On this page
This is the first part of a build series. Over the next several posts I am going to build a small cloud, from an empty hypervisor to a real application answering on a routed fabric, and show every config along the way. Not a reference architecture diagram you admire and close. The actual thing, reproducible, with the commands that made it work and the ones that did not.
The entire thing runs as virtual machines inside EVE-NG on a single large box. The switches are virtual Nexus, the firewalls are VM-series Palo Altos, the servers are cloud-image VMs. That is a feature, not an apology. It means you can build the exact same thing without a rack, a loan, or a five figure invoice, and the designs are the real designs. A VXLAN/EVPN fabric does not know it is virtual.
This part is the map. No config yet. Just what we are building, how it is addressed, and why each decision went the way it did, so the rest of the series has something to point back to.
The whole thing, one picture
Read it bottom to top. One hypervisor holds everything. On it sits a leaf-spine fabric running VXLAN with an EVPN control plane. Kubernetes nodes hang off the leaves and speak BGP directly to them through Cilium. Palo Alto firewalls in Active/Active edge the fabric to the outside world. And a single application URL, resolved by split-view DNS, rides a LoadBalancer IP that exists only as a BGP advertisement, through the firewall, across the overlay, to a pod.
