Dev/vcasse/opcp network and prerequisites by VincentCasse · Pull Request #9395 · ovh/docs

VincentCasse · 2026-05-20T13:34:40Z

What type of Pull Request is this?

New guide(s)

Description

This Pull Request adds two new guides to the On-Prem Cloud Platform (OPCP) "Getting started" section:

OPCP - Network integration and platform connectivity: describes the network architecture of an OPCP deployment, including the 1-controller and 3-controllers setups, with the associated diagrams.
OPCP - Technical prerequisites for deployment: details the technical prerequisites customers must meet before an OPCP can bedeployed on their premises.

Both guides are provided in English (en-gb) and French (fr-fr), with the corresponding meta.yaml files and entries added to pages/index.md.

Mandatory information

The translations in this Pull Request have been done using:

OVHcloud integrated translation LLM
Systran
Other tool : Claude for EN
This Pull Request didn't require any translation.
This Pull Request can be merged as soon as possible.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Remove customer-network hardware references (Cisco C9200-48T model, ens1/ens2 interface names, 25 GbE server NIC speed) and the note incorrectly stating that OPCP drives server BMCs through Ironic. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

github-actions · 2026-05-20T13:34:59Z

Screenshot Changes Detected

Image files (2)

File	Status
`pages/hosted_private_cloud/opcp/opcp-network-architecture/images/opcp-1controller-setup.png`	added
`pages/hosted_private_cloud/opcp/opcp-network-architecture/images/opcp-3controllers-setup.png`	added

Image link changes in guides (1 file(s))

pages/hosted_private_cloud/opcp/opcp-network-architecture/guide.en-gb.md

+![OPCP NANOPOD topology - 1 controller](images/opcp-1controller-setup.png){.thumbnail}
+![OPCP MINIPOD/FABRIC topology - 3 controllers](images/opcp-3controllers-setup.png){.thumbnail}

gaudic-ovh · 2026-05-20T14:15:28Z

+
+> [!warning]
+>
+> In MINIPOD and FABRIC modes, the three OPCP Core Controllers **communicate with each other through your upstream OOB network**. Control plane resiliency therefore depends directly on the availability of this network connection: a prolonged outage of the customer's OOB network can disrupt the quorum and the administration of the platform. The **NANOPOD** mode is not concerned, since it only has one controller.


There is two kind of communication:

Control plane component -> over tors

Opcp control plane administration -> over oob (ssh connection, access API exposed, opcp-cli sync command to sync artifacts/configuration on each nodes

@SimonRTC agree on the fact controller spoke together through tors? I understoor the contrary.

I agree with Guillaume.

Discussion with Simon

Controller must not see any vlan tag on the controller links

same L2 have to be shared between all controllers

gaudic-ovh · 2026-05-20T14:17:35Z

+
+#### The data plane
+
+The data plane is the network **used by the workloads** hosted on the OPCP servers (virtual machines, containers, bare-metal instances exposed via OpenStack). It carries:


data plane is not only network right ?

I got your point, but you, how you can define the name?

gaudic-ovh · 2026-05-20T14:19:53Z

+
+#### The out-of-band (OOB) administration network
+
+The OOB network is the network **through which OPCP administers itself** and through which you (and, in Fully managed by OVHcloud mode, the OVHcloud teams) reach the management interfaces. It is **physically and logically separated** from the data plane. It carries:


not itself by human for oob, and controller discuss with other overs TORs equipements with a dedicacted vlan for the kubernetes cluser

Over the same L2 ? Interesting, should we mention?

The vIP customers use to access the APIs is announced via ARP at L2, so a Layer 2 network is required. We should mention this explicitly.

gaudic-ovh · 2026-05-20T14:20:14Z

+
+- access to the **OpenStack APIs**, the **Horizon** interface, and the OPCP management interfaces (HTTPS),
+- SSH access to the **OPCP Core Controllers** (`opcp-cli`, `opcp-diag`),
+- the **inter-controller exchanges** that provide **control plane resiliency** in MINIPOD and FABRIC modes (state synchronisation, quorum election, VIP failover between the three OPCP Core Controllers),


Same as my previous comment

gaudic-ovh · 2026-05-20T14:21:46Z

+
+In terms of hardware, the OOB network relies on:
+
+- a dedicated **management switch**, which aggregates the server BMCs, the management ports of the data switches, and the BMC links of the controllers,


The OOB doesn't rely on BMC, it's only for dataplane server with the cisco

Not currently, but this should be a customer option for either the OOB network or another. The dataplane and Cisco aren't involved since neither BMC nor OOB connects to them (for the controller.s exclusively).

gaudic-ovh · 2026-05-20T14:25:55Z

+
+This is the simplest option, suitable if your security policy accepts a CA internal to the OPCP perimeter. You will however need to distribute OPCP's root certificate to your clients in order to avoid security warnings.
+
+#### Option B — Intermediate certificate authority provided by the customer


THis is the recommanded method

Y0Coss · 2026-05-22T16:07:09Z

@VincentCasse , please let us know when your edition is final. Then we will port this PR to the new repository: https://github.com/ovh/ovhcloud-docs

Network architecture: drop the dedicated management switch bullet from the OOB hardware list; clarify that the OOB network carries the controllers' VIP and admin access while inter-controller data goes through OPCP's own network. Prerequisites: promote the customer-provided intermediate CA as the recommended certificate option (Option A) and demote the OPCP-generated self-signed CA to Option B. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

VincentCasse · 2026-05-25T16:58:59Z

@gaudic-ovh @SimonRTC , I have just updated docs with your feedback. Making explicit we need a L2 untagged network for availability (but also not used for exchange data between controllers).

