Introduction
While working on a production ERP system, we needed a fast and flexible container management system. To meet this need, we chose k3s. k3s is a lightweight Kubernetes distribution. In this article, we will explain how to scale from a single node to multiple nodes using k3s.
Lightweight Kubernetes with k3s
k3s is an open-source project supported by the Cloud Native Computing Foundation (CNCF). k3s is lighter and consumes fewer resources compared to traditional Kubernetes distributions, making it ideal for resource-constrained environments or edge computing scenarios. Therefore, k3s is ideal for use in small and medium-sized projects.
Single Node Deployment with k3s
Deploying k3s as a single node is quite simple. The first step is to create a server and install k3s on it. After installing k3s, you can create a cluster and run containers on this cluster.
# To install the k3s server
# WARNING: Running scripts downloaded from the internet can pose a security risk.
# In production environments, it is recommended to review the script or use alternative installation methods.
curl -sfL https://get.k3s.io | sh -
# To check the status of the k3s cluster
k3s kubectl get nodes
This command installs the k3s server and loads helper programs like kubectl, crictl, ctr. The Kubeconfig file is written to /etc/rancher/k3s/k3s.yaml, and the k3s kubectl command automatically uses this file.
Scaling to Multiple Nodes
Scaling from a single server node to multiple nodes is particularly easy with k3s by adding worker (agent) nodes. This allows you to increase the capacity of your cluster.
Adding Worker Nodes
To add worker nodes, you first need to create these nodes. Then, you can install the k3s agent on them and have them join the existing k3s server cluster.
To have worker nodes join the cluster, you need to obtain a token from your k3s server node. This token is found in the /var/lib/rancher/k3s/server/node-token file on the server node.
# Get the token from the server node (e.g., if the server IP is 192.168.1.100)
sudo cat /var/lib/rancher/k3s/server/node-token
# To install the k3s agent on worker nodes and join the cluster
# Replace <SERVER_IP> with the IP address of your k3s server and <NODE_TOKEN> with the token you obtained above.
# WARNING: Running scripts downloaded from the internet can pose a security risk.
# In production environments, it is recommended to review the script or use alternative installation methods.
curl -sfL https://get.k3s.io | K3S_URL=https://<SERVER_IP>:6443 K3S_TOKEN=<NODE_TOKEN> sh -
This command configures the new node as a k3s agent and registers it with the specified server. After the agent joins successfully, you can verify that the new worker node is visible in the cluster by running k3s kubectl get nodes from your server node.
Security
When creating a lightweight Kubernetes deployment with k3s, it is crucial not to neglect security. The first step is to secure your servers. Then, you can secure your k3s cluster.
Server Security
To secure your servers, you first need to keep them updated regularly. Then, you can protect them with a firewall.
# To update your servers
sudo apt update && sudo apt full-upgrade -y
# To protect your servers with a firewall (e.g., using UFW)
# WARNING: Before enabling the firewall, ensure that you have opened the necessary ports for Kubernetes (e.g., 6443, 10250),
# or cluster communication may be disrupted.
sudo ufw enable
k3s Security
To secure your k3s cluster, it is essential to keep your k3s version up to date, as updates include security patches and improvements. To update k3s, you can rerun the installation script with the same configuration options or manually update the binary.
Additionally, you can apply Kubernetes Network Policies to control traffic between pods. k3s includes a built-in network policy controller by default. Network policies allow you to restrict communication between pods, enabling a zero-trust network model.
# To check the k3s version
k3s --version
# To update k3s (preserving the existing configuration)
# WARNING: Before updating, it is recommended to back up your data and update server nodes before agent nodes.
# Also, avoid large version jumps by updating one minor version at a time.
curl -sfL https://get.k3s.io | sh -
# To create an example network policy (this only creates a template, you need to define its content)
# This command alone does not provide security; the content of the NetworkPolicy YAML file is important.
# kubectl create networkpolicy <policy-name> --from=<source> --to=<target> --port=<port>
# For example, to create a policy that denies all traffic between pods by default:
# kubectl apply -f default-deny-all.yaml
# (default-deny-all.yaml content: https://docs.k3s.io/security/hardening-guide#network-policies)
Conclusion
In this article, we explained how to create a lightweight Kubernetes deployment using k3s and scale it from a single node to multiple nodes by adding worker nodes. k3s is a lightweight and flexible Kubernetes distribution ideal for small and medium-sized projects. When creating a lightweight Kubernetes deployment with k3s, do not neglect security; take measures such as regular updates and network policies for both server and cluster security. The next step is to deploy this distribution in a production environment and use it in a real project.
