Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →For a production Rancher management plane on VPS infrastructure, deploy three Linux VPS nodes running RKE2 servers, place a load balancer in front of them, point a DNS name at that balancer, and expose Rancher over HTTPS. Use at least 4 vCPUs and 16 GB RAM per node as Rancher’s published small-production starting point, SSD storage for etcd, private firewall rules for cluster traffic, recurring off-node etcd snapshots, and a tested restore procedure.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What the finished architecture looks like
Rancher is installed into a Kubernetes cluster; it is not normally installed as a standalone daemon on one VPS. The management cluster should therefore be designed first, then Rancher should be deployed into it with Helm. Rancher’s infrastructure guidance uses three Linux nodes, a load balancer and a DNS record mapped to that load balancer. Keep the nodes in one provider region for predictable latency; use separate availability zones when the VPS provider supports them and the added network complexity is acceptable.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →The load balancer is part of the control-plane design. Create listeners for the RKE2 supervisor on TCP 9345 and the Kubernetes API on TCP 6443. Rancher’s user-facing ingress is HTTPS on TCP 443. The Rancher hostname, such as rancher.example.com, should resolve to the balancer before you request or issue certificates.
RKE2 uses embedded etcd for this three-server topology. The servers must be able to exchange etcd, kubelet and overlay-network traffic over private addresses; those ports should not be open to the public internet. See Rancher’s architecture guidance for the supported arrangement: HA RKE2 Kubernetes cluster infrastructure and RKE2 for Rancher.
#1 Best Overall
Capacity, operating system and VPS requirements
Rancher’s published baseline for a small highly available production management setup is 4 vCPUs and 16 GB of RAM per node (SUSE Rancher guidance, 2025). That is a starting point, not a guarantee for every number of managed clusters, users or workloads. Check the current support matrix before selecting an operating-system image or Kubernetes version.
| Requirement | Practical target for this design | Why it matters |
|---|---|---|
| Node count | Three Linux VPS instances | Rancher identifies at least three nodes for a highly available production setup. |
| CPU and memory | 4 vCPUs and 16 GB RAM per node as the published small-production baseline | Rancher, Kubernetes control-plane components and embedded etcd share each server. |
| Storage | SSD-backed disks; capacity sized for logs, images and etcd snapshots | Rancher specifically recommends SSD storage because management-cluster performance depends on etcd performance. |
| Addressing | Unique hostnames and static IP addresses or DHCP reservations | Stable node addresses are required for cluster membership and certificates. |
| Network placement | One region, with separate zones when available | Low latency helps etcd; zone separation can reduce a single-location failure. |
| Administration workstation | curl, kubectl and Helm |
These are needed to install RKE2, inspect the cluster and install Rancher. |
Keep the Rancher management cluster dedicated to management when possible. Put application workloads in downstream clusters so a workload surge, node drain or application incident does not compete directly with Rancher and its control-plane services.
Prepare the three VPS servers
- Provision supported Linux images. Create three instances with unique hostnames, static addresses (or reservations), SSD storage and the CPU/RAM baseline above. Verify the chosen distribution and kernel are listed in the current Rancher and RKE2 support information.
- Build private connectivity. Put the servers on the provider’s private network where available. Test name resolution and reachability between every pair using their private addresses. Avoid relying on changing public addresses for node-to-node communication.
- Create the balancer and DNS record. Configure a balancer with targets for all three servers. Add listeners for TCP 9345 and TCP 6443 for control-plane traffic, and TCP 443 for Rancher’s ingress. Point the Rancher DNS name to the balancer and confirm that public and internal resolvers return the intended address.
- Apply security-group and host-firewall rules. Start with the port matrix below. Restrict etcd, kubelet and overlay traffic to node or cluster CIDRs. Permit public HTTPS only where users and automation actually need it.
- Check host services. Remove or reconfigure services that bind to Kubernetes ports. Follow the supported RKE2 guidance for host-firewall behavior; a firewall that drops required node traffic can look like a failed cluster join.
