---
name: codeengine-connectivity-subnetpool
title: Working with subnet pool connectivity in Code Engine
description: In addition, you can specify the security group that your workload should be attached to.
last-updated: 2026-06-23
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/codeengine?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Working with subnet pool connectivity in Code Engine
{: #connectivity-subnetpool}

The IBM Cloud® Code Engine subnet pool connections feature supports managing VPC subnet pool references, including security groups. 
Fleets are always connected to a VPC, and a subnet pool can be referenced when creating a fleet to specify into which network zone the Code Engine fleet workers get deployed.
You create a subnet pool to specify the VPC subnets and availability zones where your workload will be processed. 
For example, you can create a subnet pool with a single subnet in zone `eu-de-1` or a subnet pool with multiple subnets to span all 3 zones in `eu-de`. 
In addition, you can specify the security group that your workload should be attached to.
{: shortdesc}

IBM Cloud® Virtual Private Cloud (VPC) is a virtual network that is linked to your customer account. It gives you cloud security, with the ability to scale dynamically, by providing fine-grained control over your virtual infrastructure and your network traffic segmentation.
Subnets in your VPC offer private connectivity.
Subnets in your VPC can connect to the public internet through an optional public gateway.
You can keep your VPC and workloads secure by controlling network traffic using security groups.
See [About networking](https://cloud.ibm.com/docs/vpc?topic=vpc-about-networking-for-vpc&format=markdown) and [Security in your VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-security-in-your-vpc&format=markdown) for further reading.

You can manage subnet pools by using the console or the CLI.

## Managing subnet pools by using the console
{: #working-with-subnetpools-ui}
{: ui}

### Adding a subnet pool
{: #add-subnetpool-ui}
{: ui}

1. Go to the Connectivity page:
    1. Select your project from the [Projects page in the Code Engine console](https://cloud.ibm.com/codeengine/projects){: external}.
    2. Click **Project settings** > **Connectivity** and navigate to the **Subnet pools for network placement** section to see a list of existing subnet pools.
2. Click **Create** to create a subnet pool.
3. Provide a name.
4. Select **Specify by name**. You can either create a new VPC or select an existing VPC:
    - **To create a new VPC**: Click **Create** to create a new VPC. After the VPC is created, the newly created subnets for this VPC are automatically added to the subnet pool with the custom security group that was created along with the VPC applied. You can either proceed to step 5 to confirm the subnet pool creation, or update the automatically applied selection (for example, remove a subnet and add it with a different security group).
    - **To use an existing VPC**:
        1. Select the VPC.
        2. Select the VPC subnet you want to specify for network placement
        3. Optional: Select one or more VPC security group to attach to the subnet. If you do not specify any security group, the default security group of the VPC is used.
        4. Click **Add to subnet pool** to add the subnet CRN and optionally its security group CRN to the subnet pool. Repeat this step if the subnet pool should allow network placement to multiple subnets.
5. Confirm your configuration by clicking **Create**.

### Adding a subnet pool by CRN
{: #add-subnetpool-crn-ui}
{: ui}

1. Go to the Connectivity page:
    1. Select your project from the [Projects page in the Code Engine console](https://cloud.ibm.com/codeengine/projects){: external}.
    2. Click **Project settings** > **Connectivity** and navigate to the **Subnet pools for network placement** section to see a list of existing subnet pools.
2. Click **Create subnet pool** to create a subnet pool.
3. Provide a name.
4. Select **Specify by CRN** and provide a VPC subnet CRN. Optionally, provide a VPC security group CRN. Click **Add security group** if you want to attach more than one security group to the subnet. If you do not specify any security group, the default security group of the VPC is used. Click **Add to subnet pool** to add the subnet CRN and optionally its security group CRN to the subnet pool. Repeat this step if the subnet pool should allow network placement to multiple subnets.
5. Confirm your configuration by clicking **Create**.

### Deleting a subnet pool
{: #delete-subnetpool-ui}
{: ui}

You can delete previously defined subnet pools if you no longer use them.

To run a fleet, you need at least one subnet pool configured within a project.
{: remember}

1. Go to the Connectivity page:
    1. Select your project from the [Projects page in the Code Engine console](https://cloud.ibm.com/codeengine/projects){: external}.
    2. Click **Project settings** > **Connectivity** and navigate to the **Subnet pools** section to see a list of existing subnet pools.
2. Go to the row with the subnet pool that you want to remove and click the three dots row actions icon. Click **Delete**.
3. Confirm the deletion when prompted.

## Managing subnet pools by using the CLI
{: #working-with-subnetpools-cli}
{: cli}

### Before you begin
{: #working-with-subnetpools-prereqs-cli}
{: cli}

Before you can work with subnet pools using CLI commands, you must:

1. Log in into [IBM Cloud and target a region, account and resource group. Then select your Code Engine project. See [Getting started with the Code Engine CLI](https://cloud.ibm.com/docs/codeengine?topic=codeengine-cecli-getstart&format=markdown).
    ```txt
    ibmcloud login target -r REGION -c ACCOUNT_ID -g RESOURCE_GROUP
    ibmcloud ce project select -n PROJECT_NAME
    ```
    {: pre}

2. Install the VPC infrastructure plugin by running the following command:
   ```txt
   ibmcloud plugin install vpc-infrastructure
   ```
   {: pre}

For more information about VPC CLI commands, see the [VPC CLI reference page](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-reference&format=markdown).

