Why choose K3s over full Kubernetes on a VPS
Standard Kubernetes ships several heavy components: etcd, kube-apiserver, kube-controller-manager and kube-scheduler all run in parallel and easily consume 2 to 4 GB of RAM at startup, before your applications even start. On a 2 GB VPS, almost nothing is left for actual workloads. K3s solves this by packaging all control plane components into a single binary, replacing etcd with SQLite for small clusters, and removing features rarely used outside large installations. The result is a fully CNCF-certified Kubernetes cluster, compatible with kubectl and helm, that installs in under two minutes and uses around 512 MB for an agent node and about 1 GB for a server node.
The concrete advantages of K3s
- Single 60 MB binary including the
containerdruntime, CoreDNS and a local storage provisioner, with no additional system dependencies. - Traefik built in as the default ingress controller, ready to terminate TLS without extra configuration.
- Native compatibility with
kubectlandhelmimmediately after installation, no adaptation needed. - Simplified upgrades: replacing the binary and restarting the service is enough in most cases.
- CNCF v1.32 certification guaranteeing conformance with the standard Kubernetes API.
Prerequisites before you start
To follow this guide, you need a VPS with at least 2 GB of RAM and 1 vCPU running Ubuntu 22.04 or Debian 12. Port 6443 must be open in your firewall so that kubectl can reach the cluster API from your local machine. If you plan to expose services over HTTPS, prepare a domain name pointing to your VPS IP, for example your-domain.com. SSH access with root or sudo privileges completes the list.
From installation to your first HTTPS app
Provision the VPS and open the required ports
Connect to your VPS via SSH, then allow ports 80, 443 and 6443 in your firewall. On Ubuntu with ufw: ufw allow 80/tcp, ufw allow 443/tcp, ufw allow 6443/tcp. Make sure the system is up to date with apt update && apt upgrade -y before proceeding.
Install K3s with a single command
Run the official script: curl -sfL https://get.k3s.io | sh -. The script downloads the binary, installs a systemd service named k3s and starts the control plane. Check the service status with systemctl status k3s. The node is ready when its status shows Ready.
Configure kubectl on your local machine
Copy the kubeconfig file from your VPS: scp [email protected]:/etc/rancher/k3s/k3s.yaml ~/.kube/config. Replace 127.0.0.1 with your VPS public IP in that file. Test the connection with kubectl get nodes: you should see your single node with status Ready.
Deploy a sample application
Create an app.yaml file containing a Deployment and a ClusterIP Service exposing your application on port 80. Apply it with kubectl apply -f app.yaml, then check that the pod starts with kubectl get pods.
Configure Traefik for HTTPS ingress
K3s includes Traefik as an IngressController. Create an Ingress object pointing to the Service from the previous step with the annotation kubernetes.io/ingress.class: traefik and your host your-domain.com. Apply with kubectl apply -f ingress.yaml and verify HTTPS access in your browser.
In production, avoid relying on the default token stored at /var/lib/rancher/k3s/server/node-token for unattended connections. Use k3s token to generate short-lived tokens when adding worker nodes. Also enable Kubernetes audit logs by passing --kube-apiserver-arg=audit-log-path=/var/log/k3s-audit.log to the service at startup.
K3s as a bridge to full Kubernetes
K3s fills a logical gap between Docker Compose, which works well for simple single-host applications, and a full Kubernetes cluster that requires dedicated infrastructure. It lets you build Kubernetes habits — Deployments, Services, Ingress, ConfigMaps, secrets — on a real-size environment without the overhead of a multi-node cluster. When your traffic or team grows, migrating to an upstream cluster will be straightforward: the YAML manifests and helm charts you have written will work without modification. To go further with Traefik configuration on K3s, check out our guide on deploying with Traefik.
