https://docs.k3s.io/assets/js/ac75af2e.7b449e24.js

1"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[8173],{91617:(e,n,r)=>{r.r(n),r.d(n,{assets:()=>o,contentTitle:()=>l,default:()=>h,frontMatter:()=>i,metadata:()=>s,toc:()=>a});const s=JSON.parse('{"id":"installation/requirements","title":"Requirements","description":"K3s is very lightweight, but has some minimum requirements as outlined below.","source":"@site/docs/installation/requirements.md","sourceDirName":"installation","slug":"/installation/requirements","permalink":"/installation/requirements","draft":false,"unlisted":false,"editUrl":"https://github.com/k3s-io/docs/edit/main/docs/installation/requirements.md","tags":[],"version":"current","lastUpdatedAt":1790705508000,"frontMatter":{"title":"Requirements"},"sidebar":"mySidebar","previous":{"title":"Installation","permalink":"/installation/"},"next":{"title":"Configuration Options","permalink":"/installation/configuration"}}');var t=r(74848),d=r(28453);const i={title:"Requirements"},l=void 0,o={},a=[{value:"Prerequisites",id:"prerequisites",level:2},{value:"Architecture",id:"architecture",level:2},{value:"Operating Systems",id:"operating-systems",level:2},{value:"Firewalld",id:"firewalld",level:4},{value:"RHEL 10",id:"rhel-10",level:4},{value:"Firewalld",id:"firewalld-1",level:4},{value:"UFW",id:"ufw",level:4},{value:"Cgroups",id:"cgroups",level:4},{value:"Ubuntu Vxlan Module",id:"ubuntu-vxlan-module",level:4},{value:"Hardware",id:"hardware",level:2},{value:"Disks",id:"disks",level:3},{value:"Server Sizing Guide",id:"server-sizing-guide",level:3},{value:"Networking",id:"networking",level:2},{value:"Inbound Rules for K3s Nodes",id:"inbound-rules-for-k3s-nodes",level:3},{value:"Outbound Rules for K3s Nodes",id:"outbound-rules-for-k3s-nodes",level:3},{value:"Local Ports",id:"local-ports",level:3},{value:"Large Clusters",id:"large-clusters",level:2},{value:"Disks",id:"disks-1",level:3},{value:"Network",id:"network",level:3},{value:"Database",id:"database",level:3}];function c(e){const n={a:"a",admonition:"admonition",br:"br",code:"code",h2:"h2",h3:"h3",h4:"h4",li:"li",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,d.R)(),...e.components},{TabItem:r,Tabs:s}=n;return r||u("TabItem",!0),s||u("Tabs",!0),(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(n.p,{children:"K3s is very lightweight, but has some minimum requirements as outlined below."}),"\n",(0,t.jsx)(n.p,{children:"Whether you're configuring K3s to run in a container or as a native Linux service, each node running K3s should meet the following minimum requirements. These requirements are baseline for K3s and its packaged components, and do not include resources consumed by the workload itself."}),"\n",(0,t.jsx)(n.h2,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,t.jsx)(n.p,{children:"Two nodes cannot have the same hostname."}),"\n",(0,t.jsxs)(n.p,{children:["If multiple nodes will have the same hostname, or if hostnames may be reused by an automated provisioning system, use the ",(0,t.jsx)(n.code,{children:"--with-node-id"})," option to append a random suffix for each node, or devise a unique name to pass with ",(0,t.jsx)(n.code,{children:"--node-name"})," or ",(0,t.jsx)(n.code,{children:"$K3S_NODE_NAME"})," for each node you add to the cluster."]}),"\n",(0,t.jsx)(n.h2,{id:"architecture",children:"Architecture"}),"\n",(0,t.jsx)(n.p,{children:"K3s is available for the following architectures:"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"x86_64"}),"\n",(0,t.jsx)(n.li,{children:"armhf"}),"\n",(0,t.jsx)(n.li,{children:"arm64/aarch64"}),"\n"]}),"\n",(0,t.jsx)(n.h2,{id:"operating-systems",children:"Operating Systems"}),"\n",(0,t.jsx)(n.p,{children:"K3s is expected to work on most modern Linux systems."