diff --git a/.fixtures.yml b/.fixtures.yml
new file mode 100644
index 0000000000..11af96e599
--- /dev/null
+++ b/.fixtures.yml
@@ -0,0 +1,4 @@
+---
+fixtures:
+  symlinks:
+    control: "#{source_dir}"
diff --git a/hieradata/cluster/kueyen.yaml b/hieradata/cluster/kueyen.yaml
index 3981fbc934..b2b0fe27aa 100644
--- a/hieradata/cluster/kueyen.yaml
+++ b/hieradata/cluster/kueyen.yaml
@@ -5,109 +5,23 @@ clustershell::groupmembers:
     member:
       - "kueyen[01-03]"
       - "kueyen[04-09]"
-profile::core::ospl::enable_rundir: true
 profile::core::k8snode::enable_dhcp: true
+rke2::release_series: "1.31"
+rke2::version: "1.31.8~rke2r1"
 tuned::active_profile: "latency-performance"
-cni::plugins::enable: ["macvlan", "static"]
 nm::connections:
-  em1:  #PXE Boot
-    content: |
-      [connection]
-      id=em1
-      uuid=f330f829-20cc-b829-67b0-18086a5fe6fa
-      type=ethernet
-      autoconnect=false
-      interface-name=em1
-
-      [ethernet]
-
-      [ipv4]
-      method=disabled
-
-      [ipv6]
-      method=disabled
-  em2:  #embedded 2 no use.
-    content: |
-      [connection]
-      id=em2
-      uuid=f330f829-20cc-b829-67b0-18086a5fe6fa
-      type=ethernet
-      autoconnect=false
-      interface-name=em2
-
-      [ethernet]
-
-      [ipv4]
-      method=disabled
-
-      [ipv6]
-      method=disabled
-  ens2f1:  #fqdn
-    content: |
-      [connection]
-      id=ens2f1
-      uuid=de9904c8-9577-1a17-36b1-34b94132f06a
-      type=ethernet
-      interface-name=ens2f1
-
-      [ethernet]
-
-      [ipv4]
-      method=auto
-
-      [ipv6]
-      method=disabled
-  ens2f0:
-    content: |
-      [connection]
-      id=ens2f0
-      uuid=46d19ce1-bcab-7e77-6fc7-b730b26c54b1
-      type=ethernet
-      autoconnect=false
-      interface-name=ens2f0
-
-      [ethernet]
-
-      [ipv4]
-      method=disabled
-
-      [ipv6]
-      method=disabled
-  ens2f0.2301:
-    content: |
-      [connection]
-      id=ens2f0.2301
-      uuid=e74daaad-4d73-4015-bb26-83c460ddf572
-      type=vlan
-      interface-name=ens2f0.2301
-      master=br2301
-      slave-type=bridge
-
-      [ethernet]
-
-      [vlan]
-      flags=1
-      id=2301
-      parent=ens2f0
-
-      [bridge-port]
   br2301:
-    content: |
-      [connection]
-      id=br2301
-      uuid=7dd05d98-a9c3-4569-a7c3-00316b13c0eb
-      type=bridge
-      interface-name=br2301
-
-      [ethernet]
-
-      [bridge]
-      stp=false
-
-      [ipv4]
-      method=auto
-
-      [ipv6]
-      method=disabled
-
-      [proxy]
+    content:
+      connection:
+        id: "br2301"
+        uuid: "7dd05d98-a9c3-4569-a7c3-00316b13c0eb"
+        type: "bridge"
+        interface-name: "br2301"
+      ethernet: {}
+      bridge:
+        stp: "false"
+      ipv4:
+        method: "auto"
+      ipv6:
+        method: "disabled"
+      proxy: {}
diff --git a/hieradata/cluster/kueyen/role/rke.yaml b/hieradata/cluster/kueyen/role/rke2agent.yaml
similarity index 64%
rename from hieradata/cluster/kueyen/role/rke.yaml
rename to hieradata/cluster/kueyen/role/rke2agent.yaml
index 275dc16ae8..904d9d872c 100644
--- a/hieradata/cluster/kueyen/role/rke.yaml
+++ b/hieradata/cluster/kueyen/role/rke2agent.yaml
@@ -2,3 +2,6 @@
 classes:
   - "profile::core::sysctl::rp_filter"
 profile::core::sysctl::rp_filter::enable: false
+rke2::config:
+  node-label:
+    - "role=storage-node"
diff --git a/hieradata/cluster/kueyen/role/rke2server.yaml b/hieradata/cluster/kueyen/role/rke2server.yaml
new file mode 100644
index 0000000000..904d9d872c
--- /dev/null
+++ b/hieradata/cluster/kueyen/role/rke2server.yaml
@@ -0,0 +1,7 @@
+---
+classes:
+  - "profile::core::sysctl::rp_filter"
+profile::core::sysctl::rp_filter::enable: false
+rke2::config:
+  node-label:
+    - "role=storage-node"
diff --git a/hieradata/cluster/kueyen/variant/r440.yaml b/hieradata/cluster/kueyen/variant/r440.yaml
index d85c1bd5d5..d11a4163e8 100644
--- a/hieradata/cluster/kueyen/variant/r440.yaml
+++ b/hieradata/cluster/kueyen/variant/r440.yaml
@@ -1,10 +1,22 @@
 ---
 nm::connections:
+  eno1:
+    content:
+      connection:
+        id: "eno1"
+        type: "ethernet"
+        autoconnect: "false"
+        interface-name: "eno1"
+      ethernet: {}
+      ipv4:
+        method: "disabled"
+      ipv6:
+        method: "disabled"
   ens2f1:
     content:
       connection:
         id: "ens2f1"
-        uuid: "de9904c8-9577-1a17-36b1-34b94132f06a"
+        uuid: "17306edd-aff4-46b9-9ab8-29f52066c870"
         type: "ethernet"
         interface-name: "ens2f1"
       ethernet: {}
diff --git a/spec/hosts/nodes/kueyen01.dev.lsst.org_spec.rb b/spec/hosts/nodes/kueyen01.dev.lsst.org_spec.rb
index 669e51b79e..fb6209a119 100644
--- a/spec/hosts/nodes/kueyen01.dev.lsst.org_spec.rb
+++ b/spec/hosts/nodes/kueyen01.dev.lsst.org_spec.rb
@@ -2,6 +2,9 @@
 
