Cluster & Fleet · wrap-up
Cheat sheet & self-check
Every command from this section on one page.
Create
eksctl anywhere generate clusterconfig site042 --provider tinkerbell > site042.yaml | Start a cluster spec |
hardware.csv: hostname,bmc_ip,bmc_username,bmc_password,mac,ip_address,netmask,gateway,nameservers,labels,disk | Hardware inventory (labels like type=cp) |
eksctl anywhere create cluster --hardware-csv hardware.csv -f site042.yaml | Provision machines and form the cluster |
Day 2
eksctl anywhere upgrade plan cluster -f site042.yaml | See available component upgrades |
eksctl anywhere upgrade cluster -f site042.yaml | Upgrade (Kubernetes version and components) |
eksctl anywhere generate hardware -z hardware.csv > hardware.yaml | Hardware objects for adding machines later |
kubectl get clusters.anywhere.eks.amazonaws.com,machines -A | Cluster and CAPI machine status |
RKE2
curl -sfL https://get.rke2.io | sh - && systemctl enable --now rke2-server | Install and start a server (online) |
/etc/rancher/rke2/config.yaml | Node configuration (token, tls-san, profile, server…) |
server: https://<vip-or-first-server>:9345 | Join an existing cluster (supervisor port) |
/etc/rancher/rke2/rke2.yaml + /var/lib/rancher/rke2/bin/kubectl | Admin kubeconfig and bundled kubectl |
rke2 etcd-snapshot save --name pre-upgrade | Manual etcd snapshot |
Rancher & Elemental
Cluster Management → Create → Custom | Register existing machines with a registration command |
MachineRegistration / MachineInventory / SeedImage (Elemental) | Onboard and manage edge OS + nodes |
Fleet: GitRepo + cluster labels | GitOps across many clusters (built into Rancher) |
Targeting
Cluster labels: site=042, size=s, region=eu, wave=canary | Describe clusters; select by label |
Fleet: GitRepo targets[].clusterSelector | Rancher Fleet targeting |
Argo CD: ApplicationSet cluster generator selector | Argo CD targeting |
Flux: a Kustomization per cluster from its own path | Flux per-cluster entry point |
Rollout
wave=lab → canary → early → all | Staged rollout by label |
Pin revisions per wave (tags/branches) | Promote by moving a pointer |
Fleet/Argo status per cluster | Which revision each site runs |
Networking
kube-vip (ARP/BGP) | API server VIP and/or Service LoadBalancer IPs |
MetalLB (L2 or BGP) | LoadBalancer Services on bare metal |
Local DNS forwarder + NTP server (or GPS/PTP clock) | Sites keep working offline |
Multus + SR-IOV device plugin | Extra, high-performance pod interfaces (telecom) |
Storage & security
local-path / TopoLVM (LVM-backed local PVs) | Single-node or node-local storage |
Longhorn (3 nodes) | Replicated block storage for small clusters |
LUKS + TPM2 (e.g. systemd-cryptenroll / Clevis) | Encrypted disks that unlock only on the original hardware |
Secure Boot + measured boot | Only signed boot chains; tampering is detectable |
Backups
rke2 etcd-snapshot save / automatic snapshots (+ S3 upload) | RKE2 etcd backups |
etcdctl snapshot save (kubeadm-based clusters, e.g. EKS-A control plane) | Generic etcd snapshot |
velero backup create site042-daily --include-namespaces shop | Kubernetes objects + volume data |
Compliance
kube-bench run --targets master,node | CIS Kubernetes Benchmark checks |
Policy engine reports (Kyverno/Gatekeeper) | Continuous config compliance |
Per-site inventory: OS image, K8s, bundle, firmware, Secure Boot, encryption | Evidence and drift detection |
