Build your private cloud on single-tenant hardware

Proxmox VE is in the one-click OS library, so a cluster can be running the same day. Plan for three nodes as a minimum: Corosync needs a majority to keep quorum, and Ceph needs three hosts to keep three replicas apart. With two nodes, add an external quorum device (QDevice) on a small third machine.

• Networks: keep Corosync, Ceph and VM traffic on separate VLANs or at least separate subnets of the private network, and expose only management and public services on the public interface.
• Storage: with four NVMe Gen5 drives per node, Ceph with 3× replication gives about a third of raw capacity. As an estimate, three Max 96 nodes have 92 TB raw and roughly 30 TB usable, before keeping 20 to 30% free for recovery.
• Without Ceph: ZFS on each node with Proxmox storage replication works well for two or three nodes, if you can accept asynchronous copies.

Moving off VMware? Proxmox VE includes an import wizard for ESXi virtual machines. See our guide to Proxmox on a dedicated server.

Running Kubernetes directly on bare metal removes a virtualization layer and gives pods the full CPU, memory and NVMe bandwidth of the node. You also take over what a cloud provider would otherwise handle:

• Load balancing: without a cloud load balancer, use MetalLB or kube-vip to announce service IPs. Additional IPv4 addresses are available on request.
• Storage: local NVMe volumes for databases that replicate themselves, or Rook-Ceph or Longhorn for replicated block storage.
• Networking: Cilium or Calico as the CNI, with pod-to-pod traffic on the private VLAN.
• Control plane: three control-plane nodes for etcd quorum; on large hosts, run them as small VMs under Proxmox VE instead of dedicating three servers.

kubeadm, k3s and RKE2 install on Ubuntu or Debian. For Talos Linux or another immutable OS, boot its ISO through the KVM console. On dual-socket workers like the Max 192, enable the kubelet's Topology Manager so latency-sensitive pods stay on one NUMA node.

Every server includes one IPv4 address and a /64 IPv6 block, and additional IPv4 addresses are available on request. Plan addressing before you build:

• Public: give each node its own IPv4 address for management, and use the /64 for VMs and services where your users have IPv6.
• Private: pick RFC 1918 ranges for the private VLAN, one subnet per role (cluster, storage, tenants), and document them early.
• Tenant isolation: Proxmox VE SDN can build VXLAN or EVPN zones on top of the private network, giving each team or customer its own segment.
• Edge: route VM traffic through a firewall VM such as OPNsense, or nftables on the host, and keep the Proxmox web UI and SSH off the public internet.

The private network covers servers in one location. To link clusters across locations, run WireGuard or IPsec over the public interfaces: traffic is unmetered, so replication between sites adds no transfer fees. Every IP stays behind always-on DDoS protection.