If it's ok for you, we can push on production @Y0Coss

Y0Coss · 2026-06-01T13:33:40Z

Now ported to the new docs repository via ovh/ovhcloud-docs#102
Thank you for your contribution @VincentCasse

@VincentCasse

) * docs(port): add OPCP network architecture and prerequisites guides Port of legacy PR #9395 (OPCP - network and prerequisites). - New guide: opcp-network-architecture (EN+FR real, 5 locales symlinked to EN, 2 diagrams) - New guide: opcp-prerequisites (EN+FR real, 5 locales symlinked to EN) - Rewrite non-standard /links/hosted-private-cloud/opcp-* cross-links to /guides/... form - Use centralized /links/community for the community link - Add both guides to the OPCP "Getting started" sidebar group Original-URL: ovh/docs#9395 Original-author: @VincentCasse * docs: proofread OPCP network-architecture & prerequisites guides (EN/FR) - FR: grammar + non-breaking spaces before : ; ? (incl. footnotes, guillemets) - EN/FR: '*'->'-' bullets, canonical Go further Professional Services wording - S3 trademark footnote + <sup>1</sup> on first prose occurrence (4 files) - FR: switches->commutateurs, automation->automatisation - FR: 'DNS resolvers'->'Resolveurs DNS', pre-requis->prerequis - FR: 'cle privee'->'cle secrete' (S3 Secret Key), guillemets around cited guide - shorten network-architecture SEO descriptions; bump lastUpdated to 2026-06-02 * docs: align OPCP network-architecture EN description (drop 'vs.') * fix: correct OPCP guide description frontmatter (YAML colon + trailing period) * docs(opcp): bump lastUpdated to 2026-06-03 on network & prerequisites guides * fix(opcp) no 25GbE for oob yet * fix(opcp): add missing space in FR OOB uplink description --------- Co-authored-by: Benoit Chuchla <benoit.chuchla@ovhcloud.com> Co-authored-by: Vincent Cassé <vincent.casse@corp.ovh.com>

VincentCasse and others added 2 commits May 20, 2026 15:26

EN/FR - Add OPCP network architecture and technical prerequisites guides

331acfd

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

VincentCasse requested review from SimonRTC and gaudic-ovh May 20, 2026 13:35

Update schéma in OPCP network architecture

5d09283

gaudic-ovh reviewed May 20, 2026

View reviewed changes

docs(opcp-network): Rework uplink modes (access/trunk, 802.1Q vs QinQ)

f320e61

Y0Coss added the Offer: Hosted Private Cloud The PR documents Hosted Private Cloud products: VMware, Nutanix, SAP, OPCP, Bare Metal Pod label May 21, 2026

Y0Coss added the TO MIGRATE This PR needs to be ported to the new docs repo: https://github.com/ovh/ovhcloud-docs/ label May 26, 2026

bs-ovh self-assigned this May 29, 2026

Y0Coss unassigned bs-ovh Jun 1, 2026

Y0Coss mentioned this pull request Jun 1, 2026

docs(port): add OPCP network architecture and prerequisites guides ovh/ovhcloud-docs#102

Merged

Y0Coss closed this Jun 1, 2026

Y0Coss deleted the dev/vcasse/opcp-network-and-prerequisites branch June 1, 2026 13:33


		#### The data plane

		The data plane is the network used by the workloads hosted on the OPCP servers (virtual machines, containers, bare-metal instances exposed via OpenStack). It carries:


		#### The out-of-band (OOB) administration network

		The OOB network is the network through which OPCP administers itself and through which you (and, in Fully managed by OVHcloud mode, the OVHcloud teams) reach the management interfaces. It is physically and logically separated from the data plane. It carries:


		In terms of hardware, the OOB network relies on:

		- a dedicated management switch, which aggregates the server BMCs, the management ports of the data switches, and the BMC links of the controllers,


		This is the simplest option, suitable if your security policy accepts a CA internal to the OPCP perimeter. You will however need to distribute OPCP's root certificate to your clients in order to avoid security warnings.

		#### Option B — Intermediate certificate authority provided by the customer

Uh oh!

Conversation

VincentCasse commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What type of Pull Request is this?

Description

Mandatory information

Uh oh!

github-actions Bot commented May 20, 2026

Screenshot Changes Detected

Image files (2)

Image link changes in guides (1 file(s))

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Y0Coss commented May 22, 2026

Uh oh!

VincentCasse commented May 25, 2026

Uh oh!

Y0Coss commented Jun 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

VincentCasse commented May 20, 2026 •

edited

Loading