Cloud Parts

RKE2

SUSE’s security-focused Kubernetes distribution: one binary per node, hardened defaults, FIPS-validated crypto and close alignment with upstream.

What it is
Container orchestration
Part of
Kubernetes distribution
Type
Open source
Made by
SUSE
License
Apache 2.0
Facts checked
6 October 2026
Website Source code

What it is

RKE2 (also called RKE Government) is a Kubernetes distribution from SUSE’s Rancher team. You install a single rke2 binary and run it as a server (control plane plus etcd) or an agent (worker). The binary pulls a runtime image with containerd, runc and the kubelet, then writes the API server, scheduler, controller manager and etcd as static Pods that the kubelet supervises. Agents register with a server on port 9345; the Kubernetes API stays on 6443. Embedded etcd is the default datastore, and three servers is the recommended HA setup.

It borrows its installer and supervisor from K3s, Rancher’s lightweight distribution, but stays closer to upstream Kubernetes, and unlike the older RKE1 it doesn’t depend on Docker. The difference is in the defaults: components are compiled with Go’s FIPS 140-2 validated BoringCrypto module, a profile: cis setting turns on the Pod Security and network policy controls the CIS Kubernetes Benchmark expects, and every component is scanned for CVEs in the build pipeline. Canal is the default CNI (Cilium, Calico and Flannel are bundled too), and since v1.36 new clusters get Traefik instead of the retired Ingress NGINX.

Why teams pick it

  • Hardened by default: passes most CIS Kubernetes Benchmark controls out of the box, with a published self-assessment for each version
  • FIPS 140-2 builds and a DISA STIG make it one of the few distributions that US federal and defence buyers can approve as is
  • Simple operations borrowed from K3s: one binary, one config.yaml, a bundled CNI, CoreDNS, metrics-server and ingress, and air-gapped installs from image tarballs
  • Open source under Apache 2.0, runs standalone or provisioned and upgraded by Rancher

Watch out for

  • RKE2 won’t change the host OS: CIS kernel parameters and other host-level settings are still your job
  • Switching the CNI or the cluster and service CIDRs on a running cluster isn’t supported; pick before first start or rebuild
  • Heavier than K3s: SUSE asks for at least 2 CPUs and 4 GB RAM per server, and 8 GB is recommended
  • Some extras are paid: SUSE’s Rancher Prime subscription brings up to five years of support per release, and the old Ingress NGINX chart leaves community builds in v1.37

More of the Kubernetes family

What all container orchestration have in common →
K3sOpen sourceDistributionsA certified Kubernetes distribution in one small binary, built for edge, IoT and other places where a full cluster is too heavy, with SQLite or embedded etcd for state.MicroK8sOpen sourceDistributionsCanonical’s Kubernetes in one snap package: installs with one command on Linux, forms a highly available cluster by itself at three nodes, and adds features as addons.Red Hat OpenShiftCommercialDistributionsRed Hat’s Kubernetes platform: Kubernetes plus its own OS, operators that install and upgrade everything, and stricter security defaults, sold by subscription.Talos LinuxOpen sourceDistributionsA Linux distribution that only runs Kubernetes: immutable, minimal, with no shell or SSH, and managed entirely through an API.Amazon EKSAWSManaged servicesAWS runs the Kubernetes control plane for you; you choose how much of the worker side to hand over too.Azure Kubernetes ServiceAzureManaged servicesMicrosoft’s managed Kubernetes: a control plane that can be free, node pools of Azure VMs, and an Automatic mode that runs the nodes too.Google Kubernetes EngineGoogle CloudManaged servicesGoogle’s managed Kubernetes, the oldest one: Google runs the control plane, and in Autopilot mode the nodes too.kindOpen sourceFor local developmentKubernetes IN Docker: each cluster node is a container, so a conformant multi-node cluster starts and disappears inside a CI job.minikubeOpen sourceFor local developmentA local Kubernetes cluster for developers on Linux, macOS or Windows, in a container, a VM or on the host itself, with laptop-friendly extras.kubeadmOpen sourceToolsThe official tool for turning Linux machines you already have into a Kubernetes cluster: `kubeadm init`, then `kubeadm join`.RancherOpen sourceToolsSUSE’s open-source control plane for fleets of Kubernetes clusters: one place to create, import, secure and upgrade them.AgonesOpen sourceBuilt on itRuns dedicated multiplayer game servers on Kubernetes: keeps a fleet of them warm, hands one to each match, and never kills a server while players are on it.KlutchOpen sourceBuilt on itA young open-source control plane, built on Crossplane, that lets many application clusters order databases from one central Kubernetes cluster.

