An HA RKE2 cluster on one machine: KVM, MetalLB and Rancher

Wed, 11 Nov 2026 00:00:00 +0000

minikube and kind are great for checking a manifest, but they won’t show you what happens when one of three etcd members disappears, when a virtual IP moves to another machine, or when the apiserver starts losing its connection to a slow disk. I wanted a lab as close to production as possible, on a single computer. This is what came out of it:

three RKE2 nodes in HA mode (etcd with a 2-of-3 quorum),
MetalLB in L2 mode, giving LoadBalancer services real virtual IPs,
Rancher as the management UI, with its built-in Fleet for GitOps.

Going from an empty host to a running cluster is one script, rke2-lab.sh. Its messages and comments are in Polish, but the settings are self-explanatory.

Kubernetes on a VPS with one public IP: kubeadm, Gateway API and Let's Encrypt

Wed, 11 Nov 2026 00:00:00 +0000

You have a VPS with one public IP. You want real Kubernetes on it (not k3s, not minikube, but upstream kubeadm), and your apps should be reachable at https://<name>.k8s.skwarna.eu with valid certificates. No cloud load balancer, and no opening ports by hand for every app.

This guide covers the whole thing in two parts:

The cluster: kubeadm + containerd + Flannel + metrics-server on a single node behind a firewall, plus three traps I fell into along the way.
Exposing apps: wildcard DNS, the Gateway API implemented by Envoy Gateway (instead of the retired ingress-nginx), Let’s Encrypt certificates from cert-manager, and a way to get a “load balancer” without a load balancer.

The examples use my own domain, k8s.skwarna.eu; replace it with yours. The test app from this article is live: whoami.k8s.skwarna.eu shows the headers of your request as the pod in the cluster sees them. The server IP is 38.45.81.22.

Piotr Skwarna - Blog

An HA RKE2 cluster on one machine: KVM, MetalLB and Rancher

Kubernetes on a VPS with one public IP: kubeadm, Gateway API and Let's Encrypt