skills.rest
dydx
dydxCOMMUNITY
Explore all skills by this author →
GitHub

rke2-networking

Configure CNI plugins, DNS, ingress, and load balancing for RKE2 clusters.

2|Updated Jul 22, 2026
Search Tags:#load balancing#dual-stack#calico#cilium#cni#kubernetes networking#rke2
One-click install
npx skills add https://github.com/dydx/rke2-skills --skill rke2-networking-dydx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: rke2-networking
Source: https://github.com/dydx/rke2-skills/tree/main/skills/rke2-networking
Command: npx skills add https://github.com/dydx/rke2-skills --skill rke2-networking-dydx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Configuring networking on self-hosted RKE2 clusters involves many interdependent choices—CNI selection, DNS caching, ingress, dual-stack, Multus, and control-plane load balancing—and misconfiguration leads to broken pod networking, DNS failures, or unreachable API servers. ## Core Features & Use Cases - CNI Selection and Tuning: Compare Canal, Cilium, Calico, and Flannel tradeoffs and customize each via HelmChartConfig manifests, including WireGuard encryption, kube-proxy replacement, and eBPF dataplanes. - DNS, Ingress, and Gateway API: Configure CoreDNS with NodeLocal DNSCache, enable Traefik ingress and Gateway API, and handle Cilium Local Redirect Policy integration. - Advanced Topologies: Set up dual-stack or IPv6-only clusters, Multus with SR-IOV and Whereabouts IPAM, external HAProxy/Keepalived load balancers for the supervisor and API server, and Windows node BGP. - Use Case: When building an HA RKE2 cluster with Cilium kube-proxy replacement, use this Skill to generate the correct config.yaml settings and HelmChartConfig manifests, including the NodeLocal DNSCache Local Redirect Policy workaround. ## Quick Start Ask how to configure a specific RKE2 networking component, such as enabling Cilium with WireGuard encryption or setting up dual-stack networking on a new cluster.

Frequently Asked Questions about rke2-networking

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I change the CNI plugin on an RKE2 cluster?▼

Set the cni key in /etc/rancher/rke2/config.yaml to canal, cilium, calico, flannel, or none. The bundled CNI deploys as an rke2-<cni> Helm chart in kube-system, and you customize it with a HelmChartConfig manifest in /var/lib/rancher/rke2/server/manifests/.

Canal vs Cilium vs Calico for RKE2, which CNI should I choose?▼

Canal is the default combining Flannel overlay with Calico network policy. Cilium offers an eBPF dataplane with kube-proxy replacement and Hubble observability but needs kernel 4.9.17+. Calico supports BGP and Windows nodes; Flannel is simplest but lacks network policy.

Can I enable dual-stack IPv4/IPv6 on an existing RKE2 cluster?▼

No, dual-stack must be configured at cluster creation time by setting comma-separated IPv4 and IPv6 CIDRs in cluster-cidr and service-cidr in config.yaml. It cannot be enabled on an existing IPv4-only cluster.

Does RKE2 support Windows worker nodes?▼

Only Calico and Flannel CNIs support Windows nodes in RKE2. Dual-stack networking and Calico BGP are not supported on Windows installs, and Canal and Cilium do not work with Windows at all.

Why does NodeLocal DNSCache break with Cilium kube-proxy replacement?▼

Cilium's eBPF dataplane bypasses the iptables rules NodeLocal uses to intercept DNS traffic. The fix is a Cilium Local Redirect Policy: set localRedirectPolicy: true in the rke2-cilium HelmChartConfig and use_cilium_lrp: true under nodelocal in the rke2-coredns config.

How do I load-balance the RKE2 API server for HA clusters?▼

Deploy an external L4 load balancer such as HAProxy with Keepalived holding a VIP, forwarding TCP ports 9345 (supervisor) and 6443 (API) to all server nodes. Add the VIP to tls-san in each server's config.yaml and point joining nodes at https://<VIP>:9345.

Related Skills

Explore More Software Engineering Skills→
chflechfle
3

linux-security-hardener

Generate a Linux server hardening plan with SSH, firewall, audit, and sysctl configs.

Community
Advanced
spigellspigell

k8s-networking

Align Kubernetes services, endpoints, ingresses, and network policies to resolve connectivity issues.

Community
Intermediate
ConnectiveTCSConnectiveTCS

cilium-expert

Deploy Cilium eBPF networking with identity-based policies and Hubble observability.

Community
Advanced
kettleofketchupkettleofketchup

k3s

Deploy and administer K3s clusters with embedded etcd and custom CNI.

Community
Advanced