Highly available workloads on OKE: fault domains, spread constraints and load balancers

#Nodes

• Node pool placement across 3 fault domains (single-AD region) or 3 ADs (multi-AD region).
• At least 3 worker nodes per pool; cluster autoscaler min ≥ 3.
• Node labels for FD/AD exist (oci.oraclecloud.com/fault-domain, topology.kubernetes.io/zone). Check:

kubectl get nodes -L topology.kubernetes.io/zone -L oci.oraclecloud.com/fault-domain

#Pods

• 3+ replicas with spread across the topology that matches your region:

topologySpreadConstraints:
  - maxSkew: 1
    topologyKey: oci.oraclecloud.com/fault-domain     # single-AD regions
    whenUnsatisfiable: DoNotSchedule
    labelSelector: { matchLabels: { app: orders-api } }

(Use topology.kubernetes.io/zone in multi-AD regions; there it maps to the AD.)

• PodDisruptionBudget with maxUnavailable: 1.
• Readiness/liveness probes; graceful shutdown with preStop.

#Load balancer

• Service of type LoadBalancer with flexible shape annotations, and health check settings:

metadata:
  annotations:
    oci.oraclecloud.com/load-balancer-type: "lb"
    service.beta.kubernetes.io/oci-load-balancer-shape: "flexible"
    service.beta.kubernetes.io/oci-load-balancer-shape-flex-min: "10"
    service.beta.kubernetes.io/oci-load-balancer-shape-flex-max: "100"
    service.beta.kubernetes.io/oci-load-balancer-internal: "true"

• externalTrafficPolicy: Local if you need client IPs (then ensure pods exist on nodes receiving traffic).
• NSG rules for LB → node ports managed (oci.oraclecloud.com/security-rule-management-mode: "NSG").

#Storage

• Block volumes (CSI) are AD-bound: a pod with a block volume PV stays in that AD. In single-AD regions this is fine for FD failures (volumes are replicated within the AD).
• Shared storage across pods: File Storage (FSS) CSI.
• Prefer managed databases (Autonomous, Base DB with Data Guard) for important state.

#Upgrades without downtime

• Node pool upgrades with cycling (max surge / max unavailable) or blue/green node pools.
• PDBs allow at least one pod to move; drains don't hang.

#Test

Cordon and drain all nodes in one FD; confirm error rates stay flat and pods reschedule into the other FDs.

Tip

In single-AD regions, document clearly that OKE HA covers FD failures only. An AD outage there is a region outage, which needs the DR plan with a second region.