Build a Cloud-Style Fabric Lab, Part 6: The Nodes

One golden image, one netplan file per node: LACP bonds into the vPC pairs, out-of-band management, the virtio link-speed trap that silently breaks 802.3ad, and the switch side of every bond.
Fabric lab series, part 6: the nodes

On this page

Five parts in, the network is complete and nothing is plugged into it. Part 5 gave the fabric a front door; this part gives it tenants. Seven Ubuntu VMs get built from one golden image, land on the leaf pairs with LACP bonds, and pick up addresses in the role-based subnets from Part 1. It is the least glamorous part of the series and the one where two invisible details, a missing link speed and a VLAN that must match on both switch peers, decide whether anything works at all.

One image, one file per node

The build philosophy: bake everything shared into one image, keep per-node identity down to a single file. The base is an Ubuntu 24.04 cloud image seeded once with cloud-init at bake time, users, SSH keys, packages, and two small extras you will meet below, and then cloud-init is disabled so clones boot fast and never re-provision. Every node in the lab, masters, workers, and the services node, is a copy-on-write clone of that image (Part 2's overlay trick doing its job).

Node anatomy: ens3 management out of band, ens4 and ens5 forming an 802.3ad bond with one leg to each vPC leaf, and the one-image-one-file build recipe
Three NICs, two jobs: management out of band, data on a bond with a leg into each vPC peer.

Per-node identity is exactly one netplan file. Everything the node needs to be itself, its bond, its fabric address, its DNS, sits in seventeen lines:

The per-node netplan: ens3 for management, bond0 over ens4 and ens5 with 802.3ad fast LACP, layer3+4 hashing, the fabric address, split DNS and the anycast gateway as default route
The entire per-node config. Clone the image, drop this file, boot.

Three lines in that file connect backward through the series. The default route points at 10.110.0.1, the anycast gateway that Part 4 configured on every leaf pair, so the node's gateway is always one hop away no matter where it lands. The first nameserver is the services node that Part 9 will build into the lab's DNS. And the bond's MAC is pinned, because a bond that changes MAC across reboots makes switches relearn and DHCP reservations lie. One honest note: the nodes run the default MTU of 1500 while the fabric runs 9216; the fabric's jumbo headroom exists to absorb VXLAN overhead and future tuning, not because the hosts need jumbo today.

This post is for subscribers only

Subscribe to LevelUp I.T. newsletter and stay updated.

Don't miss anything. Get all the latest posts delivered straight to your inbox. It's free!
Great! Check your inbox and click the link to confirm your subscription.
Error! Please enter a valid email address!