### Install NVIDIA Container Runtime Packages

Source: https://docs.k3s.io/advanced

Example command to install the necessary NVIDIA runtime and driver packages on a node.

```bash
apt install -y nvidia-container-runtime cuda-drivers-fabricmanager-515 nvidia-headless-515-server
```

--------------------------------

### K3s Installation with Config File and Flags

Source: https://docs.k3s.io/installation/configuration

Install K3s using a configuration file and the installation script, combining environment variables and CLI arguments for a complete setup.

```yaml
token: "secret"  
debug: true  
```

```bash
curl -sfL https://get.k3s.io | K3S_KUBECONFIG_MODE="644" INSTALL_K3S_EXEC="server" sh -s - --flannel-backend none  
```

--------------------------------

### Install and Start Nginx System Service

Source: https://docs.k3s.io/datastore/cluster-loadbalancer

This command copies the Nginx configuration to the system directory and starts the Nginx service. This method is used when Nginx is installed directly on the host.

```bash
cp nginx.conf /etc/nginx/nginx.conf
systemctl start nginx
```

--------------------------------

### Install Docker on K3s Node

Source: https://docs.k3s.io/advanced

Use the Rancher installation script to set up Docker on the host machine.

```bash
curl https://releases.rancher.com/install-docker/20.10.sh | sh
```

--------------------------------

### Install etcdctl

Source: https://docs.k3s.io/advanced

Downloads and installs the etcdctl binary to /usr/local/bin.

```bash
ETCD_VERSION="v3.5.5"  

ETCD_URL="https://github.com/etcd-io/etcd/releases/download/${ETCD_VERSION}/etcd-${ETCD_VERSION}-linux-amd64.tar.gz"  

curl -sL ${ETCD_URL} | sudo tar -zxv --strip-components=1 -C /usr/local/bin  
```

--------------------------------

### Install K3s Server via Curl with Arguments

Source: https://docs.k3s.io/installation/airgap

Install K3s server using the curl command, passing arguments for token and datastore endpoint. This is an alternative to using the local install script.

```bash
curl -sfL https://get.k3s.io | sh -s - server \
  --token=SECRET \
  --datastore-endpoint="mysql://username:password@tcp(hostname:3306)/database-name"
```

--------------------------------

### Install K3s with Docker Support

Source: https://docs.k3s.io/advanced

Run the K3s installation script with the --docker flag to enable the Docker runtime.

```bash
curl -sfL https://get.k3s.io | sh -s - --docker
```

--------------------------------

### Install K3s on Single Server

Source: https://docs.k3s.io/installation/airgap?_highlight=.cache.json&airgap-load-images=Manually+Deploy+Images

Run the install script locally on the server node, skipping the download of the K3s binary as it has already been placed in /usr/local/bin.

```bash
INSTALL_K3S_SKIP_DOWNLOAD=true ./install.sh
```

--------------------------------

### Download New K3s Version Without Starting

Source: https://docs.k3s.io/upgrades/manual

Use the `INSTALL_K3S_SKIP_START=true` environment variable with the installation script to download the new K3s binary without automatically starting the service.

```shell
curl -sfL https://get.k3s.io | INSTALL_K3S_SKIP_START=true <EXISTING_K3S_ENV> sh -s - <EXISTING_K3S_ARGS>
```

--------------------------------

### Install K3s with default settings

Source: https://docs.k3s.io/reference/env-variables

The standard command to install K3s as a service on systemd or openrc systems.

```bash
curl -sfL https://get.k3s.io | sh -
```

--------------------------------

### Download K3s Install Script

Source: https://docs.k3s.io/installation/airgap?_highlight=.cache.json&airgap-load-images=Manually+Deploy+Images

Download the K3s install script to install.sh and make it executable.

```bash
curl -Lo install.sh https://get.k3s.io
```

```bash
chmod +x install.sh
```

--------------------------------

### Install K3s Server

Source: https://docs.k3s.io/quick-start

Run this command to install K3s as a service on a server node. The service will automatically restart on reboots or crashes. Additional utilities like kubectl are also installed.

```bash
curl -sfL https://get.k3s.io | sh -
```

