SUSE Rancher – Kubernetes you can actually govern
Multi-cluster | RBAC & policies | RKE2 | Upgrades | Operations
Rancher is the platform we most often meet when an organisation runs more than one Kubernetes cluster and needs to keep them together. We have built, hardened and operated Rancher environments in security-critical settings – including for the Danish Armed Forces. This page describes what we actually do with Rancher, not what the datasheet says.
What is Rancher – and when do you need it?
Rancher (now SUSE Rancher Prime) is a management platform on top of Kubernetes. It provides a single control plane for multiple clusters wherever they run – on-prem, in the cloud or at the edge – with central authentication, role-based access control, application catalogues and unified monitoring. Rancher does not replace Kubernetes; it sits above it. The need almost always appears at the same point: when you go from one cluster to several and it is no longer possible to keep track of who has access to what, which versions run where and which policies actually apply.
What we do with Rancher
We handle the whole chain: cluster and environment design, installation of Rancher and RKE2, integration with your directory service for sign-in, an RBAC model that mirrors the organisation, storage with Longhorn or external SAN/CSI, backup and restore, and upgrade routines that do not require anyone to hold their breath. We can act as owner of the entire platform, as second-line support for your own operations team, or as a targeted effort when a migration or upgrade needs to be carried out.
Security, policies and compliance
In regulated environments it is not enough that the cluster works – you must also be able to prove how it works. We implement policies with Kubewarden or OPA Gatekeeper, harden according to the CIS Kubernetes Benchmark, set up NeuVector for runtime security and image scanning, and make sure audit logs, network policies and secrets management are in place. Everything is implemented as code so the controls can be demonstrated at audit rather than reconstructed afterwards – which is precisely what NIS2 and the CRA will require of you.
Migrating to Rancher
We move workloads to Rancher from hand-built clusters, from OpenShift, from the cloud providers' managed services and from virtualisation platforms where licence costs have run away. The work always starts with a survey of what is actually running, which dependencies exist and what should be rebuilt rather than lifted as-is. We then migrate step by step, with parallel operations and clear fallback paths – not a big bang over a weekend.
Experience from production
In a strategic assignment for the Danish Armed Forces we operated and developed a Rancher-managed Kubernetes platform on SUSE Linux in a highly regulated, security-critical environment, focused on lifecycle management, controlled change management and traceability.
Frequently asked questions about Rancher
What does Rancher cost?
Rancher is open source and can be run without licence cost. SUSE Rancher Prime is the commercial subscription with support, hardened images and extended lifecycle, priced per node or cluster. In regulated organisations we almost always recommend Prime, since a support agreement and supported lifecycle are often a requirement in themselves. We help you calculate the total cost including operations – not just the licence.
Rancher or OpenShift – which should we choose?
OpenShift is a more integrated product with more built-in components and a higher price tag, and suits you when you want a finished whole from one vendor. Rancher is lighter, more open and stronger at managing many clusters across different environments, including clusters you did not build yourself. If you already run a lot of Red Hat it leans towards OpenShift; if you have mixed environments, edge nodes or SUSE at the base it leans towards Rancher. We work with both and have no reason to push either.
Can Rancher manage our existing AKS, EKS or GKE clusters?
Yes. Rancher can import existing clusters regardless of how they were created and give them the same authentication, role-based access, policies and monitoring as the clusters you build yourself. That is often the first step: take control of what already exists before building anything new.
Do we need RKE2 or can we run plain Kubernetes?
RKE2 is SUSE's Kubernetes distribution with CIS hardening and FIPS-validated cryptography, designed with government and military requirements in mind. If you operate under security or regulatory requirements, RKE2 is usually the right choice because much of the hardening is done from the start. If you already have a working distribution, Rancher can manage it anyway.
Related articles
Kubernetes hardening as NIS2 evidence
Turn Kubernetes hardening into NIS2 evidence: CIS Benchmark results, Pod Security and policy reports, audit logs, GitOps history and an evidence pack.
Kubernetes 1.34 end of support checklist
Kubernetes 1.34 reaches end of life on 27 October 2026. A pre-flight checklist for 1.35 and 1.36: cgroup v2, containerd 2.x, deprecated APIs and etcd backups.
Does the Cyber Resilience Act apply to you?
Is your product in scope of the CRA? A six-step walkthrough of products, SaaS, remote data processing and open source, with typical platform team cases.
We work daily in SUSE Rancher and Red Hat OpenShift – two of the platforms we operate and harden for our clients.
Want your Kubernetes clusters under control?
We help you with everything from installation and migration to hardening, upgrades and day-to-day operations of Rancher.
Contact us for a quoteRelated Services
Kubernetes
Design, operations and optimization of K8s clusters — multi-cloud and on-prem.
Linux & OS Platform
SUSE and Red Hat in production: hardening, patching, lifecycle management and automation for mission-critical systems.
Platform
We build scalable platforms for modern applications with CI/CD, observability and built-in security.
Compliance
Governance, policies and controls for NIS2, CRA and Cyber Resilience Act.