bootc-mke3 is an integrated container orchestration platform that is powered by an immutable Rocky Linux operating system, offering next-level security and reliability.
This repository contains a collection of tool, utilities and guides for managing and operating with bootc-mke3. These tools support operations, automation, and configuration for secure and scalable container environments.
Provisioning is the process of preparing a cluster of bootc-mke3 compute nodes within a network environment that meets the requirements for deploying and operating Mirantis products.
For further details, please see provisioning document.
Mirantis provides assets for provisioning bootc-mke3 on different providers. Assets consist of bootable images that can be used to provision a virtual machine or bare-metal machine.
| Type | Download link | Description | Mirantis product's version |
|---|---|---|---|
| ISO | Link | Simple ISO with basic kickstart embedded. Unattended Anaconda installation will be performed. See this document to get more details about Simple image edition. | MCR 29.4.1 / MKE 3.9.4 |
| ISO | Link | Generic ISO without any customisation. See this document to get the details on how to properly customise it | MCR 29.4.1 / MKE 3.9.4 |
| QCOW2 | Link | Standard QEMU/KVM bootable image | MCR 29.4.1 / MKE 3.9.4 |
Note
Simple ISO edition is used mostly for demo/test purposes. For production-grade clusters consider using Generic ISO.
Installation in this document refers to the process of deploying Mirantis Kubernetes Engine on top of already provisioned machines (VMs or baremetal).
To perform installation, Ansible is used. There are number of tasks and the playbook that serves this purpose.
Prerequisites for the installation can be found in the Provisioning section of this document.
To perform the installation, please see installation runbook.
A default install also deploys the System Upgrade Controller, cluster-upgrade-controller, and machine-config-controller to the cluster, and hardens SSH/sudo access on every host. See the controllers runbook for what gets deployed and how to verify it, and the machine configuration runbook for applying DNS/NTP/kernel/reboot changes cluster-wide via machine-config-controller.
The canonical way to upgrade a bootc-mke3 cluster is the kube-native ClusterUpgrade custom resource, handled by cluster-upgrade-controller (installed by default — see Post-install controllers). See the upgrade runbook. For clusters where the controller is unavailable or disabled, a manual Ansible-driven exception path exists — see the Ansible upgrade runbook.
No-touch join is the standard way to add worker machines after the initial install: machines join automatically on first boot with an injected join token — no SSH and no installer re-run (SSH is typically disabled on cluster machines post-install). Issue a token per batch and rotate it after the batch joins. See the no-touch join description and the join machines runbook.
Command-line access (kubectl and docker/Swarm) goes through the MKE client bundle — no SSH to cluster machines needed. See the cluster access runbook.
bootc-mke3 integrates two Kubernetes controllers, cluster-upgrade-controller and machine-config-controller, to automate cluster and node lifecycle operations. Both delegate privileged, host-mutating operations to per-node jobs — see the controller security analysis for the full trust model and risk register, and the hardening runbook for the concrete steps to configure a secure baseline.
If you encounter issues, please file an issue on this repository or contact your Mirantis representative.