--------------------------------

### Install Previous K3s Version (Server)

Source: https://docs.k3s.io/upgrades/roll-back

Roll back the K3s binary to a specific previous version for server nodes. Use INSTALL_K3S_SKIP_START="true" to prevent K3s from starting immediately after installation.

```bash
curl -sfL https://get.k3s.io | INSTALL_K3S_VERSION=vX.Y.Zk3s1 INSTALL_K3S_EXEC="server" INSTALL_K3S_SKIP_START="true" sh -
```

--------------------------------

### Install K3s Server with External Datastore

Source: https://docs.k3s.io/installation/airgap?_highlight=.cache.json&airgap-load-images=Manually+Deploy+Images

Modify the installation command to use local script execution and specify arguments for the server, token, and datastore endpoint.

```bash
INSTALL_K3S_SKIP_DOWNLOAD=true INSTALL_K3S_EXEC='server --token=SECRET' \
K3S_DATASTORE_ENDPOINT='mysql://username:password@tcp(hostname:3306)/database-name' \
./install.sh
```

--------------------------------

### Start K3s Server with Tailscale

Source: https://docs.k3s.io/networking/distributed-multicloud

Command to start a K3s server with Tailscale integration enabled. Requires a token, join key, and the server's Tailscale IP.

```bash
k3s server --token <token> --vpn-auth="name=tailscale,joinKey=<joinKey>" --node-external-ip=<TailscaleIPOfServerNode>
```

--------------------------------

### Download and Install K3s Binary

Source: https://docs.k3s.io/installation/configuration

Download the K3s binary from GitHub releases and make it executable. This is useful for quick tests and not recommended for permanent installations.

```shell
curl -Lo /usr/local/bin/k3s https://github.com/k3s-io/k3s/releases/download/v1.26.5+k3s1/k3s; chmod a+x /usr/local/bin/k3s
```

--------------------------------

### Install K3s with environment variables

Source: https://docs.k3s.io/reference/env-variables

Pass configuration variables to the installation script by prefixing the command with the desired environment variable.

```bash
curl -sfL https://get.k3s.io | INSTALL_K3S_CHANNEL=latest sh -
```

--------------------------------

### Install Previous K3s Version (Agent)

Source: https://docs.k3s.io/upgrades/roll-back

Roll back the K3s binary to a specific previous version for agent nodes. Use INSTALL_K3S_SKIP_START="true" to prevent K3s from starting immediately after installation.

```bash
curl -sfL https://get.k3s.io | INSTALL_K3S_VERSION=vX.Y.Zk3s1 INSTALL_K3S_EXEC="agent" INSTALL_K3S_SKIP_START="true" sh -
```

--------------------------------

### Install Tailscale

Source: https://docs.k3s.io/networking/distributed-multicloud

Install Tailscale on your nodes using this curl command. This is a prerequisite for integrating K3s with Tailscale.

```bash
curl -fsSL https://tailscale.com/install.sh | sh
```

--------------------------------

### Install K3s Server with Custom Configuration

Source: https://docs.k3s.io/installation/configuration

Use the installation script with environment variables and command flags to configure K3s server. These options are persisted to the service configuration.

```shell
curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="server" sh -s - --flannel-backend none --token 12345
```

```shell
curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="server --flannel-backend none" K3S_TOKEN=12345 sh -s -
```

```shell
curl -sfL https://get.k3s.io | K3S_TOKEN=12345 sh -s - server --flannel-backend none
```

```shell
curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="--flannel-backend none --token 12345" sh -s -
```

```shell
curl -sfL https://get.k3s.io | sh -s - --flannel-backend none --token 12345
```

--------------------------------

### Install HAProxy and KeepAlived

Source: https://docs.k3s.io/datastore/cluster-loadbalancer

Installs HAProxy and KeepAlived packages on load balancer nodes using apt-get.

```bash
sudo apt-get install haproxy keepalived  

```

--------------------------------

### Install Sysbox Binaries

Source: https://docs.k3s.io/blog/2025/09/27/k3s-sysbox

Install the built sysbox binaries to the system's executable path. This command is used when building on a different machine than where containerd will run.

```bash
make install
```

--------------------------------

### Install K3s Agent Node

Source: https://docs.k3s.io/installation/airgap?_highlight=.cache.json&airgap-load-images=Manually+Deploy+Images

On each agent node, run the install script locally, skipping the download. Specify the server URL and token for connection.

```bash
INSTALL_K3S_SKIP_DOWNLOAD=true K3S_URL=https://<SERVER_IP>:6443 K3S_TOKEN=<YOUR_TOKEN> ./install.sh
```

