# OneKS Seed VM is created only with public nic, private nic is missing **URL:** \ **Category:** Installation & Configuration\ **Created:** [September 10, 2026, 2:30pm UTC](https://forum.opennebula.io/t/oneks-seed-vm-is-created-only-with-public-nic-private-nic-is-missing/14565 "2026-09-10T14:30:39Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![daniva](https://avatars.discourse-cdn.com/v4/letter/d/b5a626/32.png) [@daniva](https://forum.opennebula.io/u/daniva)\ **Post date:** [September 10, 2026, 2:30pm UTC](https://forum.opennebula.io/t/oneks-seed-vm-is-created-only-with-public-nic-private-nic-is-missing/14565/1 "2026-09-10T14:30:39Z")
oneks create cluster or with sunstone creates a seed vm. Seed VM is created only with public nic, private nic is missing. Cluster provisioning fails with timeout: oneks show cluster 43 ONEKS CLUSTER 43 INFORMATION ID : 43 NAME : oneks-dev USER : oneadmin GROUP : oneadmin STATE : PROVISIONING KUBERNETES VERSION : v1.34.2 ENDPOINT : N/A REGISTRATION TIME : 09/10 14:19:19 PERMISSIONS OWNER : um- GROUP : — OTHER : — DEPLOYMENT OPENNEBULA\_CLUSTER : 0 PUBLIC\_NETWORK : 11 PRIVATE\_NETWORK : 12 CONTROL PLANE ID : 44 NAME : controlplane-general-standalone-9e7bfa92ac83 FAMILY : general FLAVOUR : standalone STATE : BOOTSTRAPPING VM IDS : – ## onevm show 664 VIRTUAL MACHINE 664 INFORMATION ID : 664 NAME : controlplane-general-standalone-9e7bfa92ac83-seed USER : oneadmin GROUP : oneadmin STATE : ACTIVE LCM\_STATE : RUNNING LOCK : None RESCHED : No HOST : somehost CLUSTER ID : 0 CLUSTER : default START TIME : 09/10 14:19:19 END TIME : - DEPLOY ID : 40875664-139b-4e08-9d73-1c0122e130d4 VIRTUAL MACHINE MONITORING [Thu Sep 10 14:25:38 2026] METRIC VALUE FORECAST FORECAST\_FAR CPU 57.51 55.31 - MEMORY 2.3G 2.2G - NETTX 10K - - NETTX\_BW 0K 0K - NETRX 4K - - NETRX\_BW 0K 0K - DISKRDBYTES 1T - - DISKRDBYTES\_BW 819K 2.6G - DISKRDIOPS 16051 - - DISKRDIOPS\_BW 0.03 39.38 - DISKWRBYTES 94.9G - - DISKWRBYTES\_BW 83.8M 249.2M - DISKWRIOPS\_BW 19.93 27.18 - DISKWRIOPS 10601 - - GPU\_COUNT - - - GPU\_UTILIZATION - - - GPU\_MEMORY\_UTILIZATI - - - GPU\_MEMORY\_FREE - - - GPU\_POWER\_USAGE - - - VM\_QEMU\_PING : QEMU Guest Agent monitoring disabled PERMISSIONS OWNER : um- GROUP : — OTHER : — VM DISKS ID DATASTORE TARGET IMAGE SIZE TYPE SAVE 0 image-ssh vda OneKS Appliance 1.3G/4G file NO 1 - sda CONTEXT 1M/- - - VM NICS ID NETWORK BRIDGE IP MAC PCI\_ID 0 public vlan 80 onebr.80 192.168.80.119 02:80:01:00:00:13 SECURITY NIC\_ID NETWORK SECURITY\_GROUPS 0 public vlan 80 0 … ---
**Author:** ![daniva](https://avatars.discourse-cdn.com/v4/letter/d/b5a626/32.png) [@daniva](https://forum.opennebula.io/u/daniva)\ **Post date:** [September 10, 2026, 2:33pm UTC](https://forum.opennebula.io/t/oneks-seed-vm-is-created-only-with-public-nic-private-nic-is-missing/14565/2 "2026-09-10T14:33:45Z")
[E][EVT]: Dependency SeedVM failed for group 44: EVENT API one.vrouter.allocate subscriber timed out after 500 seconds [E][EVT]: Dependency ClusterRouter failed for group 44: EVENT API one.vrouter.allocate subscriber timed out after 500 seconds [I][GRP]: ControlPlane (ID=44) changed state from BOOTSTRAPPING to BOOTSTRAPPING\_FAILURE [I][CLS]: Cluster 43 changed state from PROVISIONING to PROVISIONING\_FAILURE ---
**Author:** ![nhansen](https://yyz1.discourse-cdn.com/flex031/user_avatar/forum.opennebula.io/nhansen/32/7230_2.png) [@nhansen](https://forum.opennebula.io/u/nhansen)\ **Post date:** [September 11, 2026, 4:16pm UTC](https://forum.opennebula.io/t/oneks-seed-vm-is-created-only-with-public-nic-private-nic-is-missing/14565/3 "2026-09-11T16:16:32Z")
Hello @daniva , The Seed VM in OneKS is only attached to the public network. The virtual router (public + private) and the control plane VMs (private) are created later during bootstrap. Since this failed during the bootstrap phase, there likely wouldn’t be anything on the private network yet. This may be related to a known OneKS bug: [OneKS forces default image datastore · Issue #8081 · OpenNebula/one · GitHub](https://github.com/OpenNebula/one/issues/8081) . Are you using an image datastore other than ID 1, or has that datastore been removed or disabled? There