3.1 K3s¶

K3s is a CNCF-certified Kubernetes distribution packaged as one ~70 MB binary. It strips in-tree cloud providers and alpha features and swaps etcd for Kine (SQLite by default; etcd, MySQL, Postgres optional).

What it bundles out of the box:

• containerd
• Flannel (VXLAN) CNI
• CoreDNS
• Traefik ingress
• ServiceLB (formerly Klipper LB)
• Local-path provisioner
• Helm controller (HelmChart CRD)
• Embedded etcd option for HA

# Single server
curl -sfL https://get.k3s.io | sh -

# HA with embedded etcd — first server
curl -sfL https://get.k3s.io | K3S_TOKEN=supersecret sh -s - server --cluster-init

# Additional servers
curl -sfL https://get.k3s.io | K3S_TOKEN=supersecret sh -s - server \
  --server https://10.0.0.11:6443

# Agents
curl -sfL https://get.k3s.io | K3S_URL=https://10.0.0.11:6443 K3S_TOKEN=supersecret sh -

Config lives in /etc/rancher/k3s/config.yaml; any CLI flag can be expressed there:

write-kubeconfig-mode: "0644"
tls-san:
  - k3s.lab.example.net
disable:
  - traefik
flannel-backend: none          # if bringing your own CNI (e.g. Cilium)
disable-network-policy: true

3.2 RKE2¶

RKE2 ("RKE Government") combines K3s's operational model (single binary, systemd unit, config file, embedded Helm controller) with upstream-faithful components and a security-first posture:

• Passes the CIS Kubernetes Benchmark with minimal operator intervention (profile: cis).
• FIPS 140-2/140-3 capable builds.
• Control plane runs as static pods managed by the kubelet (not embedded goroutines like K3s).
• etcd always (no Kine).
• CNI choices: Canal (default), Calico, Cilium, Multus (meta-plugin).
• Ingress: ingress-nginx historically; newer releases add Traefik as an option as ingress-nginx sunsets upstream — check your release notes.

curl -sfL https://get.rke2.io | sh -
systemctl enable --now rke2-server.service
export KUBECONFIG=/etc/rancher/rke2/rke2.yaml
export PATH=$PATH:/var/lib/rancher/rke2/bin

# /etc/rancher/rke2/config.yaml
token: supersecret
tls-san:
  - rke2.example.net
cni: cilium
profile: cis
write-kubeconfig-mode: "0600"
node-taint:
  - "CriticalAddonsOnly=true:NoExecute"   # dedicated control-plane nodes

Customize packaged components with HelmChartConfig:

apiVersion: helm.cattle.io/v1
kind: HelmChartConfig
metadata:
  name: rke2-cilium
  namespace: kube-system
spec:
  valuesContent: |-
    kubeProxyReplacement: true
    k8sServiceHost: 127.0.0.1
    k8sServicePort: 6443
    hubble:
      enabled: true
      relay:
        enabled: true

3.3 Choosing between them¶

Rule of thumb: K3s for constrained environments and labs, RKE2 for anything audited or long-lived. Both are first-class guest-cluster options on Harvester.

3.4 Operational details worth knowing¶

• etcd snapshots: RKE2/K3s take scheduled snapshots automatically (etcd-snapshot-schedule-cron, etcd-snapshot-retention) and can push them to S3 (etcd-s3: true, plus bucket/endpoint flags). rke2 etcd-snapshot save|list|prune.
• Cluster reset/restore: rke2 server --cluster-reset --cluster-reset-restore-path=<snapshot>.
• Token rotation: rke2 token rotate.
• Certificate rotation: certs auto-renew on restart within 90 days of expiry; force with rke2 certificate rotate.
• Containerd mirrors: /etc/rancher/rke2/registries.yaml for private registries and pull-through caches.
• Embedded registry mirror (Spegel): peer-to-peer image distribution between nodes — very useful in air-gapped or bandwidth-constrained sites.
• Security Responder add-on in recent RKE2 releases phones home version metadata to tell you about newer releases with CVE fixes; it can be disabled or run in reduced-telemetry mode.

← Ecosystem map · Index · Rancher Manager →