Quick answer
How do I run Kubernetes on bare metal servers?
To run Kubernetes on bare metal servers at Lumenfer, rent three identical machines in one city and install k3s or kubeadm on Debian or Ubuntu. Node traffic crosses public addresses, so encrypt it with WireGuard. Each server has one IPv4 and an IPv6 /64, so publish Services on node IPs rather than a MetalLB pool. A Lumen 8 node costs $109.37 per 30 days, no KYC, paid in crypto.
Kubernetes on Lumenfer bare metal: what you start with
| Kubernetes release in the official kubeadm guide | v1.37 (kubernetes.io, read 1 November 2026) |
|---|---|
| Systems at checkout | Debian 13, Debian 12, Ubuntu 24.04 LTS, AlmaLinux 10, Rocky Linux 10 and Proxmox VE 9 |
| Access | You log in as root over SSH. Paste a public key when ordering and password logins stay disabled, or skip it and receive a temporary root password with the server, to replace on your first login |
| Addresses and traffic | One dedicated IPv4 address and an IPv6 /64 come with every server. Each plan lists its port speed and its monthly traffic, counted on outgoing data per 30 days; going over never triggers an automatic charge |
| Private network between servers | Not part of the plans: nodes talk over their public addresses |
| Console | There is no IPMI or KVM-over-IP console for customers: you request reboots and reinstalls in the dashboard and the team performs them |
| Backups | Backups are not included: keep copies of your data somewhere else |
| Locations | Amsterdam (Netherlands), Reykjavik (Iceland), Zurich (Switzerland) and Bucharest (Romania): all five plans in all four cities, one price everywhere |
| Delivery | Up to 72 hours from the moment your payment is confirmed |
| Price | Lumen 6 $91.65, Lumen 8 $109.37, Lumen 16 $205.27, Lumen 24 $356.25, Lumen 32 $749.67 per 30 days |
What do I need before installing Kubernetes on bare metal?
Three machines in one city, Linux on each, and cluster ports open between them only. The kubeadm guide asks for 2 GB of RAM per machine and 2 CPUs per control-plane machine. It wants full connectivity between nodes, on a public or a private network.
Hardware is not the hard part: the smallest Lumenfer plan has 6 cores / 12 threads and 32 GB DDR5 ECC. These are the real constraints:
- Three control-plane nodes. The Kubernetes high-availability guide asks for at least three, because each one carries an etcd member.
- Low latency. etcd's hardware guide calls fast disks the most critical factor and wants members in one data center. Every plan has NVMe; order all nodes in one city.
- No swap, or a kubelet told to accept it: by default it refuses to start when swap is on.
- A stable API address from day one. kubeadm cannot make a single control-plane cluster highly available later without
--control-plane-endpoint. Point a DNS name at node 1 now.
kubeadm, k3s or Talos: which installer fits rented bare metal?
Pick k3s for the shortest path, kubeadm for upstream components, and Talos only inside VMs here.
Three ways to install Kubernetes, from their documentation
| k3s | kubeadm | Talos Linux | |
|---|---|---|---|
| Installs on | Debian, Ubuntu, AlmaLinux or Rocky, over SSH | Debian- or Red Hat-based hosts | Its own ISO, PXE or disk image |
| Highly available control plane | Embedded etcd on an odd number of servers, three or more | Three control-plane nodes, stacked or external etcd | Set in the machine configuration |
| Pod network | Flannel built in; wireguard-native encrypts it | A CNI you install, such as Cilium | Set in the machine configuration |
| LoadBalancer Services | ServiceLB built in, on node IPs | None until you add one | None until you add one |
| Fits a Lumenfer server as delivered | Yes | Yes | No: it needs a boot image we do not offer |
Talos does not install from a running Linux system over SSH. Its documentation offers an ISO, an iPXE script and raw disk images, then takes its configuration through an API. With no console and no Talos image here, run Talos as VMs on Proxmox VE. Our comparison of Kubernetes on bare metal or on VMs covers that design.
How do I build a three-node k3s cluster on rented servers, step by step?
Built from the k3s pages on requirements, embedded etcd and networking (read 1 November 2026), for Debian 13 or Ubuntu 24.04 LTS as root.
