Setting Up RKE2 on Rocky Linux

RKE2 is Rancher’s Kubernetes distribution. These are my notes for setting up an RKE2 cluster on Rocky Linux, using the Rancher China mirror for installation. If the nodes cannot reach Docker Hub, also see RKE2 Snippets for Clusters Without Docker Hub Access.

Prepare the base server

This script disables SELinux, enables the CRB and EPEL repositories, installs common tools (including iscsi-initiator-utils and nfs-utils for storage systems such as Longhorn), and switches root’s shell to Zsh:

#!/usr/bin/env bash

# Check if SELinux is enabled
if [ $(getenforce) = "Enforcing" ]; then
    echo "SELinux is enabled. Disabling it now..."

    # Disable SELinux
    setenforce 0

    # Make sure the change is persistent
    sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config

    echo "SELinux has been disabled."
else
    echo "SELinux is already disabled."
fi

# Configure DNF
echo "Configuring DNF..."
dnf config-manager --set-enabled crb
dnf install epel-release -y
dnf update -y
dnf install openssh-server zsh git vim curl wget htop net-tools iftop dnsutils nfs-utils tmux iscsi-initiator-utils -y

# Change Shell
echo "Changing shell to ZSH..."
usermod --shell /bin/zsh root

# Enable ISCSI
systemctl enable iscsid
systemctl start iscsid

Install RKE2

Install the latest stable release from the China mirror:

curl -sfL https://rancher-mirror.rancher.cn/rke2/install.sh | INSTALL_RKE2_MIRROR=cn sh -

Or pin a version:

curl -sfL https://rancher-mirror.rancher.cn/rke2/install.sh | INSTALL_RKE2_MIRROR=cn INSTALL_RKE2_VERSION=v1.30.5+rke2r1 sh -

Write the configuration described below before starting the service for the first time, then start it:

systemctl enable --now rke2-server

The kubeconfig is written to /etc/rancher/rke2/rke2.yaml, and kubectl, ctr and crictl are installed in /var/lib/rancher/rke2/bin.

Configure a registry mirror

/etc/rancher/rke2/registries.yaml tells containerd which mirror to use for each registry:

mirrors:
  docker.io:
    endpoint:
      - "https://registry.example.com:5000"

Create /etc/rancher/rke2/config.yaml

/etc/rancher/rke2/config.yaml holds the node’s configuration:

advertise-address: <node-ip>
node-ip: <node-ip>
service-node-port-range: 30000-40000
cni: canal
kubelet-arg:
  - "--max-pods=200"
system-default-registry: "registry.example.com"

Join more nodes

On the first server, read the cluster token from /var/lib/rancher/rke2/server/node-token. On each additional node, install RKE2 the same way and point it at the first server in /etc/rancher/rke2/config.yaml:

server: https://10.168.1.100:9345
token: <node-token>
kubelet-arg:
  - "--max-pods=200"

10.168.1.100 is the first server’s address. Start rke2-server on additional control-plane nodes, or rke2-agent on worker nodes. For workers, run the installer with INSTALL_RKE2_TYPE=agent.

ctr and crictl

ctr needs the containerd socket address and the k8s.io namespace:

ctr -n k8s.io --address /run/k3s/containerd/containerd.sock <your_command>

crictl reads its endpoints from /etc/crictl.yaml:

runtime-endpoint: unix:///run/k3s/containerd/containerd.sock
image-endpoint: unix:///run/k3s/containerd/containerd.sock
timeout: 10
debug: false