> ## Documentation Index
> Fetch the complete documentation index at: https://controlplanecorporation-majid-docs-content-expansion.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Workload Settings

> BYOK-specific workload settings including internal firewall configuration for private address ranges and extra Kubernetes options.

When running workloads on a BYOK Location, there are some additional configuration settings that are available.

## Internal Firewall Settings

When a workload is running on the Control Plane cloud platform IP Addresses and CIDR blocks configured for the external firewall of a workload are ignored if they are in any private address ranges. When running in a BYOK location these internal address ranges are allowed and can be used to directly access internal resources in your data center.

## extra k8s options

Some specific k8s options can be configured on workloads.

```yaml YAML theme={null}
spec:
  extras:
    affinity: ...
    tolerations: ...
    topologySpreadConstraints: ...
    metadata:
      labels:
        my-label: my-value
    spec:
      schedulerName: my-scheduler
```

* Supported options: `affinity`, `tolerations`, `topologySpreadConstraints`, `metadata.labels`, and `spec.schedulerName`.
* `metadata.labels` are added to the workload's pods. They are merged with the platform-managed labels, which cannot be overridden.
* `spec.schedulerName` sets the Kubernetes scheduler used to place the workload's pods, for use with a custom scheduler running on your cluster.
* `affinity`, `tolerations`, and `topologySpreadConstraints` are **merged** with the default ones.

## Custom Tags

An extra list of Control Plane tags can be used to change the behavior of workloads when they are run in BYOK Locations.

### Disable Service Mesh

`cpln/disableServiceMesh`=`true`

* When this tag is added to a workload the inbound and outbound sidecar is completely disabled. this can be useful in situations where proxying can confuse clients that are expecting direct IP communication without any NAT.

### Disable Service Mesh Inbound Port

`cpln/disableServiceMeshInboundPort`

* A comma delimited list of ports to exclude from being intercepted by the sidecar proxy inbound.

### Disable Service Mesh Outbound Port

`cpln/disableServiceMeshOutboundPort`

* A comma delimited list of ports to exclude from being intercepted by the sidecar proxy outbound.

### Disable Service Mesh Outbound CIDR

`cpln/disableServiceMeshOutboundCIDR`

* A comma delimited list of CIDR IP ranges to exclude from being intercepted by the sidecar proxy outbound.

### ClusterRole

`cpln/k8sClusterRole`

* The ClusterRole that should be bound to the workload
  <Note>The actuator must be configured to allow this. See [BYOK Actuator settings](/byok/settings/actuator#byok-k8s-api-workloads)</Note>