--------------------------------

### Install K3s Server with External MySQL Datastore

Source: https://docs.k3s.io/datastore/ha

Use this command to install the K3s server with a MySQL database as the external datastore. Ensure the datastore endpoint is correctly formatted for your database type. The `--token` parameter sets a deterministic token, and `--tls-san` is optional for fixed registration addresses.

```bash
curl -sfL https://get.k3s.io | sh -s - server \
  --token=SECRET \
  --datastore-endpoint="mysql://username:password@tcp(hostname:3306)/database-name" \
  --tls-san=<FIXED_IP> # Optional, needed if using a fixed registration address

```

--------------------------------

### Run Sysbox Binary

Source: https://docs.k3s.io/blog/2025/09/27/k3s-sysbox

Execute the sysbox binary to start the sysbox runtime.

```bash
sysbox
```

--------------------------------

### Install HAProxy on Load Balancer

Source: https://docs.k3s.io/blog/2025/03/10/simple-ha

Installs haproxy on the load balancer node. This is a prerequisite for distributing traffic to K3s servers.

```bash
sudo apt install haproxy
```

--------------------------------

### Download and Install SELinux RPM

Source: https://docs.k3s.io/installation/airgap?_highlight=.cache.json&airgap-load-images=Manually+Deploy+Images

Manually install the k3s-selinux RPM on air-gapped nodes with SELinux enabled. Ensure dependencies like container-selinux, policycoreutils, and selinux-policy are available.

```bash
# On internet accessible machine:
curl -LO https://github.com/k3s-io/k3s-selinux/releases/download/v1.6.stable.1/k3s-selinux-1.6-1.el8.noarch.rpm
```

```bash
# Transfer RPM to air-gapped machine
sudo yum install ./k3s-selinux-1.6-1.el8.noarch.rpm
```

--------------------------------

### Deploy Apache via HelmChart

Source: https://docs.k3s.io/add-ons/helm

Example of deploying the Bitnami Apache chart into a specific namespace while overriding default values.

```yaml
apiVersion: v1  

kind: Namespace  

metadata:  

  name: web  

---  

apiVersion: helm.cattle.io/v1  

kind: HelmChart  

metadata:  

  name: apache  

  namespace: kube-system  

spec:  

  repo: https://charts.bitnami.com/bitnami  

  chart: apache  

  targetNamespace: web  

  valuesContent: |-  

    service:  

      type: ClusterIP  

    ingress:  

      enabled: true  

      hostname: www.example.com  

    metrics:  

      enabled: true  
```

--------------------------------

### Install System Upgrade Controller

Source: https://docs.k3s.io/upgrades/automated

Deploys the controller components including CRDs, service accounts, and cluster roles into the cluster.

```bash
kubectl apply -f https://github.com/rancher/system-upgrade-controller/releases/latest/download/crd.yaml -f https://github.com/rancher/system-upgrade-controller/releases/latest/download/system-upgrade-controller.yaml
```

--------------------------------

### Example Pod Security Policy (PSP) Configuration

Source: https://docs.k3s.io/security/hardening-guide

This is an example of a compliant PSP configuration for K3s v1.24 and older, adhering to CIS Benchmark section 5.2. It restricts privileged operations, escalations, and host access, while defining allowed volume types and user/group ID rules.

```yaml
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: restricted-psp
spec:
  privileged: false                # CIS - 5.2.1
  allowPrivilegeEscalation: false  # CIS - 5.2.5
  requiredDropCapabilities:        # CIS - 5.2.7/8/9
    - ALL
  volumes:
    - 'configMap'
    - 'emptyDir'
    - 'projected'
    - 'secret'
    - 'downwardAPI'
    - 'csi'
    - 'persistentVolumeClaim'
    - 'ephemeral'
  hostNetwork: false               # CIS - 5.2.4
  hostIPC: false                   # CIS - 5.2.3
  hostPID: false                   # CIS - 5.2.2
  runAsUser:
    rule: 'MustRunAsNonRoot'       # CIS - 5.2.6
  seLinux:
    rule: 'RunAsAny'
  supplementalGroups:
    rule: 'MustRunAs'
    ranges:
      - min: 1
        max: 65535
  fsGroup:
    rule: 'MustRunAs'
    ranges:
      - min: 1
        max: 65535
  readOnlyRootFilesystem: false
```

