Foundations · wrap-up
Cheat sheet & self-check
Every command from this section on one page.
The ZTP promise
Rack, cable, power on | The only hands-on work at the site |
BMC/PXE → OS → Kubernetes → workloads | Everything else automated and remote |
Site definition in Git | Hardware inventory + cluster spec + workloads |
Lifecycle
Day 0 | Design, inventory, images, site definition |
Day 1 | Provision: bare metal → cluster → apps |
Day 2 | Upgrade, scale, repair, rebuild, retire |
Planes
Management plane (central) | Git, registries, cluster lifecycle controllers, observability |
Provisioning at the site | DHCP/TFTP/HTTP boot + BMC access: needs L2 or DHCP relay |
Workload clusters (per site) | Run the applications; pull config and images |
Site networks
BMC / OOB VLAN | Redfish/IPMI; isolated, no internet |
Provisioning VLAN | PXE/iPXE, DHCP; can be the node network |
Node / cluster network | Kubernetes API VIP, node IPs |
Workload / uplink | Services, backhaul to the centre |
Shapes
1 node | No HA; cheapest; a node failure = site outage |
3 nodes, compact (CP + workloads on all) | Tolerates 1 node failure; common edge default |
3 CP + N workers | More isolation and capacity; more hardware |
2 nodes | No etcd fault tolerance without an external witness |
Settings
kubectl taint nodes <n> node-role.kubernetes.io/control-plane:NoSchedule- | Allow workloads on control-plane nodes (compact) |
kubelet: systemReserved / kubeReserved / evictionHard | Protect the OS and kubelet from workloads |
etcd quorum = floor(n/2) + 1 | 3 members → survives 1 failure |
