Server Configuration Reference

This is a reference to all parameters that can be used to configure the rke2 server. Note that while this is a reference to the command line arguments, the best way to configure RKE2 is using the configuration file.

Critical Configuration Values

The following options must be set to the same value on all servers in the cluster. Failure to do so will cause new servers to fail to join the cluster.

• agent-token
• cluster-cidr
• cluster-dns
• cluster-domain
• disable-cloud-controller
• disable-kube-proxy
• egress-selector-mode
• service-cidr

Common

Flag	Description	Default	Environment Variable
config	Path to config file	/etc/rancher/rke2/config.yaml	RKE2_CONFIG_FILE
debug	Turn on debug logs	false	RKE2_DEBUG
data-dir	Folder to hold state	"/var/lib/rancher/rke2"	RKE2_DATA_DIR

Listener

Flag	Description	Default
bind-address	rke2 bind address	0.0.0.0
advertise-address	IPv4/IPv6 address that apiserver uses to advertise to members of the cluster	node-external-ip/node-ip
tls-san	Add additional hostnames or IPv4/IPv6 addresses as Subject Alternative Names on the server TLS cert
tls-san-security	Protect the server TLS cert by refusing to add Subject Alternative Names not associated with the kubernetes apiserver service, server nodes, or values of the tls-san option	true

Networking

Flag	Description	Default	Environment Variable
cluster-cidr	IPv4/IPv6 network CIDRs to use for pod IPs	10.42.0.0/16
service-cidr	IPv4/IPv6 network CIDRs to use for service IPs	10.43.0.0/16
service-node-port-range	Port range to reserve for services with NodePort visibility	"30000-32767"
cluster-dns	IPv4/IPv6 Cluster IP for coredns service. Should be in your service-cidr range	10.43.0.10
cluster-domain	Cluster Domain	"cluster.local"
egress-selector-mode	One of 'agent', 'cluster', 'pod', 'disabled'	"agent"
servicelb-namespace	Namespace of the pods for the servicelb component	"kube-system"
cni	CNI Plugins to deploy, one of none, calico, canal, cilium, flannel; optionally with multus as the first value to enable the multus meta-plugin	"canal"	RKE2_CNI
ingress-controller	Ingress Controllers to deploy, one of none, traefik, ingress-nginx; the first value will be set as the default ingress class		RKE2_INGRESS_CONTROLLER

Client

Flag	Description	Environment Variable
write-kubeconfig	Write kubeconfig for admin client to this file	RKE2_KUBECONFIG_OUTPUT
write-kubeconfig-mode	Write kubeconfig with this mode	RKE2_KUBECONFIG_MODE
write-kubeconfig-group	Write kubeconfig with this group	RKE2_KUBECONFIG_GROUP

Helm

Flag	Description
helm-controller-arg	Customized flag for helm-controller process

Cluster

Flag	Description	Environment Variable
token	Shared secret used to join a server or agent to a cluster	RKE2_TOKEN
token-file	File containing the token	RKE2_TOKEN_FILE
agent-token	Shared secret used to join agents to the cluster, but not servers	RKE2_AGENT_TOKEN
agent-token-file	File containing the agent secret	RKE2_AGENT_TOKEN_FILE
server	Server to connect to, used to join a cluster	RKE2_URL
cluster-reset	Forget all peers and become sole member of a new cluster	RKE2_CLUSTER_RESET

Database

Flag	Description	Default	Environment Variable
cluster-reset-restore-path	Path to snapshot file to be restored
datastore-endpoint	Specify etcd, NATS, MySQL, Postgres, or SQLite data source name	sqlite	RKE2_DATASTORE_ENDPOINT
datastore-cafile	TLS Certificate Authority file used to secure datastore backend communication		RKE2_DATASTORE_CAFILE
datastore-certfile	TLS certification file used to secure datastore backend communication		RKE2_DATASTORE_CERTFILE
datastore-keyfile	TLS key file used to secure datastore backend communication		RKE2_DATASTORE_KEYFILE
etcd-expose-metrics	Expose etcd metrics to client interface	false
etcd-disable-snapshots	Disable automatic etcd snapshots	false
etcd-snapshot-name	Set the base name of etcd snapshots, appended with UNIX timestamp	"etcd-snapshot"
etcd-snapshot-schedule-cron	Snapshot interval time in cron spec. eg. every 5 hours '0 */5 * * *'	"0 */12 * * *"
etcd-snapshot-reconcile-interval	Snapshot reconcile interval	10m0s
etcd-snapshot-retention	Number of local snapshots to retain on each server node	5
etcd-snapshot-dir	Directory to save db snapshots.	${data-dir}/server/db/snapshots
etcd-snapshot-compress	Compress etcd snapshot	false

