Installing k0s

k0s ships everything Kubernetes needs — etcd, containerd, kube-router — as a single binary. You do not pre-install a container runtime or manage kubelet separately. Download the binary, run two commands, and you have a cluster.

Prerequisites

Hardware minimums:

Role	RAM	CPU
Controller only	1 GB	1 vCPU
Worker only	512 MB	1 vCPU
Single node (controller + worker)	1 GB	1 vCPU

A single-node setup needs roughly 2 GB of disk space. Workers must have at least 15% free disk space. An SSD is recommended.

Kernel requirements: Linux 4.3+ with cgroups v1 or v2. Fedora ships cgroups v2 by default. The kernel needs UTS, IPC, PID, and Net namespaces, plus netfilter and ext4 support. Every stock Fedora kernel has these.

Host binaries: Workers need mount and umount on the host. k0s bundles everything else.

Install the binary

curl --proto '=https' --tlsv1.2 -sSf https://get.k0s.sh | sudo sh

This places k0s in /usr/local/bin/. If you prefer not to pipe curl to sh, fetch the binary directly:

K0S_VERSION=$(curl -sSf https://docs.k0sproject.io/stable.txt)
curl -sSfL "https://github.com/k0sproject/k0s/releases/download/${K0S_VERSION}/k0s-${K0S_VERSION}-amd64" \
  -o /usr/local/bin/k0s
chmod +x /usr/local/bin/k0s

Verify the install:

k0s version

Open firewall ports

Fedora uses firewalld by default. Open the ports k0s requires:

sudo firewall-cmd --permanent --add-port=6443/tcp   # API server
sudo firewall-cmd --permanent --add-port=2380/tcp   # etcd peers
sudo firewall-cmd --permanent --add-port=9443/tcp   # k0s join API
sudo firewall-cmd --permanent --add-port=8132/tcp   # konnectivity
sudo firewall-cmd --permanent --add-port=10250/tcp  # kubelet
sudo firewall-cmd --permanent --add-port=179/tcp    # kube-router BGP

# Trust the CNI bridge so pods can reach the host
sudo firewall-cmd --permanent --zone=trusted --add-interface=kube-bridge

# Enable masquerading for pod egress
sudo firewall-cmd --permanent --add-masquerade

sudo firewall-cmd --reload

On a dedicated worker node (no control plane), you only need ports 10250 and 179.

Configure SELinux

Fedora runs SELinux in enforcing mode. Install the container SELinux policy:

sudo dnf install -y container-selinux

Then create a containerd config snippet that enables SELinux labeling inside k0s’s embedded containerd:

sudo mkdir -p /etc/k0s/containerd.d
cat <<'EOF' | sudo tee /etc/k0s/containerd.d/selinux.toml
[plugins."io.containerd.grpc.v1.cri"]
   enable_selinux = true
EOF

Install and start the service

Single node (controller + worker on the same machine):

sudo k0s install controller --enable-worker --no-taints
sudo k0s start

--enable-worker runs a kubelet on the controller node. --no-taints lets workloads schedule there. To use a custom config, add -c /etc/k0s/k0s.yaml.

Dedicated controller (multi-node cluster):

sudo k0s install controller -c /etc/k0s/k0s.yaml
sudo k0s start

Worker node (joining an existing cluster):

Generate a join token on the controller first:

sudo k0s token create --role worker > join-token

Copy the token file to the worker, then on the worker:

sudo mkdir -p /etc/k0s
sudo cp join-token /etc/k0s/join-token
sudo k0s install worker --token-file /etc/k0s/join-token
sudo k0s start

k0s install creates a systemd unit (k0scontroller.service or k0sworker.service) that starts on boot automatically.

Access the cluster

Export the admin kubeconfig to your home directory:

sudo k0s kubeconfig admin > ~/.kube/config
chmod 600 ~/.kube/config

Now kubectl works without sudo:

kubectl get nodes

Verify cluster status

Check the k0s process:

sudo k0s status

A healthy single-node cluster reports:

Version: v1.35.2+k0s.0
Role: controller
Workloads: true
Kube-api probing successful: true

Confirm the node is ready:

kubectl get nodes

NAME   STATUS   ROLES           AGE    VERSION
vale   Ready    control-plane   2d3h   v1.35.2+k0s

The node reaches Ready within a minute or two of starting. If it stays NotReady, check port 10250 in the firewall and verify kube-bridge is in the trusted zone.

Manage the service

Standard systemd commands control k0s:

sudo k0s stop
sudo k0s start
sudo systemctl status k0scontroller

Uninstall

sudo k0s stop
sudo k0s reset
sudo reboot

k0s reset removes /var/lib/k0s/, the systemd units, and CNI state. The reboot clears residual firewall rules.