Skip to content

Bootstrap virtual machines

Updated: 2026-08-29 Status: Bootstrap VMs, baseline, and guest firewall implemented

Resource policy

The initial machines are deliberately small. CPU, RAM, and disks can be grown after workloads and real utilization become visible. Memory ballooning is disabled to keep Kubernetes and etcd capacity predictable.

VM Proxmox node vCPU RAM Disk Datastore
wetopi-ops01 ns3249468 2 4 GiB 40 GiB vmssd
rke-cp01 ns3243421 4 8 GiB 50 GiB local
rke-cp02 ns3226939 4 8 GiB 50 GiB local
rke-cp03 ns3214108 4 8 GiB 50 GiB local
rke-platform01 ns31826929 4 8 GiB 60 GiB vmssd
rke-platform02 ns3226931 4 8 GiB 60 GiB vmssd
rke-platform03 ns31826925 4 8 GiB 60 GiB vmssd
wetopi-natgw01 ns3243421 2 2 GiB 20 GiB vmssd

Bootstrap allocation totals:

8 VMs
28 vCPU
54 GiB RAM
390 GiB disk

The stopped Ubuntu template is not included in the running CPU/RAM total. The NAT gateway uses the host CPU type because the Proxmox nodes are homogeneous AMD EPYC 446xP hosts. All eight bootstrap VMs are running: wetopi-natgw01, wetopi-ops01, the three control planes, and the three platform workers.

wetopi-ops01 is the WAN bastion for administrative access to the initial platform LAN. It uses 92.222.245.91 on vmbr3; Ubuntu nftables owns the firewall, permits public-key SSH from any IPv4 source with a per-source rate limit, and drops other inbound traffic. Ansible runs from the operator workstation and reaches the other VMs through ProxyJump, so private SSH keys are not copied to the bastion.

The Ubuntu baseline has been applied successfully to all eight VMs. The second playbook run reported zero changes, zero failures, and zero unreachable hosts. qemu-guest-agent is installed and active on every VM.

Placement rationale

The three control planes are placed on different physical nodes. Their local datastores are healthy NVMe RAID devices with approximately 300 GiB free at the time of analysis. This keeps etcd independent from Ceph latency and Ceph availability.

Platform workers are separated across three other failure domains. The NAT gateway is initially co-located with rke-cp01 because ns3243421 has the largest current memory headroom. ns3235424 receives no new bootstrap VM due to current memory pressure.

Placement must be reassessed immediately before creation because legacy VM load can move between Proxmox nodes.

Growth

  • Control planes begin at three members.
  • Addresses are reserved for rke-cp04 and rke-cp05.
  • If etcd is expanded, it moves from three to five members; four is not a desired steady state.
  • Platform workers can grow from 8 GiB to 16/32 GiB as platform services are introduced.
  • Customer hosting workers and edge nodes are outside this initial count.