RKE2

https://docs.rke2.io/
Admin
RKE2 is Rancher's enterprise-ready Kubernetes distribution designed for security and compliance,...
Tokens:155,989
Snippets:1,991
Trust Score:7.2
Update:1 month ago
Show doc for...
Tokens:
Raw
### Install RKE2 using the Tar Method

Source: https://docs.rke2.io/install/configuration

Example of installing the latest version using the tar installation method.

```powershell
Invoke-WebRequest -Uri https://raw.githubusercontent.com/rancher/rke2/master/install.ps1 -Outfile install.ps1  

./install.ps1 -Channel Latest -Method Tar
```

--------------------------------

### Install and Start RKE2 Server

Source: https://docs.rke2.io/advanced

Use the official installation script to download, enable, and start the RKE2 server service via systemd.

```bash
curl -sfL https://get.rke2.io | sh -  

systemctl enable rke2-server  

systemctl start rke2-server  
```

--------------------------------

### Run Windows Installer and Start Service

Source: https://docs.rke2.io/install/quickstart

Executes the installer script, adds the service, and starts it.

```powershell
./install.ps1
```

```powershell
rke2.exe agent service --add
```

```powershell
Start-Service rke2
```

--------------------------------

### Install RKE2 from the Latest Channel

Source: https://docs.rke2.io/install/configuration

Example of installing the latest version of RKE2 instead of the default stable channel.

```powershell
Invoke-WebRequest -Uri https://raw.githubusercontent.com/rancher/rke2/master/install.ps1 -Outfile install.ps1  

./install.ps1 -Channel Latest
```

--------------------------------

### Execute RKE2 installation script

Source: https://docs.rke2.io/install/methods

Downloads and executes the installation script directly to start the process.

```bash
# curl -sfL https://get.rke2.io | sudo sh -  

curl -sfL https://get.rke2.io | sh -  
```

--------------------------------

### Install RKE2

Source: https://docs.rke2.io/datastore/embedded

Use the official installation script to install RKE2.

```bash
curl -sfL https://get.rke2.io | sh -  
```

--------------------------------

### Install RKE2 Server

Source: https://docs.rke2.io/install/quickstart

Executes the installation script to set up the rke2-server service and binary. Requires root or sudo privileges.

```bash
curl -sfL https://get.rke2.io | sh -
```

--------------------------------

### Start and Monitor RKE2 Agent on Linux

Source: https://docs.rke2.io/install/quickstart

Starts the service and provides a command to follow the logs.

```bash
systemctl start rke2-agent.service
```

```bash
journalctl -u rke2-agent -f
```

--------------------------------

### Install RKE2 from Local Artifacts

Source: https://docs.rke2.io/install/airgap

Executes the installation script on an air-gapped node using the directory containing pre-downloaded artifacts.

```bash
INSTALL_RKE2_ARTIFACT_PATH=/root/rke2-artifacts sh install.sh  
```

--------------------------------

### Start RKE2 Server Service

Source: https://docs.rke2.io/datastore/embedded

Start the rke2-server systemd service.

```bash
systemctl start rke2-server.service  
```

--------------------------------

### Download and prepare installation script

Source: https://docs.rke2.io/install/methods

Downloads the script to a local file and grants execution permissions.

```bash
curl -sfL https://get.rke2.io --output install.sh  

chmod +x install.sh  
```

--------------------------------

### Example Extra Volume Mounts Configuration

Source: https://docs.rke2.io/advanced

YAML configuration example for mounting host paths into static pods, including read-only options.

```yaml
# /etc/rancher/rke2/config.yaml  

kube-apiserver-extra-mount:   

   - "/tmp/foo:/root/foo"  

   - "/tmp/bar.txt:/etc/bar.txt:ro"   
```

--------------------------------

### Download the RKE2 Windows Installation Script

Source: https://docs.rke2.io/install/configuration

Use this command to download the installation script to your local machine.

```powershell
Invoke-WebRequest -Uri https://raw.githubusercontent.com/rancher/rke2/master/install.ps1 -Outfile install.ps1
```