### Gather subnet information for network placement
{: #working-with-subnetpools-gather-subnet-cli}
{: cli}

This step is required if you want to specify a subnet pool for network placement by providing the **CRN** of one or more VPC subnets.
{: note}

Run the commands to get the CRN of up to three subnets that you want your fleet workers to attach to. These subnets must reside in the same region as the Code Engine project you want to run your fleets in. In the output, find the  **CRN**, which has a format similar to the following: `crn:v1:bluemix:public:is:us-east-2:a/1af204bc1def56171eed1a8100b1cc121::subnet:1345-16e10cc-ba18-19ee-de1b0-1213aa1a41a0156`. These CRNs are referenced later in the subnet pool.

To list all subnets.

```txt
ibmcloud is subnets
```
{: pre}

To get the details of a single subnet.

```txt
ibmcloud is subnet <subnet_id>
```
{: pre}

### Gather security group information for each subnet (optional)
{: #working-with-subnetpools-gather-security-group-cli}
{: cli}

If you want to apply existing custom security groups to the subnets attached to your fleet workers, run the commands to get the CRN of all security groups for each subnet you found in the previous step. In the output for each security group, find the **CRN**, which has the following format: `crn:v1:bluemix:public:is:us-east:a/1af204bc1def56171eed1a8100b1cc121::security-group:6789-16e10cc-ba18-19ee-de1b0-1213aa1a41a0156`. These CRNs are referenced later in the subnet pool. If you do not specify a security group, the default security group of the VPC is used.

To list all security groups

```txt
ibmcloud is sgs
```
{: pre}

To get the details of a single security group.

```txt
ibmcloud is sg <securitygroup_id>
```
{: pre}

### Adding a subnet pool
{: #add-subnetpool-cli}
{: cli}

For Code Engine `connectivity subnetpool` CLI commands, you can specify
the `--name`, `--subnet-crn`, and optionally `--security-group-crn` options to configure subnet pools.
Follow these guidelines:

* Do not use duplicate `--name` values within a project.
* Do not use duplicate `--subnet-crn` values within one subnet pool.

1. Select your Code Engine project. For example:

    ```txt
    ibmcloud ce project select --name myproject
    ```
    {: pre}

2. Create a subnet pool by specifying the `--name`, `--subnet-crn`, and optionally `--security-group-crn` options. The `--subnet-crn` and `--security-group-crn` options can be specified multiple times. To correlate `--security-group-crn` values with their `--subnet-crn` value, use an arbitrary identifier as key. Refer to this example, which uses keys `S1` and `IDx`:

    ```txt
    ibmcloud ce connectivity subnetpool create --name my-other-pool \
        --subnet-crn S1=crn:v1:bluemix:public:is:eu-de-3:a/abcdefabcdefabcdefabcd1234567890::subnet:1a1a-2b2b2b2b-3c3c-4d4d-5e5e-6f6f6f6f6f21 \
        --security-group-crn S1=crn:v1:bluemix:public:is:eu-de:a/abcdefabcdefabcdefabcd1234567890::security-group:2b2b-3c3c3c3c-4d4d-5e5e-6f6f-7g7g7g7g7g7g \
        --subnet-crn IDx=crn:v1:bluemix:public:is:eu-de-3:a/abcdefabcdefabcdefabcd1234567890::subnet:1a1a-2b2b2b2b-3c3c-4d4d-5e5e-6f6f6f6f6f22 \
        --security-group-crn IDx=crn:v1:bluemix:public:is:eu-de:a/abcdefabcdefabcdefabcd1234567890::security-group:2b2b-3c3c3c3c-4d4d-5e5e-6f6f-7g7g7g7g7g7g \
        --security-group-crn IDx=crn:v1:bluemix:public:is:eu-de:a/abcdefabcdefabcdefabcd1234567890::security-group:2b2b-3c3c3c3c-4d4d-5e5e-6f6f-7g7g7g7g7g8h
    ```
    {: pre}

### Showing existing subnet pools
{: #show-subnetpools-cli}
{: cli}

To show a specific subnet pool, specify the name or ID. For example:

```txt
ibmcloud ce connectivity subnetpool get --name my-other-pool
```
{: pre}

To show all subnet pools, run:

```txt
ibmcloud ce connectivity subnetpool list
```
{: pre}

### Deleting a subnet pool
{: #delete-subnetpool-cli}
{: cli}

You can delete previously defined subnet pools if you no longer use them.

To run a fleet, you need at least one subnet pool configured within a project.
{: remember}

To delete a subnet pool with confirmation, specify the name or ID. For example:

```txt
ibmcloud ce connectivity subnetpool delete --name my-other-pool
```
{: pre}

To delete a subnet pool forcefully (that is, without confirmation), run:

```txt
ibmcloud ce connectivity subnetpool delete --name my-other-pool --force
```
{: pre}