RKE2: One-Click Deployment - Time To Switch From K3S!?

  Рет қаралды 33,193

Jim's Garage

Jim's Garage

Күн бұрын

K3S isn't secured by design like RKE2. Both products are created by Rancher (SUSE) but with competing objectives. However, given that RKE2 is simple to deploy, is lightweight like K3S, and comes with a raft of security benefits, isn't it time to change?
This video provides an automated install and walkthrough for RKE2.
RKE2 Instructions:
github.com/JamesTurland/JimsG...
Rancher Page:
docs.rke2.io/install/quickstart
Recommended Hardware: github.com/JamesTurland/JimsG...
Discord: / discord
Twitter: / jimsgarage_
Reddit: / jims-garage
GitHub: github.com/JamesTurland/JimsG...
00:00 - Introduction to RKE2 & Security Benefits
03:03 - Prerequisites
05:20 - Script Walkthrough
15:52 - Deploying RKE2
18:05 - Accessing Rancher
20:40 - Outro

Пікірлер: 121
@BromZlab
@BromZlab 8 ай бұрын
Nice😊. I had to try it. Workes on the first try. Good job again jim 👍
@Jims-Garage
@Jims-Garage 8 ай бұрын
Awesome, thanks for confirming 😄
@josesantiago3216
@josesantiago3216 4 ай бұрын
Great video! Tested today and fully working. Good job Jim!!
@Jims-Garage
@Jims-Garage 4 ай бұрын
Glad to help
@raulgil8207
@raulgil8207 8 ай бұрын
there is no enough likes for your video, the amount of work that you put into this is incredible, thanks, i'm waiting for my new homelab server to try all of this.
@Jims-Garage
@Jims-Garage 8 ай бұрын
Thanks so much, really appreciate the feedback. Exciting times getting your new homelab, jump on Discord if you need any help.
@raulgil8207
@raulgil8207 7 ай бұрын
@@Jims-Garage now that i have my proxmox server, i tried this script, but in the end the kubectl does not connect to the vip ip address, i did the complete process 3 times, with fresh vms, it still gives the same error, any ideas?
@Jims-Garage
@Jims-Garage 7 ай бұрын
@@raulgil8207If you can come on Discord and show the output of your logs that would help. I suspect it's failing early on. Are you able to manually SSH with certificates?
@raulgil8207
@raulgil8207 7 ай бұрын
@@Jims-Garage thanks, i will do that, and yes, i was able to ssh with certificate into the vip Ip
@chrisumali9841
@chrisumali9841 8 ай бұрын
Thanks for the demo and info, have a great day
@Jims-Garage
@Jims-Garage 8 ай бұрын
Thanks, Chris. You too.
@terjemoen8193
@terjemoen8193 6 ай бұрын
Well delivered and easy to comprehend, thanks again for awesome content!
@Jims-Garage
@Jims-Garage 6 ай бұрын
Thanks 👍
@draukuxan1081
@draukuxan1081 8 ай бұрын
Interesting. I'll be giving this a shot, I hadn't heard of RKE2 before. Thanks for the video!
@Jims-Garage
@Jims-Garage 8 ай бұрын
You're welcome, it's the hidden gem
@crc-error-7968
@crc-error-7968 6 ай бұрын
Thank you and happy new year! 🥂🍾 I can confirm that both rke2 and longhorn works even on debian12 cloud generic (with a little bit of tuning of the script - like the ssh - and the installation of open-iscsi on the workers)
@Jims-Garage
@Jims-Garage 6 ай бұрын
That's good news, thanks for confirming.
@jdncat
@jdncat 3 ай бұрын
Thank you! Will give this a try
@Jims-Garage
@Jims-Garage 3 ай бұрын
Did it work?
@reneb5222
@reneb5222 8 ай бұрын
Great one Jim. Thanks for this great video. I was just about to hack your k3s script to use RKE2. There is already lots of content about this version. There's a big move going on from K3s to RKE2.
@Jims-Garage
@Jims-Garage 8 ай бұрын
Thanks, that's good to know. It seems like an obvious migration given the benefits and similarities with K3S. I'm going to dual cluster for a while in case of issues (so far, so good).