--------------------------------

### Install RKE2 on SLES 16

Source: https://docs.rke2.io/install/methods

Installs the RKE2 server package using zypper.

```bash
zypper --gpg-auto-import-keys install -y rke2-server  


```

--------------------------------

### Start RKE2 Service

Source: https://docs.rke2.io/upgrades/roll-back

Start the RKE2 server or agent service after binary rollback.

```bash
systemctl start rke2-server #or rke2-agent  
```

--------------------------------

### Windows Installation Script Syntax and Options

Source: https://docs.rke2.io/install/configuration

Reference for the parameters available when running the install.ps1 script.

```text
SYNTAX  
  
install.ps1 [[-Channel] <String>] [[-Method] <String>] [[-Type] <String>] [[-Version] <String>] [[-TarPrefix] <String>] [-Commit] [[-AgentImagesDir] <String>] [[-ArtifactPath] <String>] [[-ChannelUrl] <String>] [<CommonParameters>]  
  
OPTIONS  
  
-Channel           Channel to use for fetching RKE2 download URL (Default: "stable")  
-Method            The installation method to use. Currently tar or choco installation supported. (Default: "tar")  
-Type              Type of RKE2 service. Only the "agent" type is supported on Windows. (Default: "agent")  
-Version           Version of rke2 to download from Github  
-TarPrefix         Installation prefix when using the tar installation method. (Default: `C:/usr/local` unless `C:/usr/local` is read-only or has a dedicated mount point, in which case `C:/opt/rke2` is used instead)  
-Commit            (experimental/agent) Commit of RKE2 to download from temporary cloud storage. If set, this forces `--Method=tar`. Intended for development purposes only.  
-AgentImagesDir    Installation path for airgap images when installing from CI commit. (Default: `C:/var/lib/rancher/rke2/agent/images`)  
-ArtifactPath      If set, the install script will use the local path for sourcing the `rke2.windows-$SUFFIX` and `sha256sum-$ARCH.txt` files rather than the downloading the files from GitHub. Disabled by default.
```

--------------------------------

### Install HAProxy and Keepalived

Source: https://docs.rke2.io/networking/cluster-loadbalancer

Install the necessary load balancing and high availability packages on the load balancer nodes.

```bash
sudo apt-get install haproxy keepalived
```

--------------------------------

### Example Control Plane Resource Configuration

Source: https://docs.rke2.io/advanced

YAML configuration example for setting resource requests in the RKE2 config file.

```yaml
# /etc/rancher/rke2/config.yaml  

control-plane-resource-requests:  

  - kube-apiserver-cpu=500m  

  - kube-apiserver-memory=512M  

  - kube-scheduler-cpu=250m  

  - kube-scheduler-memory=512M  

  - etcd-cpu=1000m  
```

--------------------------------

### View etcd configuration output

Source: https://docs.rke2.io/security/cis_self_assessment110

Example output showing the etcd configuration parameters.

```text
advertise-client-urls: https://10.10.10.100:2379  

client-transport-security:  

  cert-file: /var/lib/rancher/rke2/server/tls/etcd/server-client.crt  

  client-cert-auth: true  

  key-file: /var/lib/rancher/rke2/server/tls/etcd/server-client.key  

  trusted-ca-file: /var/lib/rancher/rke2/server/tls/etcd/server-ca.crt  

data-dir: /var/lib/rancher/rke2/server/db/etcd  

election-timeout: 5000  

experimental-initial-corrupt-check: true  

experimental-watch-progress-notify-interval: 5000000000  

heartbeat-interval: 500  

initial-advertise-peer-urls: https://10.10.10.100:2380  

initial-cluster: server-0-c121eac1=https://10.10.10.100:2380  

initial-cluster-state: new  

listen-client-http-urls: https://127.0.0.1:2382  

listen-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379  

listen-metrics-urls: http://127.0.0.1:2381  

listen-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380  

log-outputs:  

- stderr  

logger: zap  

name: server-0-c121eac1  

peer-transport-security:  

  cert-file: /var/lib/rancher/rke2/server/tls/etcd/peer-server-client.crt  

  client-cert-auth: true  

  key-file: /var/lib/rancher/rke2/server/tls/etcd/peer-server-client.key  

  trusted-ca-file: /var/lib/rancher/rke2/server/tls/etcd/peer-ca.crt  

snapshot-count: 10000
```

