Home / OCI

OCIHow-toIntermediate

OKE baseline cluster: enhanced cluster, private endpoint, node pools and workload identity

Create a production Oracle Kubernetes Engine cluster with a private API endpoint, VCN-native pod networking, node pools spread across fault domains or ADs, workload identity and upgrade discipline.

Deepak Bhardwaj2 min read

Applies toOCI Kubernetes Engine (OKE) enhanced clusters

1. Cluster type and networking

  • Enhanced cluster: financially backed SLA for the control plane, workload identity, add-on management, virtual nodes.
  • VCN-native pod networking (pods get VCN IPs, NSGs apply to pods) or Flannel overlay (fewer VCN IPs). VCN-native needs a pod subnet sized for max pods.
  • Private Kubernetes API endpoint in a private subnet; administrators reach it via Bastion or VPN.

Subnets: API endpoint subnet, worker node subnet, pod subnet (VCN-native), load balancer subnet (public or private).

2. Node pools

oci ce node-pool create --cluster-id <cluster-ocid> --compartment-id <cmp> --name np-apps \
  --kubernetes-version v1.30.1 --node-shape VM.Standard.E5.Flex \
  --node-shape-config '{"ocpus":4,"memoryInGBs":64}' \
  --size 3 \
  --placement-configs '[{"availabilityDomain":"Abcd:AP-MUMBAI-1-AD-1","subnetId":"<worker-subnet-ocid>","faultDomains":["FAULT-DOMAIN-1","FAULT-DOMAIN-2","FAULT-DOMAIN-3"]}]'
  • In single-AD regions (such as Mumbai), spread nodes over the three fault domains. In multi-AD regions, spread over ADs.
  • Separate pools for system add-ons and apps; separate pools for GPU or Arm workloads.
  • Cluster Autoscaler add-on with min/max per pool.

3. Access

  • kubeconfig via the OCI CLI (oci ce cluster create-kubeconfig ... --kube-endpoint PRIVATE_ENDPOINT), authenticated by IAM.
  • IAM policies grant cluster access (use clusters), Kubernetes RBAC maps IAM groups/users to roles.

4. Workload identity

Pods call OCI services (Object Storage, Vault, Streaming) without API keys:

Allow any-user to read objects in compartment cmp-payments-prod where all {
  request.principal.type = 'workload',
  request.principal.namespace = 'orders',
  request.principal.service_account = 'orders-api',
  request.principal.cluster_id = '<cluster-ocid>' }

5. Images and secrets

  • OCI Container Registry (OCIR) private repositories, with image scanning.
  • Secrets from OCI Vault via the Secrets Store CSI driver provider for OCI.

6. Upgrades

OKE supports a limited number of Kubernetes minor versions. Upgrade the control plane, then node pools (create new pool with the new version and cordon/drain old nodes, or in-place cycling with max surge).

oci ce cluster get --cluster-id <cluster-ocid> --query "data.\"available-kubernetes-upgrades\""

Standalone scope

One OKE cluster across fault domains or ADs handles node and FD failures when apps use 3+ replicas with spread constraints. A region outage or broken cluster needs a second cluster and GitOps (see the OCI DR posts).

Related fixes