---
name: containers-edge-vpc-lb
title: Isolating network workloads to edge nodes in VPC clusters
description: Add the `dedicated=edge` label to worker nodes in your cluster. The labels ensure that load balancers are deployed to those worker nodes only. Note that router pods for Ingress controllers and routers are not deployed to edge nodes and remain on non-edge worker nodes.
last-updated: 2026-07-30
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/containers?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Isolating network workloads to edge nodes in VPC clusters
{: #edge-vpc-workloads}

Add the `dedicated=edge` label to worker nodes in your cluster. The labels ensure that load balancers are deployed to those worker nodes only. Note that router pods for Ingress controllers and routers are not deployed to edge nodes and remain on non-edge worker nodes.

## Prerequisites
{: #edge-vpc-workloads-pre}

- Ensure that you have the following IBM Cloud IAM roles:
    - Any platform access role for the cluster
    - **Writer** or **Manager** service access role for all namespaces
- Access to your Red Hat OpenShift cluster from the CLI.

## Isolating workloads to edge nodes
{: #edge-vpc-workloads-steps}

1. Create a worker pool with the label `dedicated=edge` or add the label to one of your existing worker pools.
    * To create a VPC worker pool, you can use the `worker-pool create vpc-gen2` [command](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-cli&format=markdown#worker-pool-create-vpc-gen2-cli).
        ```sh
        ibmcloud oc worker-pool create vpc-gen2 --name POOL_NAME --cluster CLUSTER --flavor FLAVOR --size-per-zone WORKERS_PER_ZONE --hardware ISOLATION --label dedicated=edge
        ```
        {: pre}

    * To label an existing worker pool, you can use the `worker-pool label set` [command](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-cli&format=markdown#worker-pool-label-set-cli).
        ```sh
        ibmcloud oc worker-pool label set --cluster CLUSTER --worker-pool POOL --label dedicated=edge
        ```
        {: pre}

1. Verify that the worker pool and worker nodes have the `dedicated=edge` label.
    * To check the worker pool, run the `get` command.
        ```sh
        ibmcloud ks worker-pool get --cluster CLUSTER_NAME_OR_ID --worker-pool WORKER_POOL_NAME_OR_ID
        ```
        {: pre}

    * To check individual worker nodes, review the **Labels** field of the output of the following command.
        ```sh
        kubectl describe node <worker_node_private_IP>
        ```
        {: pre}

1. Refresh your cluster master to trigger an update to your VPC load balancer member pool.
    ```sh
    ibmcloud ks cluster master refresh --cluster CLUSTER_NAME_OR_ID
    ```
    {: pre}


## Next steps
{: #edge-workloads-vpc-next}



[Isolate Ingress resources to edge worker nodes](https://cloud.ibm.com/docs/containers?topic=containers-edge&format=markdown#edge).