Guide: Production k3s Cluster with Rancher, Longhorn and MetalLB

Guide: n8n Workflow Automation in Production

n8n in queue mode with Redis, PostgreSQL persistence, and proper process supervision — the boring, reliable setup that survives restarts and workload spikes. The automation layer behind several of my

Guide: n8n Workflow Automation in Production

n8n in queue mode with Redis, PostgreSQL persistence, and proper process supervision — the boring, reliable setup that survives restarts and workload spikes. The automation layer behind several of my

A complete Kubernetes lab-to-production pattern: k3s in Docker with the embedded etcd datastore, Rancher for management, MetalLB for Layer-2 LoadBalancer IPs, Longhorn replicated storage, and Traefik ingress. I run versions of this on my own hardware.

What this is

A deployment guide with working examples — not a downloadable product. Everything below is the actual configuration I use, abridged to the parts that matter.

Deployment example

services:
  k3s-server:
    image: rancher/k3s:${K3S_VERSION:-v1.36.4-k3s1}
    container_name: k3s-server
    restart: unless-stopped
    privileged: true
    command:
      - server
      - --disable=servicelb
      - --node-name=${K3S_NODE_NAME:-k3s-server}
    environment:
      K3S_TOKEN: ${K3S_TOKEN:?set K3S_TOKEN in .env}
      K3S_KUBECONFIG_MODE: '644'
      K3S_AGENT_TOKEN: ${K3S_AGENT_TOKEN:-}
    tmpfs:
      - /run
      - /var/run
    volumes:
      - k3s-server-data:/var/lib/rancher/k3s
      - k3s-server-etc:/etc/rancher/k3s
      - /var/lib/rancher/k3s/agent:/var/lib/rancher/k3s/agent
      - /dev/mapper:/dev/mapper
      - /etc/localtime:/etc/localtime:ro
    ports:
      - ${K3S_API_PORT:-6443}:6443
    networks:
      - k3s
    healthcheck:
      test:
        - CMD
        - k3s
        - kubectl
        - get
        - nodes
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s

Excerpt — k3s-server from the compose file. The remaining services (k3s-agent, rancher) follow the same pattern and mount their configuration from a config/ directory.

Essential environment variables

Copy .env.example to .env and at minimum set:

K3S_VERSION=v1.36.4-k3s1
RANCHER_VERSION=v2.15.0
K3S_TOKEN=change_me_random_64_chars
K3S_AGENT_TOKEN=
K3S_API_PORT=6443
RANCHER_HTTP_PORT=8080

Production checklist

• Set a strong, unique K3S_TOKEN (never reuse across environments)
• Restrict K3S_API_PORT with a firewall; never expose 6443 to the public internet
• Access Rancher over HTTPS (configure a trusted cert, not the self-signed default)
• Install Longhorn before workloads, and set a backup target (S3/MinIO)
• Point config/metallb/pool.yaml at a range you own; avoid overlapping DHCP
• Enable etcd backups with a cron job (scripts/backup-etcd.sh)
• Restrict wireless/sensitive pods with network policies (k3s doesn't ship a CNI policy engine by default)
• Pin versions in .env for reproducible upgrades; test restore before relying on backup

A guide, not a product. This page is deployment documentation with working examples — there is no zip, no download, no support contract. You adapt the patterns to your own environment, and you own the result.

Want this running production-grade in your infrastructure instead? I teach this as the two-day Kubernetes in Production workshop — details on the consulting page.