@simuman
@simuman 3 ай бұрын
Hey Jim, great video and script again. I'm on my own homelab journey too and your videos have helped me so much, as I'm also a Linux newb as well (know enough to be dangerous). I'm late to this video because I had some issues with some equipment. Thought I'd just jump in the deep end with this as had already followed your k3s setup but figured I'd keep upto date. Script worked perfectly after I figured out an issue with something two feet in front of keyboard as I copied and pasted your script like yourself into WinSCP, but could not get it to run with a error message "/bin/sh^M: bad interpreter" till I work-out about unix format. Hope you are still using rke2 as am following along, keep up the good work.
@JPEaglesandKatz
@JPEaglesandKatz Ай бұрын
I know that must have taken quiet a lot of time getting that script to work as expected.. There are always things that we overlook hehe... Appreciate all you do and it is very helpful indeed!
@Jims-Garage
@Jims-Garage Ай бұрын
You're welcome, yes it took quite a while 😂
@nahum35
@nahum35 2 ай бұрын
Great video!!!😉Jim, are you planning on doing a tutorial of how to deploy RKE2 cluster using an Ansible playbook?
@Jims-Garage
@Jims-Garage 2 ай бұрын
I am, it'll be the climax of the Ansible series
@paulfx5019
@paulfx5019 2 ай бұрын
Hi Jim, Great video and very high success rates from the looks of the feedback, although I do have 1 concern and that is combing RKE2 & Longhorn all on the single network, I built a K3S\Longhorn cluster and experience huge performance issue due to Longhorn replication and automatic snapshotting processes....how difficult would be to segregate the storage network from the RKE2 pod and ingress network? Cheers
@Gamrin
@Gamrin 3 ай бұрын
I love this series, and it's very good for learning about kubernetes in all shapes and sizes. Excellent to see someone go through it and have an opportunity to play along. I'm wondering though, why not create a script-download-run-embed in an image like with cloud-init. Having your own github repo host the version of the script that you need to run on each node, and then having an image for every master/worker that you can apply and copy. On startup it would get the github script, and run it on first boot to set itself up within the cluster. This makes everything much more parallel, since the scalability of this script ends if you want to do - say - 10 workers and masters. Since you have to wait for each one before going on to the next one.
@Jims-Garage
@Jims-Garage 3 ай бұрын
Thanks. End goal is to have ansible which should address your point through the use of parallelism.
@zodiak6504
@zodiak6504 7 ай бұрын
I saw your script and the only thing I could think was; ANSIBLE :)
@Jims-Garage
@Jims-Garage 7 ай бұрын
Ansible is great, I just wanted to do something as simple as possible for people to get started.
@geemobile6037
@geemobile6037 5 ай бұрын
I’ve used ansible. And while I love the capabilities. I prefer your script as it has a lower bar to execute. Ansible requires learning the syntax and structure while I already understand scripts well enough.
@kristoferwohlgang
@kristoferwohlgang 4 ай бұрын
Thanks for the video, I'm really looking forward to deploying it. Do you have any video/guidance on how to setup the SSH certificates to make sure your script works as intended?
@Jason.K.O
@Jason.K.O 4 ай бұрын
it uses ssh keys you can generate them using ssh-keygen then copy them to your home directory on the admin server
@Guerilla1337
@Guerilla1337 Ай бұрын
You are the boss!
@subzizo091
@subzizo091 8 ай бұрын
Thanks once for the great videos ❤ , a little request please zoom in more when viewing the scripts the texts i mean as i am watching you from mobile 😅 , thanks
@Jims-Garage
@Jims-Garage 8 ай бұрын
Thanks, I'll try to do that. It's difficult as zooming in too much looks bad on PC...
@subzizo091
@subzizo091 8 ай бұрын
@@Jims-Garage not too much just a little bit
@MrPatrik1234567
@MrPatrik1234567 8 ай бұрын
Hello Jim, Great video. Do you know if it's possible to change the cluster IP from the default 10.43.x.x to something else, in case that range is already in use on the network?
