This guide gives deployment engineers a single preflight checklist that catches storage, latency, and disk-capacity issues before installation — the class of issues that most often surface later as false 'network' failures.
Getting Started
You will need:
- Target host(s) meeting the deployment profile for your chosen installation platform. See On-Premise Deployment Options to select your installation platform and network mode.
- Root or sudo shell access on each target host (Embedded Cluster) or a Kubernetes administrator context (KOTS).
- The install package from get.pca.cisco.com staged locally.
- Supported OS versions and profile boundaries listed in the Compatibility Matrix.
Installation Platform and Network Mode
Crosswork Assurance supports two installation platforms and two network modes. Your choice affects which preflight checks apply.
Installation Platform
| Platform | Description | Kubernetes Expertise | Setup Complexity |
|---|---|---|---|
| Embedded Cluster | Provisions a lightweight K0s distribution on customer-supplied VMs. Self-contained with integrated management. | Basic | Low |
| Customer-Supplied Kubernetes (KOTS) | Integrates with an existing Kubernetes platform (OpenShift, Rancher, etc.) through a web-based admin console. | Advanced | Medium |
For a full comparison, see the Deployment Considerations Matrix in On-Premise Deployment Options.
Network Mode
| Mode | Description |
|---|---|
| Online | Internet connectivity available. The installer retrieves container images and deployment artifacts from the Cisco registry. |
| Air-Gap | No internet connectivity required during installation or operation. Offline license management and manual update procedures. |
Compute and Memory
CPU, memory, and disk requirements vary by deployment profile. The table below summarizes the minimum resource floor per profile.
| Profile | CPU Cores | Memory | Disk | Min Nodes | Sessions | Read IOPS | Write IOPS |
|---|---|---|---|---|---|---|---|
| Lab | 32 | 64 GB | 750 GB | 1 | Up to 100 | 10,000 | 1,000 |
| Small | 72 | 128 GB | 2.5 TB | 1 | Up to 10,000 | 10,000 | 1,000 |
Verify that your host meets or exceeds the profile floor before proceeding. For the full requirements table, see:
Multi-node deployments: The resources above represent the total required across all nodes. The minimum node size is 32 vCPU and 64 GB of RAM.
Hyper-threading and oversubscription: The requirements assume hyper-threading is enabled. Avoid hypervisor oversubscription; if needed, do not exceed a 4:1 vCPU-to-physical ratio and 20% RAM over-commit.
Storage Requirements
VM Storage Sizing (Embedded Cluster)
The following table details mount point sizes for Kubernetes hosting VMs.
| Mount Point | Lab | Small |
|---|---|---|
| /boot | 1 GB | 1 GB |
| / (root) | 30 GB | 40 GB |
| /opt | 60 GB | 108 GB |
| /var/log | 10 GB | 15 GB |
| /var/lib | 649 GB | ~2.28 TB |
| Total | ~750 GB | ~2.5 TB |
Kubernetes Storage (KOTS)
The cluster must have an existing StorageClass available. Crosswork Assurance creates the required stateful components using the default StorageClass in the cluster.
Verify your default StorageClass:
kubectl get storageclass
The default class is marked (default) in the output. If no default exists, set one before installing.
IOPS Requirements
All profiles require a minimum of 10,000 read IOPS and 1,000 write IOPS. Verify your storage backend meets these thresholds before proceeding.
Disk Latency Gate (etcd P99 ≤ 10 ms)
etcd requires low write latency. If the disk backing etcd cannot sustain P99 ≤ 10 ms, the cluster will exhibit control-plane instability that often resembles a network problem.
Measure disk latency before installing. If the test fails, remediate storage before proceeding. See Troubleshoot On-Prem Installation Failures for failure signatures caused by slow disk.
Preflight Verification
Run the following checks in order. All must pass before you start the install.
The installer also runs its own automated preflight checks after you begin deployment. Those checks read cluster-scoped information (Nodes, Namespaces, StorageClasses, installed APIs) and verify minimum requirements. However, a successful automated preflight is a point-in-time validation and does not replace your infrastructure approval, storage-performance validation, or security review. Run the manual checks below first to catch issues the automated checks do not cover.
All Deployments
| Check | Command | Expected |
|---|---|---|
| OS version | cat /etc/os-release |
Matches Compatibility Matrix |
| DNS resolver | cat /etc/resolv.conf |
At least one nameserver entry (required even in air-gap) |
| Disk free (root) | df -h / |
≥ 30 GB (Lab) or ≥ 40 GB (Small) |
| Disk free (/opt) | df -h /opt |
≥ 60 GB (Lab) or ≥ 108 GB (Small) |
| Disk free (/var/log) | df -h /var/log |
≥ 10 GB (Lab) or ≥ 15 GB (Small) |
| Disk free (/var/lib) | df -h /var/lib |
≥ 649 GB (Lab) or ≥ ~2.28 TB (Small) |
| Disk IOPS | see Disk Latency Gate | ≥ 10,000 read / ≥ 1,000 write |
| etcd disk latency | see Disk Latency Gate | P99 ≤ 10 ms |
| Time sync | chronyc tracking or timedatectl status |
Synchronized |
KOTS Deployments (Additional)
| Check | Command | Expected |
|---|---|---|
| Default StorageClass | kubectl get storageclass |
One class marked (default) |
| socat installed | which socat |
Prints path (for example, /usr/bin/socat) |
| Kubernetes version | kubectl version --short |
Compatible with KOTS release (Replicated matrix) |
Online Deployments (Additional)
Verify network reachability to the required external URLs:
| URL | Purpose |
|---|---|
proxy-registry.pca.cisco.com |
Cisco container registry |
update.pca.cisco.com |
Update service |
replicated.app |
KOTS application |
kots.io |
KOTS CLI |
*.docker.io / *.docker.com |
Container images |
cdn.auth0.com |
Authentication |
charts.jetstack.io |
cert-manager |
operator.min.io |
MinIO operator |
prometheus-community.github.io |
Prometheus |
Quick reachability test (repeat for each URL):
curl -s -o /dev/null -w "%{http_code}" https://proxy-registry.pca.cisco.com
A 200, 301, or 403 response confirms connectivity. A timeout or connection-refused indicates a firewall or proxy issue.
IPv6 Deployments (Additional)
If you deploy using an IPv6 address for the host machine, you must use a deployer version post-fixed with the label dual-stack. The preflight checks will fail if a non-dual-stack deployer version is used on an IPv6 host.
Symptom Decoder
Some symptoms look like network errors but are actually disk or latency issues.
When install or first-run fails with what appears to be a network error, check storage first:
| Symptom | Likely Root Cause | Related Documentation |
|---|---|---|
| etcd leader elections repeat | Disk P99 > 10 ms | Troubleshoot On-Prem Installation Failures |
| Pod evictions / OOM at install | Memory or disk pressure | Installation on Kubernetes |
| Install hang | Disk, latency, or resource starvation | Troubleshoot On-Prem Installation Failures |
unable to do port forwarding: socat not found |
socat package missing on node | Installation on Kubernetes — Port Forwarding |
| Preflight fails on IPv6 host | Deployer version is not dual-stack |
Installation on Kubernetes — Pre-Flight Checks |
© 2026 Cisco and/or its affiliates. All rights reserved.
For more information about trademarks, please visit: Cisco trademarks
For more information about legal terms, please visit: Cisco legal terms