RKE2 Deep Dive
Guide

RKE2 provides an installer script that sets up the binary and systemd service:

# Download and run the official installer
curl -sfL https://get.rke2.io | sudo sh -

# What just happened?
# 1. Downloaded the rke2 binary to /usr/local/bin/rke2
# 2. Created a systemd service: rke2-server.service
# 3. Created config directory: /etc/rancher/rke2/

# Create the config directory
sudo mkdir -p /etc/rancher/rke2

# Create config file
sudo tee /etc/rancher/rke2/config.yaml <<EOF
# Specify a custom node name
node-name: my-first-server

# Enable CIS hardening profile
profile: cis

# Use Canal CNI (default, but being explicit)
cni: canal

# Write kubeconfig with this permission
write-kubeconfig-mode: "0644"

# TLS Subject Alternative Names
tls-san:
  - my-server.example.com
  - 10.0.0.100
EOF

# Enable the service so it starts on boot
sudo systemctl enable rke2-server.service

# Start RKE2 (this takes 2-5 minutes on first run)
sudo systemctl start rke2-server.service

# Watch the startup logs in real-time
sudo journalctl -u rke2-server -f

# Add RKE2 binaries to PATH
echo 'export PATH=$PATH:/var/lib/rancher/rke2/bin' >> ~/.bashrc

# Point kubectl to the RKE2 kubeconfig
echo 'export KUBECONFIG=/etc/rancher/rke2/rke2.yaml' >> ~/.bashrc

# Apply changes immediately
source ~/.bashrc

# Verify kubectl works
kubectl version --short

# Check node status (should show "Ready")
kubectl get nodes
NAME              STATUS   ROLES                       AGE   VERSION
my-first-server   Ready    control-plane,etcd,master   3m    v1.30.x+rke2r1

# Check all system pods are running
kubectl get pods -A
NAMESPACE     NAME                                          READY   STATUS
kube-system   etcd-my-first-server                           1/1     Running
kube-system   kube-apiserver-my-first-server                 1/1     Running
kube-system   kube-controller-manager-my-first-server        1/1     Running
kube-system   kube-scheduler-my-first-server                 1/1     Running
kube-system   rke2-canal-xxxxx                               2/2     Running
kube-system   rke2-coredns-rke2-coredns-xxxxx                1/1     Running
kube-system   rke2-ingress-nginx-controller-xxxxx            1/1     Running
kube-system   rke2-metrics-server-xxxxx                      1/1     Running

# Save the node token (needed for adding more nodes later)
sudo cat /var/lib/rancher/rke2/server/node-token
K10abc123def456...::server:xyz789...

# Install RKE2 in AGENT mode (not server)
curl -sfL https://get.rke2.io | INSTALL_RKE2_TYPE="agent" sudo sh -

sudo mkdir -p /etc/rancher/rke2

sudo tee /etc/rancher/rke2/config.yaml <<EOF
# Point to the server's supervisor port
server: https://10.0.0.100:9345

# Paste the token from the server node
token: K10abc123def456...::server:xyz789...

# Give this worker a friendly name
node-name: worker-01
EOF

sudo systemctl enable --now rke2-agent.service

# Back on the server node:
kubectl get nodes
NAME              STATUS   ROLES                       AGE   VERSION
my-first-server   Ready    control-plane,etcd,master   30m   v1.30.x+rke2r1
worker-01         Ready    <none>                      2m    v1.30.x+rke2r1

# Label the worker for organization
kubectl label node worker-01 node-role.kubernetes.io/worker=worker

curl -sfL https://get.rke2.io | sudo sh -

sudo mkdir -p /etc/rancher/rke2
sudo tee /etc/rancher/rke2/config.yaml <<EOF
token: my-shared-secret-token-12345
tls-san:
  - rke2.example.com
  - 10.0.0.100
  - 10.0.0.101
  - 10.0.0.102
EOF

sudo systemctl enable --now rke2-server.service
# Wait until fully ready before starting server 2!

curl -sfL https://get.rke2.io | sudo sh -

sudo mkdir -p /etc/rancher/rke2
sudo tee /etc/rancher/rke2/config.yaml <<EOF
server: https://10.0.0.100:9345
token: my-shared-secret-token-12345
tls-san:
  - rke2.example.com
  - 10.0.0.100
  - 10.0.0.101
  - 10.0.0.102
EOF

sudo systemctl enable --now rke2-server.service

# /etc/nginx/nginx.conf (on a separate LB machine)
stream {
    upstream rke2_api {
        least_conn;
        server 10.0.0.100:6443 max_fails=3 fail_timeout=5s;
        server 10.0.0.101:6443 max_fails=3 fail_timeout=5s;
        server 10.0.0.102:6443 max_fails=3 fail_timeout=5s;
    }
    upstream rke2_supervisor {
        least_conn;
        server 10.0.0.100:9345 max_fails=3 fail_timeout=5s;
        server 10.0.0.101:9345 max_fails=3 fail_timeout=5s;
        server 10.0.0.102:9345 max_fails=3 fail_timeout=5s;
    }
    server { listen 6443; proxy_pass rke2_api; }
    server { listen 9345; proxy_pass rke2_supervisor; }
}

cat <<EOF | kubectl apply -f -
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-web-app
spec:
  replicas: 3
  selector:
    matchLabels:
      app: my-web-app
  template:
    metadata:
      labels:
        app: my-web-app
    spec:
      containers:
      - name: nginx
        image: nginx:1.25-alpine
        ports:
        - containerPort: 80
        resources:
          requests: { cpu: 100m, memory: 64Mi }
          limits:   { cpu: 200m, memory: 128Mi }
EOF

kubectl get deploy my-web-app
NAME         READY   UP-TO-DATE   AVAILABLE
my-web-app   3/3     3            3

cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Service
metadata:
  name: my-web-app-svc
spec:
  selector:
    app: my-web-app
  ports:
  - port: 80
    targetPort: 80
  type: ClusterIP
EOF

cat <<EOF | kubectl apply -f -
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-web-app-ingress
spec:
  ingressClassName: nginx
  rules:
  - host: myapp.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: my-web-app-svc
            port:
              number: 80
EOF

# Internal test
kubectl run curl-test --image=curlimages/curl --rm -it -- \
  curl http://my-web-app-svc.default.svc.cluster.local

# External test
curl http://myapp.example.com

# Scale up!
kubectl scale deployment my-web-app --replicas=5