How it fits with other technologies

Install a hardened server, then join an agent · bash

# on the first server
mkdir -p /etc/rancher/rke2
cat > /etc/rancher/rke2/config.yaml <<EOF
profile: cis          # opt in to CIS Pod Security and network policies
cni: canal
EOF
curl -sfL https://get.rke2.io | sh -
systemctl enable --now rke2-server.service
cat /var/lib/rancher/rke2/server/node-token   # join token

# on each worker
curl -sfL https://get.rke2.io | INSTALL_RKE2_TYPE="agent" sh -
cat > /etc/rancher/rke2/config.yaml <<EOF
server: https://<server>:9345
token: <token from server>
EOF
systemctl enable --now rke2-agent.service

See it in a real stack

No architecture uses RKE2 yet. Drop it into the playground and wire it up yourself.Open playground →
Where it came from2019–2026

Rancher Labs had two Kubernetes distributions by 2019. RKE (now called RKE1) ran every Kubernetes component, including the control plane, as Docker containers, and stayed close to upstream. K3s, released in February 2019, was a single small binary built for edge devices, easy to install but diverging from upstream in places. Rancher’s US federal customers wanted something else again: a distribution they could get through a security accreditation, with FIPS-validated cryptography, SELinux support and CIS-compliant defaults.

Rancher’s answer, first tagged in May 2020 and released as v1.18.9+rke2r1 in October 2020, was RKE2, “also known as RKE Government”. It took K3s’s installer and supervisor process but ran upstream components as static Pods under containerd, with no Docker. SUSE bought Rancher Labs in December 2020; from Rancher 2.6 in 2021, Rancher could provision RKE2 clusters itself, and in November 2022 DISA approved and published an RKE2 STIG.

When RKE1 reached end of life on July 31, 2025, Rancher 2.12 stopped managing RKE1 clusters and told users to move to RKE2. RKE2 is now Rancher’s main datacenter distribution, with K3s for the edge.

Why it’s built this way

Static Pods under containerd instead of Docker containers
RKE1 needed Docker on every node to run the control plane. Writing the control plane as static Pod manifests lets the kubelet supervise it like any other Pod, and drops a whole container engine from the node.
Reuse K3s’s supervisor, not its trimmed-down Kubernetes
K3s had proved that one binary and one config file made Kubernetes easy to run, but it diverged from upstream to stay small. RKE2 kept the operating model and shipped standard components, which matters when an auditor compares your cluster with upstream benchmarks.
Compile everything with BoringCrypto
Federal systems must use FIPS 140-2 validated cryptographic modules. Building every Go component against the validated BoringCrypto module meets that without separate patched builds.

Timeline

  1. 2019

    Rancher releases K3s, whose installer and supervisor RKE2 later reuses

  2. 2020

    First RKE2 tags in May; v1.18.9+rke2r1, “also known as RKE Government”, in October

  3. 2021

    Rancher 2.6 adds automated provisioning of RKE2 clusters

  4. 2022

    DISA approves and publishes a STIG for RKE2

  5. 2025

    RKE1 reaches end of life on July 31; Rancher 2.12 points users to RKE2

  6. 2026

    Traefik replaces the retired Ingress NGINX as the default ingress from v1.36

Sources13 · facts checked 6 October 2026

Improve this page on GitHub