@Jims-Garage
@Jims-Garage 8 ай бұрын
I don't believe so. However, it's an internal Kubernetes range, it will not conflict with existing external networks (much like how Docker works). You expose services through the loadbalancer defining the network range you want to use.
@alphenit
@alphenit 5 ай бұрын
I believe you can alter the internal networks trough the cluster.yaml
@xultix
@xultix 6 ай бұрын
This is cool! Would be nice to automate this with something like ansible as well
@Jims-Garage
@Jims-Garage 6 ай бұрын
Thanks. My plan is to use jet porch in the near future.
@reasonmath
@reasonmath 8 ай бұрын
Wow I can wait to build a lab to try all of this!
@Jims-Garage
@Jims-Garage 8 ай бұрын
It's a pretty awesome set-up. Hop onto Discord if you need any help 😊
@reasonmath
@reasonmath 8 ай бұрын
@@Jims-Garage I will download this on the phone and see if I can add the channel
@-rm-rf
@-rm-rf 8 ай бұрын
RKE2 Hype! RKE2 Hype!
@-rm-rf
@-rm-rf 8 ай бұрын
Script worked perfectly right away, and yeah took maybe 10 min max to install
@tolpacourt
@tolpacourt 20 күн бұрын
How many of Jim's videos do I need to search before I find where he generates the cert files? I have plain old kvm/qemu not Proxmox. I can ssh into all of my nodes using ssh keys (passwordless) from the kvm hypervisor host. What sort of certs files are expected?
@Jims-Garage
@Jims-Garage 20 күн бұрын
I simply use the certs generated by Proxmox. You should be able to use the ones you already are (or generate some new ones and use ssh-copy, I cover that in my ansible series).
@mnieri71
@mnieri71 4 ай бұрын
The script contains also metallb (not mentioned in the video). What's the reason to include both metallb and vip?
@Jims-Garage
@Jims-Garage 4 ай бұрын
Yes, I've added metallb since as kube-vip would not honour the source IP.
@geemobile6037
@geemobile6037 5 ай бұрын
Cause myself extra problems by using two sets of ssh keys. One from main pc to admin vm and from admin vm to rke cluster nodes. Had to do a round robin public key authorization on the admin node for the script to work. As I said my fault. Script worked flawlessly once I figured that out. Only took me 3 months to figure out. 😅
@Jims-Garage
@Jims-Garage 5 ай бұрын
Great, glad to hear that you made it work.
@subzizo091
@subzizo091 7 ай бұрын
thanks jim for the informative videos, is the script working with redhat OS
@Jims-Garage
@Jims-Garage 7 ай бұрын
Not sure, I haven't tested it with redhat. Let me know? 😁
@offakerala
@offakerala 8 күн бұрын
Would you be able to create a video showing how to set up RKE2 on a Raspberry Pi cluster?
@Jims-Garage
@Jims-Garage 8 күн бұрын
I would advise against it, RKE2 is too heavy for a Pi IMO
@pstoianov
@pstoianov 5 ай бұрын
What tools did you use to scan the vulnerabilities?
@Jims-Garage
@Jims-Garage 5 ай бұрын
CIS Benchmark 1.7
@WickedFalcon
@WickedFalcon 5 ай бұрын
Just a quick thought, any reason why this does not deploy as LXC on proxmox other than "security" ?
@Jims-Garage
@Jims-Garage 5 ай бұрын
Not off top of my head, although there are many reasons that could interrupt deployment (VMs are fundamentally different to LXCs). I hope to do some testing in future to enable LXCs.
@imranmanan7346
@imranmanan7346 4 ай бұрын
Hi, I've been trying out your cilium version, however it does not work. The lb-range does not exist in your cilium config and the vip is unable to get created as well. Any fixes regarding this?
@Jims-Garage
@Jims-Garage 4 ай бұрын
Not yet, that's why it's labelled with do not use. I am going to move to cilium in the near future
@imranmanan7346
@imranmanan7346 4 ай бұрын
Oh wow I don't know how I missed that. Well thank you lol. I do hope you'll release a video of it soon.@@Jims-Garage
@jacobburgin826
@jacobburgin826 5 ай бұрын
Should the local cluster not be left for rancher management abs a new cluster with workers etc be deployed separately so you aren't giving local access to all your services?