Order three identical servers in one city
Same plan, same city, same system, with your SSH key at checkout. Delivery: Up to 72 hours from the moment your payment is confirmed.
Measure latency between every pair
Run
ping -c 100from each node to the other two. If times jump, ask support first.Open cluster ports to the peers only
Allow TCP 6443, 2379-2380 and 10250 and UDP 51820 from the two other nodes, plus the k3s pod and service ranges.
Start the first server with embedded etcd
Run the first command below on node 1.
--cluster-initstarts etcd;wireguard-nativeencrypts pod traffic between nodes.Join the other two servers
Run the second command on nodes 2 and 3 with the same token. Each becomes a control-plane node and an etcd member.
Check the cluster and publish a Service
kubectl get nodesshould list three Ready nodes. A LoadBalancer Service on port 443 then answers on each node's own IP: list all three in DNS.
# firewall on every node (apt install ufw); PEER1_IP and PEER2_IP = the two other nodes
ufw allow 22/tcp
ufw allow 80,443/tcp
ufw allow from 10.42.0.0/16 to any # k3s pods
ufw allow from 10.43.0.0/16 to any # k3s services
for p in PEER1_IP PEER2_IP; do
ufw allow from $p to any port 6443,2379:2380,10250 proto tcp
ufw allow from $p to any port 51820 proto udp
done
ufw allow from YOUR_ADMIN_IP to any port 6443 proto tcp
ufw enable
# node 1
curl -sfL https://get.k3s.io | K3S_TOKEN=CHANGE_ME sh -s - server \
--cluster-init \
--flannel-backend=wireguard-native \
--tls-san=k8s.example.com
# nodes 2 and 3
curl -sfL https://get.k3s.io | K3S_TOKEN=CHANGE_ME sh -s - server \
--server https://NODE1_IP:6443 \
--flannel-backend=wireguard-native \
--tls-san=k8s.example.com
kubectl get nodes -o wideHow do I get LoadBalancer IPs on bare metal with one IPv4 per server?
Use the node addresses you already have. Without a cloud provider, Kubernetes has no network load balancer, and a LoadBalancer Service stays Pending. MetalLB fills that gap from a pool of addresses you supply. MetalLB hands out addresses; it cannot invent them.
- Layer 2 mode makes one node own each address and answer ARP or NDP for it. Failover needs other nodes on the same segment.
- BGP mode peers every node with routers you control. The plans include no BGP session.
One dedicated IPv4 address and an IPv6 /64 come with every server. Each plan lists its port speed and its monthly traffic, counted on outgoing data per 30 days; going over never triggers an automatic charge. Extra IPv4 addresses are not sold, so an IPv4 pool would be empty. Hosts that sell IP blocks or private VLANs make MetalLB easy; Lumenfer sells neither. Use one of these instead:
- k3s ServiceLB: a DaemonSet binds each service port with
hostPort, so the Service answers on every node's IP. - An ingress or Gateway API controller on ports 80 and 443 of each node, routing HTTP by host name.
- NodePort for other protocols, in the default 30000-32767 range.
Then publish one DNS record per node, and drop a dead node's record by hand or by health check.
IPv6 is where MetalLB fits. If your /64 is on-link, layer 2 mode can hand out its addresses through NDP. Only the node that owns that /64 can answer for them, so there is no failover. Ask support whether your /64 is routed or on-link.
How do I keep cluster traffic private without a private network?
Encrypt pod traffic and open control ports to peer addresses only.
- Pod traffic. k3s's
wireguard-nativebackend needs the WireGuard kernel module and UDP 51820 between nodes. On kubeadm, Cilium's WireGuard mode encrypts pod-to-pod traffic over UDP 51871. - etcd and the API server. etcd listens on TCP 2379-2380 and the API on 6443. Allow etcd from control-plane peers only, and the API from nodes and your own address.
- The kubelet on TCP 10250 must never face the internet.
- Flannel VXLAN. k3s warns that an exposed UDP 8472 opens the cluster network to anyone.
Which Lumenfer plan should I use for Kubernetes nodes?
Size nodes by memory and pod count, then keep one node of slack. Kubernetes v1.37 is designed for no more than 110 pods per node. A large machine full of small pods reaches that limit before it runs out of cores. etcd's guide says 8 GB of memory is typically enough for it.