--------------------------------

### Install RKE2 on Enterprise Linux

Source: https://docs.rke2.io/install/methods

Installs the RKE2 server or agent package using yum.

```bash
yum -y install rke2-server  


```

```bash
yum -y install rke2-agent  


```

--------------------------------

### Start RKE2 Agent via CLI

Source: https://docs.rke2.io/install/windows_airgap

Starts the RKE2 agent using command-line arguments instead of a configuration file.

```powershell
c:/usr/local/bin/rke2.exe agent --token <> --server <>
```

--------------------------------

### Enable RKE2 Agent Service on Linux

Source: https://docs.rke2.io/install/quickstart

Enables the rke2-agent service to start on boot.

```bash
systemctl enable rke2-agent.service
```

--------------------------------

### View kube-controller-manager process output

Source: https://docs.rke2.io/security/cis_self_assessment18

Example output showing the active arguments for the kube-controller-manager process.

```text
UID          PID    PPID  C STIME TTY          TIME CMD  

root        2696    2604  1 19:13 ?        00:00:02 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true  
```

--------------------------------

### Example kube-apiserver process output

Source: https://docs.rke2.io/security/cis_self_assessment18

This output displays the active arguments for the kube-apiserver process.

```text

UID          PID    PPID  C STIME TTY          TIME CMD  

root        2550    2500 12 19:13 ?        00:00:15 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key  


```

--------------------------------

### Example kube-scheduler process output

Source: https://docs.rke2.io/security/cis_self_assessment19

This output shows the active arguments for the running kube-scheduler process.

```text
UID          PID    PPID  C STIME TTY          TIME CMD  

root        2992    2874  0 18:32 ?        00:00:05 kube-scheduler --permit-port-sharing=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259  
```

--------------------------------

### Example output for kube-scheduler process

Source: https://docs.rke2.io/security/cis_self_assessment112

This shows the expected process output when auditing the kube-scheduler.

```text
UID          PID    PPID  C STIME TTY          TIME CMD  

root        2763    2674  1 22:56 ?        00:00:00 kube-scheduler --permit-port-sharing=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259 --tls-cert-file=/var/lib/rancher/rke2/server/tls/kube-scheduler/kube-scheduler.crt --tls-private-key-file=/var/lib/rancher/rke2/server/tls/kube-scheduler/kube-scheduler.key  
```

--------------------------------

### Enable RKE2 Server Service

Source: https://docs.rke2.io/datastore/embedded

Enable the rke2-server systemd service to ensure it starts on boot.

```bash
systemctl enable rke2-server.service  
```

