Architecture & setup diagrams

📋 Single-NIC SNO — capability matrix

✅ VMs + masquerade

OVN-K over eno2/br-ex — no bridge setup required

✅ VLANs via trunk

NMState VLAN bridges on sub-interfaces

✅ Multus CNI

Multiple VLAN bridge interfaces per VM

✅ LVM storage

Thin provisioning — fast clones

✅ VM snapshots

With VolumeSnapshotClass on LVM thin

✅ MetalLB Layer2

ARP on eno2 (via br-ex / OVS)

✅ Hosted control planes

Worker VMs via OVN-K over eno2/br-ex

✅ VM migration (MTV)

Import traffic over eno2/br-ex — watch bandwidth

✅ Backup/restore (OADP)

Velero + kubevirt plugin, S3 via Minio (insecureSkipTLSVerify)

✅ Backup/restore (K10)

Veeam Kasten K10, CSI snapshots, Minio S3, free tier up to 10 nodes

✅ ACM v2.17 fleet mgmt

MultiClusterHub, observability (Thanos), governance policy framework

⚠️ Physical LAN network

OVN-K localnet on br-ex — macvtap not supported on OCP

⚠️ Shared bandwidth

All functions share eno2 (via OVN-K/br-ex)

⚠️ MetalLB BGP

No ECMP — only one node as BGP peer

🚫 Live migration

SNO = one node = no migration target

🚫 SR-IOV

Second dedicated NIC required

🚫 HA control plane

SNO = single point of failure