Course Overview
Hands-on Rancher training for Kubernetes administrators and platform engineers who run production clusters on premises. Install and harden RKE2 and K3s, deploy a highly available Rancher Manager, and run a multi-cluster estate with single sign-on, project-based multi-tenancy, GitOps with Fleet and distributed storage with Longhorn. We go one layer deeper than the web interface, into etcd, certificates, agents and disaster recovery, using open-source Rancher only: no Prime subscription required.
Who should attend
Kubernetes administrators, platform engineers and operations teams who will install and run Rancher, RKE2 and K3s in production, particularly in regulated organisations such as banks, airlines, government and defence. Also valuable for architects weighing Rancher against OpenShift or managed cloud Kubernetes.
What you'll learn
- Install, configure and harden RKE2 and K3s, and explain how they differ from kubeadm
- Deploy a highly available Rancher Manager and understand how it reaches and controls its clusters
- Provision custom clusters and register existing ones, including clusters built without Rancher
- Integrate Active Directory, LDAP or OIDC single sign-on, and design access with global, cluster and project roles
- Deliver applications to many clusters at once with Fleet and GitOps
- Provide replicated, backed-up persistent storage with Longhorn
- Back up and restore etcd and Rancher itself, and rotate certificates and encryption keys
- Upgrade Rancher and its clusters safely, using open-source Rancher without a Prime subscription
Course Prerequisites
Participants should be comfortable using Kubernetes: Pods, Deployments, Services, Ingress, ConfigMaps, Secrets, persistent volumes and Kubernetes RBAC. We recommend our Core Kubernetes course; our Kubernetes Crash-course is the minimum. Participants should also work confidently on the Linux command line and know the basics of Git and containers. Experience with cluster administration, for example from Kubernetes Administration, helps but is not required.
Outline
Rancher is three things at once: two Kubernetes distributions, RKE2 and K3s; a management plane, Rancher Manager, that runs any number of clusters from one place; and a family of add-ons such as Fleet and Longhorn. This course teaches all three the way our Kubernetes Administration course teaches upstream Kubernetes: one layer deeper. You build clusters from blank machines, install Rancher Manager as a production platform team would, and then look underneath every screen at the Kubernetes resources, agents and protocols that make it work. That is the knowledge that matters when a cluster is stuck in provisioning and the web interface has nothing more to say.
The course is written for administrators who will run Rancher on their own infrastructure in demanding environments such as banks, airlines and defence organisations, and it shows in the details: a highly available control plane behind a load balancer, every image pulled through an internal registry, CIS hardening and encrypted Secrets, single sign-on against Active Directory or LDAP, and rehearsed recovery for etcd, for Rancher itself and for the data in Longhorn.
We use the open-source community editions throughout, and follow the latest Rancher Manager release, because that is the only line the community edition patches. Where Rancher Prime adds something, we tell you what, so that your organisation can decide whether it needs a subscription.
Kubernetes itself is not retaught. Workloads, Services, Ingress, NetworkPolicies and Kubernetes RBAC are covered in Core Kubernetes, which leaves every hour of this course for what Rancher adds and how it works. If your organisation runs upstream Kubernetes rather than Rancher, choose Kubernetes Administration instead: the two courses are siblings, with the same depth on a different platform.
The Rancher Ecosystem
- Appreciate the three layers of Rancher: distributions, management plane and add-ons
- Trace Rancher's history, from the Cattle orchestrator of Rancher 1.x to a management plane built on Kubernetes
- Discuss the end of life of RKE1 and what replaced it
- Distinguish the open-source community edition from Rancher Prime
- Understand the community patch policy and what it means for your upgrade cadence
- Identify Prime-only features and their open-source alternatives
- Compare Rancher with OpenShift and managed cloud Kubernetes
- Appreciate when a management plane pays off, and when it does not
K3s: Kubernetes in a Single Binary
Architecture
- Understand the single-process architecture of K3s
- Explore the packaged components: containerd, Flannel, CoreDNS, Traefik, local-path and metrics-server
- Distinguish server and agent nodes, and how an agent joins
- Configure K3s declaratively with config.yaml
- Protect the cluster administrator's kubeconfig on nodes and workstations
- Discuss where K3s fits: edge, CI and small clusters
Datastores
- Compare the K3s datastore options: SQLite, embedded etcd and external databases
- Analyse how kine serves the etcd API from a SQL database
- Migrate a single server from SQLite to embedded etcd
Tailoring Packaged Components
- Appreciate the helm-controller and the auto-deploying manifests directory
