rke2-deployment
RKE2 Deployment
Overview
RKE2 (also known as RKE Government) is Rancher's next-generation Kubernetes distribution focused on security and compliance. It deploys a fully conformant Kubernetes cluster using a single binary that manages containerd, kubelet, kube-proxy, and control plane components as static pods. Unlike Kubespray (which orchestrates kubeadm via Ansible), RKE2 is a self-contained installer that handles everything from container runtime to CNI in a single process.
Core principle: RKE2 is security-first -- it ships with CIS Benchmark compliance, FIPS 140-2 support via BoringCrypto, and SELinux policies out of the box. Everything runs on containerd with minimal host OS dependencies.
When to Use
- Deploying new Kubernetes clusters with RKE2
- Setting up RKE2 server (control plane) and agent (worker) nodes
- Configuring built-in Helm chart addons (Canal, CoreDNS, metrics-server, ingress-nginx)
- Customizing CNI and addon behavior via HelmChartConfig manifests
- Building CIS-hardened or FIPS-compliant clusters
Not for: Kubespray-based deployments (use kubespray-deployment), RKE2 upgrades and day-2 operations (use rke2-operations), air-gapped RKE2 installations (see RKE2 documentation for tarball-based offline install)