--------------------------------

### Sample Audit Output

Source: https://docs.rke2.io/security/cis_self_assessment110

Example output showing the compliance status of various system pods.

```text
***pod_name: cloud-controller-manager-server-0 container_name: cloud-controller-manager pod_namespace: kube-system is_container_allowprivesc: notset is_compliant: true  

***pod_name: etcd-server-0 container_name: etcd pod_namespace: kube-system is_container_allowprivesc: notset is_compliant: true  

***pod_name: helm-install-rke2-canal-9n9dk container_name: helm pod_namespace: kube-system is_container_allowprivesc: false is_compliant: true  

***pod_name: helm-install-rke2-coredns-8tv2t container_name: helm pod_namespace: kube-system is_container_allowprivesc: false is_compliant: true  

***pod_name: helm-install-rke2-ingress-nginx-nlmrr container_name: helm pod_namespace: kube-system is_container_allowprivesc: false is_compliant: true  

***pod_name: helm-install-rke2-metrics-server-n99w4 container_name: helm pod_namespace: kube-system is_container_allowprivesc: false is_compliant: true  

***pod_name: helm-install-rke2-snapshot-controller-crd-f9zkr container_name: helm pod_namespace: kube-system is_container_allowprivesc: false is_compliant: true  

***pod_name: helm-install-rke2-snapshot-controller-shqn6 container_name: helm pod_namespace: kube-system is_container_allowprivesc: false is_compliant: true  

***pod_name: helm-install-rke2-snapshot-validation-webhook-sfh6n container_name: helm pod_namespace: kube-system is_container_allowprivesc: false is_compliant: true  

***pod_name: kube-apiserver-server-0 container_name: kube-apiserver pod_namespace: kube-system is_container_allowprivesc: notset is_compliant: true  

***pod_name: kube-controller-manager-server-0 container_name: kube-controller-manager pod_namespace: kube-system is_container_allowprivesc: notset is_compliant: true  

***pod_name: kube-proxy-server-0 container_name: kube-proxy pod_namespace: kube-system is_container_allowprivesc: notset is_compliant: true  

***pod_name: kube-scheduler-server-0 container_name: kube-scheduler pod_namespace: kube-system is_container_allowprivesc: notset is_compliant: true  

***pod_name: rke2-canal-b8l4s container_name: calico-node pod_namespace: kube-system is_container_allowprivesc: notset is_compliant: true  

***pod_name: rke2-canal-b8l4s container_name: kube-flannel pod_namespace: kube-system is_container_allowprivesc: notset is_compliant: true  

***pod_name: rke2-coredns-rke2-coredns-6794d5bfbb-6srrk container_name: coredns pod_namespace: kube-system is_container_allowprivesc: notset is_compliant: true  

***pod_name: rke2-coredns-rke2-coredns-autoscaler-694dcd9546-sc6mf container_name: autoscaler pod_namespace: kube-system is_container_allowprivesc: notset is_compliant: true  

***pod_name: rke2-ingress-nginx-controller-wqq4m container_name: rke2-ingress-nginx-controller pod_namespace: kube-system is_container_allowprivesc: false is_compliant: true  

***pod_name: rke2-metrics-server-7694cf7d77-rv9qh container_name: metrics-server pod_namespace: kube-system is_container_allowprivesc: false is_compliant: true  

***pod_name: rke2-snapshot-controller-5c9df4d7d6-ks7tw container_name: rke2-snapshot-controller pod_namespace: kube-system is_container_allowprivesc: notset is_compliant: true  

***pod_name: rke2-snapshot-validation-webhook-54f487ff94-cc254 container_name: rke2-snapshot-validation-webhook pod_namespace: kube-system is_container_allowprivesc: notset is_compliant: true
```

--------------------------------

### Example output for cluster-admin audit

Source: https://docs.rke2.io/security/cis_self_assessment111

Sample output showing cluster-admin role bindings for RKE2 managed components.

```text
cluster-admin                                                   cluster-admin                                                   system:masters  

cluster-admin                                                   helm-kube-system-rke2-canal                                     helm-rke2-canal  

cluster-admin                                                   helm-kube-system-rke2-coredns                                   helm-rke2-coredns  

cluster-admin                                                   helm-kube-system-rke2-ingress-nginx                             helm-rke2-ingress-nginx  

cluster-admin                                                   helm-kube-system-rke2-metrics-server                            helm-rke2-metrics-server  

cluster-admin                                                   helm-kube-system-rke2-runtimeclasses                            helm-rke2-runtimeclasses  

cluster-admin                                                   helm-kube-system-rke2-snapshot-controller                       helm-rke2-snapshot-controller  

cluster-admin                                                   helm-kube-system-rke2-snapshot-controller-crd                   helm-rke2-snapshot-controller-crd  
```