- Prepare the workstation. Install current, compatible versions of
curl,kubectland Helm. Keep administrative kubeconfig files outside shared folders and protect them like credentials.
Do not issue a certificate until the Rancher hostname resolves through the balancer. A certificate for a name that points at an individual node will fail when traffic is sent to another node.
Firewall and load-balancer port matrix
Use the following as a design checklist, then adapt it to your provider’s security groups and the exact RKE2 features enabled. Rancher’s complete requirements, including outbound access, are documented in the Rancher port requirements.
| Port | Protocol | Source and destination | Purpose and exposure |
|---|---|---|---|
| 9345 | TCP | RKE2 servers to the fixed registration endpoint; balancer to server targets | RKE2 server registration and supervisor traffic. The balancer listener must remain stable when nodes join. |
| 6443 | TCP | Administrators, balancer and required node traffic to the API servers | Kubernetes API access. Expose it through the balancer as required by your operations model, and limit direct node access. |
| 2379 | TCP | RKE2 servers only | etcd client traffic. Keep it on the private cluster network. |
| 2380 | TCP | RKE2 servers only | etcd peer traffic. Never publish it to the internet. |
| 10250 | TCP | Required RKE2 server and agent paths | Kubelet traffic. Restrict sources to the node or cluster CIDRs that need it. |
| 8472 | UDP | Cluster nodes only | Flannel VXLAN when that backend is used. Do not expose it publicly. |
| 30000-32767 | TCP/UDP | Only where NodePort services are used | Kubernetes NodePort range. Open only the protocols and source ranges your services require. |
| 443 | TCP | Users and automation to the Rancher ingress | Encrypted Rancher UI and API traffic, including HTTPS access used by kubectl-facing workflows. |
Nodes also need outbound HTTPS for catalog and image-related access, and the management cluster needs API connectivity to hosted or imported downstream clusters. Add egress rules for your identity provider, registries, backup target and cloud integrations rather than assuming unrestricted outbound access.
Bootstrap the first RKE2 server
Choose one VPS as the initial server. Use a long, randomly generated shared token; the value below is illustrative and must be replaced. Include every DNS name or address that clients will use in tls-san, especially the Rancher name and the fixed RKE2 registration name.
mkdir -p /etc/rancher/rke2
cat > /etc/rancher/rke2/config.yaml <<'EOF'
token: replace-with-a-long-random-secret
tls-san:
- rancher.example.com
- rke2.example.com
EOFInstall and start RKE2 on that server:
curl -sfL https://get.rke2.io | sh -
systemctl enable rke2-server.service
systemctl start rke2-server.serviceRKE2 writes the administrative kubeconfig to /etc/rancher/rke2/rke2.yaml. Protect the file because it grants cluster administration. Copy it over an encrypted channel to the administration workstation, set the workstation’s KUBECONFIG to the protected copy, and use the balancer’s API name rather than a loopback address when the file must work remotely.
If you did not set a token in the configuration, RKE2 generates one at /var/lib/rancher/rke2/server/node-token. Retrieve that file only through a protected administrative session and do not place its contents in tickets, shell history or public repositories.
Join VPS two and VPS three
On each additional server, create the same configuration directory. Use the identical token and point server to the fixed registration address exposed by the balancer. The port is 9345, not the Kubernetes API port.
mkdir -p /etc/rancher/rke2
cat > /etc/rancher/rke2/config.yaml <<'EOF'
token: replace-with-a-long-random-secret
server: https://rke2.example.com:9345
tls-san:
- rancher.example.com
- rke2.example.com
EOF
curl -sfL https://get.rke2.io | sh -
systemctl enable rke2-server.service
systemctl start rke2-server.serviceRepeat the procedure on the third VPS. Keep the token, registration URL and relevant tls-san names consistent. A typo in the token produces an authentication failure; a registration name omitted from the certificate SANs produces a TLS name error; and a balancer that sends 9345 to only one unhealthy target can make an otherwise healthy server appear unable to join.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRank #3
Wait for all three servers to register before installing Rancher. From the workstation, run:
kubectl get nodes -o wide
kubectl get pods -AEvery server should become Ready. Investigate networking, certificates and service logs before proceeding if a node remains NotReady; adding Rancher on top of an unhealthy control plane makes the eventual failure harder to diagnose.
