Skip to content

RKE2 HA Platform Foundation

Overview

RKE2 HA Platform Foundation provides the on-prem Kubernetes base for workload delivery. The current environment has a three-node control plane, a published kubeconfig, and a live GitOps root.

It is the on-prem cluster base for application, GitOps, and secret-delivery workloads. Cloud burst targets reuse the same HybridOps contract model as separate execution environments.

Case study

  • Context: the estate had no on-prem Kubernetes. Application and secret delivery had no repeatable target, and each new workload requirement reopened the question of where and how to run it.
  • Challenge: provisioning a HA control plane and handing it to operators in a usable state, with kubeconfig published and GitOps ready, through a single controlled path rather than a sequence of manual steps.
  • Approach: onprem/rke2@v1 delivers the three-node control plane. Kubeconfig is published as part of the platform workflow, not assembled manually. Argo CD and secret delivery are added on top of the same cluster baseline through onprem/rke2-workloads@v1.
  • Outcome: the RKE2 control plane is healthy across rke2-cp-01, rke2-cp-02, and rke2-cp-03, kubeconfig is published and immediately operable, and GitOps root hyops-workloads-root is active. On-prem workload and secret-delivery paths build directly on this cluster; GKE burst reuses the same delivery model on its own cluster.

Covers cluster delivery, published kubeconfig access, node readiness, and the extension path into GitOps, secret delivery, and workload rollout.

Outcome

The result is an on-prem Kubernetes platform ready for controlled workload delivery.

  • Three control-plane nodes provide the current HA baseline.
  • Operator access is published as part of the platform path rather than assembled manually.
  • GitOps and secret delivery extend the same RKE2 cluster; cloud burst stays a separate target under the same operating contract.

Operating model

  • RKE2 provides the on-prem HA control plane.
  • Published kubeconfig makes the cluster immediately operable after delivery.
  • GitOps and secret delivery extend the same cluster baseline.
  • Cloud targets remain separate execution environments while reusing the same HybridOps delivery model.

Architecture

RKE2 HA platform foundation architecture showing the on-prem network and inventory foundation, the three-node RKE2 control plane, published operator access, and the GitOps, secret-delivery, and workload extensions on that cluster.

The on-prem foundation feeds a three-node RKE2 control plane. HybridOps publishes kubeconfig as an operator handoff, then GitOps, secret delivery, and platform workloads extend that same cluster. Cloud targets remain separate execution environments.

Cluster sequence

  1. The RKE2 control plane is provisioned through the platform path.
  2. Kubeconfig is published for operator use.
  3. GitOps and secret delivery are added on top of the cluster.
  4. Public and private workload paths can then be introduced without changing the foundation.

Platform state

Argo CD root application view showing the platform workload baseline delivered to the RKE2 cluster
Argo CD root application delivering the platform workload baseline.
kubectl get nodes output: rke2-cp-01, rke2-cp-02, rke2-cp-03 all Ready, showing the current control-plane node set
Three RKE2 control-plane nodes reporting Ready.

IP addresses, hostnames, and instance identifiers visible in screenshots and recordings reflect the ephemeral infrastructure provisioned during the recorded exercise.

Implementation

  • Cluster layer: RKE2 delivers the HA control plane for the current environment.
  • Operator handoff: kubeconfig is published as part of the platform workflow.
  • GitOps readiness: Argo CD and workload roots extend the same cluster baseline.
  • Secret delivery: on-prem GSM bootstrap extends this RKE2 cluster; GKE uses the corresponding delivery model on its own execution target.

Key components

  • Cluster blueprint: onprem/rke2@v1
  • Workload extension path: onprem/rke2-workloads@v1
  • Cluster module: platform/onprem/rke2-cluster
  • Related extensions: platform/k8s/gsm-bootstrap, platform/k8s/gcp-secret-store, platform/k8s/runtime-bundle-secret

Where it fits

  • on-prem Kubernetes foundations for controlled workload rollout
  • GitOps-ready internal platform clusters
  • on-prem secret delivery and private runtime delivery built on a shared RKE2 baseline

References

Further reading
Implementation references
  • platform/onprem/rke2-cluster
  • platform/k8s/gsm-bootstrap
  • platform/k8s/gcp-secret-store
  • platform/k8s/runtime-bundle-secret

What was verified

Verified against HybridOps v1.0.1 with the RKE2 control plane healthy, kubeconfig published, and the GitOps extension path available.