This document provides prescriptive guidance for hardening a production installation of K3s. It outlines the configurations and controls required to address Kubernetes benchmark controls from the Center for Internet Security (CIS). K3s has
This document is a companion to the K3s security hardening guide. The hardening guide provides prescriptive guidance for hardening a production installation of K3s, and this benchmark guide is meant to help you evaluate the level of securit…
When deploying an application that needs to retain data, you’ll need to create persistent storage. Persistent storage allows you to store application data external from the pod running your application. This storage practice allows you to m…
This page focuses on the options that are commonly used when setting up K3s for the first time. Refer to the documentation on Advanced Options and Configuration and the server and agent command documentation for more in-depth coverage. As m…
Uninstalling K3s may cause data loss! If you installed K3s using the installation script, a script to uninstall K3s was generated during installation. Running the uninstall script stops K3s and all running pods, and deletes the local cluste…
Starting the K3s server with --cluster-init will run all control-plane components, including the apiserver, controller-manager, scheduler, and etcd. It is possible to disable specific components in order to split the control-plane and etcd
K3s client and server certificates are valid for 365 days from their date of issuance. Any certificates that are expired or within 120 days of expiring are automatically renewed every time K3s starts. This renewal reuses the existing keys,
This section describes how to install an external load balancer in front of a High Availability (HA) K3s cluster's server nodes. Two examples are provided: Nginx and HAProxy. External load-balancers should not be confused with the embedded
This guide walks you through installing K3s in an air-gapped environment using a three-step process. Each image loading method has different requirements and is suited for different air-gapped scenarios. Choose the method that best fits you…
This page describes K3s network configuration options, including configuration or replacement of Flannel, and configuring IPv6 or dualStack. Flannel is a lightweight provider of layer 3 network fabric that implements the Kubernetes Containe…
Kubernetes 1.36 has officially landed! Following our continuous commitment to providing a lightweight yet production-grade Kubernetes distribution, the K3s team and community have put together another incredible milestone release. Here is w…
Containerd can be configured to connect to private registries and use them to pull images as needed by the kubelet. Upon startup, K3s will check to see if /etc/rancher/k3s/registries.yaml exists. If so, the registry configuration contained