Skip to content

ADR-0001: Dedicated RKE2 node LAN

Date: 2026-08-29 Status: Accepted, pending implementation

Context

The existing 192.168.96.0/20 network is used by Ceph and legacy VMs. The new RKE2 foundation must not increase coupling with that network or require renumbering when hosting workers grow.

Decision

  • Reserve 10.72.0.0/20 for Wetopi platform networks.
  • Use 10.72.0.0/23 for the initial RKE2 node LAN.
  • Use VLAN 4 across the OVH vRack.
  • Create custom VLAN interface vlan_rke and access bridge vmbr4 on each Proxmox node.
  • Do not assign an IP address to vmbr4 on the hypervisors.
  • Use MTU 1500 until end-to-end jumbo-frame support is demonstrated.
  • Keep Pod CIDR 10.64.0.0/14 and Service CIDR 10.68.0.0/16 separate.
  • ~~Route, rather than NAT, traffic from the node LAN to Ceph.~~ Superseded by ADR-0007 (operator decision 2026-08-30): the Ceph clients (the 3 platform workers) attach directly to the Ceph storage network (VLAN 2 / vmbr2, 192.168.96.0/20) with addresses from the operator-reserved 192.168.98.0/25 — no routing and no NAT on the Ceph path. The invariants this bullet protected are PRESERVED and unchanged: the Ceph network is still never NATed on any path, and 192.168.96.0/20 is still never renumbered; only the access model (routed vs directly attached) is replaced.

Consequences

  • Node, Pod, Service, and Ceph networks are distinct.
  • The initial node LAN has 510 usable addresses.
  • Future networks can consume adjacent /24 blocks from the reserved /20.
  • A router/NAT gateway is required before private VMs can reach the Internet.
  • VLAN 4 and the proposed CIDRs require validation outside Proxmox before implementation.

Supersedes

This decision supersedes earlier drafts that left the node LAN undefined or implicitly reused 192.168.96.0/20.