Install Rancher with Helm and TLS
Rancher must be served over encrypted TLS. Its installation overview requires a working Ingress controller and the kubectl and Helm command-line tools; RKE2 provides an Ingress controller for this setup. Read the current installation procedure at Install or upgrade Rancher on a Kubernetes cluster.
- Confirm the cluster is healthy. Check that all three nodes are
Ready, system pods are running and the API is reachable through the intended endpoint. - Install cert-manager as specified by Rancher. Use the version and Helm procedure in Rancher’s installation documentation rather than selecting an arbitrary chart version. Decide whether your organization will issue the certificate or whether you will use Let’s Encrypt.
- Create the Rancher namespace. The standard namespace is
cattle-system:
kubectl create namespace cattle-system- Add the Rancher chart repository and update Helm metadata.
helm repo add rancher-stable https://releases.rancher.com/server-charts/stable
helm repo update- Install the chart with your DNS hostname. Follow the chart command and TLS options in Rancher’s tutorial for the selected certificate method. The hostname value must exactly match the DNS name that resolves to the balancer and the certificate SAN.
- Watch the rollout. Use
kubectl -n cattle-system get podsandkubectl -n cattle-system get ingress. Open the HTTPS hostname only after the Rancher pods and ingress report healthy status. - Complete the initial login and identity setup. Set the bootstrap administrator password, configure an identity provider if required, and remove temporary access paths that your organization does not need.
The self-signed option is useful for a tutorial or an isolated lab, but a real deployment should use Let’s Encrypt or an organization-managed certificate. Keep certificate renewal in the operational calendar and monitor expiry; an expired Rancher certificate can prevent both human access and automation.
Free tools Windows power users keep installed
One-click scans. No signup required.
For the exact proxy, cert-manager and Helm values supported by the current release, use Rancher’s Rancher installation tutorial. Proxy settings, private certificate authorities and external load-balancer TLS termination change the required values, so do not copy a self-signed example unchanged into production.
Validate the deployment before calling it production
- Control plane: all three nodes are
Ready; RKE2 server services are enabled and active; and the API remains reachable through the balancer after stopping or draining one target during a maintenance test. - Registration: a joining server can reach the fixed 9345 endpoint, and the balancer health check removes failed targets instead of sending new registrations to them.
- Ingress: the Rancher hostname resolves to the balancer, presents the expected certificate chain, and redirects or rejects plain HTTP according to your policy.
- Network isolation: scans from outside the cluster cannot reach 2379, 2380, 8472 or 10250; only approved sources can use the API and NodePort ranges.
- Downstream access: Rancher can reach the Kubernetes APIs, registries, identity provider and catalog endpoints needed for the clusters you will manage.
- Credentials: the RKE2 token, kubeconfig and Rancher bootstrap credentials are stored in an access-controlled secret system, not in source control.
Backups and ongoing operations
Enable recurring etcd snapshots and send copies off the VPS nodes, such as to an external object-storage target. A snapshot that exists only on the failed disk is not a disaster-recovery plan. Perform a restore exercise on a schedule and record the exact RKE2 version, snapshot location, credentials and recovery steps used.
Monitor disk I/O, free space, memory pressure, node health, API latency and certificate expiry. SSD performance is particularly important to etcd; a nearly full or degraded disk can turn a healthy-looking node into a control-plane bottleneck. Keep operating-system, RKE2, Rancher and chart upgrades within the versions supported by the current Rancher matrix, and test upgrades against a recent backup.
