Bare Metal Linux Cluster Deployment
Twenty machines arrive. In fifteen minutes each they are identical, provisioned from Git, and ready to join a cluster — with nobody logging in by hand.
What this usually looks like
You have the hardware — in a rack, in colo, or arriving next week. What you do not have is a repeatable way to turn it into a fleet.
- Machines get installed by hand, and six months later nobody knows what was changed on rack 3.
- Bring-up takes days because firmware, RAID, bonding and OS drift from a wiki page that stopped being true.
- Adding a node means a senior engineer spends an afternoon on BMC consoles.
- Nobody can answer "which machines are still on the vulnerable firmware?" without a spreadsheet.
Three ways to buy this
Audit if you want to know how bad it is. Build if you have the team and want the capability. Managed if you don't want to own the pager. Most engagements start with the audit and decide afterwards.
Audit
A fixed-price health check — the cheapest way in
- Hardware and firmware inventory (including end-of-life components)
- Provisioning gap analysis against a Git-driven baseline
- Network and out-of-band access review
- Findings ranked by risk, with effort estimates
Build
One-off delivery: design, code, hardening, handover
- PXE/iPXE + preseed/kickstart provisioning plane
- MAAS or Foreman as the source of truth for machines
- Ansible roles for OS baseline, networking, firmware
- Package mirror and unattended-upgrade policy
- Full bring-up runbook, and a rehearsal with your team
Managed
Build plus 7×24 on-call, SLA and quarterly drills
- Firmware and OS patch cycle on your schedule
- Hardware fault monitoring via BMC/Redfish, alerting before failure
- Capacity and spares tracking across the fleet
- Node replacement as a documented, timed procedure
What we actually deploy
Specific tooling, not categories. If a version matters to your decision, ask — we will tell you which one we would pick and why, including when the answer is the older one.
Provisioning
- PXE / iPXE
- Debian Preseed
- Kickstart
- MAAS
- Foreman / Katello
- Tinkerbell
- Warewulf
- netboot.xyz
Configuration
- Ansible (AWX / Semaphore)
- Puppet
- SaltStack
- Packer + cloud-init
- Chef (legacy estates)
Operating systems
- Debian 12/13
- Ubuntu 22.04/24.04 LTS
- RHEL 9/10
- AlmaLinux
- Rocky Linux
- SLES
- Oracle Linux
Immutable / K8s-native OS
- Talos Linux
- Flatcar Container Linux
- Bottlerocket
- Fedora CoreOS
Out-of-band
- IPMI
- Redfish
- Dell iDRAC
- HPE iLO
- Supermicro IPMI
- vendor firmware tooling
Network baseline
- LACP bonding
- VLAN / VXLAN
- FRR (BGP)
- BIRD
- NTP / chrony
- PTP
- MTU/ECN tuning
Compliance baseline
- OpenSCAP
- CIS Level 1/2
- auditd
- AIDE
- Lynis
What we will be measured on
These are the numbers we put in the delivery report. If we cannot measure it, we do not promise it.
- Bare metal to cluster-ready in ≤ 15 minutes per node, measured, not estimated.
- 100% of machine state described in Git — no undocumented manual step remains.
- New node joins with zero interactive logins (except initial BMC credential rotation).
- Firmware baseline report delivered for every node, with drift detection on a schedule.
- Bring-up procedure rehearsed once with your own engineers before handover.
What we would build, and where the weak point is
The PXE/TFTP plane is a single point of failure during provisioning. We either pair it or document the recovery time. Everything else is idempotent and re-runnable.
marks a single point of failure we would raise with you rather than hide. Every architecture has one; the question is whether you know where it is.
What we don't do
Every vendor says yes to everything. Here is where our answer is no, or where someone else needs to be in the room. If this list looks wrong for your situation, tell us — we would rather argue about scope before the contract than after.
- Requires partner
Server hardware selection and procurement
We specify requirements and vet quotes; we do not resell hardware or take margin on it.
- Requires partner
Rack, power, cooling, and structured cabling
We work with your colo or your facilities team. We will not pull cable.
- Out of scope
Windows Server provisioning
Linux only. We would be learning on your budget.
- Out of scope
Hardware break-fix and vendor RMA handling
We diagnose and hand you the evidence for the RMA; we do not act as your hardware reseller.
What it looked like last time
A 40-node research cluster, previously provisioned from a stale wiki page, reduced to a single Git-driven bring-up with per-node bring-up time under 12 minutes and firmware drift detection running weekly.
Anonymised under NDA. No client names, no logos, no invented metrics. Full case library on the work page.
Talk to the platform engineer about your bare metal & os layer
Send us the architecture, or just describe what broke most recently. You'll get an engineer's answer, not a discovery questionnaire.
Talk to a platform engineer: botonwa@gmail.com · +86 130 5181 3099