Kubernetes cluster with RKE2

Developed in collaboration with eOracle, this guide will walk you through the process of setting up a K8s cluster on bare metal using RKE2. RKE2 (Rancher Kubernetes Engine 2) is a lightweight, secure, and production-ready Kubernetes distribution designed to simplify cluster deployment and management. Let’s dive in!

Prerequisites

Latitude.sh servers (at least 3 control-plane nodes and 2 worker nodes).
kubectl installed on your local machine.
A DNS A-record pointing to the control-plane nodes.
Properly configured IP addresses for all nodes.
SSH access to all nodes with root privileges.
A server token and agent token to securely join nodes to the cluster.
Cilium as the CNI plugin

Step 1: Prepare DNS and generate tokens

Set up DNS record

Set up a DNS A-record that points to the external IP addresses of all control-plane nodes. This record will serve as the Kubernetes API endpoint and the RKE2 registration address.

Generate tokens

Run the following command twice to create a server-token (for control-plane nodes) and an agent-token (for worker nodes):

openssl rand -hex 32

Save both tokens for use during the cluster setup.

Step 2: Configure RKE2 on the first control-plane node

On the first server, create the RKE2 configuration file at /etc/rancher/rke2/config.yaml with the following content:

token: <server-token>
agent-token: <agent-token>
tls-san:
  - rke2.ext.example.com
  - <control_plane_ip>
node-name: control-plane-01
advertise-address: <control_plane_ip>
node-ip: <node_internal_ip>
node-external-ip: <node_external_ip>
disable:
  - rke2-ingress-nginx
cni: "cilium"
disable-kube-proxy: true

Replace <server-token> and <agent-token> with the generated tokens.

Step 3: Install RKE2

Set RKE2 version

Set the desired RKE2 version as an environment variable:

export RKE2_VERSION=v1.31.1+rke2r1

Install RKE2 server

Run the following command to install the RKE2 distribution on the first control-plane node:

curl -sfL https://get.rke2.io | INSTALL_RKE2_VERSION=${RKE2_VERSION} INSTALL_RKE2_TYPE=server INSTALL_RKE2_CHANNEL=stable INSTALL_RKE2_METHOD=tar sh -

Start RKE2 service

Enable RKE2 to start on boot, start the service, and observe the service logs:

systemctl enable rke2-server.service && systemctl restart rke2-server.service & journalctl -u rke2-server -f

Step 4: Configure additional control-plane nodes

Get tokens from first node

After deploying the first control-plane node, use the tokens located at /var/lib/rancher/rke2/server as the server token and /var/lib/rancher/rke2/server/agent-token as the agent token.

The server option applies to all nodes except the first.

Configure additional control-plane nodes

Create the configuration file /etc/rancher/rke2/config.yaml on each additional control-plane node.Example for control-plane-02:

server: https://rke2.ext.example.com:9345
token: <server-token>
agent-token: <agent-token>
tls-san:
  - rke2.ext.example.com
  - <control_plane_ip>
node-name: control-plane-02
advertise-address: <control_plane_ip>
node-ip: <node_internal_ip>
node-external-ip: <node_external_ip>
disable:
  - rke2-ingress-nginx
cni: "cilium"
disable-kube-proxy: true

Example for control-plane-03:

server: https://rke2.ext.example.com:9345
token: <server-token>
agent-token: <agent-token>
tls-san:
  - rke2.ext.example.com
  - <control_plane_ip>
node-name: control-plane-03
advertise-address: <control_plane_ip>
node-ip: <node_internal_ip>
node-external-ip: <node_external_ip>
disable:
  - rke2-ingress-nginx
cni: "cilium"
disable-kube-proxy: true

Repeat this process for all control-plane nodes, updating the node-name and IP addresses accordingly.