Use provider snapshots only as an additional layer unless you have verified that they capture a consistent etcd state. Coordinate node maintenance so that enough servers remain available for the management cluster, and document how the balancer, DNS, firewall and certificate settings are recreated if the provider account or region is unavailable.
Rancher’s production checklist covers these operational controls in more detail: production-ready cluster checklist.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common failure modes and fixes
A joining node times out on port 9345
Verify that the node resolves rke2.example.com to the balancer, that the balancer has a healthy 9345 listener and that security groups allow TCP 9345 from the joining node. Check the RKE2 server service log on both sides. Do not substitute 6443 for 9345 in the joining configuration.
TLS errors mention an unknown name
Compare the hostname in the server URL and the browser URL with the names under tls-san. Recreate the configuration with the exact DNS names used by clients and ensure the balancer does not rewrite the destination to an unlisted name.
Recommended Free Tools
The node joins but remains NotReady
Check private routes and firewall rules for 2379, 2380, 10250 and, when enabled, UDP 8472. Confirm that the host firewall is not dropping overlay or kubelet traffic and inspect kubectl get pods -A for networking or system-component failures.
Rancher’s page is unreachable while pods are running
Check DNS, the balancer’s TCP 443 listener, ingress status and the certificate chain. A healthy Rancher pod does not prove that the external listener forwards to the correct ingress service. Test from a network that should be allowed and verify that the certificate name matches the public hostname.
Rancher installs but catalogs or downstream clusters fail
Review outbound TCP 443 rules and the routes to hosted or imported-cluster APIs. Add explicit egress permissions for registries, authentication services, backup storage and catalog endpoints required by your environment.
How to evaluate a VPS provider for this topology
Rancher does not endorse a particular VPS vendor. Compare providers against the requirements that affect control-plane reliability rather than choosing solely on advertised vCPU price.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors| Evaluation area | Questions to answer before purchase |
|---|---|
| Compute | Can each instance sustain at least 4 vCPUs and 16 GB RAM, and can you resize without changing addresses? |
| Storage | Are disks SSD-backed, what durability and I/O guarantees exist, and can snapshots be exported? |
| Private networking | What latency and bandwidth exist between nodes, and can traffic be restricted to private interfaces? |
| Addresses and DNS | Are static IPv4 and IPv6 addresses, reverse DNS and automated DNS changes available? |
| Load balancer | Can it provide independent TCP listeners for 9345, 6443 and 443, health checks and stable addresses? |
| Availability zones | Can the three nodes be distributed across zones without introducing unsupported network latency? |
| Recovery | Can you create off-node snapshots or object-storage backups, and what are the provider’s incident and recovery procedures? |
| Security controls | Are security groups, private firewalls, audit logs and IPv4/IPv6 rules granular enough for the port matrix? |
Record these answers as part of the design review. A provider that cannot offer stable addresses, private low-latency networking or the required balancer listeners may be unsuitable even if its instances meet the CPU and RAM numbers.
Production decision checklist
- Three supported Linux VPS nodes are provisioned with unique names, stable addresses and SSD storage.
- The nodes communicate over a low-latency private network, and the balancer has stable listeners on 9345, 6443 and 443.
- The Rancher DNS name resolves to the balancer before certificate issuance.
- The same protected RKE2 token and compatible
tls-sannames are used on every server. - All three RKE2 servers are
Readybefore Rancher is installed. - Rancher is installed into
cattle-systemwith Helm and served over a trusted TLS certificate. - Cluster-only ports are private, outbound dependencies are explicitly allowed, and NodePort exposure is intentional.
- Etcd snapshots run on a schedule, are stored off-node and have passed a restore test.
- Monitoring covers etcd disk performance, memory, node health, API availability and certificate expiry.
This arrangement makes the load balancer, DNS, firewall and recovery procedures first-class parts of the Rancher platform. A single VPS can be useful for development, but the three-server RKE2 design is the appropriate foundation when Rancher itself must remain available during a node failure or maintenance event.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
