Node roles, topology, and the licensing angle

Most first production designs are “3 masters + N workers.” In a serious environment that two-role split usually isn’t what you actually want. The model that holds up has at least four roles, and one of them quietly saves you money.

Watch on YouTube ↗

The four-role model

Role	Count	Rough spec (per node)	Purpose
Control plane	3	8–16 vCPU, 32–64 GB, NVMe with dedicated etcd disk	API + etcd; keep dedicated
Infra	3	8–16 vCPU, 32–64 GB	Ingress/router, monitoring, logging, registry
Worker	N (6+)	16–32 vCPU, 64–128 GB	Application workloads
Storage	3	16+ vCPU, 64+ GB, dedicated disks	Only if running ODF/Ceph in-cluster

Why dedicated infra nodes earn their place

Two reasons, and the second surprises people.

Contention. You don’t want monitoring, logging and ingress fighting your production workloads for CPU and memory. In a latency-sensitive environment that contention becomes response times you’ll have to explain to someone.

Tip

The licensing angle. Properly tainted infra nodes that run only infrastructure components don’t consume OpenShift subscriptions the way worker nodes do. Historically this makes dedicated infra nodes close to free from a subscription standpoint — you’re moving heavy platform services off billable workers rather than adding cost. Confirm current terms with Red Hat, but this is a real and often-missed saving.

Storage nodes, or not

If you run ODF/Ceph internally, you need those 3 storage nodes with their own raw disks — Ceph is resource-hungry. Many shops instead use external enterprise storage (NetApp Trident, Pure, Dell) through a CSI driver and skip the storage nodes entirely. Decide this early: it changes your node count and your bill materially.

What regulated environments add

Finance, healthcare and similar sectors layer hardening on top of the topology, much of which must be decided at install time:

• FIPS mode — must be enabled at install; you can’t flip it on later.
• etcd encryption at rest and disk encryption (LUKS/TPM).
• Disconnected / air-gapped install from a mirror registry.
• OVN-Kubernetes with NetworkPolicies for east-west segmentation, plus egress IP control where outbound traffic must come from known addresses.
• An odd number of control-plane nodes (3) for etcd quorum — non-negotiable.

Caution

The install-time items are the trap. FIPS, etcd encryption choices and the disconnected-install decision are painful or impossible to retrofit. In a regulated build, settle these before you run the installer, not after the auditors ask.

The through-line

The topology isn’t bureaucracy — each role exists to isolate a failure or a cost. Control plane isolates cluster state, infra isolates (and de-bills) platform services, storage isolates I/O-heavy Ceph, workers stay free for what you’re actually there to run. Start from the four roles and adjust down only when you can say which isolation you’re giving up.