@Jims-Garage
@Jims-Garage 5 ай бұрын
In a proper production environment you want to separate clusters. In a homelab I think this is an acceptable tradeoff given most will be running Docker in a single machine.
@jacobburgin826
@jacobburgin826 5 ай бұрын
@@Jims-Garage thanks for your insight :)
@scuzzynate11
@scuzzynate11 5 ай бұрын
Hey Jim, thanks so much for the video series, super helpful! I'm having a weird issue with the script however. It's asking for the password for the admin box during running. Appears to be happening during step 3, at line 147-149. When I start typing the admin password, it displays text typed in clear text. Am I missing something obvious here? Testing using all ubuntu 2204 server nodes on top of an esxi cluster.
@scuzzynate11
@scuzzynate11 5 ай бұрын
Actually, correction. I was able to modify script with installing sshpass on all my nodes and passing through the password during that command during the install. Probably not the "right" way to do it but it seems to be working now. Strange haha.
@Jims-Garage
@Jims-Garage 5 ай бұрын
Be sure to remove passwords on the ssh keys.
@SMBICommunity
@SMBICommunity 2 ай бұрын
Yup, that entire ssh -tt $user@master1 -i ~/.ssh/$certName sudo su
@SMBICommunity
@SMBICommunity 2 ай бұрын
From what I'm seeing here, the entire: ssh -tt $user@$master1 -i ~/.ssh/$certName sudo su
@SMBICommunity
@SMBICommunity 2 ай бұрын
The entirety of Step 3: (lines 137-151) results in a prompt for the password on the admin box and then echoes that password to the screen and this entire ssh -tt ... section is never executed on master1 I am trying to run this on Synology Ubuntu VMs, all 6 created from the one image, names and IPs changed as appropriate. The SSH keys have no passphrase.
@PCMagikHomeLab
@PCMagikHomeLab 7 ай бұрын
Hi Jim, maybe its time to Terraform and Ansible to automate creating VMs :) or maybe cloudinit templates by scripts?
@Jims-Garage
@Jims-Garage 7 ай бұрын
Yes, I want to use terraform and jet porch soon. Just so much to do...
@PCMagikHomeLab
@PCMagikHomeLab 7 ай бұрын
I like Your vids, my traefik now just work with docker. Thanks to You! Next approach is kubernetes :) traefik and docker works greats, but what when i want to add separate domain with proxmox, not in docker. How to do that with Your traefik template? @@Jims-Garage
@NoBiggi
@NoBiggi 6 ай бұрын
Great video, work first time, i struggle a bit in first go, realised RAM needed Atleast 5 GB and disk space 30 GB to finish the cluster setup comfortably. My setup is behind pfsense , and i use HAProxy to offload cert and redirect to port to access all app in network. However there is some extra setup need to be done with Metallb and BGP mode. I have the pfsense side ready to accept the request from Metallb using FSS plugin. But I am not sure how/what to modify the Metallb to advertise the loadbalancer ip to pfsense. Any help ?
@Jims-Garage
@Jims-Garage 6 ай бұрын
Thanks. The lbrange should be a shared VIP that is dynamically assigned on service request. I haven't tested with OpnSense, but it works out of the gate with Sophos. What have you tried?
@NoBiggi
@NoBiggi 6 ай бұрын
@@Jims-Garage I have it fixed and working now, every IP given out by metallb now advertise to pfsense. i had to deploy 2 more config file , BGPAdvertisements.yaml and BGPPeers.yaml. which define all the details. and IPAddressPools.yaml has to be edited to add protocol: BGP. after that everything should work, incase any one wornering.
@NoBiggi
@NoBiggi 6 ай бұрын
@@Jims-Garage what would be the command to expose app without any certificate? my pfsense haproxy handle all https/http offloading for domain pointing. i think selfsign certificate is the reason why HAproxy doest work and i am not able to point any domain to the ip address. Thanks for your help.
