Accessing RKE2 Administrative Commands

Purpose

Provide consistent, copy-safe commands for running kubectl and rke2 on RKE2 server and worker nodes.

Scope

RKE2 server nodes: control plane and etcd
RKE2 worker nodes
Environment validated with RKE2 v1.32.4+rke2r1

Command locations in this environment

/usr/local/bin/rke2
/var/lib/rancher/rke2/bin/kubectl
/etc/rancher/rke2/rke2.yaml

The administrative kubeconfig is expected on server nodes. Do not assume it exists on workers.

Method 1: Full paths as your own account using sudo

This is the most reliable method because it does not depend on PATH preservation by sudo.

On an RKE2 server node

sudo /var/lib/rancher/rke2/bin/kubectl \
  --kubeconfig /etc/rancher/rke2/rke2.yaml \
  get nodes

sudo /usr/local/bin/rke2 certificate check --output table

sudo /usr/local/bin/rke2 --version

On an RKE2 worker node

Use RKE2 locally:

sudo /usr/local/bin/rke2 certificate check --output table

sudo /usr/local/bin/rke2 --version

Run cluster-wide kubectl commands from a server node unless an approved administrative kubeconfig has been installed on the worker.

Method 2: Interactive root shell

Use sudo -i, rather than sudo su, to start a root login shell.

sudo -i

Set the environment:

export PATH="/usr/local/bin:/var/lib/rancher/rke2/bin:$PATH"

On a server node only:

export KUBECONFIG=/etc/rancher/rke2/rke2.yaml

Verify command resolution:

command -v rke2
command -v kubectl
printf '%s\n' "$KUBECONFIG"

Expected on a server node:

/usr/local/bin/rke2
/var/lib/rancher/rke2/bin/kubectl
/etc/rancher/rke2/rke2.yaml

Test:

rke2 --version
rke2 certificate check --output table
kubectl get nodes

This changes root's shell profile. Follow local change-control requirements.

cat >> /root/.bashrc <<'EOF'
export PATH="/usr/local/bin:/var/lib/rancher/rke2/bin:$PATH"
if [ -f /etc/rancher/rke2/rke2.yaml ]; then
  export KUBECONFIG=/etc/rancher/rke2/rke2.yaml
fi
EOF

Reload the profile:

source /root/.bashrc

Common errors

`sudo: kubectl: command not found`

sudo commonly uses its own restricted PATH. Use the full path:

sudo /var/lib/rancher/rke2/bin/kubectl \
  --kubeconfig /etc/rancher/rke2/rke2.yaml \
  get nodes

`sudo: rke2: command not found`

Use the full path:

sudo /usr/local/bin/rke2 certificate check --output table

`The connection to the server localhost:8080 was refused`

kubectl did not receive a valid kubeconfig. On a server node:

sudo /var/lib/rancher/rke2/bin/kubectl \
  --kubeconfig /etc/rancher/rke2/rke2.yaml \
  get nodes

`rke2-agent.service is masked`

Confirm the node role:

sudo systemctl status rke2-server rke2-agent --no-pager

Server nodes use rke2-server.
Worker nodes use rke2-agent.

Validation checklist

[ ] rke2 --version runs successfully.
[ ] rke2 certificate check --output table runs successfully.
[ ] On a server node, kubectl get nodes lists the cluster.
[ ] The operator has confirmed whether the current host is a server or worker before restarting a service.