--- name: containers-edge-classic-nlb title: Isolating Classic NLBs to edge worker nodes description: In the following steps, you add the `dedicated=edge` label to worker nodes on each public or private VLAN in your cluster. This label is used to deploy your network load balancers (NLBs) to those worker nodes only. Both public and private NLBs can be deployed to edge worker nodes. last-updated: 2026-07-30 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/containers?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. # Isolating Classic NLBs to edge worker nodes {: #edge-nlb-classic} [Classic]{: tag-classic-inf} In the following steps, you add the `dedicated=edge` label to worker nodes on each public or private VLAN in your cluster. This label is used to deploy your network load balancers (NLBs) to those worker nodes only. Both public and private NLBs can be deployed to edge worker nodes. {: shortdesc} If you plan to use an existing worker pool, the pool must span all zones in your cluster and have at least two worker nodes per zone. You can label the worker pool with `dedicated=edge` by using the [`ibmcloud ks worker-pool label set` command](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-cli&format=markdown#worker-pool-label-set-cli). {: note} ## Before you begin {: #edge-nlb-classic-prereqs} * Ensure that you have the following [IBM Cloud IAM roles](https://cloud.ibm.com/docs/containers?topic=containers-iam-platform-access-roles&format=markdown): * Any platform access role for the cluster * **Writer** or **Manager** service access role for all namespaces * [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster&format=markdown) 1. Create a worker pool with the label `dedicated=edge` or add the label to one of your existing worker pools. * To create a worker pool you can use the `worker-pool create classic` [command](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-cli&format=markdown#worker-pool-create-classic-cli). ```sh ibmcloud ks worker-pool create classic --name POOL_NAME --cluster CLUSTER --flavor FLAVOR --size-per-zone WORKERS_PER_ZONE --hardware ISOLATION --label dedicated=edge ``` {: pre} * To label an existing worker pool, you can use the `worker-pool label set` [command](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-cli&format=markdown#worker-pool-label-set-cli). ```sh ibmcloud ks worker-pool label set --cluster CLUSTER --worker-pool POOL --label dedicated=edge ``` {: pre} 2. Verify that the worker pool and worker nodes have the `dedicated=edge` label. * To check the worker pool, run the `get` command. ```sh ibmcloud ks worker-pool get --cluster CLUSTER_NAME_OR_ID --worker-pool WORKER_POOL_NAME_OR_ID ``` {: pre} * To check individual worker nodes, review the **Labels** field of the output of the following command. ```sh kubectl describe node ``` {: pre} 1. Retrieve all existing NLBs in the cluster. In the output, note the **namespace** and **name** of each load balancer. ```sh kubectl get services --all-namespaces | grep LoadBalancer ``` {: pre} Example output: ```sh kube-system private-crc81nk5l10gfhdql4i3qg-nlb1 LoadBalancer 172.21.233.160 10.216.23.123 80:31345/TCP,443:32630/TCP 8d kube-system public-crc81nk5l10gfhdql4i3qg-nlb1 LoadBalancer 172.21.190.18 169.46.17.2 80:31345/TCP,443:32630/TCP 8d ``` {: screen} 1. Using the output from the previous step, run the following command for each NLB. This command redeploys the NLB to an edge worker node. ```sh kubectl get service -n -o yaml | kubectl apply -f - ``` {: pre} Example output: ```sh service "private-crc81nk5l10gfhdql4i3qg-nlb1" configured service "public-crc81nk5l10gfhdql4i3qg-nlb1" configured ``` {: screen} 1. To verify that networking workloads are restricted to edge nodes, confirm that the load balancers are scheduled onto the edge nodes and are not scheduled onto non-edge nodes. * NLB pods 1. Confirm that the NLB pods are deployed to edge nodes. Search for the external IP address of the load balancer service that is listed in the output of the previous step. Replace the periods (`.`) with hyphens (`-`). In the following example for the `crc81nk5l10gfhdql4i3qg`, the NLB has an external IP address of `169.46.17.2`. ```sh kubectl describe nodes -l dedicated=edge | grep "169-46-17-2" ``` {: pre} Example output: ```sh ibm-system ibm-cloud-provider-ip-169-46-17-2-76fcb4965d-wz6dg 5m (0%) 0 (0%) 10Mi (0%) 0 (0%) ibm-system ibm-cloud-provider-ip-169-46-17-2-76fcb4965d-2z64r 5m (0%) 0 (0%) 10Mi (0%) 0 (0%) ``` {: screen} 2. Confirm that no NLB pods are deployed to non-edge nodes. Example for the `public-crc81nk5l10gfhdql4i3qg-nlb1` NLB that has an external IP address of `169.46.17.2`: ```sh kubectl describe nodes -l dedicated!=edge | grep "169-46-17-2" ``` {: pre} * If the NLB pods are correctly deployed to edge nodes, no NLB pods are returned. Your NLBs are successfully rescheduled onto only edge worker nodes. * If NLB pods are returned, continue to the next step. 1. If NLB pods are still deployed to non-edge nodes, you can delete the pods so that they redeploy to edge nodes. Delete only one pod at a time, and verify that the pod is rescheduled onto an edge node before you delete other pods. {: important} 1. Delete a pod. For example, if one of the `public-crc81nk5l10gfhdql4i3qg-alb1` NLB pods did not schedule to an edge node: ```sh kubectl delete pod ibm-cloud-provider-ip-169-46-17-2-76fcb4965d-wz6dg -n ibm-system ``` {: pre} 2. Verify that the pod is rescheduled onto an edge worker node. Rescheduling is automatic, but might take a few minutes. Example for the `public-crc81nk5l10gfhdql4i3qg-alb1` NLB that has an external IP address of `169.46.17.2`: ```sh kubectl describe nodes -l dedicated=edge | grep "169-46-17-2" ``` {: pre} Example output: ```sh ibm-system ibm-cloud-provider-ip-169-46-17-2-76fcb4965d-wz6dg 5m (0%) 0 (0%) 10Mi (0%) 0 (0%) ibm-system ibm-cloud-provider-ip-169-46-17-2-76fcb4965d-2z64r 5m (0%) 0 (0%) 10Mi (0%) 0 (0%) ``` {: screen} You labeled worker nodes in a worker pool with `dedicated=edge` and redeployed all the existing NLBs to the edge nodes. All subsequent NLBs that are added to the cluster are also deployed to an edge node in your edge worker pool. Next, prevent other [workloads from running on edge worker nodes](https://cloud.ibm.com/docs/containers?topic=containers-edge-workload-prevent&format=markdown) and [block inbound traffic to NodePorts on worker nodes](https://cloud.ibm.com/docs/containers?topic=containers-network_policies&format=markdown#block_ingress).