Server Configuration Reference

config

Path to config file

/etc/rancher/rke2/config.yaml

RKE2_CONFIG_FILE

debug

Turn on debug logs

RKE2_DEBUG

data-dir

Folder to hold state

"/var/lib/rancher/rke2"

bind-address

rke2 bind address

0.0.0.0

advertise-address

IPv4/IPv6 address that apiserver uses to advertise to members of the cluster

node-external-ip/node-ip

tls-san

Add additional hostnames or IPv4/IPv6 addresses as Subject Alternative Names on the server TLS cert

tls-san-security

Protect the server TLS cert by refusing to add Subject Alternative Names not associated with the kubernetes apiserver service, server nodes, or values of the tls-san option

true

cluster-cidr

IPv4/IPv6 network CIDRs to use for pod IPs

10.42.0.0/16

service-cidr

IPv4/IPv6 network CIDRs to use for service IPs

10.43.0.0/16

service-node-port-range

Port range to reserve for services with NodePort visibility

"30000-32767"

cluster-dns

IPv4 Cluster IP for coredns service. Should be in your service-cidr range

10.43.0.10

cluster-domain

Cluster Domain

"cluster.local"

egress-selector-mode

One of 'agent', 'cluster', 'pod', 'disabled'

"agent"

servicelb-namespace

Namespace of the pods for the servicelb component

"kube-system"

cni

CNI Plugins to deploy, one of none, calico, canal, cilium; optionally with multus as the first value to enable the multus meta-plugin

canal

RKE2_CNI

write-kubeconfig

Write kubeconfig for admin client to this file

RKE2_KUBECONFIG_OUTPUT

write-kubeconfig-mode

Write kubeconfig with this mode

RKE2_KUBECONFIG_MODE

helm-job-image

Default image to use for helm jobs

token

Shared secret used to join a server or agent to a cluster

RKE2_TOKEN

token-file

File containing the token

RKE2_TOKEN_FILE

agent-token

Shared secret used to join agents to the cluster, but not servers

RKE2_AGENT_TOKEN

agent-token-file

File containing the agent secret

RKE2_AGENT_TOKEN_FILE

server

Server to connect to, used to join a cluster

RKE2_URL

cluster-reset

Forget all peers and become sole member of a new cluster

RKE2_CLUSTER_RESET

cluster-reset-restore-path

Path to snapshot file to be restored

etcd-expose-metrics

Expose etcd metrics to client interface.

false

etcd-disable-snapshots

Disable automatic etcd snapshots

etcd-snapshot-name

Set the base name of etcd snapshots

etcd-snapshot-<unix-timestamp>)

etcd-snapshot-schedule-cron

Snapshot interval time in cron spec. eg. every 5 hours '0 */5 * * *'

"0 */12 * * *"

etcd-snapshot-retention

Number of snapshots to retain

5

etcd-snapshot-dir

Directory to save db snapshots.

${data-dir}/db/snapshots

etcd-snapshot-compress

Compress etcd snapshot

etcd-s3

Enable backup to S3

etcd-s3-endpoint

S3 endpoint url

"s3.amazonaws.com"

etcd-s3-endpoint-ca

S3 custom CA cert to connect to S3 endpoint

etcd-s3-skip-ssl-verify

Disables S3 SSL certificate validation

etcd-s3-access-key

S3 access key

AWS_ACCESS_KEY_ID

etcd-s3-secret-key

S3 secret key

AWS_SECRET_ACCESS_KEY

etcd-s3-bucket

S3 bucket name

etcd-s3-region

S3 region / bucket location (optional)

"us-east-1"

etcd-s3-folder

S3 folder

etcd-s3-insecure

Disables S3 over HTTPS

etcd-s3-timeout

S3 timeout

5m0s

kube-apiserver-arg

Customized flag for kube-apiserver process

etcd-arg

Customized flag for etcd process

kube-controller-manager-arg

Customized flag for kube-controller-manager process

kube-scheduler-arg

Customized flag for kube-scheduler process

kube-cloud-controller-manager-arg

Customized flag for kube-cloud-controller-manager process

disable

Do not deploy packaged components and delete any deployed components (valid items: rke2-coredns, rke2-ingress-nginx, rke2-metrics-server)