S3 etcd Snapshot Storage

Flag	Description	Default	Environment Variable
etcd-s3	Enable backup to S3	false
etcd-s3-endpoint	S3 endpoint url	"s3.amazonaws.com"
etcd-s3-endpoint-ca	S3 custom CA cert to connect to S3 endpoint
etcd-s3-skip-ssl-verify	Disables S3 SSL certificate validation	false
etcd-s3-access-key	S3 access key		AWS_ACCESS_KEY_ID
etcd-s3-secret-key	S3 secret key		AWS_SECRET_ACCESS_KEY
etcd-s3-session-token	S3 session token		AWS_SESSION_TOKEN
etcd-s3-bucket	S3 bucket name
etcd-s3-bucket-lookup-type	S3 bucket lookup type, one of 'auto', 'dns', 'path'; default is 'auto' if not set
etcd-s3-region	S3 region / bucket location (optional)	"us-east-1"
etcd-s3-folder	S3 folder
etcd-s3-retention	Number of S3 snapshots to retain in the configured region, bucket, and prefix	5
etcd-s3-proxy	Proxy server to use when connecting to S3, overriding any proxy-releated environment variables
etcd-s3-config-secret	Name of secret in the kube-system namespace used to configure S3, if etcd-s3 is enabled and no other etcd-s3 options are set
etcd-s3-insecure	Disables S3 over HTTPS	false
etcd-s3-timeout	S3 timeout	5m0s

Flags

Flag	Description
kube-apiserver-arg	Customized flag for kube-apiserver process
etcd-arg	Customized flag for etcd process
kube-controller-manager-arg	Customized flag for kube-controller-manager process
kube-scheduler-arg	Customized flag for kube-scheduler process
kube-cloud-controller-manager-arg	Customized flag for kube-cloud-controller-manager process

Components

Flag	Description	Default	Environment Variable
disable	Do not deploy packaged components and delete any deployed components (valid items: rke2-coredns, rke2-metrics-server, rke2-snapshot-controller, rke2-snapshot-controller-crd, rke2-snapshot-validation-webhook, rke2-security-responder, rke2-gateway-api-crd)
disable-scheduler	Disable Kubernetes default scheduler	false
disable-cloud-controller	Disable rke2 default cloud controller manager	false
disable-kube-proxy	Disable running kube-proxy	false
embedded-registry	Enable embedded distributed container registry; requires use of embedded containerd; when enabled agents will also listen on the supervisor port	false
enable-servicelb	Enable rke2 default cloud controller manager's service controller	false	RKE2_ENABLE_SERVICELB
control-plane-resource-requests	Control Plane resource requests		RKE2_CONTROL_PLANE_RESOURCE_REQUESTS
control-plane-resource-limits	Control Plane resource limits		RKE2_CONTROL_PLANE_RESOURCE_LIMITS
control-plane-probe-configuration	Control Plane Probe configuration		RKE2_CONTROL_PLANE_PROBE_CONFIGURATION
kube-apiserver-extra-mount	kube-apiserver extra volume mounts		RKE2_KUBE_APISERVER_EXTRA_MOUNT
kube-scheduler-extra-mount	kube-scheduler extra volume mounts		RKE2_KUBE_SCHEDULER_EXTRA_MOUNT
kube-controller-manager-extra-mount	kube-controller-manager extra volume mounts		RKE2_KUBE_CONTROLLER_MANAGER_EXTRA_MOUNT
kube-proxy-extra-mount	kube-proxy extra volume mounts		RKE2_KUBE_PROXY_EXTRA_MOUNT
etcd-extra-mount	etcd extra volume mounts		RKE2_ETCD_EXTRA_MOUNT
cloud-controller-manager-extra-mount	cloud-controller-manager extra volume mounts		RKE2_CLOUD_CONTROLLER_MANAGER_EXTRA_MOUNT
kube-apiserver-extra-env	kube-apiserver extra environment variables		RKE2_KUBE_APISERVER_EXTRA_ENV
kube-scheduler-extra-env	kube-scheduler extra environment variables		RKE2_KUBE_SCHEDULER_EXTRA_ENV
kube-controller-manager-extra-env	kube-controller-manager extra environment variables		RKE2_KUBE_CONTROLLER_MANAGER_EXTRA_ENV
kube-proxy-extra-env	kube-proxy extra environment variables		RKE2_KUBE_PROXY_EXTRA_ENV
etcd-extra-env	etcd extra environment variables		RKE2_ETCD_EXTRA_ENV
cloud-controller-manager-extra-env	cloud-controller-manager extra environment variables		RKE2_CLOUD_CONTROLLER_MANAGER_EXTRA_ENV