--------------------------------

### Expected Audit Output

Source: https://docs.rke2.io/security/cis_self_assessment110

Example output showing compliant pods where hostPID is set to false.

```text
***pod_name: cloud-controller-manager-server-0 pod_namespace: kube-system is_pod_hostpid: false is_compliant: true  

***pod_name: etcd-server-0 pod_namespace: kube-system is_pod_hostpid: false is_compliant: true  

***pod_name: helm-install-rke2-canal-9n9dk pod_namespace: kube-system is_pod_hostpid: false is_compliant: true  

***pod_name: helm-install-rke2-coredns-8tv2t pod_namespace: kube-system is_pod_hostpid: false is_compliant: true  

***pod_name: helm-install-rke2-ingress-nginx-nlmrr pod_namespace: kube-system is_pod_hostpid: false is_compliant: true  

***pod_name: helm-install-rke2-metrics-server-n99w4 pod_namespace: kube-system is_pod_hostpid: false is_compliant: true  

***pod_name: helm-install-rke2-snapshot-controller-crd-f9zkr pod_namespace: kube-system is_pod_hostpid: false is_compliant: true  

***pod_name: helm-install-rke2-snapshot-controller-shqn6 pod_namespace: kube-system is_pod_hostpid: false is_compliant: true  

***pod_name: helm-install-rke2-snapshot-validation-webhook-sfh6n pod_namespace: kube-system is_pod_hostpid: false is_compliant: true  

***pod_name: kube-apiserver-server-0 pod_namespace: kube-system is_pod_hostpid: false is_compliant: true  

***pod_name: kube-controller-manager-server-0 pod_namespace: kube-system is_pod_hostpid: false is_compliant: true  

***pod_name: kube-proxy-server-0 pod_namespace: kube-system is_pod_hostpid: false is_compliant: true  

***pod_name: kube-scheduler-server-0 pod_namespace: kube-system is_pod_hostpid: false is_compliant: true  

***pod_name: rke2-canal-b8l4s pod_namespace: kube-system is_pod_hostpid: false is_compliant: true  

***pod_name: rke2-coredns-rke2-coredns-6794d5bfbb-6srrk pod_namespace: kube-system is_pod_hostpid: false is_compliant: true  

***pod_name: rke2-coredns-rke2-coredns-autoscaler-694dcd9546-sc6mf pod_namespace: kube-system is_pod_hostpid: false is_compliant: true  

***pod_name: rke2-ingress-nginx-controller-wqq4m pod_namespace: kube-system is_pod_hostpid: false is_compliant: true  

***pod_name: rke2-metrics-server-7694cf7d77-rv9qh pod_namespace: kube-system is_pod_hostpid: false is_compliant: true  

***pod_name: rke2-snapshot-controller-5c9df4d7d6-ks7tw pod_namespace: kube-system is_pod_hostpid: false is_compliant: true  

***pod_name: rke2-snapshot-validation-webhook-54f487ff94-cc254 pod_namespace: kube-system is_pod_hostpid: false is_compliant: true
```

--------------------------------

### Audit Command Output

Source: https://docs.rke2.io/security/cis_self_assessment110

Example output generated by the audit script showing compliant pods.

```text
***pod_name: cloud-controller-manager-server-0 pod_namespace: kube-system is_pod_hostipc: false is_compliant: true  

***pod_name: etcd-server-0 pod_namespace: kube-system is_pod_hostipc: false is_compliant: true  

***pod_name: helm-install-rke2-canal-9n9dk pod_namespace: kube-system is_pod_hostipc: false is_compliant: true  

***pod_name: helm-install-rke2-coredns-8tv2t pod_namespace: kube-system is_pod_hostipc: false is_compliant: true  

***pod_name: helm-install-rke2-ingress-nginx-nlmrr pod_namespace: kube-system is_pod_hostipc: false is_compliant: true  

***pod_name: helm-install-rke2-metrics-server-n99w4 pod_namespace: kube-system is_pod_hostipc: false is_compliant: true  

***pod_name: helm-install-rke2-snapshot-controller-crd-f9zkr pod_namespace: kube-system is_pod_hostipc: false is_compliant: true  

***pod_name: helm-install-rke2-snapshot-controller-shqn6 pod_namespace: kube-system is_pod_hostipc: false is_compliant: true  

***pod_name: helm-install-rke2-snapshot-validation-webhook-sfh6n pod_namespace: kube-system is_pod_hostipc: false is_compliant: true  

***pod_name: kube-apiserver-server-0 pod_namespace: kube-system is_pod_hostipc: false is_compliant: true  

***pod_name: kube-controller-manager-server-0 pod_namespace: kube-system is_pod_hostipc: false is_compliant: true  

***pod_name: kube-proxy-server-0 pod_namespace: kube-system is_pod_hostipc: false is_compliant: true  

***pod_name: kube-scheduler-server-0 pod_namespace: kube-system is_pod_hostipc: false is_compliant: true  

***pod_name: rke2-canal-b8l4s pod_namespace: kube-system is_pod_hostipc: false is_compliant: true  

***pod_name: rke2-coredns-rke2-coredns-6794d5bfbb-6srrk pod_namespace: kube-system is_pod_hostipc: false is_compliant: true  

***pod_name: rke2-coredns-rke2-coredns-autoscaler-694dcd9546-sc6mf pod_namespace: kube-system is_pod_hostipc: false is_compliant: true  

***pod_name: rke2-ingress-nginx-controller-wqq4m pod_namespace: kube-system is_pod_hostipc: false is_compliant: true  

***pod_name: rke2-metrics-server-7694cf7d77-rv9qh pod_namespace: kube-system is_pod_hostipc: false is_compliant: true  

***pod_name: rke2-snapshot-controller-5c9df4d7d6-ks7tw pod_namespace: kube-system is_pod_hostipc: false is_compliant: true  

***pod_name: rke2-snapshot-validation-webhook-54f487ff94-cc254 pod_namespace: kube-system is_pod_hostipc: false is_compliant: true
```

