diff --git a/README.RKE2.md b/README.RKE2.md
new file mode 100644
index 0000000..c9f435c
--- /dev/null
+++ b/README.RKE2.md
@@ -0,0 +1,43 @@
+# RKE2 Cluster Configuration HOWTO
+
+The package warewulf4-overlay-rke2 provides a configuration template
+to share a connection token - a shared secret - and the hostname of
+the first server endpoint across an RKE2 cluster.  
+To use it,
+
+- create a profile `rke2-config-key`:
+
+    ```
+	wwctl profile add rke2-config-key
+	token="$(printf 'K'; \
+         for n in {1..20}; do printf %x $RANDOM; done; \
+         printf "::server:"; \
+         for n in {1..20}; do printf %x $RANDOM; done)"
+	 wwctl profile set --tagadd="connectiontoken=${token}" \
+              -O rke2-config rke2-config-key
+    ```
+- create a profile `rke2-config-first-server`:
+
+	```
+    server=<hostname_of_first_rke2_server>
+	wwctl profile add rke2-config-first-server
+	wwctl profile set --tagadd="server=${server}" -O rke2-config rke2-config-first-server
+
+	```
+- add the `rke2-config-key` profile to the server node:
+
+    ```
+	wwctl node set -P default,rke2-config-key $server
+
+	```
+- finally, add both profiles to the agent nodes:
+
+	```
+	agents="<agent_list>"
+	wwctl node set -P default,rke2-config-key,rke2-config-first-server $agents
+	```
+
+In case the RKE2 server node is not deployed by Warewulf, you will
+have to grab the connection token (see variable `token` above) from
+the file `/var/lib/rancher/rke2/server/node-token` on the running
+server.
diff --git a/warewulf4.changes b/warewulf4.changes
index 6ac1a8e..5f10810 100644
--- a/warewulf4.changes
+++ b/warewulf4.changes
@@ -1,3 +1,10 @@
+-------------------------------------------------------------------
+Fri Feb 21 08:17:53 UTC 2025 - Egbert Eich <eich@suse.com>
+
+- Provide an overlay package for the cluster-wide configuration
+  of an RKE2 cluster. This allows to share the connection token
+  across all node and sthe first server endpoint across all agents.
+
 -------------------------------------------------------------------
 Tue Oct 22 06:53:46 UTC 2024 - Christian Goll <cgoll@suse.com>
 
diff --git a/warewulf4.spec b/warewulf4.spec
index 4baabf7..45d359e 100644
--- a/warewulf4.spec
+++ b/warewulf4.spec
@@ -35,6 +35,7 @@ Source5:        warewulf4-rpmlintrc
 Source10:       config-ww4.sh
 Source11:       adjust_overlays.sh
 Source20:       README.dnsmasq
+Source21:       README.RKE2.md
 
 BuildRequires:  distribution-release
 BuildRequires:  dracut
@@ -100,9 +101,19 @@ Obsoletes:      warewulf4-slurm <= 4.4.0
 Provides:       warewulf4-slurm = %version
 
 %description overlay-slurm
-This package install the necessary configuration files in order to run a slurm
+This package installs the necessary configuration files in order to run a slurm
 cluster on the configured warewulf nodes.
 
+%package overlay-rke2
+Summary:        Configuration template for RKE2
+Requires:       %{name} = %{version}
+Requires:       slurm
+BuildArch:      noarch
+
+%description overlay-rke2
+This package provides a template that is used to share a connection token
+and server endpoint information across an RKE2 cluster.
+
 %package dracut
 Summary:        Dracut module for loading a Warewulf container image
 BuildArch:      noarch
@@ -173,7 +184,7 @@ mv -v %{buildroot}%{_sysconfdir}/bash_completion.d/wwctl \
   %{buildroot}%{_datadir}/bash-completion/completions/wwctl
 # copy the LICESNSE.md via %%doc
 rm -f %{buildroot}/usr/share/doc/packages/warewulf/LICENSE.md
-cp %{S:20} .
+cp %{S:20} %{S:21} .
 
 # use ipxe-bootimgs images from distribution
 yq e '
@@ -211,6 +222,17 @@ mkdir -p %{buildroot}%{_localstatedir}/lib/warewulf/overlays/generic/rootfs/etc/
 cat >  %{buildroot}%{_localstatedir}/lib/warewulf/overlays/generic/rootfs/etc/slurm/slurm.conf.ww <<EOF
 {{ Include "/etc/slurm/slurm.conf" }}
 EOF
+# prepare RKE2 configuration template
+mkdir -p %{buildroot}%{_localstatedir}/lib/warewulf/overlays/rke2-config/etc/rancher/rke2
+cat > %{buildroot}%{_localstatedir}/lib/warewulf/overlays/rke2-config/etc/rancher/rke2/config.yaml.ww <<EOF
+{{ if ne (index .Tags "server") "" -}}
+server: https://{{ index .Tags "server" }}:9345
+{{ end -}}
+{{ if ne (index .Tags "clienttoken") "" -}}
+token: {{ index .Tags "connectiontoken" }}
+{{ end -}}
+EOF
+chmod 600 %{buildroot}%{_localstatedir}/lib/warewulf/overlays/rke2-config/etc/rancher/rke2/config.yaml.ww
 # move the other example templates for client overlays to package documentation
 mkdir -p %{buildroot}/%{_defaultdocdir}/%{name}
 mv %{buildroot}/%{_sysconfdir}/warewulf/examples %{buildroot}%{_defaultdocdir}/%{name}/example-templates
@@ -273,6 +295,7 @@ mv %{buildroot}/%{_sysconfdir}/logrotate.d/warewulfd.conf %{buildroot}/%{_syscon
 %exclude %{_localstatedir}/lib/warewulf/overlays/host/rootfs/etc/slurm
 %exclude %{_localstatedir}/lib/warewulf/overlays/generic/rootfs/etc/slurm
 %exclude %{_localstatedir}/lib/warewulf/overlays/generic/rootfs/etc/munge
+%exclude %{_localstatedir}/lib/warewulf/overlays/rke2-config
 
 %files overlay-slurm
 %dir %{_localstatedir}/lib/warewulf/overlays/host/rootfs/etc/slurm
@@ -284,6 +307,14 @@ mv %{buildroot}/%{_sysconfdir}/logrotate.d/warewulfd.conf %{buildroot}/%{_syscon
 %dir %attr(0700,munge,munge) %{_localstatedir}/lib/warewulf/overlays/generic/rootfs/etc/munge
 %attr(0600,munge,munge) %config(noreplace) %{_localstatedir}/lib/warewulf/overlays/generic/rootfs/etc/munge/munge.key.ww
 
+%files overlay-rke2
+%doc README.RKE2.md
+%dir %{_localstatedir}/lib/warewulf/overlays/rke2-config
+%dir %{_localstatedir}/lib/warewulf/overlays/rke2-config/etc
+%dir %{_localstatedir}/lib/warewulf/overlays/rke2-config/etc/rancher
+%dir %{_localstatedir}/lib/warewulf/overlays/rke2-config/etc/rancher/rke2
+%attr(0600,root,root) %{_localstatedir}/lib/warewulf/overlays/rke2-config/etc/rancher/rke2/config.yaml.ww
+
 %files dracut
 %defattr(-, root, root)
 %dir %{_prefix}/lib/dracut/modules.d/90wwinit