Image

Flag	Description	Environment Variable
kube-apiserver-image	Override image to use for kube-apiserver	RKE2_KUBE_APISERVER_IMAGE
kube-controller-manager-image	Override image to use for kube-controller-manager	RKE2_KUBE_CONTROLLER_MANAGER_IMAGE
cloud-controller-manager-image	Override image to use for cloud-controller-manager	RKE2_CLOUD_CONTROLLER_MANAGER_IMAGE
kube-proxy-image	Override image to use for kube-proxy	RKE2_KUBE_PROXY_IMAGE
kube-scheduler-image	Override image to use for kube-scheduler	RKE2_KUBE_SCHEDULER_IMAGE
pause-image	Override image to use for pause	RKE2_PAUSE_IMAGE
runtime-image	Override image to use for runtime binaries (containerd, kubectl, crictl, etc)	RKE2_RUNTIME_IMAGE
etcd-image	Override image to use for etcd	RKE2_ETCD_IMAGE

Cloud Provider

Flag	Description	Default	Environment Variable
cloud-provider-name	Cloud provider name		RKE2_CLOUD_PROVIDER_NAME
cloud-provider-config	Cloud provider configuration file path		RKE2_CLOUD_PROVIDER_CONFIG
node-name-from-cloud-provider-metadata	Set node name from instance metadata service hostname	false	RKE2_NODE_NAME_FROM_CLOUD_PROVIDER_METADATA

Security

Flag	Description	Environment Variable
profile	Validate system configuration against the selected benchmark (valid items: cis, etcd)	RKE2_CIS_PROFILE
audit-policy-file	Path to the file that defines the audit policy configuration	RKE2_AUDIT_POLICY_FILE
pod-security-admission-config-file	Path to the file that defines Pod Security Admission configuration	RKE2_POD_SECURITY_ADMISSION_CONFIG_FILE

Experimental

Flag	Description	Default	Environment Variable
supervisor-metrics	Enable serving rke2 internal metrics on the supervisor port; when enabled agents will also listen on the supervisor port	false
enable-pprof	Enable pprof endpoint on supervisor port	false
secrets-encryption-provider	Secret encryption provider (valid values: 'aescbc', 'secretbox')	"aescbc"
kubelet-path	Override kubelet binary path		RKE2_KUBELET_PATH

Agent/Node

Flag	Description	Default	Environment Variable
node-name	Node name		RKE2_NODE_NAME
with-node-id	Append id to node name	false
node-label	Registering and starting kubelet with set of labels
node-taint	Registering kubelet with set of taints
image-credential-provider-bin-dir	The path to the directory where credential provider plugin binaries are located	"/var/lib/rancher/credentialprovider/bin"
image-credential-provider-config	The path to the credential provider plugin config file	"/var/lib/rancher/credentialprovider/config.yaml"
protect-kernel-defaults	Kernel tuning behavior. If set, error if kernel tunables are different than kubelet defaults.	false
selinux	Enable SELinux in containerd	false	RKE2_SELINUX
lb-server-port	Local port for supervisor client load-balancer. If the supervisor and apiserver are not colocated an additional port 1 less than this port will also be used for the apiserver client load-balancer.	6444	RKE2_LB_SERVER_PORT

Agent/Runtime

Flag	Description	Default	Environment Variable
container-runtime-endpoint	Disable embedded containerd and use the CRI socket at the given path
default-runtime	Set the default runtime in containerd
snapshotter	Override default containerd snapshotter	"overlayfs"
private-registry	Private registry configuration file	"/etc/rancher/rke2/registries.yaml"
system-default-registry	Private registry to be used for all system images		RKE2_SYSTEM_DEFAULT_REGISTRY

Agent/Containerd

Flag	Description	Default
disable-default-registry-endpoint	Disables containerd's fallback default registry endpoint when a mirror is configured for that registry	false
nonroot-devices	Allows non-root pods to access devices by setting device_ownership_from_security_context=true in the containerd CRI config	false

Agent/Networking

Flag	Description	Environment Variable
node-ip	IPv4/IPv6 addresses to advertise for node
node-external-ip	IPv4/IPv6 external IP addresses to advertise for node
node-internal-dns	internal DNS addresses to advertise for node
node-external-dns	external DNS addresses to advertise for node
resolv-conf	Kubelet resolv.conf file	RKE2_RESOLV_CONF

Agent/Flags

Flag	Description
kubelet-arg	Customized flag for kubelet process
kube-proxy-arg	Customized flag for kube-proxy process