@Jims-Garage
@Jims-Garage 6 ай бұрын
@@NoBiggi in the service section of service.yaml you need to specify an IP in the loadbalancerIP range. Then you should be able to access the same as you would with Docker.
@jacobburgin826
@jacobburgin826 5 ай бұрын
I found that as well, had to up the vm's from 20 to 30gb. Thankyou!
@crc-error-7968
@crc-error-7968 3 ай бұрын
Hello Jim, is your script to install RKE2 with Cilium works? Because I would like to do some tests but I am not sure if it is there but it is still "work in progress" or not (since there are some comments about kube-vip installation but without really install it)
@Jims-Garage
@Jims-Garage 3 ай бұрын
No, it doesn't work. Still on the to do list
@crc-error-7968
@crc-error-7968 3 ай бұрын
​@@Jims-Garage Thanks 👍 hope it will be soon on top of the list 😅 About kube vip, do you think it could have sense to use it at least as service lb even with cilium?
@Jims-Garage
@Jims-Garage 3 ай бұрын
@@crc-error-7968 hoping to do it with Ansible. It should replace kube-vip
@crc-error-7968
@crc-error-7968 3 ай бұрын
@@Jims-Garage Ciao Jim, just a last question to let me better understand, do you know if with Cilium is possible to assign a vip for master nodes (to allow communication between the admin machine and one - random - master node) as you did in your scripts for the installations of rke2/k3s? or, to control he cluster from the admin vm do I still need kube vip (or something similar)? So chilium will manage the cloud system side of the cluster?
@looper6120
@looper6120 3 ай бұрын
Btw how many cpu and ram you finally gave to rke2? Looks like they are more resource intensive
@Jims-Garage
@Jims-Garage 3 ай бұрын
They are, CPU about the same, but about 50% more ram from my experience
@looper6120
@looper6120 3 ай бұрын
​@@Jims-Garage Thanks, I was following your script to install rancher, but somehow the rancher got installed to only worker node, while I wanted to install them on the master nodes instead, is there a way to specify some parameters to let rancher only live on master nodes? Thanks a lot!
@Jims-Garage
@Jims-Garage 3 ай бұрын
@@looper6120 yes, remove the non-schedulable tag
@looper6120
@looper6120 3 ай бұрын
@@Jims-Garage got it, thanks! but removing the tag would allow all pods get moved to masters as well. I kinda just want rancher to be on masters, was trying to play with the taint and toleration stuff but no luck yet.. not sure if Im doing it wrong.
@Jims-Garage
@Jims-Garage 3 ай бұрын
@@looper6120 watch my videos again. Workers are tagged with worker=true and deployments reference this.
@addesigns2121
@addesigns2121 8 ай бұрын
just ran the script after 25mins it end with ::1]:8080: connect: connection refused, The connection to the server localhost:8080 was refused - did you specify the right host or port?
@Jims-Garage
@Jims-Garage 8 ай бұрын
Sounds like there's an issue with your kubeconfig. Can you run kubectl on one of the nodes? Also, what OS?
@addesigns2121
@addesigns2121 8 ай бұрын
I ran kubectl get nodes on the master1 I get this error......Command 'kubectl' not found, but can be installed with:sudo snap install kubectl...been trying this since yesterday afternoon after i checked your github I thought i was doing something wrong so I waited for the video..still same error.. i even spun new nodes at least 3 different time@@Jims-Garage
@Jims-Garage
@Jims-Garage 8 ай бұрын
@@addesigns2121 hop on Discord so I can see some error messages. Sounds like something quite simple as it appears the script is failing
@addesigns2121
@addesigns2121 8 ай бұрын
I ran kubectl get nodes on the master1 I get this error......Command 'kubectl' not found, but can be installed with:sudo snap install kubectl...been trying this since yesterday afternoon after i checked your github I thought i was doing something wrong so I waited for the video..still same error.. i even spun new nodes at least 3 different time
@xazianxtcboy69x
@xazianxtcboy69x 5 ай бұрын
0po82.00 98😊ppoooo😊😊😊pp8😊
@jsross33
@jsross33 8 ай бұрын
certificates? you mean ssh key. specifically the public key.