--------------------------------

### Install K3s Agent with Custom Configuration

Source: https://docs.k3s.io/installation/configuration

Configure K3s agent during installation using environment variables and command flags. Ensure server URL and token are correctly provided.

```shell
curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="agent --server https://k3s.example.com --token mypassword" sh -s -
```

```shell
curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="agent" K3S_TOKEN="mypassword" sh -s - --server https://k3s.example.com
```

```shell
curl -sfL https://get.k3s.io | K3S_URL=https://k3s.example.com sh -s - agent --token mypassword
```

```shell
curl -sfL https://get.k3s.io | K3S_URL=https://k3s.example.com K3S_TOKEN=mypassword sh -s - # agent is assumed because of K3S_URL
```

--------------------------------

### Example Pod Security Admission (PSA) Configuration

Source: https://docs.k3s.io/security/hardening-guide

This is an example of a compliant PSA configuration file (`psa.yaml`) for K3s v1.25 and newer. It sets default policies to 'restricted' and exempts specific namespaces.

```yaml
apiVersion: apiserver.config.k8s.io/v1
kind: AdmissionConfiguration
plugins:
- name: PodSecurity
  configuration:
    apiVersion: pod-security.admission.config.k8s.io/v1beta1
    kind: PodSecurityConfiguration
    defaults:
      enforce: "restricted"
      enforce-version: "latest"
      audit: "restricted"
      audit-version: "latest"
      warn: "restricted"
      warn-version: "latest"
    exemptions:
      usernames: []
      runtimeClasses: []
      namespaces: [kube-system, compliance-operator-system]
```

--------------------------------

### Configure Registry Redirect

Source: https://docs.k3s.io/installation/private-registry

Example of redirecting pulls from a public registry to a private mirror.

```yaml
mirrors:  

  docker.io:  

    endpoint:  

      - "https://registry.example.com:5000"
```

--------------------------------

### Start K3s Server with systemd

Source: https://docs.k3s.io/upgrades/killall

Use this command to restart the K3s server service when using systemd.

```bash
sudo systemctl start k3s
```

--------------------------------

### Configure Registry with TLS

Source: https://docs.k3s.io/installation/private-registry

Examples for configuring registries with TLS, including options for authentication and standard certificate paths.

```yaml
mirrors:  

  docker.io:  

    endpoint:  

      - "https://registry.example.com:5000"  

configs:  

  "registry.example.com:5000":  

    auth:  

      username: xxxxxx # this is the registry username  

      password: xxxxxx # this is the registry password  

    tls:  

      cert_file: # path to the cert file used in the registry  

      key_file:  # path to the key file used in the registry  

      ca_file:   # path to the ca file used in the registry  
```

```yaml
mirrors:  

  docker.io:  

    endpoint:  

      - "https://registry.example.com:5000"  

configs:  

  "registry.example.com:5000":  

    tls:  

      cert_file: # path to the cert file used in the registry  

      key_file:  # path to the key file used in the registry  

      ca_file:   # path to the ca file used in the registry  
```

--------------------------------

### Upgrade K3s to Stable Release using Install Script

Source: https://docs.k3s.io/upgrades/manual

Re-run the installation script to upgrade to the current stable release. Ensure existing environment variables and arguments are passed to maintain configuration.

```shell
curl -sfL https://get.k3s.io | <EXISTING_K3S_ENV> sh -s - <EXISTING_K3S_ARGS>
```

--------------------------------

### Disable K3s auto-start and service enablement

Source: https://docs.k3s.io/advanced

Use environment variables with the installation script to prevent the service from starting or enabling automatically upon installation.

```bash
curl -sfL https://get.k3s.io | INSTALL_K3S_SKIP_START=true INSTALL_K3S_SKIP_ENABLE=true sh -
```

--------------------------------

### K3s Server Execution with Config and Flags

Source: https://docs.k3s.io/installation/configuration

Run the K3s server binary with specific environment variables and CLI flags, demonstrating how to combine different configuration methods.

```bash
K3S_KUBECONFIG_MODE="644" k3s server --flannel-backend none  
```

--------------------------------

### Disable Traefik AddOn in K3s

Source: https://docs.k3s.io/installation/packaged-components

Use the `--disable` flag when starting K3s to prevent Traefik from being installed or to uninstall it from an existing cluster. This flag also removes the manifest from the directory.

```bash
k3s --disable=traefik
```