disable-scheduler

Disable Kubernetes default scheduler

disable-cloud-controller

Disable rke2 default cloud controller manager

disable-kube-proxy

Disable running kube-proxy

enable-servicelb

Enable rke2 default cloud controller manager’s service controller

RKE2_ENABLE_SERVICELB

control-plane-resource-requests

Control Plane resource requests

RKE2_CONTROL_PLANE_RESOURCE_REQUESTS

control-plane-resource-limits

Control Plane resource limits

RKE2_CONTROL_PLANE_RESOURCE_LIMITS

control-plane-probe-configuration

Control Plane Probe configuration

RKE2_CONTROL_PLANE_PROBE_CONFIGURATION

kube-apiserver-extra-mount

kube-apiserver extra volume mounts

RKE2_KUBE_APISERVER_EXTRA_MOUNT

kube-scheduler-extra-mount

kube-scheduler extra volume mounts

RKE2_KUBE_SCHEDULER_EXTRA_MOUNT

kube-controller-manager-extra-mount

kube-controller-manager extra volume mounts

RKE2_KUBE_CONTROLLER_MANAGER_EXTRA_MOUNT

kube-proxy-extra-mount

kube-proxy extra volume mounts

RKE2_KUBE_PROXY_EXTRA_MOUNT

etcd-extra-mount

etcd extra volume mounts

RKE2_ETCD_EXTRA_MOUNT

cloud-controller-manager-extra-mount

cloud-controller-manager extra volume mounts

RKE2_CLOUD_CONTROLLER_MANAGER_EXTRA_MOUNT

kube-apiserver-extra-env

kube-apiserver extra environment variables

RKE2_KUBE_APISERVER_EXTRA_ENV

kube-scheduler-extra-env

kube-scheduler extra environment variables

RKE2_KUBE_SCHEDULER_EXTRA_ENV

kube-controller-manager-extra-env

kube-controller-manager extra environment variables

RKE2_KUBE_CONTROLLER_MANAGER_EXTRA_ENV

kube-proxy-extra-env

kube-proxy extra environment variables

RKE2_KUBE_PROXY_EXTRA_ENV

etcd-extra-env

etcd extra environment variables

RKE2_ETCD_EXTRA_ENV

cloud-controller-manager-extra-env

cloud-controller-manager extra environment variables

RKE2_CLOUD_CONTROLLER_MANAGER_EXTRA_ENV

kube-apiserver-image

Override image to use for kube-apiserver

RKE2_KUBE_APISERVER_IMAGE

kube-controller-manager-image

Override image to use for kube-controller-manager

RKE2_KUBE_CONTROLLER_MANAGER_IMAGE

cloud-controller-manager-image

Override image to use for cloud-controller-manager

RKE2_CLOUD_CONTROLLER_MANAGER_IMAGE

kube-proxy-image

Override image to use for kube-proxy

RKE2_KUBE_PROXY_IMAGE

kube-scheduler-image

Override image to use for kube-scheduler

RKE2_KUBE_SCHEDULER_IMAGE

pause-image

Override image to use for pause

RKE2_PAUSE_IMAGE

runtime-image

Override image to use for runtime binaries (containerd, kubectl, crictl, etc)

RKE2_RUNTIME_IMAGE

etcd-image

Override image to use for etcd

RKE2_ETCD_IMAGE

cloud-provider-name

Cloud provider name

RKE2_CLOUD_PROVIDER_NAME

cloud-provider-config

Cloud provider configuration file path

RKE2_CLOUD_PROVIDER_CONFIG

profile

Validate system configuration against the selected benchmark (valid items: cis, cis-1.23 (deprecated))

RKE2_CIS_PROFILE

audit-policy-file

Path to the file that defines the audit policy configuration

RKE2_AUDIT_POLICY_FILE

pod-security-admission-config-file

Path to the file that defines Pod Security Admission configuration

RKE2_POD_SECURITY_ADMISSION_CONFIG_FILE

embedded-registry

Enable embedded distributed container registry; requires use of embedded containerd

enable-pprof

Enable pprof endpoint on supervisor port

kubelet-path

Override kubelet binary path

RKE2_KUBELET_PATH

node-name

Node name

RKE2_NODE_NAME

with-node-id

Append id to node name

node-label

Registering and starting kubelet with set of labels

node-taint

Registering kubelet with set of taints

image-credential-provider-bin-dir

The path to the directory where credential provider plugin binaries are located

"/var/lib/rancher/credentialprovider/bin"

image-credential-provider-config

The path to the credential provider plugin config file

"/var/lib/rancher/credentialprovider/config.yaml"

protect-kernel-defaults

Kernel tuning behavior. If set, error if kernel tunables are different than kubelet defaults.

selinux

Enable SELinux in containerd

RKE2_SELINUX

lb-server-port

Local port for supervisor client load-balancer. If the supervisor and apiserver are not colocated an additional port 1 less than this port will also be used for the apiserver client load-balancer.

6444

RKE2_LB_SERVER_PORT

container-runtime-endpoint

Disable embedded containerd and use the CRI socket at the given path; when used with --docker this sets the docker socket path

default-runtime

Set the default runtime in containerd

snapshotter

Override default containerd snapshotter

"overlayfs"

private-registry

Private registry configuration file

"/etc/rancher/rke2/registries.yaml"

system-default-registry

Private registry to be used for all system images

RKE2_SYSTEM_DEFAULT_REGISTRY

disable-default-registry-endpoint

Disables containerd’s fallback default registry endpoint when a mirror is configured for that registry

node-ip

IPv4/IPv6 addresses to advertise for node

node-external-ip

IPv4/IPv6 external IP addresses to advertise for node

resolv-conf

Kubelet resolv.conf file

RKE2_RESOLV_CONF

kubelet-arg

Customized flag for kubelet process

kube-proxy-arg

Customized flag for kube-proxy process