix

Fixes error execution phase preflight

[ERROR Port-10250]: Port 10250 is in use
[ERROR DirAvailable--etc-kubernetes-manifests]: /etc/kubernetes/manifests is not empty
[ERROR CRI]: container runtime is not running
[ERROR Swap]: running with swap on is not supported
[ERROR SystemVerification]: missing required cgroups: cpuset
  1. Read the full preflight error message carefully
  2. Clean up from previous installations with kubeadm reset
  3. Disable swap and make it permanent
  4. Verify and configure the container runtime
kubernetes — error
[ERROR Port-10250]: Port 10250 is in use
[ERROR DirAvailable--etc-kubernetes-manifests]: /etc/kubernetes/manifests is not empty
[ERROR CRI]: container runtime is not running
[ERROR Swap]: running with swap on is not supported
[ERROR SystemVerification]: missing required cgroups: cpuset
error execution phase preflight

What this error means

The preflight phase is kubeadm's safety gate that runs before cluster initialization. It validates system prerequisites including container runtime availability, port availability, swap status, cgroup configuration, and kernel module loading. The 'error execution phase preflight' error indicates at least one mandatory check failed. Each check ensures the system is in a valid state to run Kubernetes control plane and worker components. If any critical check fails (like swap being enabled or required ports being in use), kubeadm halts initialization to prevent a broken cluster state. When you see 'error execution phase preflight', the error message always includes the specific check that failed—this could be related to container runtime, port conflicts, leftover files, swap, cgroups, or kernel modules.

Typical symptoms

  • kubeadm init command exits immediately with "error execution phase preflight" message
  • Specific error details appear after the phase name (e.g., "[ERROR Port-10250]: Port 10250 is in use")
  • Docker or container runtime fails to initialize if CRI check fails
  • Previous Kubernetes configuration files remain in /etc/kubernetes/ from failed attempts
  • Unable to join worker nodes because preflight checks fail on node prerequisites
  • Firewall or port mapping prevents kubeadm from validating port availability

Common causes

  1. Port conflicts from previous installations - ports 10250, 6443, 10259, 10257, 2379-2380 are still in use
  2. Leftover Kubernetes configuration files and directories from a previous installation attempt
  3. Swap is enabled on the system - Kubernetes requires swap to be disabled
  4. Container runtime not installed or not running - Docker, containerd, or cri-o is unavailable
  5. Cgroup driver mismatch between container runtime and kubelet
  6. Missing required cgroup subsystems or kernel modules like bridge-nf-call-iptables
  7. Insufficient privileges or running as non-root user

How to fix "error execution phase preflight"

1Read the full preflight error message carefully

The error output always specifies which check failed. Look for the [ERROR ...] line:

Common patterns:

bash
[ERROR Port-10250]: Port 10250 is in use
[ERROR DirAvailable--etc-kubernetes-manifests]: /etc/kubernetes/manifests is not empty
[ERROR CRI]: container runtime is not running
[ERROR Swap]: running with swap on is not supported
[ERROR SystemVerification]: missing required cgroups: cpuset

This tells you exactly which fix to apply first.

2Clean up from previous installations with kubeadm reset

If you've run kubeadm init before and it failed, reset the state:

bash
sudo kubeadm reset --force

For a complete cleanup, also remove kubelet configuration:

bash
sudo rm -rf /var/lib/kubelet/* /var/lib/etcd/*
sudo systemctl restart kubelet

If you want to remove all Kubernetes packages entirely:

bash
sudo apt-get purge kubeadm kubectl kubelet kubernetes-cni kube*
sudo apt-get autoremove
sudo rm -rf ~/.kube
3Disable swap and make it permanent

Disable swap immediately:

bash
sudo swapoff -a

Make the change permanent by editing /etc/fstab:

bash
sudo nano /etc/fstab

Find lines containing "swap" and add # to comment them out:

bash
# /dev/mapper/ubuntu--vg-swap_1 none swap sw 0 0

Verify swap is disabled:

bash
free -h
4Verify and configure the container runtime

Ensure your container runtime is installed and running:

bash
# For containerd
sudo systemctl start containerd
sudo systemctl enable containerd
sudo systemctl status containerd

# For Docker
sudo systemctl start docker
sudo systemctl enable docker
sudo systemctl status docker

If using Docker with Kubernetes 1.24+, you must install the cri-dockerd adapter since dockershim was removed.

5Fix cgroup driver mismatch

Check your Docker cgroup driver:

bash
docker info | grep -i cgroup

kubeadm defaults to 'systemd' for v1.22+, so change Docker to match. Create or edit /etc/docker/daemon.json:

json
{
  "exec-opts": ["native.cgroupdriver=systemd"]
}

Restart Docker:

bash
sudo systemctl daemon-reload
sudo systemctl restart docker
sudo systemctl restart kubelet

For containerd, edit /etc/containerd/config.toml and set SystemdCgroup = true.

6Enable kernel modules and configure network bridge settings

Load required kernel modules:

bash
sudo modprobe br_netfilter
sudo modprobe overlay

Enable IP forwarding and bridge iptables filtering:

bash
sudo sysctl -w net.ipv4.ip_forward=1
sudo sysctl -w net.bridge.bridge-nf-call-iptables=1
sudo sysctl -w net.bridge.bridge-nf-call-ip6tables=1

Make these settings permanent in /etc/sysctl.d/k8s.conf:

bash
net.ipv4.ip_forward = 1
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1

Apply with:

bash
sudo sysctl --system

Then retry kubeadm init:

bash
sudo kubeadm init --pod-network-cidr=10.244.0.0/16

Advanced notes

While you can use --ignore-preflight-errors to skip specific checks (e.g., --ignore-preflight-errors='Swap,IsPrivilegedUser'), this should only be done if you fully understand the consequences.

On systems with cgroup v2 (newer Linux distributions like Ubuntu 22.04+, Fedora 33+), the cgroup structure is flatter and some checks behave differently. cgroup v2 supports swap with proper kubelet configuration, but v1 does not. Check your cgroup version with: stat -fc %T /sys/fs/cgroup/ (returns 'cgroup2fs' for v2).

When joining worker nodes with kubeadm join, similar preflight checks run. Node-join errors often relate to kubelet configuration, container runtime socket paths, or network connectivity to the control plane.

The preflight checks validate port availability for: API server (6443), kubelet (10250 on all nodes), and etcd (2379-2380 on control plane). Firewall rules may block kubeadm from detecting port usage.

For production setups, use kubeadm config files (kubeadm init --config=kubeadm-config.yaml) to specify container runtime, cgroup driver, and other parameters explicitly.

Frequently asked questions

What does "error execution phase preflight" mean?
The preflight phase is kubeadm's safety gate that runs before cluster initialization. It validates system prerequisites including container runtime availability, port availability, swap status, cgroup configuration, and kernel module loading. The 'error execution phase preflight' error indicates at least one mandatory check failed.
How do I fix "error execution phase preflight"?
kubeadm init fails during the preflight validation phase when system prerequisites are not met. This safety check validates container runtime, port availability, swap status, and cgroup configuration before cluster initialization.
What causes "error execution phase preflight"?
Port conflicts from previous installations - ports 10250, 6443, 10259, 10257, 2379-2380 are still in use Leftover Kubernetes configuration files and directories from a previous installation attempt Swap is enabled on the system - Kubernetes requires swap to be disabled
Is the "error execution phase preflight" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading