Overview
k3s service active on the pinned version
The k3s service reporting active and enabled, the pinned v1.36.2+k3s1 release, and the VERSION provenance file listing the verified sha256 digests of every downloaded artifact.
k3s service active on the pinned version
Single-node cluster Ready
A real workload from the bundled images
Locked down by default
This is a repackaged open source software product wherein additional charges apply for cloudimg support services.
k3s is a fully conformant, CNCF-certified Kubernetes distribution packaged as one self-contained binary. It bundles the entire control plane together with the container runtime, cluster networking, in-cluster DNS, a metrics pipeline, a local storage provisioner and a service load balancer, so a complete working cluster starts from a single service rather than a stack of separately installed components. Standard kubectl, standard manifests and standard Helm charts all work unchanged, because this is real Kubernetes rather than a lookalike. This image delivers it fully installed and configured, so a Ready single-node cluster is running within minutes of launch with no manual assembly.
Unlike a bare deployment, this image treats the cluster boundary as the headline feature, because an exposed Kubernetes API server is total cluster compromise. No cluster credential of any kind ships inside the image: the cluster certificate authority, every client and serving certificate, the service-account signing key, the node join token and the kubeconfig are all destroyed before capture and generated fresh on each instance's first boot, and the build refuses to produce an image if any of them survive. The API server is never opened to the network by default; only the SSH port is. Every component that does not need to face the network is bound to loopback, the default public ingress controller is removed so nothing unexpected listens, and the cluster image set is bundled and checksum-verified on the image so the first boot needs no registry access at all. The operating system ships fully patched with unattended security updates enabled.
Use k3s to run a genuine Kubernetes cluster without the operational weight of a multi-node control plane: development and continuous-integration clusters, edge and branch deployments, single-tenant application hosting, and learning or evaluating Kubernetes on infrastructure you fully own. Administer the node over SSH with kubectl already on the PATH, tunnel the API to your workstation, or deliberately open the API to your own address range as the deployment guide describes. The current release available is k3s 1.36.2.
This is a repackaged open source software product with additional charges for cloudimg support services. k3s is distributed under the Apache License 2.0. cloudimg is not affiliated with or endorsed by the k3s project, the CNCF or SUSE. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.
Highlights
- A complete, CNCF-certified single-node Kubernetes cluster from one self-contained binary, Ready within minutes of launch with the control plane, container runtime, networking, DNS, metrics and local storage bundled - standard kubectl, manifests and Helm charts work unchanged
- Secure by default: no cluster credential ships in the image, the certificate authority, certificates, node token and kubeconfig are all generated on first boot, and the API server is never exposed to the network - only the SSH port is open
- Offline-deterministic first boot with the cluster image set bundled and checksum-verified on the image, a fully patched OS with unattended security updates, and 24/7 cloudimg support
Details
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
Pricing
Free trial
- ...
Dimension | Description | Cost/hour |
|---|---|---|
m5.large Recommended | m5.large | $0.08 |
t2.micro | t2.micro instance type | $0.04 |
t3.micro | t3.micro instance type | $0.04 |
c5a.12xlarge | c5a.12xlarge instance type | $0.24 |
c5a.16xlarge | c5a.16xlarge instance type | $0.24 |
c5a.24xlarge | c5a.24xlarge instance type | $0.24 |
c5a.2xlarge | c5a.2xlarge instance type | $0.24 |
c5a.4xlarge | c5a.4xlarge instance type | $0.24 |
c5a.8xlarge | c5a.8xlarge instance type | $0.24 |
c5a.large | c5a.large instance type | $0.08 |
Vendor refund policy
Refunds available on request.
How can we make this page better?
Legal
Vendor terms and conditions
Content disclaimer
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
Initial release of k3s as a ready-to-use, CNCF-certified single-node Kubernetes cluster, with the cluster certificate authority, node token and kubeconfig all generated on first boot and the API server never exposed to the network by default.
Additional details
Usage instructions
Connect via SSH on port 22 as the default login user for your operating system variant (for the Ubuntu 24.04 variant the user is ubuntu). kubectl is already on the PATH for root, so administer the cluster with: sudo kubectl get nodes -o wide and sudo kubectl get pods -A. Retrieve this instance's cluster details with: sudo cat /root/k3s-credentials.txt - it holds the kubeconfig path, the per-instance node join token, the API server address and the cluster CA fingerprint, all generated on first boot. Verify the whole cluster and its security posture at once with: sudo /opt/k3s/cloudimg-verify.sh. A digest-pinned example workload is provided: sudo kubectl apply -f /opt/k3s/examples/cloudimg-smoke-workload.yaml then sudo kubectl -n cloudimg-smoke rollout status deployment/cloudimg-smoke. The Kubernetes API server listens on 127.0.0.1:6443 but the security group opens port 22 only, so the API is not reachable from the internet by default. To use kubectl from your workstation, tunnel the API with: ssh -L 6443:127.0.0.1:6443 ubuntu@<instance-public-ip> and point a copy of the kubeconfig at https://127.0.0.1:6443 . To open the API deliberately, add a security-group inbound rule for TCP 6443 scoped to your own source CIDR (never 0.0.0.0/0) - your instance address is already a TLS SAN on the API certificate.
Resources
Vendor resources
Support
Vendor support
cloudimg provides 24/7 technical support for this product by email and live chat. Our engineers help with deployment, configuration, updates, performance tuning and troubleshooting; critical issues receive a one hour average response. Contact support@cloudimg.co.uk .
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.