--------------------------------

### Start K3s Service

Source: https://docs.k3s.io/cli/etcd-snapshot

Starts the K3s service after the restore process is complete.

```bash
systemctl start k3s
```

--------------------------------

### Configure K3s Server with Binary

Source: https://docs.k3s.io/installation/configuration

Run the K3s server binary and pass configuration using environment variables or command flags. Ensure critical flags match across server nodes.

```shell
K3S_KUBECONFIG_MODE="644" k3s server
```

```shell
k3s server --write-kubeconfig-mode=644
```

--------------------------------

### Install SELinux Policies

Source: https://docs.k3s.io/advanced

Installs required SELinux policy packages on CentOS-based systems.

```bash
yum install -y container-selinux selinux-policy-base
yum install -y https://rpm.rancher.io/k3s/latest/common/centos/9/noarch/k3s-selinux-1.6-1.el9.noarch.rpm
```

--------------------------------

### Kubelet Configuration via Config Directory Flag

Source: https://docs.k3s.io/installation/configuration

Configure Kubelet by pointing to a directory containing configuration files using the `--kubelet-arg=config-dir` flag. Drop-in files in this directory will be loaded.

```bash
k3s server --kubelet-arg=config-dir=/etc/rancher/k3s/kubelet.conf.d
```

--------------------------------

### Define Server and Agent Upgrade Plans

Source: https://docs.k3s.io/upgrades/automated

Example YAML configurations for server and agent nodes to track the stable release channel.

```yaml
# Server plan  

apiVersion: upgrade.cattle.io/v1  

kind: Plan  

metadata:  

  name: server-plan  

  namespace: system-upgrade  

spec:  

  concurrency: 1  

  cordon: true  

  nodeSelector:  

    matchExpressions:  

    - key: node-role.kubernetes.io/control-plane  

      operator: In  

      values:  

      - "true"  

  serviceAccountName: system-upgrade  

  upgrade:  

    image: rancher/k3s-upgrade  

  channel: https://update.k3s.io/v1-release/channels/stable  

---  

# Agent plan  

apiVersion: upgrade.cattle.io/v1  

kind: Plan  

metadata:  

  name: agent-plan  

  namespace: system-upgrade  

spec:  

  concurrency: 1  

  cordon: true  

  nodeSelector:  

    matchExpressions:  

    - key: node-role.kubernetes.io/control-plane  

      operator: DoesNotExist  

  prepare:  

    args:  

    - prepare  

    - server-plan  

    image: rancher/k3s-upgrade  

  serviceAccountName: system-upgrade  

  upgrade:  

    image: rancher/k3s-upgrade  

  channel: https://update.k3s.io/v1-release/channels/stable
```

--------------------------------

### Initialize the first server node

Source: https://docs.k3s.io/datastore/ha-embedded

Use this command to start the first server node with the cluster-init flag to enable etcd clustering.

```bash
curl -sfL https://get.k3s.io | K3S_TOKEN=SECRET sh -s - server \

    --cluster-init \

    --tls-san=<FIXED_IP> # Optional, needed if using a fixed registration address
```

--------------------------------

### Install Kernel Modules Extra on RHEL 10

Source: https://docs.k3s.io/installation/requirements?_highlight=nm&_highlight=cloud&_highlight=setup.service&os=rhel

Installs the required 'kernel-modules-extra' package on RHEL 10 systems for K3s compatibility.

```bash
sudo dnf install -y kernel-modules-extra
```

--------------------------------

### Install Longhorn

Source: https://docs.k3s.io/add-ons/storage

Apply the Longhorn installation YAML to deploy Longhorn in the 'longhorn-system' namespace. Ensure Longhorn is compatible with your architecture as it does not support ARM32.

```bash
kubectl apply -f https://raw.githubusercontent.com/longhorn/longhorn/v1.8.1/deploy/longhorn.yaml

```

--------------------------------

### Install Rancher Logging for K3s

Source: https://docs.k3s.io/advanced

Commands to add the Rancher charts repository and install the logging CRDs and logging agent with K3s support enabled.

```bash
helm repo add rancher-charts https://charts.rancher.io  

helm repo update  

helm install --create-namespace -n cattle-logging-system rancher-logging-crd rancher-charts/rancher-logging-crd  

helm install --create-namespace -n cattle-logging-system rancher-logging --set additionalLoggingSources.k3s.enabled=true rancher-charts/rancher-logging  
```

