k3s · HOMELAB // k3s

Overview


Version	k3s v1.35 channel (CKAD 2026 runs on Kubernetes v1.35)
Bundled	containerd, Flannel, CoreDNS, Traefik, metrics-server, local-path provisioner
Access	`kubectl` on the server via SSH, alias `k` with completion

1. Firewall for cluster traffic

shell @ server

sudo ufw allow 6443/tcp comment 'k3s API'
sudo ufw allow 80/tcp comment 'Traefik HTTP'
sudo ufw allow 443/tcp comment 'Traefik HTTPS'
sudo ufw allow from 10.42.0.0/16 comment 'k3s pods'
sudo ufw allow from 10.43.0.0/16 comment 'k3s services'

Without the pod and service network rules, ufw drops in-cluster traffic such as DNS queries to CoreDNS.

2. Install

shell @ server

curl -sfL https://get.k3s.io | INSTALL_K3S_CHANNEL=v1.35 INSTALL_K3S_EXEC="--write-kubeconfig-mode 600" sh -

INSTALL_K3S_CHANNEL=v1.35: latest patch release of the 1.35 line,
--write-kubeconfig-mode 600: kubeconfig readable by root only.

3. kubectl for the admin user

shell @ server

mkdir -p ~/.kube
sudo cp /etc/rancher/k3s/k3s.yaml ~/.kube/config
sudo chown "$USER:$USER" ~/.kube/config && chmod 600 ~/.kube/config
cat >> ~/.bashrc <<'EOF'
export KUBECONFIG=~/.kube/config
source <(kubectl completion bash)
alias k=kubectl
complete -o default -F __start_kubectl k
EOF
source ~/.bashrc

Verify

shell @ server

k get nodes
k get pods -A

text

NAME      STATUS   ROLES           AGE   VERSION
homelab   Ready    control-plane   46s   v1.35.9+k3s1

`kube-system` pod	Role
`coredns`	in-cluster DNS
`traefik`, `svclb-traefik`	ingress controller and its host-port load balancer
`local-path-provisioner`	PersistentVolumes on the node’s disk
`metrics-server`	resource metrics (`k top`)
`helm-install-traefik*`	one-off install jobs (`Completed`)

Smoke test of the ingress path:

shell @ server

k create deployment hello --image=nginx
k expose deployment hello --port=80
k create ingress hello --rule="/=hello:80"
curl -s http://localhost | grep -o "<title>.*</title>"
k delete ingress,svc,deployment hello

Notes

curl … | sh runs the official installer unreviewed; acceptable for a homelab. In production: download, review, pin with INSTALL_K3S_VERSION.
k3s uses SQLite as its datastore on a single node; workloads are managed declaratively through GitOps.