}),"\n",(0,t.jsx)(n.p,{children:"Some OSs have additional setup requirements:"}),"\n",(0,t.jsxs)(s,{queryString:"os",children:[(0,t.jsxs)(r,{value:"suse",label:"SUSE Linux Enterprise / openSUSE",children:[(0,t.jsx)(n.h4,{id:"firewalld",children:"Firewalld"}),(0,t.jsx)(n.p,{children:"It is recommended to turn off firewalld:"}),(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:"systemctl disable firewalld --now\n"})}),(0,t.jsx)(n.p,{children:"If you wish to keep firewalld enabled, by default, the following rules are required:"}),(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:"firewall-cmd --permanent --add-port=6443/tcp #apiserver\nfirewall-cmd --permanent --zone=trusted --add-source=10.42.0.0/16 #pods\nfirewall-cmd --permanent --zone=trusted --add-source=10.43.0.0/16 #services\nfirewall-cmd --reload\n"})}),(0,t.jsxs)(n.p,{children:["Additional ports may need to be opened depending on your setup. See ",(0,t.jsx)(n.a,{href:"#inbound-rules-for-k3s-nodes",children:"Inbound Rules"})," for more information. If you change the default CIDR for pods or services, you will need to update the firewall rules accordingly."]})]}),(0,t.jsxs)(r,{value:"rhel",label:"Red Hat Enterprise Linux / CentOS / Fedora",children:[(0,t.jsx)(n.h4,{id:"rhel-10",children:"RHEL 10"}),(0,t.jsx)(n.p,{children:"On RHEL 10, an additional package is required:"}),(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:"sudo dnf install -y kernel-modules-extra\n"})}),(0,t.jsx)(n.h4,{id:"firewalld-1",children:"Firewalld"}),(0,t.jsx)(n.p,{children:"It is recommended to turn off firewalld:"}),(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:"systemctl disable firewalld --now\n"})}),(0,t.jsx)(n.p,{children:"If you wish to keep firewalld enabled, by default, the following rules are required:"}),(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:"firewall-cmd --permanent --add-port=6443/tcp #apiserver\nfirewall-cmd --permanent --zone=trusted --add-source=10.42.0.0/16 #pods\nfirewall-cmd --permanent --zone=trusted --add-source=10.43.0.0/16 #services\nfirewall-cmd --reload\n"})}),(0,t.jsxs)(n.p,{children:["Additional ports may need to be opened depending on your setup. See ",(0,t.jsx)(n.a,{href:"#inbound-rules-for-k3s-nodes",children:"Inbound Rules"})," for more information. If you change the default CIDR for pods or services, you will need to update the firewall rules accordingly."]}),(0,t.jsxs)(n.admonition,{title:"Older RHEL/CentOS Releases",type:"warning",children:[(0,t.jsx)(n.p,{children:"OS versions prior to RHEL 8.4 carry NetworkManager with a known bug that interferes with K3s networking. If using an older release, it is required to disable nm-cloud-setup and reboot the node:"}),(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:"systemctl disable nm-cloud-setup.service nm-cloud-setup.timer\nreboot\n"})})]})]}),(0,t.jsxs)(r,{value:"debian",label:"Ubuntu / Debian",children:[(0,t.jsxs)(n.p,{children:["Older Debian release may suffer from a known iptables bug. See ",(0,t.jsx)(n.a,{href:"/known-issues#iptables",children:"Known Issues"}),"."]}),(0,t.jsx)(n.h4,{id:"ufw",children:"UFW"}),(0,t.jsx)(n.p,{children:"It is recommended to turn off ufw (uncomplicated firewall):"}),(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:"ufw disable\n"})}),(0,t.jsx)(n.p,{children:"If you wish to keep ufw enabled, by default, the following rules are required:"}),(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:"ufw allow 6443/tcp #apiserver\nufw allow from 10.42.0.0/16 to any #pods\nufw allow from 10.43.0.0/16 to any #services\n"})}),(0,t.jsxs)(n.p,{children:["Additional ports may need to be opened depending on your setup. See ",(0,t.jsx)(n.a,{href:"#inbound-rules-for-k3s-nodes",children:"Inbound Rules"})," for more information. If you change the default CIDR for pods or services, you will need to update the firewall rules accordingly."]})]}),(0,t.jsxs)(r,{value:"pi",label:"Raspberry Pi",children:[(0,t.jsxs)(n.p,{children:["Raspberry Pi OS is Debian based, and may suffer from a known iptables bug. See ",(0,t.jsx)(n.a,{href:"/known-issues#iptables",children:"Known Issues"}),"."]