--------------------------------

### Create Image Directory and Copy Example

Source: https://docs.k3s.io/add-ons/import-images

Create the directory for image import and copy a text file containing image names. This is used for online image importing.

```bash
mkdir /var/lib/rancher/k3s/agent/images  

cp example.txt /var/lib/rancher/k3s/agent/images  
```

--------------------------------

### Install System Upgrade Controller

Source: https://docs.k3s.io/blog/2025/03/10/simple-ha

Installs the system-upgrade-controller and its Custom Resource Definitions (CRDs) using kubectl. This controller manages automated K3s upgrades.

```bash
kubectl apply -f https://github.com/rancher/system-upgrade-controller/releases/latest/download/system-upgrade-controller.yaml
```

```bash
kubectl apply -f https://github.com/rancher/system-upgrade-controller/releases/latest/download/crd.yaml
```

--------------------------------

### Download K3s Binary

Source: https://docs.k3s.io/installation/airgap?_highlight=.cache.json&airgap-load-images=Manually+Deploy+Images

Download the K3s binary and place it in /usr/local/bin. Ensure the binary is executable.

```bash
sudo curl -Lo /usr/local/bin/k3s https://github.com/k3s-io/k3s/releases/download/v1.33.3%2Bk3s1/k3s
```

```bash
sudo chmod +x /usr/local/bin/k3s
```

--------------------------------

### Upgrade K3s to Specific Channel using Install Script

Source: https://docs.k3s.io/upgrades/manual

Use the `INSTALL_K3S_CHANNEL` environment variable to specify a release channel, such as 'latest', when upgrading with the installation script.

```shell
curl -sfL https://get.k3s.io | INSTALL_K3S_CHANNEL=latest <EXISTING_K3S_ENV> sh -s - <EXISTING_K3S_ARGS>
```

--------------------------------

### Configure K3s Agent with Binary

Source: https://docs.k3s.io/installation/configuration

Run the K3s agent binary and pass configuration using command flags. This requires specifying the server URL and token.

```shell
k3s agent --server https://k3s.example.com --token mypassword
```

--------------------------------

### Kubelet Configuration via Config File Flag

Source: https://docs.k3s.io/installation/configuration

Configure Kubelet using a specified configuration file path with the `--kubelet-arg=config` flag. This allows for advanced Kubelet settings.

```bash
k3s server --kubelet-arg=config=/etc/rancher/k3s/kubelet.conf
```

--------------------------------

### Start Dedicated control-plane Node

Source: https://docs.k3s.io/installation/server-roles

Use this command to start a K3s server with only the control-plane role, disabling etcd. This requires an existing etcd node to join.

```bash
curl -fL https://get.k3s.io | sh -s - server --token <token> --disable-etcd --server https://<etcd-only-node>:6443   
```