 require 'spec_helper'
 
+#
+# testing cluster/kueyen & cluster/kueyen/variant/r440
+#
 describe 'kueyen01.dev.lsst.org', :sitepp do
   on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
@@ -19,18 +22,23 @@
       end
       let(:node_params) do
         {
-          role: 'rke',
+          role: 'rke2server',
           site: 'dev',
           cluster: 'kueyen',
+          variant: 'r440',
         }
       end
 
       it { is_expected.to compile.with_all_deps }
 
-      include_examples 'docker', docker_version: '25.0.3'
       include_examples 'baremetal'
       include_examples 'ceph cluster'
-      include_context 'with nm interface'
+
+      it do
+        expect(catalogue.resource('class', 'rke2')[:config]).to include(
+          'node-label' => ['role=storage-node']
+        )
+      end
 
       it do
         is_expected.to contain_class('profile::core::sysctl::rp_filter').with_enable(false)
@@ -51,28 +59,22 @@
       end
 
       it do
-        is_expected.to contain_class('rke').with(
-          version: '1.7.7'
+        is_expected.to contain_class('rke2').with(
+          node_type: 'server',
+          release_series: '1.31',
+          version: '1.31.8~rke2r1'
         )
       end
 
-      it do
-        is_expected.to contain_class('cni::plugins').with(
-          version: '1.2.0',
-          checksum: 'f3a841324845ca6bf0d4091b4fc7f97e18a623172158b72fc3fdcdb9d42d2d37',
-          enable: %w[macvlan static]
-        )
-      end
+      it { is_expected.to contain_class('cni::plugins::dhcp::service') }
 
-      it { is_expected.to contain_class('cni::plugins::dhcp') }
-
-      it { is_expected.to contain_class('profile::core::ospl').with_enable_rundir(true) }
+      include_context 'with nm interface'
 
       it { is_expected.to have_nm__connection_resource_count(6) }
 
       %w[
-        em1
-        em2
+        eno1
+        eno2
         ens2f0
       ].each do |i|
         context "with #{i}" do
diff --git a/spec/hosts/nodes/kueyen04.dev.lsst.org_spec.rb b/spec/hosts/nodes/kueyen04.dev.lsst.org_spec.rb
index c2ea4666e3..5887250132 100644
--- a/spec/hosts/nodes/kueyen04.dev.lsst.org_spec.rb
+++ b/spec/hosts/nodes/kueyen04.dev.lsst.org_spec.rb
@@ -19,7 +19,7 @@
       end
       let(:node_params) do
         {
-          role: 'rke',
+          role: 'rke2agent',
           site: 'dev',
           cluster: 'kueyen',
           variant: 'c6420',
@@ -28,7 +28,6 @@
 
       it { is_expected.to compile.with_all_deps }
 
-      # include_examples 'docker', docker_version: '24.0.9'
       include_examples 'baremetal'
       include_examples 'ceph cluster'
       include_context 'with nm interface'
@@ -37,6 +36,12 @@
         is_expected.to contain_class('profile::core::sysctl::rp_filter').with_enable(false)
       end
 
+      it do
+        expect(catalogue.resource('class', 'rke2')[:config]).to include(
+          'node-label' => ['role=storage-node']
+        )
+      end
+
       it do
         is_expected.to contain_class('clustershell').with(
           groupmembers: {
@@ -52,36 +57,14 @@
       end
 
       it do
-        is_expected.to contain_class('rke').with(
-          version: '1.7.7'
+        is_expected.to contain_class('rke2').with(
+          node_type: 'agent',
+          release_series: '1.31',
+          version: '1.31.8~rke2r1'
         )
       end
 
-      it do
-        is_expected.to contain_class('cni::plugins').with(
-          version: '1.2.0',
-          checksum: 'f3a841324845ca6bf0d4091b4fc7f97e18a623172158b72fc3fdcdb9d42d2d37',
-          enable: %w[macvlan static]
-        )
-      end
-
-      it { is_expected.to contain_class('cni::plugins::dhcp') }
-
-      it { is_expected.to contain_class('profile::core::ospl').with_enable_rundir(true) }
-
-      it { is_expected.to have_nm__connection_resource_count(8) }
-
-      %w[
-        em1
-        em2
-        ens2f0
-      ].each do |i|
-        context "with #{i}" do
-          let(:interface) { i }
-
-          it_behaves_like 'nm disabled interface'
-        end
-      end
+      it { is_expected.to have_nm__connection_resource_count(3) }
 
       context 'with ens4f0' do
         let(:interface) { 'ens4f0' }