Rancher + RKE2 provisioning · Prasanta Kumar Behera

The SUSE/Rancher route to edge Kubernetes: RKE2's hardened-by-default distribution and configuration, joining servers and agents, air-gapped installs, managing many clusters with Rancher, and OS lifecycle with Elemental on SUSE Linux Micro.

RKE2 in a nutshell

RKE2 (also called "RKE Government") is SUSE Rancher's Kubernetes distribution focused on security and compliance:

Single binary per node with a supervisor that runs containerd, kubelet and the control plane as static pods.
Hardened defaults, and a CIS profile for benchmark-aligned settings.
Embedded etcd with automatic snapshots.
Straightforward air-gapped installs from tarballs.

(Its lightweight sibling K3s is popular for very small edge devices.)

RKE2 is a pre-assembled, locked safe version of Kubernetes: the doors are already bolted, the alarms are set (CIS profile). Rancher is the control tower that can see and manage all the safes in all the cities. Elemental goes one level lower and looks after the floors the safes stand on (the operating system).

A three-server site

# /etc/rancher/rke2/config.yaml on the FIRST server
token: "<long-random-shared-secret>"
tls-san:
  - "10.42.0.10"                 # the API VIP
  - "site042-api.example.internal"
profile: cis                     # older releases used versioned names (e.g. cis-1.23)
write-kubeconfig-mode: "0600"

# on servers 2 and 3 (and agents, with rke2-agent)
server: https://10.42.0.10:9345
token: "<same-secret>"
tls-san: [ "10.42.0.10", "site042-api.example.internal" ]
profile: cis

Servers run control plane + etcd; agents are workers (rke2-agent service).
The CIS profile needs host preparation (an etcd user and group, and the kernel parameters RKE2 ships in rke2-cis-sysctl.conf); follow the hardening guide for your version.
Provide the VIP with kube-vip or a load balancer (lesson 11), so joins and clients don't depend on one node.

Air-gapped install

Download from the release page: the images tarball (rke2-images*.tar.zst), rke2.linux-amd64.tar.gz, the checksums file and install.sh.
Install with INSTALL_RKE2_ARTIFACT_PATH=/path/to/artifacts sh install.sh.
Place the image tarball in /var/lib/rancher/rke2/agent/images/, or configure a private registry with registries.yaml (lesson 07) and system-default-registry.

Rancher for many clusters

Rancher manages clusters it provisions (RKE2/K3s) and clusters it imports (EKS, EKS-A, others).
Custom clusters: create the cluster in Rancher, then run the generated registration command on each machine with role flags (etcd, control plane, worker). Great for pre-imaged edge hardware.
Fleet, built into Rancher, delivers GitOps to many clusters using cluster labels and groups (lesson 10).

Elemental and SUSE Linux Micro

SUSE Linux Micro (formerly SLE Micro) is an immutable, transactional OS: updates apply atomically and can roll back.
Elemental adds OS management to Rancher: a MachineRegistration endpoint, machines booted from a seed image register themselves and appear as MachineInventory, and selectors assign them to clusters, with OS upgrades managed declaratively.
SUSE's edge offering combines these with tools such as Metal3 and an image builder for customised, air-gap-ready images; check the current SUSE Edge documentation for the supported combination.

Try it: RKE2 by hand

On three VMs (2 vCPU, 4 GB each), install RKE2 online on the first with the config above (without profile: cis at first).
Join the other two as servers via the first node's IP (or a kube-vip VIP), and check kubectl get nodes with the bundled kubectl.
Take a snapshot with rke2 etcd-snapshot save, and list automatic snapshots in /var/lib/rancher/rke2/server/db/snapshots.
Enable profile: cis on a fresh node following the hardening guide; note what fails until the host is prepared.
(Stretch) Install Rancher on a separate cluster and import your RKE2 cluster, or create a custom cluster with the registration command.

Going deeper: choosing a stack

EKS Anywhere (lesson 08) vs Rancher/RKE2: compare support model, OS options, provisioning (Tinkerbell vs Elemental/Metal3), fleet tooling (Flux/Argo vs Fleet), and your team's skills. Both can run excellent edge fleets.
Automate etcd snapshots to object storage (RKE2 supports S3 targets) and test restores.
Keep K3s in mind for very small devices; the operational model is similar.

Recap

RKE2: hardened, single-binary Kubernetes with embedded etcd and a CIS profile; configure in config.yaml, join via :9345.
Air-gapped installs from tarballs, or via registry mirrors.
Rancher manages many clusters (custom clusters via registration commands) with Fleet for GitOps.
Elemental + SUSE Linux Micro manage the OS layer declaratively.

This site is a public version of my personal engineering knowledge hub. It intentionally excludes confidential company information and internal operational details.