network configuration for libvirt / kvm on scaleway servers

Hi I have three servers at Scaleway
they are dedicated 'dedibox'

each server has two additional failover ips

and all of them are associated with an RPNv2 vlan group.


I'm having trouble setting up the network for the virtual machines:
I would like each vm to have its own public ip (the failover ip)
and also use the virtual switch (the RPNv2 vlan).

Also, the three hosts should have another vlan
separated and inaccessible from the vms
which will allow for a different type of traffic (ceph).


The final configuration should be:
vm A on host A and vm A on host B and vm A on host C should have their own vlan subnet
vm B on host A and vm B on host B and vm B on host C should have their own vlan subnet

Please bid only if you have experience with this setup
and with Scaleway if possible

This configuration needs to be production quality
and secure
(no leaks: the vm can't trick the host in order to tap into other's traffic)

Also I need you to document your work
so that I can replicate it on the servers from scratch.


Thank you.