A replacement node is not instant: Up to 72 hours from the moment your payment is confirmed. Run three nodes that can carry the load of two, and copy etcd snapshots off the cluster.
In Lumenfer's check of 30 October 2026, 95 of 229 comparable plans at no-KYC crypto hosts listed DDR5 memory. Every Lumenfer plan has DDR5 and NVMe only. See whether DDR5 is worth paying for and how many cores a node needs. All five plans are on what a Lumenfer server costs.
Lumenfer plans as Kubernetes nodes
| Plan | CPU | Cores | RAM | Price per 30 days | Role in a cluster |
|---|---|---|---|---|---|
| Lumen 6 | AMD EPYC 4244P | 6 cores / 12 threads | 32 GB DDR5 ECC | $91.65 | Lab cluster or small control plane |
| Lumen 8 | AMD Ryzen 7 9700X | 8 cores / 16 threads | 64 GB DDR5 | $109.37 | Three-node starter cluster |
| Lumen 16 | AMD Ryzen 9 9950X | 16 cores / 32 threads | 128 GB DDR5 | $205.27 | General nodes: web apps, builds |
| Lumen 24 | AMD EPYC 9254 | 24 cores / 48 threads | 256 GB DDR5 ECC | $356.25 | Stateful nodes for databases |
| Lumen 32 | AMD EPYC 9354 | 32 cores / 64 threads | 384 GB DDR5 ECC | $749.67 | Memory-heavy pods |
Three control-plane nodes in one city beat five spread across Europe, because etcd wants low latency. For a second region, run a second cluster. For the money side, read whether bare metal is cheaper than the cloud.
Kubernetes on bare metal servers: FAQ
Can I run Kubernetes on a single bare-metal server?
Yes. One k3s server runs the control plane and your workloads together. It has no high availability: if the machine fails, the cluster stops.
Do I need MetalLB on bare metal?
Only with a pool of spare addresses. Each Lumenfer server has one IPv4, so k3s ServiceLB or an ingress controller on node IPs is simpler. MetalLB can still serve IPv6 from an on-link /64, on one node.
Can I install Talos Linux on a Lumenfer server?
Not directly. Talos boots from its own ISO, PXE script or disk image, and there is no Talos image or remote console here. Order Proxmox VE 9 and run Talos as VMs.
Can I mix plans in one cluster?
Yes. Keep the three control-plane nodes on one plan so each can carry the others' load. Stateful workloads suit the EPYC plans with ECC memory.
How do I pay for three servers without KYC?
Top up once in crypto (BTC, USDT, USDC, ETH, SOL, LTC, minimum $25) and order each server from the balance. No KYC: we never ask for an ID, a selfie, documents, a card or a phone number.
Rent the nodes for your cluster
Three identical machines in one city, each yours as root. Pay in crypto, no KYC.
- Operator: DomaineGoat LLC, Panama
- Prices checked against 13 hosts, 30 October 2026
- No KYC: no ID, no card, no phone
- Built by hand within 72 h of payment
Sources (14)
- Installing kubeadm (Kubernetes v1.37 requirements, swap) — Kubernetes documentation (read 2026-11-01)
- Creating a cluster with kubeadm (control-plane endpoint) — Kubernetes documentation (read 2026-11-01)
- Options for Highly Available Topology — Kubernetes documentation (read 2026-11-01)
- Ports and Protocols — Kubernetes documentation (read 2026-11-01)
- Considerations for large clusters (110 pods per node) — Kubernetes documentation (read 2026-11-01)
- Hardware recommendations — etcd documentation (read 2026-11-01)
- Requirements (hardware, inbound rules, firewall notes) — K3s documentation (read 2026-11-01)
- High Availability Embedded etcd — K3s documentation (read 2026-11-01)
- Networking Services (ServiceLB) — K3s documentation (read 2026-11-01)
- Basic Network Options (flannel backends) — K3s documentation (read 2026-11-01)
- MetalLB: why and requirements — MetalLB (read 2026-11-01)
- MetalLB in layer 2 mode — MetalLB (read 2026-11-01)
- WireGuard Transparent Encryption — Cilium documentation (read 2026-11-01)
- Boot Assets (Talos v1.14) — Sidero Labs documentation (read 2026-11-01)