}),(0,t.jsx)(n.h4,{id:"cgroups",children:"Cgroups"}),(0,t.jsxs)(n.p,{children:["Standard Raspberry Pi OS installations do not start with ",(0,t.jsx)(n.code,{children:"cgroups"})," enabled. ",(0,t.jsx)(n.strong,{children:"K3S"})," needs ",(0,t.jsx)(n.code,{children:"cgroups"})," to start the systemd service. ",(0,t.jsx)(n.code,{children:"cgroups"}),"can be enabled by appending ",(0,t.jsx)(n.code,{children:"cgroup_memory=1 cgroup_enable=memory"})," to ",(0,t.jsx)(n.code,{children:"/boot/firmware/cmdline.txt"}),".",(0,t.jsx)(n.br,{}),"\n",(0,t.jsx)(n.strong,{children:"Note:"})," On Debian 11 and older Pi OS releases the cmdline.txt is located at ",(0,t.jsx)(n.code,{children:"/boot/cmdline.txt"}),"."]}),(0,t.jsx)(n.p,{children:"Example cmdline.txt:"}),(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{children:"console=serial0,115200 console=tty1 root=PARTUUID=58b06195-02 rootfstype=ext4 elevator=deadline fsck.repair=yes rootwait cgroup_memory=1 cgroup_enable=memory\n"})}),(0,t.jsx)(n.h4,{id:"ubuntu-vxlan-module",children:"Ubuntu Vxlan Module"}),(0,t.jsx)(n.p,{children:"With Ubuntu 21.10 to Ubuntu 23.10, vxlan support on Raspberry Pi was moved into a separate kernel module. This step in not required for Ubuntu 24.04 and later."}),(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:"sudo apt install linux-modules-extra-raspi\n"})})]})]}),"\n",(0,t.jsxs)(n.p,{children:["For more information on which OSs were tested with Rancher managed K3s clusters, refer to the ",(0,t.jsx)(n.a,{href:"https://rancher.com/support-maintenance-terms/",children:"Rancher support and maintenance terms."})]}),"\n",(0,t.jsx)(n.h2,{id:"hardware",children:"Hardware"}),"\n",(0,t.jsx)(n.p,{children:"Hardware requirements scale based on the size of your deployments. The minimum requirements are:"}),"\n",(0,t.jsxs)(n.table,{children:[(0,t.jsx)(n.thead,{children:(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.th,{children:"Node"}),(0,t.jsx)(n.th,{children:"CPU"}),(0,t.jsx)(n.th,{children:"RAM"})]})}),(0,t.jsxs)(n.tbody,{children:[(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"Server"}),(0,t.jsx)(n.td,{children:"2 cores"}),(0,t.jsx)(n.td,{children:"2 GB"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"Agent"}),(0,t.jsx)(n.td,{children:"1 core"}),(0,t.jsx)(n.td,{children:"512 MB"})]})]})]}),"\n",(0,t.jsxs)(n.p,{children:[(0,t.jsx)(n.a,{href:"/reference/resource-profiling",children:"Resource Profiling"})," captures the results of tests and analysis to determine minimum resource requirements for the K3s agent, the K3s server with a workload, and the K3s server with one agent."]}),"\n",(0,t.jsx)(n.h3,{id:"disks",children:"Disks"}),"\n",(0,t.jsx)(n.p,{children:"K3s performance depends on the performance of the database. To ensure optimal speed, we recommend using an SSD when possible."}),"\n",(0,t.jsx)(n.p,{children:"If deploying K3s on a Raspberry Pi or other ARM devices, it is recommended that you use an external SSD. etcd is write intensive; SD cards and eMMC cannot handle the IO load."}),"\n",(0,t.jsx)(n.h3,{id:"server-sizing-guide",children:"Server Sizing Guide"}),"\n",(0,t.jsx)(n.p,{children:"When limited on CPU and RAM on the server (control-plane + etcd) node, there are limitations on the amount of agent nodes that can be joined under standard workload conditions."}),"\n",(0,t.jsxs)(n.table,{children:[(0,t.jsx)(n.thead,{children:(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.th,{children:"Server CPU"}),(0,t.jsx)(n.th,{children:"Server RAM"}),(0,t.jsx)(n.th,{children:"Number of Agents"})]})}),(0,t.jsxs)(n.tbody,{children:[(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"2"}),(0,t.jsx)(n.td,{children:"4 GB"}),(0,t.jsx)(n.td,{children:"0-350"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"4"}),(0,t.jsx)(n.td,{children:"8 GB"}),(0,t.jsx)(n.td,{children:"351-900"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"8"}),(0,t.jsx)(n.td,{children:"16 GB"}),(0,t.jsx)(n.td,{children:"901-1800"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"16+"}),(0,t.jsx)(n.td,{children:"32 GB"}),(0,t.jsx)(n.td,{children:"1800+"})]})]})]}),"\n",(0,t.jsx)(n.admonition,{title:"High Availability Sizing",type:"tip",children:(0,t.jsxs)(n.p,{children:["When using a high-availability setup of 3 server nodes, the number of agents can scale roughly ~50% more than the above table. ",(0,t.jsx)(n.br,{}

