Rancher (by SUSE) is an open-source management platform for Kubernetes. It gives you a web UI to create and import clusters, deploy workloads and Helm charts, manage users and permissions across clusters, and monitor everything from one place. It’s useful when you run several clusters, or want teammates to use Kubernetes without living in kubectl.

When Rancher makes sense

  • You manage multiple clusters (dev, staging, production, or several locations).
  • You want centralised authentication (GitHub, LDAP, OIDC) and RBAC across clusters.
  • Developers need a friendly UI to view logs, scale deployments, and install apps.

For a single small cluster, Rancher may be more than you need. k9s or a lightweight dashboard (Headlamp) may be enough. See k9s.

Requirements

  • A dedicated VPS (or small cluster) for Rancher itself: 4 GB RAM and 2 vCPU minimum. More for managing many clusters.
  • A domain name (for example rancher.example.com) pointing to it.
  • A Kubernetes cluster to run Rancher on. k3s is the usual choice for a single-node Rancher server. See k3s.

Rancher’s supported Kubernetes versions change with each release: check the support matrix, and install a matching k3s version.

Install k3s

curl -sfL https://get.k3s.io | INSTALL_K3S_VERSION="v1.30.6+k3s1" sh -s - server
sudo k3s kubectl get nodes
mkdir -p ~/.kube && sudo cp /etc/rancher/k3s/k3s.yaml ~/.kube/config && sudo chown $USER ~/.kube/config

(Pick a version from the Rancher support matrix.)

Install cert-manager and Rancher with Helm

helm repo add jetstack https://charts.jetstack.io
helm repo add rancher-stable https://releases.rancher.com/server-charts/stable
helm repo update

helm install cert-manager jetstack/cert-manager -n cert-manager --create-namespace --set crds.enabled=true

helm install rancher rancher-stable/rancher -n cattle-system --create-namespace \
  --set hostname=rancher.example.com \
  --set bootstrapPassword='a-long-temporary-password' \
  --set ingress.tls.source=letsEncrypt \
  --set [email protected] \
  --set letsEncrypt.ingress.class=traefik

kubectl -n cattle-system rollout status deploy/rancher

See Helm tutorial and cert-manager.

Open https://rancher.example.com, log in with the bootstrap password, set a new admin password, and confirm the server URL.

Add clusters

  • Import an existing cluster: Cluster Management → Import Existing → run the generated kubectl apply command on that cluster. Rancher installs an agent that connects back.
  • Create a cluster: with RKE2 or k3s on your own VPS nodes (“custom” cluster). Rancher gives you a registration command to run on each node.

Agents connect outbound to the Rancher URL over HTTPS, so managed clusters don’t need inbound ports opened for Rancher.

Users and access

  • Configure an authentication provider (GitHub, Keycloak/OIDC, LDAP) under Users & Authentication. See Keycloak.
  • Assign global, cluster and project roles. Projects group namespaces for teams.
  • Enable 2FA through your identity provider.

Security

  • Rancher holds credentials to every cluster it manages. Protect it accordingly: strong admin password, SSO with MFA, restricted network access (or at least a WAF and rate limits), and regular upgrades.
  • Keep Rancher on its own cluster, not inside a production workload cluster.
  • See Kubernetes security basics.

Backups and upgrades

  • Install the Rancher Backups operator (from Rancher’s Apps), and schedule backups to S3-compatible storage. See MinIO.
  • Upgrade with Helm (helm upgrade rancher rancher-stable/rancher …), one minor version at a time, after reading the release notes, and check the Kubernetes support matrix first.

Quick reference

Item Value
Minimum server 2 vCPU / 4 GB RAM
Install k3s → cert-manager → helm install rancher …
First login Bootstrap password
Add cluster Import (agent) or create (RKE2/k3s)
Backups Rancher Backups operator → S3

Related: Kubernetes vs Docker Compose and kubectl cheat sheet.

  • Kubernetes
  • DevOps
  • Self-Hosting