--------------------------------

### Example output for wildcard audit

Source: https://docs.rke2.io/security/cis_self_assessment111

Sample output showing compliance status for checked Roles.

```text
**role_name: system:controller:bootstrap-signer                 role_namespace: kube-public               is_compliant: true  

**role_name: extension-apiserver-authentication-reader          role_namespace: kube-system               is_compliant: true  

**role_name: rke2-ingress-nginx                                 role_namespace: kube-system               is_compliant: true  

**role_name: rke2-snapshot-controller                           role_namespace: kube-system               is_compliant: true  
```

--------------------------------

### Example Kubelet Process Output

Source: https://docs.rke2.io/security/cis_self_assessment18

Sample output showing the full command-line arguments for a running kubelet process.

```text

UID          PID    PPID  C STIME TTY          TIME CMD  

root        2281    2254  2 19:13 ?        00:00:04 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key  

```

--------------------------------

### Example Kubelet Process Output

Source: https://docs.rke2.io/security/cis_self_assessment18

Sample output showing the command-line arguments for a running kubelet process.

```text
UID          PID    PPID  C STIME TTY          TIME CMD  

root        2281    2254  2 19:13 ?        00:00:04 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key  
```

--------------------------------

### Install RKE2 Agent

Source: https://docs.rke2.io/datastore/external

Command to install the RKE2 agent using the installation script.

```bash
curl -sfL https://get.rke2.io | INSTALL_RKE2_TYPE="agent" sh -  
```

--------------------------------

### Start RemoteAccess Service

Source: https://docs.rke2.io/networking/windows_bgp

Start the RemoteAccess service to enable routing functionality.

```powershell
Start-Service RemoteAccess
```

--------------------------------

### Install Windows RemoteAccess Features

Source: https://docs.rke2.io/networking/windows_bgp

Install the necessary Windows features for routing and remote access.

```powershell
Install-WindowsFeature RemoteAccess  

Install-WindowsFeature RSAT-RemoteAccess-PowerShell  

Install-WindowsFeature Routing
```

--------------------------------

### Start RKE2 Service

Source: https://docs.rke2.io/datastore/backup_restore

Command to start the RKE2 server service after the restore process is complete.

```bash
systemctl start rke2-server
```

--------------------------------

### View kube-apiserver process output

Source: https://docs.rke2.io/security/cis_self_assessment18

Example output showing the active arguments for the kube-apiserver process, including the kubelet client certificate and key paths.

```text

UID          PID    PPID  C STIME TTY          TIME CMD  

root        2550    2500 12 19:13 ?        00:00:15 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key  