1),"\n","Ex: 3 server with 4 vCPU/8 GB can scale to ~1200 agents."]})}),"\n",(0,t.jsxs)(n.p,{children:["It is recommended to join agent nodes in batches of 50 or less to allow the CPU to free up space, as there is a spike on node join. Remember to modify the default ",(0,t.jsx)(n.code,{children:"cluster-cidr"})," if desiring more than 255 nodes!"]}),"\n",(0,t.jsxs)(n.p,{children:[(0,t.jsx)(n.a,{href:"/reference/resource-profiling#server-sizing-requirements-for-k3s",children:"Resource Profiling"})," contains more information how these recommendations were found."]}),"\n",(0,t.jsx)(n.h2,{id:"networking",children:"Networking"}),"\n",(0,t.jsx)(n.p,{children:"The K3s server needs port 6443 to be accessible by all nodes."}),"\n",(0,t.jsx)(n.p,{children:"The nodes need to be able to reach other nodes over UDP port 8472 when using the Flannel VXLAN backend, or over UDP port 51820 (and 51821 if IPv6 is used) when using the Flannel WireGuard backend. The node should not listen on any other port. K3s uses reverse tunneling such that the nodes make outbound connections to the server and all kubelet traffic runs through that tunnel. However, if you do not use Flannel and provide your own custom CNI, then the ports needed by Flannel are not needed by K3s."}),"\n",(0,t.jsx)(n.p,{children:"If you wish to utilize the metrics server, all nodes must be accessible to each other on port 10250."}),"\n",(0,t.jsx)(n.p,{children:"If you plan on achieving high availability with embedded etcd, server nodes must be accessible to each other on ports 2379 and 2380."}),"\n",(0,t.jsx)(n.p,{children:"Additional changes to the firewall may be required depending on the OS used."}),"\n",(0,t.jsx)(n.admonition,{title:"Important",type:"tip",children:(0,t.jsx)(n.p,{children:"The VXLAN port on nodes should not be exposed to the world as it opens up your cluster network to be accessed by anyone. Run your nodes behind a firewall/security group that disables access to port 8472."})}),"\n",(0,t.jsx)(n.admonition,{type:"danger",children:(0,t.jsxs)(n.p,{children:["Flannel relies on the ",(0,t.jsx)(n.a,{href:"https://www.cni.dev/plugins/current/main/bridge/",children:"Bridge CNI plugin"})," to create a L2 network that switches traffic. Rogue pods with ",(0,t.jsx)(n.code,{children:"NET_RAW"})," capabilities can abuse that L2 network to launch attacks such as ARP spoofing. Therefore, as documented in the ",(0,t.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/security/pod-security-standards/",children:"Kubernetes docs"}),", please set a restricted profile that disables ",(0,t.jsx)(n.code,{children:"NET_RAW"})," on non-trustable pods."]})}),"\n",(0,t.jsx)(n.h3,{id:"inbound-rules-for-k3s-nodes",children:"Inbound Rules for K3s Nodes"}),"\n",(0,t.jsxs)(n.table,{children:[(0,t.jsx)(n.thead,{children:(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.th,{children:"Protocol"}),(0,t.jsx)(n.th,{children:"Port"}),(0,t.jsx)(n.th,{children:"Source"}),(0,t.jsx)(n.th,{children:"Destination"}),(0,t.jsx)(n.th,{children:"Description"})]})}),(0,t.jsxs)(n.tbody,{children:[(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"TCP"}),(0,t.jsx)(n.td,{children:"2379-2380"}),(0,t.jsx)(n.td,{children:"Servers"}),(0,t.jsx)(n.td,{children:"Servers"}),(0,t.jsx)(n.td,{children:"Required only for HA with embedded etcd"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"TCP"}),(0,t.jsx)(n.td,{children:"6443"}),(0,t.jsx)(n.td,{children:"Agents"}),(0,t.jsx)(n.td,{children:"Servers"}),(0,t.jsx)(n.td,{children:"K3s supervisor and Kubernetes API