K3s

https://docs.k3s.io/
Admin
K3s is a lightweight, certified Kubernetes distribution designed for edge, IoT, CI, and development,...
Tokens:869,310
Snippets:3,476
Trust Score:9.8
Update:1 day ago
Show doc for...
Tokens:
Raw
### Install K3s with INSTALL_K3S_CHANNEL=latest

Source: https://docs.k3s.io/reference/env-variables

Example showing how to set an environment variable (INSTALL_K3S_CHANNEL) as an option after the pipe in the installation command.

```bash
curl -sfL https://get.k3s.io | INSTALL_K3S_CHANNEL=latest sh -
```

--------------------------------

### K3s binary server command with environment variable and flag

Source: https://docs.k3s.io/installation/configuration

Starts the K3s server directly from the binary with K3S_KUBECONFIG_MODE set to '644' and the --flannel-backend none flag. This is an alternative to using the installation script.

```bash
K3S_KUBECONFIG_MODE="644" k3s server --flannel-backend none

```

--------------------------------

### Install K3s on first server with cluster-init

Source: https://docs.k3s.io/blog/2025/03/10/simple-ha

Install K3s on the first server with embedded etcd, a known token, and the load balancer IP as a TLS SAN.

```bash
curl -sfL https://get.k3s.io | INSTALL_K3S_CHANNEL=v1.31 sh -s - \
--cluster-init --token k3sblog --tls-san 10.10.10.100
```

--------------------------------

### Disable auto-start and service enablement with install script

Source: https://docs.k3s.io/advanced

Use this command to install K3s without automatically starting or enabling the service. The installation script auto-detects systemd or openrc; with openrc logs go to /var/log/k3s.log, with systemd to /var/log/syslog (view via journalctl -u k3s).

```bash
curl -sfL https://get.k3s.io | INSTALL_K3S_SKIP_START=true INSTALL_K3S_SKIP_ENABLE=true sh -
```

--------------------------------

### Returned Value: kube-apiserver startup log

Source: https://docs.k3s.io/security/self-assessment-1.24

Example output from the audit command showing the kube-apiserver startup line with the --kubelet-client-certificate and --kubelet-client-key arguments present.

```log
Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"

```

--------------------------------

### registries.yaml mirror for docker.io only

Source: https://docs.k3s.io/blog/2026/10/01/K3s-system-images-ghcr

Example `registries.yaml` configuration that only mirrors `docker.io`. This is the starting point for users who only mirror Docker Hub today.

```yaml
mirrors:
  docker.io:
    endpoint:
      - "https://registry.example.com:5000"
```

--------------------------------

### Install Tailscale on nodes

Source: https://docs.k3s.io/networking/distributed-multicloud

Run this command on each node to install Tailscale before deploying K3s.

```bash
curl -fsSL https://tailscale.com/install.sh | sh
```

--------------------------------

### Install K3s with environment variables and flags

Source: https://docs.k3s.io/zh/installation/configuration

Runs the installation script with K3S_KUBECONFIG_MODE and INSTALL_K3S_EXEC to set kubeconfig permissions and flannel backend.

```bash
curl -sfL https://get.k3s.io | K3S_KUBECONFIG_MODE="644" INSTALL_K3S_EXEC="server" sh -s - --flannel-backend none
```

--------------------------------

### Roll back K3s binary on agent nodes (embedded etcd, internet access)

Source: https://docs.k3s.io/ja/upgrades/roll-back

Install the previous K3s version on agent nodes without starting the service.

```bash
curl -sfL https://get.k3s.io | INSTALL_K3S_VERSION=vX.Y.Zk3s1 INSTALL_K3S_EXEC="agent" INSTALL_K3S_SKIP_START="true" sh -
```

--------------------------------

### Roll back K3s binary on server nodes (embedded etcd, internet access)

Source: https://docs.k3s.io/ja/upgrades/roll-back

Install the previous K3s version on server nodes without starting the service.

```bash
curl -sfL https://get.k3s.io | INSTALL_K3S_VERSION=vX.Y.Zk3s1 INSTALL_K3S_EXEC="server" INSTALL_K3S_SKIP_START="true" sh -
```

--------------------------------

### Launch K3s server with MySQL external datastore

Source: https://docs.k3s.io/datastore/ha

Use this command to install a K3s server node that connects to an external MySQL datastore. The --token parameter sets a deterministic token for adding nodes; if empty, it is generated automatically. The --tls-san flag is optional and needed when using a fixed registration address.

```bash
curl -sfL https://get.k3s.io | sh -s - server \
  --token=SECRET \
  --datastore-endpoint="mysql://username:password@tcp(hostname:3306)/database-name" \
  --tls-san=<FIXED_IP> # Optional, needed if using a fixed registration address
```

--------------------------------

### Install and run Nginx load balancer with systemd

Source: https://docs.k3s.io/datastore/cluster-loadbalancer

These commands copy the nginx.conf to the system Nginx configuration directory and start the Nginx service. This is an alternative to running Nginx in Docker.

```bash
cp nginx.conf /etc/nginx/nginx.conf
systemctl start nginx
```
Tokens:
Raw