Workload Settings

BYOK-specific workload settings including internal firewall configuration for private address ranges and extra Kubernetes options.

When running workloads on a BYOK Location, there are some additional configuration settings that are available.

Internal Firewall Settings

When a workload is running on the Control Plane cloud platform IP Addresses and CIDR blocks configured for the external firewall of a workload are ignored if they are in any private address ranges. When running in a BYOK location these internal address ranges are allowed and can be used to directly access internal resources in your data center.

extra k8s options

Some specific k8s options can be configured on workloads.

YAML

spec:
  extras:
    affinity: ...
    tolerations: ...
    topologySpreadConstraints: ...
    metadata:
      labels:
        my-label: my-value
    spec:
      schedulerName: my-scheduler

• Supported options: affinity, tolerations, topologySpreadConstraints, metadata.labels, and spec.schedulerName.
• metadata.labels are added to the workload’s pods. They are merged with the platform-managed labels, which cannot be overridden.
• spec.schedulerName sets the Kubernetes scheduler used to place the workload’s pods, for use with a custom scheduler running on your cluster.
• affinity, tolerations, and topologySpreadConstraints are merged with the default ones.

Custom Tags

An extra list of Control Plane tags can be used to change the behavior of workloads when they are run in BYOK Locations.

Disable Service Mesh

cpln/disableServiceMesh=true

• When this tag is added to a workload the inbound and outbound sidecar is completely disabled. this can be useful in situations where proxying can confuse clients that are expecting direct IP communication without any NAT.

Disable Service Mesh Inbound Port

cpln/disableServiceMeshInboundPort

• A comma delimited list of ports to exclude from being intercepted by the sidecar proxy inbound.

Disable Service Mesh Outbound Port

cpln/disableServiceMeshOutboundPort

• A comma delimited list of ports to exclude from being intercepted by the sidecar proxy outbound.

Disable Service Mesh Outbound CIDR

cpln/disableServiceMeshOutboundCIDR

• A comma delimited list of CIDR IP ranges to exclude from being intercepted by the sidecar proxy outbound.

ClusterRole

cpln/k8sClusterRole

• The ClusterRole that should be bound to the workload
  The actuator must be configured to allow this. See BYOK Actuator settings