Server"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"UDP"}),(0,t.jsx)(n.td,{children:"8472"}),(0,t.jsx)(n.td,{children:"All nodes"}),(0,t.jsx)(n.td,{children:"All nodes"}),(0,t.jsx)(n.td,{children:"Required only for Flannel VXLAN"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"TCP"}),(0,t.jsx)(n.td,{children:"10250"}),(0,t.jsx)(n.td,{children:"All nodes"}),(0,t.jsx)(n.td,{children:"All nodes"}),(0,t.jsx)(n.td,{children:"Kubelet metrics and API"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"UDP"}),(0,t.jsx)(n.td,{children:"51820"}),(0,t.jsx)(n.td,{children:"All nodes"}),(0,t.jsx)(n.td,{children:"All nodes"}),(0,t.jsx)(n.td,{children:"Required only for Flannel Wireguard with IPv4"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"UDP"}),(0,t.jsx)(n.td,{children:"51821"}),(0,t.jsx)(n.td,{children:"All nodes"}),(0,t.jsx)(n.td,{children:"All nodes"}),(0,t.jsx)(n.td,{children:"Required only for Flannel Wireguard with IPv6"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"TCP"}),(0,t.jsx)(n.td,{children:"5001"}),(0,t.jsx)(n.td,{children:"All nodes"}),(0,t.jsx)(n.td,{children:"All nodes"}),(0,t.jsx)(n.td,{children:"Required only for embedded distributed registry (Spegel)"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"TCP"}),(0,t.jsx)(n.td,{children:"6443"}),(0,t.jsx)(n.td,{children:"All nodes"}),(0,t.jsx)(n.td,{children:"All nodes"}),(0,t.jsx)(n.td,{children:"Required only for embedded distributed registry (Spegel)"})]})]})]}),"\n",(0,t.jsx)(n.h3,{id:"outbound-rules-for-k3s-nodes",children:"Outbound Rules for K3s Nodes"}),"\n",(0,t.jsx)(n.p,{children:"Typically, all outbound traffic is allowed."}),"\n",(0,t.jsx)(n.h3,{id:"local-ports",children:"Local Ports"}),"\n",(0,t.jsx)(n.p,{children:"Kubernetes and the Container Runtime listen on the loopback interface for monitoring and communication between components. Avoid deploying other workloads that use these ports, or using these as the Node Port for pods or services."}),"\n",(0,t.jsxs)(n.table,{children:[(0,t.jsx)(n.thead,{children:(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.th,{children:"Protocol"}),(0,t.jsx)(n.th,{children:"Port"}),(0,t.jsx)(n.th,{children:"Description"})]})}),(0,t.jsxs)(n.tbody,{children:[(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"TCP"}),(0,t.jsx)(n.td,{children:"2381"}),(0,t.jsx)(n.td,{children:"etcd metrics"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"TCP"}),(0,t.jsx)(n.td,{children:"2382"}),(0,t.jsx)(n.td,{children:"etcd legacy HTTP API"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"TCP"}),(0,t.jsx)(n.td,{children:"6444"}),(0,t.jsx)(n.td,{children:"kube-apiserver local access"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"TCP"}),(0,t.jsx)(n.td,{children:"10010"}),(0,t.jsx)(n.td,{children:"containerd and cri-dockerd CRI service exec/logs streaming"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"TCP"}),(0,t.jsx)(n.td,{children:"10248"}),(0,t.jsx)(n.td,{children:"kubelet health"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"TCP"}),(0,t.jsx)(n.td,{children:"10249"}),(0,t.jsx)(n.td,{children:"kube-proxy metrics"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"TCP"}),(0,t.jsx)(n.td,{children:"10250"}),(0,t.jsx)(n.td,{children:"kubelet metrics and API"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"TCP"}),(0,t.jsx)(n.td,{children:"10256"}),(0,t.jsx)(n.td,{children:"kube-proxy health"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"TCP"}),(0,t.jsx)(n.td,{children:"10257"}),(0,t.jsx)(n.td,{children:"kube-controller-manager metrics"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"TCP"}),(0,t.jsx)(n.td,{children:"10258"}),(0,t.jsx)(n.td,{children:"cloud-controller-manager metrics"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"TCP"}),(0,t.jsx)(n.td,{children:"10259"}),(0,t.jsx)(n.td,{children:"kube-scheduler metrics"})]})]})]}),"\n",(0,t.jsx)(n.h2,{id:"large-clusters",children:"Large Cluster