```

--------------------------------

### Create RKE2 Directories

Source: https://docs.rke2.io/install/windows_airgap

Sets up the necessary directory structure for RKE2 binaries and images.

```powershell
New-Item -Type Directory c:\usr\local\bin -Force

New-Item -Type Directory c:\var\lib\rancher\rke2\bin -Force
```

--------------------------------

### Verify GPU Operator Installation

Source: https://docs.rke2.io/add-ons/gpu_operators

Commands to verify driver detection, resource allocation, and runtime binary installation.

```bash
kubectl get node $NODENAME -o jsonpath='{.metadata.labels}' |  grep "nvidia.com"  
```

```bash
kubectl get node $NODENAME -o jsonpath='{.status.allocatable}'  
```

```bash
ls /usr/local/nvidia/toolkit/nvidia-container-runtime  
```

```bash
grep nvidia /var/lib/rancher/rke2/agent/etc/containerd/config.toml  
```

--------------------------------

### Configure RKE2 with Multiple Files

Source: https://docs.rke2.io/install/configuration

Demonstrates how to use multiple configuration files and the '+' suffix to append values instead of overwriting them.

```yaml
# config.yaml  
token: boop  
node-label:  

  - foo=bar  

  - bar=baz  

  

  

# config.yaml.d/test1.yaml  
write-kubeconfig-mode: 600  
node-taint:  

  - alice=bob:NoExecute  

  

# config.yaml.d/test2.yaml  
write-kubeconfig-mode: 777  
node-label:  

  - other=what  

  - foo=three  
node-taint+:  

  - charlie=delta:NoSchedule  
```

```yaml
write-kubeconfig-mode: 777  
token: boop  
node-label:  

  - other=what  

  - foo=three  
node-taint:  

  - alice=bob:NoExecute  

  - charlie=delta:NoSchedule  
```

--------------------------------

### Configure RKE2 via YAML and CLI

Source: https://docs.rke2.io/install/configuration

Examples of defining RKE2 server settings using a YAML configuration file versus equivalent CLI arguments.

```yaml
write-kubeconfig-mode: "0644"  

tls-san:  

  - "foo.local"  

node-label:  

  - "foo=bar"  

  - "something=amazing"  

debug: true  
```

```bash
rke2 server \

  --write-kubeconfig-mode "0644"    \

  --tls-san "foo.local"             \

  --node-label "foo=bar"            \

  --node-label "something=amazing"  \

  --debug  
```

--------------------------------

### View kube-apiserver process output

Source: https://docs.rke2.io/security/cis_self_assessment18

Example output showing the current configuration of the running kube-apiserver process.

```text
UID          PID    PPID  C STIME TTY          TIME CMD  

root        2550    2500 12 19:13 ?        00:00:15 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key  
```

--------------------------------

### Configure RKE2 Agent on Linux

Source: https://docs.rke2.io/install/quickstart

Creates the configuration directory and initializes the config.yaml file.

```bash
mkdir -p /etc/rancher/rke2/

vim /etc/rancher/rke2/config.yaml
```

```yaml
server: https://<server>:9345

token: <token from server node>
```

--------------------------------

### Install kernel modules on RHEL 10

Source: https://docs.rke2.io/install/requirements

Required package installation to enable nf_conntrack on RHEL 10 and derivative distributions.

```bash
sudo dnf install kernel-modules-extra -y
```

--------------------------------

### Install RKE2 on SLE Micro

Source: https://docs.rke2.io/install/methods

Uses transactional-update to install RKE2 on the immutable SLE Micro filesystem, followed by a reboot.

```bash
transactional-update --no-selfupdate -d run zypper --gpg-auto-import-keys install -y rke2-server  

reboot  


```

--------------------------------

### Install System Upgrade Controller

Source: https://docs.rke2.io/upgrades/automated

Deploys the controller components including CRDs, deployment, and service accounts into the cluster.

```bash
kubectl apply -f https://github.com/rancher/system-upgrade-controller/releases/latest/download/crd.yaml -f https://github.com/rancher/system-upgrade-controller/releases/latest/download/system-upgrade-controller.yaml
```
Tokens:
Raw