Configure worker nodes

Install agent nodes and create the following configuration file at /etc/rancher/rke2/config.yaml:

server: https://rke2.ext.example.com:9345
token: <agent-token>
node-name: worker-node-01
node-ip: <worker_node_internal_ip>
node-external-ip: <worker_node_external_ip>
node-label:
  - "node.kubernetes.io/role=worker"

Install RKE2 agent

Run export RKE2_VERSION=v1.31.1+rke2r1Install the RKE2 distribution:

curl -sfL https://get.rke2.io | INSTALL_RKE2_VERSION=${RKE2_VERSION} INSTALL_RKE2_TYPE=agent INSTALL_RKE2_CHANNEL=stable INSTALL_RKE2_METHOD=tar sh -

Enable RKE2 to start on boot, start the service, and observe the service logs:

systemctl enable rke2-agent.service && systemctl restart rke2-agent.service & journalctl -u rke2-agent -f

Step 5: Acquire the kubeconfig file

Locate kubeconfig

Locate the kubeconfig file on any control-plane node at /etc/rancher/rke2/rke2.yaml.The file should look similar to this:

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: <CERTIFICATE_DATA>
    server: https://127.0.0.1:6443
  name: default
contexts:
- context:
    cluster: default
    user: default
  name: default
current-context: default
kind: Config
preferences: {}
users:
- name: default
  user:
    client-certificate-data: <CLIENT_CERTIFICATE_DATA>
    client-key-data: <CLIENT_KEY_DATA>

Update server address

Replace the server value with the external registration address:server: https://rke2.ext.example.com:6443

Copy to local machine

Copy the file to your local machine and save it as ~/.kube/config or another location (e.g., ~/.kube/test).Use the following command to check the cluster nodes:

kubectl get nodes --kubeconfig ~/.kube/test

Step 6: Configure Cilium for kube-proxy replacement

Create Cilium configuration

Create a file named rke2-cilium-values.yamlwith this content:

apiVersion: helm.cattle.io/v1
kind: HelmChartConfig
metadata:
  name: rke2-cilium
  namespace: kube-system
spec:
  valuesContent: |-
    k8sServiceHost: "rke2.ext.example.com"
    k8sServicePort: "6443"
    kubeProxyReplacement: "true"

You must specify KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT in the configuration to enable kube-proxy replacement mode. See the HelmChartConfig for more information.

Apply configuration

Run this command to apply the configuration:

kubectl apply -f ./rke2-cilium-values.yaml --kubeconfig ~/.kube/test

Check if the configuration is applied:

helmchartconfig.helm.cattle.io/rke2-cilium created

Cilium is now configured to replace kube-proxy.

Step 7: Check cluster status

Check pod status

Run the following to check the status of all pods in all namespaces:

kubectl get pods -A --kubeconfig ~/.kube/test

Ensure all pods are in the Running state.

Check node status

Check the status of all nodes:

kubectl get nodes --kubeconfig ~/.kube/test

Nodes should show Ready in the Status column.

Troubleshooting

Add these aliases to perform troubleshooting on control-plane nodes:

alias kubectl='/var/lib/rancher/rke2/bin/kubectl --kubeconfig /etc/rancher/rke2/rke2.yaml'
kubectl get nodes

alias crictl='/var/lib/rancher/rke2/bin/crictl'
export CONTAINER_RUNTIME_ENDPOINT="unix:///run/k3s/containerd/containerd.sock"
crictl ps

That’s it!

Your cluster is now set up and ready to handle workloads on bare metal. Check out our guide on Kubernetes load balancing to optimize traffic management across your nodes.

Guides

General guides

Kubernetes on Metal

Terraform

Prerequisites

Step 1: Prepare DNS and generate tokens

Step 2: Configure RKE2 on the first control-plane node

Step 3: Install RKE2

Step 4: Configure additional control-plane nodes

Step 5: Acquire the kubeconfig file

Step 6: Configure Cilium for kube-proxy replacement

Step 7: Check cluster status

Troubleshooting

That’s it!

​Prerequisites

​Step 1: Prepare DNS and generate tokens

​Step 2: Configure RKE2 on the first control-plane node

​Step 3: Install RKE2

​Step 4: Configure additional control-plane nodes

​Step 5: Acquire the kubeconfig file

​Step 6: Configure Cilium for kube-proxy replacement

​Step 7: Check cluster status

​Troubleshooting

​That’s it!

Prerequisites

Step 1: Prepare DNS and generate tokens

Step 2: Configure RKE2 on the first control-plane node

Step 3: Install RKE2

Step 4: Configure additional control-plane nodes

Step 5: Acquire the kubeconfig file

Step 6: Configure Cilium for kube-proxy replacement

Step 7: Check cluster status

Troubleshooting

That’s it!