@Jims-Garage
@Jims-Garage 8 ай бұрын
Not sure exactly what part you are referring to (you might be right). SSH keys are certificates though.
@jsross33
@jsross33 8 ай бұрын
@@Jims-Garage sure, but no one calls them certificates. They are typically referred to as keys or collectively as a key pair. This is most likely where some of the viewers confusion is coming from.
@Jims-Garage
@Jims-Garage 8 ай бұрын
@@jsross33 Fair enough, good to hear some feedback. I'll be sure to explain terms clearly in future to avoid possible confusion.
@GriffinsAdventures
@GriffinsAdventures 8 ай бұрын
That did confuse me also. But yes SSH keys got it.@@Jims-Garage
@KD_Puvvadi
@KD_Puvvadi 3 ай бұрын
Why use script? Why not ansible? I know bash scripts are bread and butter for us. But ansible is clean and idempotent.
@Jims-Garage
@Jims-Garage 3 ай бұрын
That's why I'm doing the Ansible series now. Script helps people to understand what is happening.
@SMBICommunity
@SMBICommunity 2 ай бұрын
Can I suggest changing the following line as indicated (to pick up the actual certName)? Current: ssh-copy-id $user@node Changed: ssh-copy-id -i $certName $user@node
@Jims-Garage
@Jims-Garage 2 ай бұрын
Thanks, I think that might be updated already on GitHub, I'll double check
@SMBICommunity
@SMBICommunity 2 ай бұрын
@@Jims-Garage It wasn't a few hours ago when I copied the script.
@Jims-Garage
@Jims-Garage 2 ай бұрын
@@SMBICommunity OK, in that case I'll take a look - thanks
@suikast420
@suikast420 5 ай бұрын
Homelab -》 hashicrop nomad
@Jims-Garage
@Jims-Garage 5 ай бұрын
I have seen that, I'll try to visit in the near future. I don't believe it has the security credentials of RKE2 though.
@suikast420
@suikast420 5 ай бұрын
@@Jims-Garage Per default you yre right. But to be honest. PEr defasult the credetinal management of kubernetes is worst too. You are end up in bioth platforms to use vault. And that is the same level of security am I wrong? By the way you can use Boundary to get more secure in nomad.
@chrisumali9841
@chrisumali9841 6 ай бұрын
Thanks for the demo and info, have a great day
@Jims-Garage
@Jims-Garage 6 ай бұрын
Cheers, have a good one.
Zitadel, Single Sign On, and OAuth. It's Impressive!
24:20
Jim's Garage
Рет қаралды 37 М.
Получилось у Вики?😂 #хабибка
00:14
ХАБИБ
Рет қаралды 6 МЛН
Дибала против вратаря Легенды
00:33
Mr. Oleynik
Рет қаралды 3,9 МЛН
Don’t run Proxmox without these settings!
25:45
Christian Lempa
Рет қаралды 118 М.
k3s vs k8s: What's the difference?
5:49
Civo
Рет қаралды 36 М.
What is Rancher RKE2  with Installation and Configurations
36:48
SRE School
Рет қаралды 3,4 М.
Running your own Kubernetes cluster with Rancher
35:47
That DevOps Guy
Рет қаралды 70 М.
Low Power Cluster - Small, Efficient, BUT Powerful!
12:18
Techno Tim
Рет қаралды 170 М.
Thunderbolt Networking is FAST & CHEAP!
31:04
Jim's Garage
Рет қаралды 18 М.
How To Manage Production-Grade Kubernetes Clusters With Rancher
34:51
DevOps Toolkit
Рет қаралды 22 М.
Set up a Kubernetes cluster in under 5 minutes with Proxmox and k3s
6:25
cute mini iphone
0:34
승비니 Seungbini
Рет қаралды 5 МЛН
Игровой Комп с Авито за 4500р
1:00
ЖЕЛЕЗНЫЙ КОРОЛЬ
Рет қаралды 1,3 МЛН
ПОКУПКА ТЕЛЕФОНА С АВИТО?🤭
1:00
Корнеич
Рет қаралды 3,3 МЛН