are a couple of places that default to ID 1 when creating images for OneKS. That causes image creation, and therefore bootstrapping, to fail and prevents the cluster from deploying. It appears you’re using `image-ssh` datastore, was that renamed from default or is it a separate datastore? Can you check whether the router and node images were created? ```auto oneimage list | grep oneks-general ``` The current workaround is to create the images manually in the datastore you want them in. If failed images with these names already exist, delete them first. The current image URLs are in the files under /var/lib/one/oneks (`grep -rn qcow2 /var/lib/one/oneks/`), so use those if they differ from the ones below: ```auto cat > /tmp/oneks-general-router.tpl <<'EOF' NAME = "oneks-general-router" PATH = "https://d24fmfybwxpuhu.cloudfront.net/service_VRouter-6.10.0-3-20250424.qcow2" DEV_PREFIX = "vd" TYPE = "OS" EOF cat > /tmp/oneks-general-node.tpl <<'EOF' NAME = "oneks-general-node" PATH = "https://d24fmfybwxpuhu.cloudfront.net/ubuntu2204-7.0.0-0-20250528.qcow2" DEV_PREFIX = "vd" TYPE = "OS" EOF oneimage create -d image-ssh /tmp/oneks-general-router.tpl oneimage create -d image-ssh /tmp/oneks-general-node.tpl ``` Create them as the same user that deploys the clusters so ownership and permissions match(appears to be oneadmin from your output). Wait until both show READY in `oneimage list`, then delete the failed cluster and create a new one. ---
**Author:** ![daniva](https://avatars.discourse-cdn.com/v4/letter/d/b5a626/32.png) [@daniva](https://forum.opennebula.io/u/daniva)\ **Post date:** [September 11, 2026, 5:30pm UTC](https://forum.opennebula.io/t/oneks-seed-vm-is-created-only-with-public-nic-private-nic-is-missing/14565/4 "2026-09-11T17:30:58Z")
Hello Neal, I’ve created the images oneks-general-node and oneks-general-router according to you instruction, but there is still the timeout. **Fri Sep 11 16:53:04 2026 [I][CLS]: Starting cluster provisioning** **Fri Sep 11 16:53:04 2026 [I][CLS]: Cluster 47 changed state from PENDING to PROVISIONING** **Fri Sep 11 16:53:04 2026 [I][EVT]: Cluster 47 provision started** **Fri Sep 11 16:53:04 2026 [I][GRP]: ControlPlane (ID=48) changed state from PENDING to BOOTSTRAPPING** **Fri Sep 11 16:53:04 2026 [I][SVM]: Creating Seed VM for ControlPlane provisioning** **Fri Sep 11 16:53:05 2026 [I][SVM]: Seed VM (ID=666) deployed successfully** **Fri Sep 11 16:53:05 2026 [I][EVT]: ControlPlane (ID=48) bootstrap successfully** **Fri Sep 11 16:53:05 2026 [I][CVR]: Waiting for Cluster Router creation by the Seed VM** **Fri Sep 11 16:53:05 2026 [I][SVM]: Waiting for Seed VM (ID=666) to provision the ControlPlane** **Fri Sep 11 16:53:30 2026 [I][SVM]: Seed VM entered state PROVISIONING\_MGMT** **Fri Sep 11 16:53:32 2026 [I][SVM]: Seed VM entered state PROVISIONING\_CP** **Fri Sep 11 17:01:32 2026 [E][EVT]: Dependency SeedVM failed for group 48: EVENT API one.vrouter.allocate subscriber timed out after 500 seconds** **Fri Sep 11 17:01:32 2026 [E][EVT]: Dependency ClusterRouter failed for group 48: EVENT API one.vrouter.allocate subscriber timed out after 500 seconds** **Fri Sep 11 17:01:32 2026 [I][GRP]: ControlPlane (ID=48) changed state from BOOTSTRAPPING to BOOTSTRAPPING\_FAILURE** **Fri Sep 11 17:01:32 2026 [I][CLS]: Cluster 47 changed state from PROVISIONING to PROVISIONING\_FAILURE** ---
**Author:** ![nhansen](https://yyz1.discourse-cdn.com/flex031/user_avatar/forum.opennebula.io/nhansen/32/7230_2.png) [@nhansen](https://forum.opennebula.io/u/nhansen)\ **Post date:** [September 16, 2026, 2:04pm UTC](https://forum.opennebula.io/t/oneks-seed-vm-is-created-only-with-public-nic-private-nic-is-missing/14565/5 "2026-09-16T14:04:09Z")
Check oned.log for calls coming from the Seed VM during creation to verify that it is actually contacting the API at all. If you see no calls from the Seed VM, it can’t reach the API. OneKS reaches oned through the transparent proxy, and that needs a tproxy entry for **2633** in addition to the 5030 one used for OneGate, in `/var/lib/one/remotes/etc/vnm/OpenNebulaNetwork.conf`: ```yaml :tproxy: - :service_port: 5030 :remote_addr: :remote_port: 5030 - :service_port: 2633 :remote_addr: :remote_port: 2633 ``` Run `onehost sync -f` after editing. If the `:networks:` key is set on those entries, the public vnet ID needs to be in the list. You can verify from inside the Seed VM with `curl -v ``http://169.254.16.9:2633/RPC2`. any HTTP response means it’s reachable. If you do see calls and they’re failing, the error text should point at what it’s trying to allocate. The Seed VM should still be up during the 500s window (it’s only destroyed once the group reaches RUNNING). Get the IP from `onevm show `, then SSH in and check the cluster logs: ```bash kubectl get pods -A kubectl -n capone-system logs deploy/capone-controller-manager --tail=200 kubectl get cluster,onecluster,machine -A kubectl describe onecluster -A ``` ---
**Author:** ![daniva](https://avatars.discourse-cdn.com/v4/letter/d/b5a626/32.png) [@daniva](https://forum.opennebula.io/u/daniva)\ **Post date:** [September 17, 2026, 9:14am UTC](https://forum.opennebula.io/t/oneks-seed-vm-is-created-only-with-public-nic-private-nic-is-missing/14565/6 "2026-09-17T09:14:13Z")
Hello Neal, thank you for your anser. tproxy entry is defined, but [http://169.254.16.9:2633/RPC2](http://169.254.16.9:2633/RPC2) is not reachable from the seed\_vm, port 2633 is open on sunstone host. How can i enable 169.254.16.9? ---
**Author:** ![daniva](https://avatars.discourse-cdn.com/v4/letter/d/b5a626/32.png) [@daniva](https://forum.opennebula.io/u/daniva)\ **Post date:** [September 17, 2026, 10:18am UTC](https://forum.opennebula.io/t/oneks-seed-vm-is-created-only-with-public-nic-private-nic-is-missing/14565/7 "2026-09-17T10:18:00Z")
Hello Neal, looks like route is not set for 169.254.16.9 ip route get 169.254.16.9 169.254.16.9 via 192.168.80.1 dev eth0 src 192.168.80.122 but it shoud be 169.254.16.9 dev eth0 src 192.168.80.122 curl -v --connect-timeout 5 [http://169.254.16.9:2633/RPC2](http://169.254.16.9:2633/RPC2) - Trying 169.254.16.9:2633… - Connected to 169.254.16.9 (169.254.16.9) port 2633 ---
**Author:** ![nhansen](https://yyz1.discourse-cdn.com/flex031/user_avatar/forum.opennebula.io/nhansen/32/7230_2.png) [@nhansen](https://forum.opennebula.io/u/nhansen)\ **Post date:** [September 25, 2026, 6:26pm UTC](https://forum.opennebula.io/t/oneks-seed-vm-is-created-only-with-public-nic-private-nic-is-missing/14565/8 "2026-09-25T18:26:05Z")
Hello, Can you try updating your `/etc/one/oned.conf` and define `ONEGATE_ENDPOINT = "http://169.254.16.9:5030"` ? Perhaps this is still set to your frontend’s IP but when using Transparent Proxy this should be set to the tproxy address. The network config may not be generating properly for the VM if that value is pointed to the frontend’s address rather than the tproxy address. If that doesn’t work you can try updating the OneKS templates and add a start script to the contect section: `START_SCRIPT = "ip route replace 169.254.16.9 dev eth0"` ? ---
**Author:** ![daniva](https://avatars.discourse-cdn.com/v4/letter/d/b5a626/32.png) [@daniva](https://forum.opennebula.io/u/daniva)\ **Post date:** [September 27, 2026, 12:17pm UTC](https://forum.opennebula.io/t/oneks-seed-vm-is-created-only-with-public-nic-private-nic-is-missing/14565/9 "2026-09-27T12:17:30Z")
Hello Neal, ONEGATE\_ENDPOINT = “[http://169.254.16.9:5030](http://169.254.16.9:5030)” helped, route is now ok. But the cluster provisioning still times out. When i try a kubectl command in the seed vm I’ll get: 3457 memcache.go:265] “Unhandled Error” err=“couldn’t get current server API group list: Get “[https://127.0.0.1:43953/api?timeout=32s\](https://127.0.0.1:43953/api?timeout=32s%5C)”: dial tcp 127.0.0.1:43953: connect: connection refused” I assume the provisioning supposed to be done with podman, but no containers are running. I’m only seeing a container exited 5 months ago: podman ps -a CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 48a3027b8d74 [docker.io/kindest/node@sha256:18fbefc20a7113353c7b75b5c869d7145a6abd6269154825872dc59c1329912e](http://docker.io/kindest/node@sha256:18fbefc20a7113353c7b75b5c869d7145a6abd6269154825872dc59c1329912e) 5 months ago Exited (137) 5 months ago 127.0.0.1:43953-\>6443/tcp kind-control-plane