1s"}),"\n",(0,t.jsx)(n.p,{children:"Hardware requirements are based on the size of your K3s cluster. For production and large clusters, we recommend using a high-availability setup with an external database. The following options are recommended for the external database in production:"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"MySQL"}),"\n",(0,t.jsx)(n.li,{children:"PostgreSQL"}),"\n",(0,t.jsx)(n.li,{children:"etcd"}),"\n"]}),"\n",(0,t.jsxs)(n.p,{children:["For control-plane node CPU and memory sizing relative to the number of agents, see the ",(0,t.jsx)(n.a,{href:"#server-sizing-guide",children:"Server Sizing Guide"})," above."]}),"\n",(0,t.jsx)(n.h3,{id:"disks-1",children:"Disks"}),"\n",(0,t.jsx)(n.p,{children:"The cluster performance depends on database performance. To ensure optimal speed, we recommend always using SSD disks to back your K3s cluster. On cloud providers, you will also want to use the minimum size that allows the maximum IOPS."}),"\n",(0,t.jsx)(n.h3,{id:"network",children:"Network"}),"\n",(0,t.jsxs)(n.p,{children:["You should consider increasing the subnet size for the cluster CIDR so that you don't run out of IPs for the pods. You can do that by passing the ",(0,t.jsx)(n.code,{children:"--cluster-cidr"})," option to K3s server upon starting."]}),"\n",(0,t.jsx)(n.h3,{id:"database",children:"Database"}),"\n",(0,t.jsxs)(n.p,{children:["K3s supports different databases including MySQL, PostgreSQL, MariaDB, and etcd.  See ",(0,t.jsx)(n.a,{href:"/datastore/",children:"Cluster Datastore"})," for more info."]}),"\n",(0,t.jsx)(n.p,{children:"The following is a sizing guide for the database resources you need to run large clusters:"}),"\n",(0,t.jsxs)(n.table,{children:[(0,t.jsx)(n.thead,{children:(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.th,{style:{textAlign:"center"},children:"Deployment Size"}),(0,t.jsx)(n.th,{style:{textAlign:"center"},children:"Nodes"}),(0,t.jsx)(n.th,{style:{textAlign:"center"},children:"vCPUs"}),(0,t.jsx)(n.th,{style:{textAlign:"center"},children:"RAM"})]})}),(0,t.jsxs)(n.tbody,{children:[(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{style:{textAlign:"center"},children:"Small"}),(0,t.jsx)(n.td,{style:{textAlign:"center"},children:"Up to 10"}),(0,t.jsx)(n.td,{style:{textAlign:"center"},children:"1"}),(0,t.jsx)(n.td,{style:{textAlign:"center"},children:"2 GB"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{style:{textAlign:"center"},children:"Medium"}),(0,t.jsx)(n.td,{style:{textAlign:"center"},children:"Up to 100"}),(0,t.jsx)(n.td,{style:{textAlign:"center"},children:"2"}),(0,t.jsx)(n.td,{style:{textAlign:"center"},children:"8 GB"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{style:{textAlign:"center"},children:"Large"}),(0,t.jsx)(n.td,{style:{textAlign:"center"},children:"Up to 250"}),(0,t.jsx)(n.td,{style:{textAlign:"center"},children:"4"}),(0,t.jsx)(n.td,{style:{textAlign:"center"},children:"16 GB"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{style:{textAlign:"center"},children:"X-Large"}),(0,t.jsx)(n.td,{style:{textAlign:"center"},children:"Up to 500"}),(0,t.jsx)(n.td,{style:{textAlign:"center"},children:"8"}),(0,t.jsx)(n.td,{style:{textAlign:"center"},children:"32 GB"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{style:{textAlign:"center"},children:"XX-Large"}),(0,t.jsx)(n.td,{style:{textAlign:"center"},children:"500+"}),(0,t.jsx)(n.td,{style:{textAlign:"center"},children:"16"}),(0,t.jsx)(n.td,{style:{textAlign:"center"},children:"64 GB"})]})]})]})]})}function h(e={}){const{wrapper:n}={...(0,d.R)(),...e.components};return n?(0,t.jsx)(n,{...e,children:(0,t.jsx)(c,{...e})}):c(e)}function u(e,n){throw new Error("Expected "+(n?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}},28453:(e,n,r)=>{r.d(n,{R:()=>i,x:()=>l});var s=r(96540);const t={},d=s.createContext(t);function i(e){const n=s.useContext(d);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function l(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:i(e.components),s.createElement(d.Provider,{value:n},e.children)}}}]);