- Customise the bundled Traefik with a HelmChartConfig instead of disabling it
- Disable a packaged component you intend to replace
- Analyse how ServiceLB, formerly Klipper LB, provides LoadBalancer Services without a cloud provider
RKE2: Hardened Kubernetes
Architecture
- Understand RKE2's origins as RKE Government, and its focus on compliance
- Compare RKE2 with kubeadm: packaging, configuration, joining and certificate handling
- Explore how the supervisor starts the kubelet, which runs the control plane and etcd as static pods
- Inspect a node with crictl and RKE2's own log locations
Installation
- Plan a highly available control plane behind a load balancer
- Install servers and agents from config.yaml and drop-in files
- Pull every image through an internal registry with registries.yaml
- Discuss air-gapped installation
Datastore Management
- Understand etcd quorum, and what losing it means for the cluster
- Add and remove server nodes without losing quorum
- Schedule etcd snapshots, locally and to S3-compatible storage
- Restore a cluster from a snapshot with cluster-reset
- Maintain etcd with etcdctl: health, membership and defragmentation
Hardening
- Apply the CIS profile, and understand every change it makes
- Encrypt Secrets at rest, and compare the defaults of K3s and RKE2
- Run RKE2 with SELinux in enforcing mode
- Configure API server audit logging
- Discuss FIPS 140 cryptography for regulated environments
Cluster Networking
- Choose a CNI for RKE2: Canal, Calico or Cilium, with Multus for multiple interfaces
- Discuss eBPF networking and kube-proxy replacement with Cilium
- Understand why RKE2 moved from ingress-nginx to Traefik
- Plan the migration of existing Ingress resources to Traefik
- Customise RKE2's bundled charts with HelmChartConfig
- Compare ServiceLB with MetalLB for on-premises LoadBalancer Services
- Deploy MetalLB on RKE2
- Troubleshoot node-level prerequisites such as kernel modules and firewall rules
Rancher Manager
Architecture
- Understand the role of the local cluster that Rancher runs on
- Appreciate that Rancher keeps all its state as custom resources in the local cluster
- Explore the cluster agent tunnel that lets Rancher reach clusters behind firewalls
- Analyse the authentication proxy, and how Rancher impersonates users on downstream clusters
- Discuss what keeps working when Rancher is down
Installation
- Size and plan a highly available Rancher server cluster
- Choose a TLS source with cert-manager: Rancher-generated, Let's Encrypt or your own certificates
- Install Rancher Manager with Helm
- Trust a private CA across Rancher and its agents
- Discuss why the Docker single-node install is not for production
- Use the web interface, the Rancher API and the kubectl shell
Downstream Clusters
- Distinguish the cluster types: custom, registered, hosted and infrastructure-provisioned
- Create a custom cluster on existing machines with a registration command
- Understand how rancher-system-agent applies plans to install and configure RKE2
- Inspect the provisioning resources Rancher creates for a cluster, built on Cluster API
- Register an existing K3s or kubeadm cluster
- Compare what Rancher manages in a registered cluster with a cluster it provisioned
- Scale a cluster and replace a failed node
- Discuss hosted clusters on EKS, AKS and GKE
- Discuss node drivers and Cluster API providers through Rancher Turtles
- Troubleshoot a cluster stuck in provisioning
Authentication and Access Control
Authentication
- Secure the bootstrap administrator and local users
- Integrate Active Directory and OpenLDAP
- Configure single sign-on with OIDC or SAML, for example through Keycloak
- Map directory groups to Rancher roles
- Manage API tokens and kubeconfig token lifetimes
- Reach clusters directly through the Authorized Cluster Endpoint when Rancher is unavailable
Authorisation
- Distinguish global, cluster and project roles
- Define custom role templates
- Inspect how Rancher renders its roles into native RBAC on each cluster
- Design an access model for platform teams, application teams and auditors
Projects and Multi-Tenancy
- Introduce projects as Rancher's grouping of namespaces
- Set resource quotas and default container limits per project
- Isolate projects with project network isolation
- Deploy applications from the Apps catalogue and your own chart repositories
- Troubleshoot workloads with Rancher's workload views, logs and shell
Platform Security and Compliance
- Enforce Pod Security Admission with Rancher's configuration templates
- Scan clusters against the CIS Benchmark with compliance scans
- Audit user activity with Rancher's API audit log
- Discuss runtime security and network visibility with NeuVector
- Discuss policy as code with Kubewarden
Continuous Delivery with Fleet
- Recap the principles of GitOps
- Understand Fleet's architecture: the controller, the agents and the pull model
- Follow a GitRepo through Bundles and BundleDeployments
- Target clusters with labels and cluster groups
- Customise deployments per cluster with fleet.yaml
- Deliver Helm charts, Kustomize overlays and plain manifests
- Separate teams and environments with workspaces
- Detect and correct drift
- Diagnose bundles that fail to deploy
