1. Container Engine for Kubernetes
  2. Creating Network Resources
  3. Creating an OKE Worker Subnet

Creating an OKE Worker Subnet

Create the following resources in the order listed:

  1. Worker security list

  2. Worker subnet

Create a Worker Security List

To create a security list, use the instructions in "Creating a Security List" in Controlling Traffic with Security Lists in the Oracle Private Cloud Appliance User Guide. For Terraform input, see Example Terraform Scripts for Network Resources.

This security list defines traffic that is allowed to contact worker nodes directly.

For this example, use the following input for the worker subnet security list.

Compute Web UI property OCI CLI property

  • Name: worker-seclist

  • --vcn-id: ocid1.vcn.oke_vcn_id

  • --display-name: worker-seclist

Seven ingress security rules:

Seven ingress security rules:

--ingress-security-rules

Ingress Rule 1

  • Stateless: uncheck the box

  • Ingress CIDR: vcn_cidr

  • IP Protocol: TCP

    • Destination Port Range: 22

  • Description: "Allow intra-VCN ssh."

Ingress Rule 1

  • isStateless: false

  • source: vcn_cidr

  • sourceType: CIDR_BLOCK

  • protocol: 6

  • tcpOptions

    destinationPortRange

    • max: 22

    • min: 22

  • description: "Allow intra-VCN ssh."

Ingress Rule 2

  • Stateless: uncheck the box

  • Ingress CIDR: kube_client_cidr

  • IP Protocol: TCP

    • Destination Port Range: 30000-32767

  • Description: "Allow clients to contact the node port range."

Ingress Rule 2

  • isStateless: false

  • source: kube_client_cidr

  • sourceType: CIDR_BLOCK

  • protocol: 6

  • tcpOptions

    destinationPortRange

    • max: 32767

    • min: 30000

  • description: "Allow clients to contact the node port range."

Ingress Rule 3

  • Stateless: uncheck the box

  • Ingress CIDR: workerlb_cidr

  • IP Protocol: TCP

    • Destination Port Range: 30000-32767

  • Description: "Allow the worker load balancer to contact the worker nodes."

Ingress Rule 3

  • isStateless: false

  • source: workerlb_cidr

  • sourceType: CIDR_BLOCK

  • protocol: 6

  • tcpOptions

    destinationPortRange

    • max: 32767

    • min: 30000

  • description: "Allow the worker load balancer to contact the worker nodes."

Ingress Rule 4

  • Stateless: uncheck the box

  • Ingress CIDR: workerlb_cidr

  • IP Protocol: TCP

    • Destination Port Range: 10256

  • Description: "Allow the worker load balancer to contact the worker nodes."

Ingress Rule 4

  • isStateless: false

  • source: workerlb_cidr

  • sourceType: CIDR_BLOCK

  • protocol: 6

  • tcpOptions

    destinationPortRange

    • max: 10256

    • min: 10256

  • description: "Allow the worker load balancer to contact the worker nodes."

Ingress Rule 5

  • Stateless: uncheck the box

  • Ingress CIDR: kmi_cidr

  • IP Protocol: TCP

    • Destination Port Range: 22-65535

  • Description: "Allow the control plane to contact the worker nodes."

Ingress Rule 5

  • isStateless: false

  • source: kmi_cidr

  • sourceType: CIDR_BLOCK

  • protocol: 6

  • tcpOptions

    destinationPortRange

    • max: 65535

    • min: 22

  • description: "Allow the control plane to contact the worker nodes."

Ingress Rule 6

  • Stateless: uncheck the box

  • Ingress CIDR: worker_cidr

  • IP Protocol: UDP

    • Destination Port Range: 8285-8472

  • Description: "Allow flannel traffic."

Ingress Rule 6

  • isStateless: false

  • source: worker_cidr

  • sourceType: CIDR_BLOCK

  • protocol: 17

  • udpOptions

    destinationPortRange

    • max: 8472

    • min: 8285

  • description: "Allow flannel traffic."

Ingress Rule 7

  • Stateless: uncheck the box

  • Ingress CIDR: kmi_cidr

  • IP Protocol: UDP

    • Destination Port Range: 8285-8472

  • Description: "Allow flannel traffic."

Ingress Rule 7

  • isStateless: false

  • source: kmi_cidr

  • sourceType: CIDR_BLOCK

  • protocol: 17

  • udpOptions

    destinationPortRange

    • max: 8472

    • min: 8285

  • description: "Allow flannel traffic."

Create the Worker Subnet

To create a subnet, use the instructions in Creating a Subnet in the Oracle Private Cloud Appliance User Guide. For Terraform input, see Example Terraform Scripts for Network Resources.

For this example, use the following input to create the worker subnet. Use the OCID of the VCN that was created in Creating an OKE VCN. Create the worker subnet in the same compartment where you created the VCN.

Compute Web UI property OCI CLI property

  • Name: worker

  • CIDR Block: worker_cidr

  • Route Table: Select "Default - private" from the list

  • Private Subnet: check the box

  • DNS Hostnames:

    Use DNS Hostnames in this Subnet: check the box

    • DNS Label: worker

  • Security Lists: Select "worker-seclist" and "Default Security List for oketest-vcn" from the list

  • --vcn-id: ocid1.vcn.oke_vcn_id

  • --display-name: worker

  • --cidr-block: worker_cidr

  • --dns-label: worker

  • --prohibit-public-ip-on-vnic: true

  • --route-table-id: OCID of the "Default - private" route table

  • --security-list-ids: OCIDs of the "worker-seclist" security list and the "Default Security List for oketest-vcn" security list