Managed Kubernetes Data Plane

The Kubernetes® data plane is composed of cluster's worker nodes. With UpCloud's Managed Kubernetes, worker nodes are deployed through cluster node groups. These nodes run customer workloads and are managed by the control plane.

Node groups

Users have full control of their data plane configuration, allowing them to arrange worker nodes in groups with varying Cloud Server plans.

Node groups can be configured to use any pre-defined Cloud Server plan. For more information, see Cloud Server configurations for more details.

Node groups can be scaled horizontally by adding or removing nodes.

Anti-affinity

When creating a new node group, users have the option to select Anti-affinity in the Advanced settings. If enabled, nodes in this group are aimed to be placed on separate compute hosts.

Please note that the anti-affinity policy is considered a “best effort” and enabling it does not fully guarantee that the nodes will end up on different hardware.

Automatic node updates

Node groups can install operating system updates on their worker nodes automatically. Automatic node updates is in beta, available on clusters running Kubernetes 1.35 or later, and off by default.

You can turn on automatic node updates when you create a node group, either with a new cluster or by adding a node group to an existing one. It can't be turned on for a node group that already exists. When it's on, every node in the group installs the available Debian updates, including security updates, on the day and at the time you schedule. The updates can include new kernel versions, which need a reboot. The schedule is either daily or one day of the week, and the time is in UTC. All nodes in the group install updates at the same time. A node that joins the group later gets the same settings and can install updates as soon as it starts.

With Include Kubernetes patch updates on, the nodes also update kubelet, kubeadm and kubectl to the latest patch release of the cluster's Kubernetes version. The Kubernetes minor version stays the same. To move the cluster to a new Kubernetes version, upgrade the cluster.

Nodes are not restarted automatically. Updates that need a restart, such as kernel updates, take effect after the node reboots. To reboot nodes one at a time without disrupting your workloads, see How to keep Managed Kubernetes nodes up to date.

Network connectivity

UpCloud's Managed Kubernetes is pre-configured with and optimised to use Cilium as the Container Networking Interface (CNI) plugin.

Data plane worker nodes are connected via Private networks made available in the same zone as the Managed Kubernetes cluster.

Requirements are:

• One Private network per Kubernetes cluster is required.
• Only one cluster can be connected to any one Private network at the same time.
• The Private network cannot be changed after cluster creation.

Network CIDR ranges

When creating the cluster, please make sure your network configuration does not overlap with the following CIDR ranges:

• Control Plane CIDR: 172.31.240.0/24
• Service CIDR: 10.128.0.0/12
• POD CIDR: 192.168.0.0/16
• Forwarder CIDR: 10.33.128.0/22
• Load Balancer CIDR: 100.64.0.0/10 (Used for Load Balancer assignment)
• Utility CIDR (per cluster zone):
  • fi-hel1: 10.1.0.0/16
  • uk-lon1: 10.2.0.0/16
  • us-chi1: 10.3.0.0/16
  • de-fra1: 10.4.0.0/16
  • nl-ams1: 10.5.0.0/16
  • fi-hel2: 10.6.0.0/16
  • es-mad1: 10.7.0.0/16
  • us-sjo1: 10.8.0.0/16
  • us-nyc1: 10.9.0.0/16
  • sg-sin1: 10.10.0.0/16
  • pl-waw1: 10.11.0.0/16
  • au-syd1: 10.12.0.0/16
  • se-sto1: 10.13.0.0/16
  • dk-cph1: 10.14.0.0/16
  • no-svg1: 10.15.0.0/16

Private node groups

Optionally, cluster can be created by assigning only private IP addresses to the cluster worker nodes. Cluster nodes are then not accessible from the Internet and all services have to be exposed through a Load Balancer.

The worker nodes require Internet access to operate correctly. As a requirement, the selected SDN network has to have a SDN router and a NAT Gateway configured. See NAT Gateways for more information.

Accessing worker nodes over SSH

Node groups support the use of SSH keys for accessing worker nodes. These can be configured in the Advanced settings, only upon node group creation. Note that SSH keys are not configured by default.

Kubernetes is a registered trademark of The Linux Foundation.