diff --git a/kubernetes/defaults/main.yml b/kubernetes/defaults/main.yml
index 8dddbf9..ab258db 100644
--- a/kubernetes/defaults/main.yml
+++ b/kubernetes/defaults/main.yml
@@ -40,6 +40,10 @@ kubernetes:
   # when this is set and differs; empty installs the latest when k3s is missing.
   version: ""
 
+  # KubeletConfiguration fields (systemReserved, evictionHard, ...) written to
+  # /etc/rancher/k3s/kubelet.conf.d/20-memory.conf; empty writes no file
+  kubelet_memory: {}
+
   # Extra config of the nodes running etcd, left out with disable-etcd
   etcd_config_extra:
     # Without it etcd serves metrics on 127.0.0.1 only, out of reach of vmagent
diff --git a/kubernetes/tasks/node.yml b/kubernetes/tasks/node.yml
index 40ab3c7..40c5919 100644
--- a/kubernetes/tasks/node.yml
+++ b/kubernetes/tasks/node.yml
@@ -18,6 +18,30 @@
           imageGCLowThresholdPercent: 55
           imageMaximumGCAge: 168h
 
+# KubeletConfiguration fields from kubernetes.kubelet_memory; the file is removed
+# while the variable is empty.
+- name: Kubelet memory reservation and eviction
+  tags: kubelet_memory
+  block:
+    - name: Create the kubelet drop-in directory
+      file:
+        path: /etc/rancher/k3s/kubelet.conf.d
+        state: directory
+        mode: "0755"
+
+    - name: Set the kubelet memory reservation and eviction thresholds
+      copy:
+        dest: /etc/rancher/k3s/kubelet.conf.d/20-memory.conf
+        mode: "0644"
+        content: "{{ {'apiVersion': 'kubelet.config.k8s.io/v1beta1', 'kind': 'KubeletConfiguration'} | combine(kubernetes.kubelet_memory) | to_nice_yaml(indent=2) }}"
+      when: kubernetes.kubelet_memory | length > 0
+
+    - name: Remove the kubelet memory drop-in
+      file:
+        path: /etc/rancher/k3s/kubelet.conf.d/20-memory.conf
+        state: absent
+      when: kubernetes.kubelet_memory | length == 0
+
 # Every pod watching its config files takes inotify instances and watches from
 # the per-user pool. An LXC container inherits these from its host. Only this
 # file is loaded: sysctl --system would also apply distribution defaults such as