Limits
Enforced limits
Section titled “Enforced limits”| Resource | Limit |
|---|---|
| Listeners per load balancer | 50 |
| Explicit targets per listener | 32 |
| Subnets attached to one gateway | 16 |
| Domains on one certificate | 20 |
| Control-plane machines per Kubernetes cluster | 1 or 3 |
| Nodes per object storage cluster | 1 or 3 |
| Subnets per private network | 16 (the /20 allocation divided into /24s) |
| Public addresses per server | 1 |
| Public addresses per gateway or load balancer | 1 |
Structural constraints
Section titled “Structural constraints”Not quotas — things the model does not permit at all.
| Constraint | Why |
|---|---|
A data subnet can never have egress | The tier is enforced, not advisory |
| All listeners on one port share a protocol | Mixing pass-through and termination on one port needs a two-stage loop-back arrangement in HAProxy |
| A load balancer only reaches its own private network | It has one leg |
| Nothing crosses regions | No shared networks, addresses, images or migration |
| Subnet tier is immutable | Chosen at creation |
| Disks grow, never shrink | A property of the storage |
A tcp listener with a hostname only serves TLS clients | Routing uses SNI; there is nothing else to match on |
External limits
Section titled “External limits”| Limit | Source | Consequence |
|---|---|---|
| ~50 certificates per registered domain per week | Let’s Encrypt | Exceeding it blocks issuance for that domain |
| 5 identical certificates per week | Let’s Encrypt | Why an existing certificate is reused rather than re-requested |
| Provider API rate limits | DNS provider | Transient failures surface as 503; retried with backoff |
| VLAN identifier space | Your switches | In VLAN mode, bounds the number of subnets per region |
Practical guidance
Section titled “Practical guidance”Poll jobs no faster than every five seconds. A job is talking to a hypervisor.
Do not retry a 409 unchanged. It means a precondition failed, and the same request
produces the same conflict. The message names the precondition.
Expect certificate issuance to take minutes. The challenge record has to be published and observed by public resolvers before Let’s Encrypt is asked to look.
Expect cluster creation to take minutes. Machines are cloned, bootstrapped and then measured for readiness rather than assumed ready.