--------------------------------

### K3s Server CLI Help Output

Source: https://docs.k3s.io/cli/server

Displays the full list of available options and usage instructions for the k3s server command.

```text
NAME:  

   k3s server - Run management server  

  

USAGE:  

   k3s server [OPTIONS]  

  

OPTIONS:  

   --config FILE, -c FILE                     (config) Load configuration from FILE (default: "/etc/rancher/k3s/config.yaml") [$K3S_CONFIG_FILE]  

   --debug                                    (logging) Turn on debug logs [$K3S_DEBUG]  

   -v value                                   (logging) Number for the log level verbosity (default: 0)  

   --vmodule value                            (logging) Comma-separated list of FILE_PATTERN=LOG_LEVEL settings for file-filtered logging  

   --log value, -l value                      (logging) Log to file  

   --alsologtostderr                          (logging) Log to standard error as well as file (if set)  

   --bind-address value                       (listener) k3s bind address (default: 0.0.0.0)  

   --https-listen-port value                  (listener) HTTPS listen port (default: 6443)  

   --advertise-address value                  (listener) IPv4/IPv6 address that apiserver uses to advertise to members of the cluster (default: node-external-ip/node-ip)  

   --advertise-port value                     (listener) Port that apiserver uses to advertise to members of the cluster (default: listen-port) (default: 0)  

   --tls-san value                            (listener) Add additional hostnames or IPv4/IPv6 addresses as Subject Alternative Names on the server TLS cert  

   --tls-san-security                         (listener) Protect the server TLS cert by refusing to add Subject Alternative Names not associated with the kubernetes apiserver service, server nodes, or values of the tls-san option (default: true)  

   --data-dir value, -d value                 (data) Folder to hold state default /var/lib/rancher/k3s or ${HOME}/.rancher/k3s if not root [$K3S_DATA_DIR]  

   --cluster-cidr value                       (networking) IPv4/IPv6 network CIDRs to use for pod IPs (default: 10.42.0.0/16)  

   --service-cidr value                       (networking) IPv4/IPv6 network CIDRs to use for service IPs (default: 10.43.0.0/16)  

   --service-node-port-range value            (networking) Port range to reserve for services with NodePort visibility (default: "30000-32767")  

   --cluster-dns value                        (networking) IPv4 Cluster IP for coredns service. Should be in your service-cidr range (default: 10.43.0.10)  

   --cluster-domain value                     (networking) Cluster Domain (default: "cluster.local")  

   --flannel-backend value                    (networking) Backend (valid values: 'none', 'vxlan', 'host-gw', 'wireguard-native' (default: "vxlan")  

   --flannel-ipv6-masq                        (networking) Enable IPv6 masquerading for pod  

   --flannel-external-ip                      (networking) Use node external IP addresses for Flannel traffic  

   --egress-selector-mode value               (networking) One of 'agent', 'cluster', 'pod', 'disabled' (default: "agent")  

   --servicelb-namespace value                (networking) Namespace of the pods for the servicelb component (default: "kube-system")  

   --write-kubeconfig value, -o value         (client) Write kubeconfig for admin client to this file [$K3S_KUBECONFIG_OUTPUT]  

   --write-kubeconfig-mode value              (client) Write kubeconfig with this mode [$K3S_KUBECONFIG_MODE]  

   --write-kubeconfig-group value             (client) Write kubeconfig with this group [$K3S_KUBECONFIG_GROUP]  

   --helm-controller-arg value                (helm) Customized configuration for helm-controller process  

   --token value, -t value                    (cluster) Shared secret used to join a server or agent to a cluster [$K3S_TOKEN]
```

--------------------------------

### Start Dedicated etcd Node

Source: https://docs.k3s.io/installation/server-roles

Use this command to start a K3s server with only the etcd role, disabling all control-plane components. This node will initialize the cluster and wait for other nodes.

```bash
curl -fL https://get.k3s.io | sh -s - server --cluster-init --disable-apiserver --disable-controller-manager --disable-scheduler  
```

--------------------------------

### Equivalent K3s Server CLI Arguments

Source: https://docs.k3s.io/installation/configuration

These CLI arguments achieve the same configuration as the example YAML file. Repeatable arguments like `--node-label` can be specified multiple times.

```bash
k3s server \ 
  --write-kubeconfig-mode "0644"    \ 
  --tls-san "foo.local"             \ 
  --node-label "foo=bar"            \ 
  --node-label "something=amazing"  \ 
  --cluster-init  
```

--------------------------------

### Upgrade K3s to Specific Version using Install Script

Source: https://docs.k3s.io/upgrades/manual

Specify the exact K3s version to install using the `INSTALL_K3S_VERSION` environment variable. Replace 'vX.Y.Z+k3s1' with the desired version.

```shell
curl -sfL https://get.k3s.io | INSTALL_K3S_VERSION=vX.Y.Z+k3s1 <EXISTING_K3S_ENV> sh -s - <EXISTING_K3S_ARGS>
```

--------------------------------

### Verify Embedded Registry Mirror Startup Logs

Source: https://docs.k3s.io/blog/2025/11/11/strategies-for-large-images

Check the K3s logs for these informational messages to confirm that the distributed registry mirror and P2P node have started successfully.

```log
level=info msg="Starting distributed registry mirror at https://10.11.0.11:6443/v2 for registries [docker.io registry.k8s.io]"
level=info msg="Starting distributed registry P2P node at 10.11.0.11:5001"
```

--------------------------------

### Install K3s Server with Secrets Encryption

Source: https://docs.k3s.io/security/secrets-encryption

Use this command to install K3s server with secrets encryption enabled. This will automatically generate an AES-CBC key and an encryption config file.

```bash
curl -sfL https://get.k3s.io | sh -s - server --secrets-encryption
```