- Compare Fleet with Argo CD and Flux
Persistent Storage with Longhorn
Architecture
- Understand Longhorn's architecture: engines, replicas and instance managers
- Analyse how a volume reaches its pod through the kernel's iSCSI initiator
- Discuss the V2 data engine and its SPDK-based design
Operating Longhorn
- Prepare nodes and dedicated disks for Longhorn
- Define StorageClasses with replica counts and data locality
- Provide ReadWriteMany volumes through the share manager
- Observe replica rebuilding after a node failure
- Configure an S3 backup target
- Schedule snapshots and backups with recurring jobs
- Fail over to a second cluster with disaster recovery volumes
- Monitor volume and node health
Day-Two Operations and Disaster Recovery
Upgrades
- Plan upgrades against the support matrix of Rancher, RKE2 and Longhorn
- Upgrade Rancher Manager with Helm
- Roll out a new Kubernetes version to downstream clusters from Rancher
- Automate node upgrades with the system-upgrade-controller
Certificates and Keys
- Understand RKE2's automatic certificate renewal
- Rotate certificates from Rancher and on the node
- Replace or rotate the cluster CA
- Rotate the encryption keys for Secrets
Backup and Disaster Recovery
- Distinguish three layers of backup: etcd snapshots, Rancher backups and Longhorn backups
- Restore a downstream cluster from an etcd snapshot through Rancher
- Back up Rancher itself with the rancher-backup operator
- Restore Rancher onto a new cluster
- Recover a cluster from quorum loss
- Design and rehearse a disaster recovery plan
The Wider Ecosystem (Discussion)
- Discuss observability with kube-prometheus-stack, now that rancher-monitoring is deprecated
- Discuss virtual clusters with k3k
- Discuss Harvester for running virtual machines alongside containers
- Discuss Hauler for delivering images and charts to air-gapped sites
Frequently asked questions
Do we need a Rancher Prime subscription?
No. The course uses the open-source community builds of Rancher Manager, RKE2, K3s, Fleet and Longhorn throughout. We explain what Prime adds (support, longer lifecycles, a signed image registry and a handful of gated features) so that your organisation can make an informed decision, and we show the open-source alternative wherever a feature is Prime-only.
Which versions of Rancher does the course use?
We follow the latest Rancher Manager minor release, with the RKE2, K3s and Longhorn versions it supports. The community edition only receives patches on its latest minor release, so a course built on an older one would teach you a version you could not run safely.
What is the difference with the Kubernetes Administration course?
The two are siblings. K8S-ADMIN teaches cluster administration on upstream Kubernetes built with kubeadm; this course teaches it on RKE2 and K3s, managed by Rancher. Both go one layer deeper into etcd, certificates and the control plane, so the concepts carry over in either direction. Choose the one that matches the platform your organisation runs.
How hands-on is the course?
Very. As on all our courses, every participant gets a machine of their own. For this course it hosts a set of virtual machines that start blank: you install, configure and manage everything on them yourself, from RKE2 and K3s clusters and a highly available Rancher Manager to single sign-on, Fleet, Longhorn, upgrades and disaster recovery. Everything follows production practice, including an internal image registry and a load balancer in front of the control plane.
Does the course focus on on-premises or cloud clusters?
On-premises. The course concentrates on RKE2 and K3s on your own infrastructure, where the administrator is responsible for everything from etcd and certificates to load balancing and storage. Hosted clusters such as EKS, AKS and GKE are discussed: how Rancher manages them through the cloud providers' APIs, and what remains the provider's responsibility.
Do I need to install anything on my laptop?
No. Your machine and its virtual machines are provisioned before the course, so all you need locally is an SSH client (already present on Linux, macOS and Windows) and a web browser for the Rancher interface. Work in the editors installed on the machine (vim, LazyVim, Emacs) or connect your own with VS Code Remote Development or IntelliJ's SSH remote development. Login details are emailed a week before the course.
How long is the Rancher Administration: RKE2, K3s, Fleet & Longhorn course?
3 days, on-site or online. Sessions can run on consecutive days or be spread out to fit your team's schedule.
What are the prerequisites?
Participants should be comfortable using Kubernetes: Pods, Deployments, Services, Ingress, ConfigMaps, Secrets, persistent volumes and Kubernetes RBAC. We recommend our Core Kubernetes course; our Kubernetes Crash-course is the minimum. Participants should also work confidently on the Linux command line and know the basics of Git and containers. Experience with cluster administration, for example from Kubernetes Administration, helps but is not required.
How large are the groups?
Deliberately small so the trainer can adapt to every participant: at most 10 on-site and 7 online.
In which languages can the course be delivered?
English, French or Dutch.
