k3s is a lightweight, certified Kubernetes distribution well-suited for smaller-scale deployments — this guide covers installation specifically on AlmaLinux/Rocky Linux, addressing distribution-specific considerations.
Why k3s for a Single/Few-Node VPS Setup
See Getting Started with Kubernetes: k3s vs Full Kubernetes for the broader rationale — k3s's reduced resource footprint makes it practical on modest VPS hardware, unlike full Kubernetes which typically needs more substantial dedicated infrastructure.
Step 1 — Disable firewalld (Or Configure It Properly for k3s)
sudo systemctl stop firewalld
sudo systemctl disable firewalldk3s's networking (particularly with Flannel, its default CNI) has known compatibility friction with firewalld's default configuration — disabling firewalld is a common simplification, though properly configuring specific required ports is the more security-conscious alternative if you need firewalld active for other reasons.
Alternative: Configuring firewalld for k3s Instead of Disabling
sudo firewall-cmd --permanent --add-port=6443/tcp
sudo firewall-cmd --permanent --add-port=8472/udp
sudo firewall-cmd --permanent --zone=trusted --add-source=10.42.0.0/16
sudo firewall-cmd --reloadOpens k3s's required API port and Flannel VXLAN port, and trusts the internal pod network range — more work than simply disabling firewalld, but maintains firewall protection for everything else.
Step 2 — Disable SELinux Enforcement for k3s (Or Install SELinux Policy)
sudo dnf install container-selinux -y
sudo dnf install k3s-selinux -yk3s provides a dedicated SELinux policy package for RHEL-family distributions — installing this (rather than disabling SELinux) is the recommended approach specifically for AlmaLinux/Rocky Linux.
Step 3 — Install k3s
curl -sfL https://get.k3s.io | sh -Step 4 — Verify the Cluster Is Running
sudo k3s kubectl get nodesStep 5 — Set Up kubectl Access (Non-Root)
mkdir ~/.kube
sudo cp /etc/rancher/k3s/k3s.yaml ~/.kube/config
sudo chown $(id -u):$(id -g) ~/.kube/configDeploying Your First Application
kubectl create deployment nginx --image=nginx
kubectl expose deployment nginx --port=80 --type=NodePortJoining Additional Nodes (For a Multi-Server Cluster)
curl -sfL https://get.k3s.io | K3S_URL=https://SERVER_IP:6443 K3S_TOKEN=NODE_TOKEN sh -Retrieve the token from /var/lib/rancher/k3s/server/node-token on the initial server; see general multi-server networking considerations if joining nodes across different VPS instances.
Uninstalling k3s
sudo /usr/local/bin/k3s-uninstall.shCommon Errors
Pods stuck in "Pending" or networking failures between pods — almost always a firewalld or SELinux configuration issue on RHEL-family distributions specifically; verify you've properly addressed both as covered above, rather than assuming a Kubernetes-level configuration problem.
Continue Reading
- How to Configure firewalld on AlmaLinux/Rocky Linux
- Understanding SELinux Basics on AlmaLinux/Rocky Linux
- How to Install Docker on AlmaLinux/Rocky Linux
Browse more articles in AlmaLinux & Rocky Linux.
