Select Page

K3S is a lightweight and certified Kubernetes distribution, perfect for run development environments, CI/CD and IoT. It works very well with the ARM architecture. It’s packaged to a single binary that makes deployment and setup easy.

The default installation comes with:

  • embedded SQLite
  • containerd
  • flannel
  • coredns
  • traefik (ingress controller)
  • local path provisioner
  • service load balancer

All those features are more than enough for most use-cases. Of course, installation is fully configurable, so if you want etcd, docker, Nginx ingress and so on – go to official documentation page .

Default installation

Login to machine and run:

curl -sfL | sh -

and that’s it… After a few seconds, you should see that the master node is ready with k3s kubectl get node.

You will find config.yaml for kubernetes in /etc/rancher/k3s/k3s.yaml

Advanced installation with nginx-ingress, metallb and cert-manager

  1. Deploy k3s without traefik and servicelb

    curl -sfL | K3S_KUBECONFIG_MODE="644" INSTALL_K3S_EXEC=" --no-deploy=servicelb --no-deploy=traefik" sh -s -
  2. Get config from /etc/rancher/k3s/k3s.yaml and put into ~/.kube/config on your machine

  3. Install helm

    curl | bash
  4. Add helm repo and update

    helm repo add stable
    helm repo update
  5. Install metallb. Range of available ip addresses for loadbalancer are set in configInline.address-pools[0].addresses[0].

    helm install --namespace=kube-system 
      --set configInline.address-pools[0].name=default 
      --set configInline.address-pools[0].protocol=layer2 
      --set configInline.address-pools[0].addresses[0]= 
      metallb stable/metallb
  6. Install nginx-ingress

    helm install --namespace=kube-system 
        --set rbac.create=true 
        nginx-ingress stable/nginx-ingress
  7. Install and configure certmanager for lets-encrypt

    kubectl apply -f
    helm install --namespace=kube-system cert-manager stable/cert-manager
    cat <<EOF | kubectl apply -f -
    kind: ClusterIssuer
      name: letsencrypt
        email: ACME_EMAIL
          name: letsencrypt
          - dns01:
                email: CLOUDFLARE_EMAIL
                  name: cloudflare-apikey-secret
                  key: CLOUDFLARE_APIKEY
                - 'DOMAIN_NAME'


    • ACME_EMAIL – some email in yor domain (will be used to limit number of requests to acme)
    • CLOUDFLARE_EMAIL – email of your cloudflare account
    • CLOUDFLARE_APIKEYapi key to your cloudflare acccount
    • DOMAIN_NAME – domain that will be used in lets-encrypt certs (eg.: *

Important disclaimer

Don’t deploy everything in kube-system if it’s not test/development cluster. Be safe.