RKE2 Deployment

Overview

RKE2 (also known as RKE Government) is Rancher's next-generation Kubernetes distribution focused on security and compliance. It deploys a fully conformant Kubernetes cluster using a single binary that manages containerd, kubelet, kube-proxy, and control plane components as static pods. Unlike Kubespray (which orchestrates kubeadm via Ansible), RKE2 is a self-contained installer that handles everything from container runtime to CNI in a single process.

Core principle: RKE2 is security-first -- it ships with CIS Benchmark compliance, FIPS 140-2 support via BoringCrypto, and SELinux policies out of the box. Everything runs on containerd with minimal host OS dependencies.

When to Use

• Deploying new Kubernetes clusters with RKE2
• Setting up RKE2 server (control plane) and agent (worker) nodes
• Configuring built-in Helm chart addons (Canal, CoreDNS, metrics-server, ingress-nginx)
• Customizing CNI and addon behavior via HelmChartConfig manifests
• Building CIS-hardened or FIPS-compliant clusters

Not for: Kubespray-based deployments (use kubespray-deployment), RKE2 upgrades and day-2 operations (use rke2-operations), air-gapped RKE2 installations (see RKE2 documentation for tarball-based offline install)

Quick Reference