Agent Configuration Reference

config

Path to config file

/etc/rancher/rke2/config.yaml

RKE2_CONFIG_FILE

debug

Turn on debug logs

false

RKE2_DEBUG

data-dir

Folder to hold state

"/var/lib/rancher/rke2"

RKE2_DATA_DIR

token

Token to use for authentication

RKE2_TOKEN

token-file

Token file to use for authentication

RKE2_TOKEN_FILE

server

Server to connect to

RKE2_URL

bind-address

rke2 bind address

0.0.0.0

kube-apiserver-image

Override image to use for kube-apiserver

RKE2_KUBE_APISERVER_IMAGE

kube-controller-manager-image

Override image to use for kube-controller-manager

RKE2_KUBE_CONTROLLER_MANAGER_IMAGE

cloud-controller-manager-image

Override image to use for cloud-controller-manager

RKE2_CLOUD_CONTROLLER_MANAGER_IMAGE

kube-proxy-image

Override image to use for kube-proxy

RKE2_KUBE_PROXY_IMAGE

kube-scheduler-image

Override image to use for kube-scheduler

RKE2_KUBE_SCHEDULER_IMAGE

pause-image

Override image to use for pause

RKE2_PAUSE_IMAGE

runtime-image

Override image to use for runtime binaries (containerd, kubectl, crictl, etc)

RKE2_RUNTIME_IMAGE

etcd-image

Override image to use for etcd

RKE2_ETCD_IMAGE

cloud-provider-name

Cloud provider name

RKE2_CLOUD_PROVIDER_NAME

cloud-provider-config

Cloud provider configuration file path

RKE2_CLOUD_PROVIDER_CONFIG

node-name-from-cloud-provider-metadata

Set node name from instance metadata service hostname

false

RKE2_NODE_NAME_FROM_CLOUD_PROVIDER_METADATA

profile

Validate system configuration against the selected benchmark (valid items: cis, etcd)

RKE2_CIS_PROFILE

audit-policy-file

Path to the file that defines the audit policy configuration

RKE2_AUDIT_POLICY_FILE

pod-security-admission-config-file

Path to the file that defines Pod Security Admission configuration

RKE2_POD_SECURITY_ADMISSION_CONFIG_FILE

control-plane-resource-requests

Control Plane resource requests

RKE2_CONTROL_PLANE_RESOURCE_REQUESTS

control-plane-resource-limits

Control Plane resource limits

RKE2_CONTROL_PLANE_RESOURCE_LIMITS

control-plane-probe-configuration

Control Plane Probe configuration

RKE2_CONTROL_PLANE_PROBE_CONFIGURATION

kube-apiserver-extra-mount

kube-apiserver extra volume mounts

RKE2_KUBE_APISERVER_EXTRA_MOUNT

kube-scheduler-extra-mount

kube-scheduler extra volume mounts

RKE2_KUBE_SCHEDULER_EXTRA_MOUNT

kube-controller-manager-extra-mount

kube-controller-manager extra volume mounts

RKE2_KUBE_CONTROLLER_MANAGER_EXTRA_MOUNT

kube-proxy-extra-mount

kube-proxy extra volume mounts

RKE2_KUBE_PROXY_EXTRA_MOUNT

etcd-extra-mount

etcd extra volume mounts

RKE2_ETCD_EXTRA_MOUNT

cloud-controller-manager-extra-mount

cloud-controller-manager extra volume mounts

RKE2_CLOUD_CONTROLLER_MANAGER_EXTRA_MOUNT

kube-apiserver-extra-env

kube-apiserver extra environment variables

RKE2_KUBE_APISERVER_EXTRA_ENV

kube-scheduler-extra-env

kube-scheduler extra environment variables

RKE2_KUBE_SCHEDULER_EXTRA_ENV

kube-controller-manager-extra-env

kube-controller-manager extra environment variables

RKE2_KUBE_CONTROLLER_MANAGER_EXTRA_ENV

kube-proxy-extra-env

kube-proxy extra environment variables

RKE2_KUBE_PROXY_EXTRA_ENV

etcd-extra-env

etcd extra environment variables

RKE2_ETCD_EXTRA_ENV

cloud-controller-manager-extra-env

cloud-controller-manager extra environment variables

RKE2_CLOUD_CONTROLLER_MANAGER_EXTRA_ENV

node-name

Node name

RKE2_NODE_NAME

with-node-id

Append id to node name

false

node-label

Registering and starting kubelet with set of labels

node-taint

Registering kubelet with set of taints

image-credential-provider-bin-dir

The path to the directory where credential provider plugin binaries are located

"/var/lib/rancher/credentialprovider/bin"

image-credential-provider-config

The path to the credential provider plugin config file

"/var/lib/rancher/credentialprovider/config.yaml"

selinux

Enable SELinux in containerd

false

RKE2_SELINUX

lb-server-port

Local port for supervisor client load-balancer. If the supervisor and apiserver are not colocated an additional port 1 less than this port will also be used for the apiserver client load-balancer.

6444

RKE2_LB_SERVER_PORT

protect-kernel-defaults

Kernel tuning behavior. If set, error if kernel tunables are different than kubelet defaults.

false

container-runtime-endpoint

Disable embedded containerd and use the CRI socket at the given path

default-runtime

Set the default runtime in containerd

snapshotter

Override default containerd snapshotter

"overlayfs"

private-registry

Private registry configuration file

"/etc/rancher/rke2/registries.yaml"

disable-default-registry-endpoint

Disables containerd’s fallback default registry endpoint when a mirror is configured for that registry

false

nonroot-devices

Allows non-root pods to access devices by setting device_ownership_from_security_context=true in the containerd CRI config

false

node-ip

IPv4/IPv6 addresses to advertise for node

node-external-ip

IPv4/IPv6 external IP addresses to advertise for node

node-internal-dns

internal DNS addresses to advertise for node

node-external-dns

external DNS addresses to advertise for node

resolv-conf

Kubelet resolv.conf file

RKE2_RESOLV_CONF

kubelet-arg

Customized flag for kubelet process

kube-proxy-arg

Customized flag for kube-proxy process

enable-pprof

Enable pprof endpoint on supervisor port

false

kubelet-path

Override kubelet binary path

RKE2_KUBELET_PATH