--- name: openshift-edge-classic-nlb title: Isolating Classic NLBs to edge worker nodes description: In the following steps, you add the `dedicated=edge` label to worker nodes on each public or private VLAN in your cluster. This label is used to deploy your network load balancers (NLBs) to those worker nodes only. Both public and private NLBs can be deployed to edge worker nodes. last-updated: 2026-07-30 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/openshift?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. # Isolating Classic NLBs to edge worker nodes {: #edge-nlb-classic} [Classic]{: tag-classic-inf} In the following steps, you add the `dedicated=edge` label to worker nodes on each public or private VLAN in your cluster. This label is used to deploy your network load balancers (NLBs) to those worker nodes only. Both public and private NLBs can be deployed to edge worker nodes. {: shortdesc} If you plan to use an existing worker pool, the pool must span all zones in your cluster and have at least two worker nodes per zone. You can label the worker pool with `dedicated=edge` by using the [`ibmcloud oc worker-pool label set` command](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-cli&format=markdown#worker-pool-label-set-cli). {: note} ## Before you begin {: #edge-nlb-classic-prereqs} * Ensure that you have the following [IBM Cloud IAM roles](https://cloud.ibm.com/docs/openshift?topic=openshift-iam-platform-access-roles&format=markdown): * Any platform access role for the cluster * **Writer** or **Manager** service access role for all namespaces * [Access your Red Hat OpenShift cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-access_cluster&format=markdown). 1. Create a worker pool with the label `dedicated=edge` or add the label to one of your existing worker pools. * To create a worker pool you can use the `worker-pool create classic` [command](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-cli&format=markdown#worker-pool-create-classic-cli). ```sh ibmcloud oc worker-pool create classic --name POOL_NAME --cluster CLUSTER --flavor FLAVOR --size-per-zone WORKERS_PER_ZONE --hardware ISOLATION --label dedicated=edge ``` {: pre} * To label an existing worker pool, you can use the `worker-pool label set` [command](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-cli&format=markdown#worker-pool-label-set-cli). ```sh ibmcloud oc worker-pool label set --cluster CLUSTER --worker-pool POOL --label dedicated=edge ``` {: pre} 2. Verify that the worker pool and worker nodes have the `dedicated=edge` label. * To check the worker pool, run the `get` command. ```sh ibmcloud oc worker-pool get --cluster CLUSTER_NAME_OR_ID --worker-pool WORKER_POOL_NAME_OR_ID ``` {: pre} * To check individual worker nodes, review the **Labels** field of the output of the following command. ```sh oc describe node ``` {: pre} 1. Retrieve all existing NLBs in the cluster. In the output, note the **namespace** and **name** of each load balancer. ```sh oc get services --all-namespaces | grep LoadBalancer ``` {: pre} Example output: ```sh PORT(S) AGE router-default 80:31228/TCP,443:31655/TCP 4h54m LoadBalancer 172.21.71.79 169.46.17.2 ``` {: screen} 4. Using the output from the previous step, run the following command for each NLB. This command redeploys the NLB to an edge worker node. ```sh oc get service -n -o yaml | oc apply -f - ``` {: pre} Example output: ```sh service "router-default" configured ``` {: screen} 1. To verify that networking workloads are restricted to edge nodes, confirm that the load balancers are scheduled onto the edge nodes and are not scheduled onto non-edge nodes. * NLB pods 1. Confirm that the NLB pods are deployed to edge nodes. Search for the external IP address of the load balancer service that is listed in the output of the previous step. Replace the periods (`.`) with hyphens (`-`). In the following example for the `crc81nk5l10gfhdql4i3qg`, the NLB has an external IP address of `169.46.17.2`. ```sh oc describe nodes -l dedicated=edge | grep "169-46-17-2" ``` {: pre} Example output: ```sh ibm-system ibm-cloud-provider-ip-169-46-17-2-76fcb4965d-wz6dg 5m (0%) 0 (0%) 10Mi (0%) 0 (0%) ibm-system ibm-cloud-provider-ip-169-46-17-2-76fcb4965d-2z64r 5m (0%) 0 (0%) 10Mi (0%) 0 (0%) ``` {: screen} 1. Confirm that no NLB pods are deployed to non-edge nodes. Example for the `public-crc81nk5l10gfhdql4i3qg-nlb1` NLB that has an external IP address of `169.46.17.2`: ```sh oc describe nodes -l dedicated!=edge | grep "169-46-17-2" ``` {: pre} * If the NLB pods are correctly deployed to edge nodes, no NLB pods are returned. Your NLBs are successfully rescheduled onto only edge worker nodes. * If NLB pods are returned, continue to the next step. 1. If NLB pods are still deployed to non-edge nodes, you can delete the pods so that they redeploy to edge nodes. Delete only one pod at a time, and verify that the pod is rescheduled onto an edge node before you delete other pods. {: important} 1. Delete a pod. For example, if one of the `public-crc81nk5l10gfhdql4i3qg-alb1` NLB pods did not schedule to an edge node: ```sh oc delete pod ibm-cloud-provider-ip-169-46-17-2-76fcb4965d-wz6dg -n ibm-system ``` {: pre} 2. Verify that the pod is rescheduled onto an edge worker node. Rescheduling is automatic, but might take a few minutes. Example for the `public-crc81nk5l10gfhdql4i3qg-alb1` NLB that has an external IP address of `169.46.17.2`: ```sh oc describe nodes -l dedicated=edge | grep "169-46-17-2" ``` {: pre} Example output: ```sh ibm-system ibm-cloud-provider-ip-169-46-17-2-76fcb4965d-wz6dg 5m (0%) 0 (0%) 10Mi (0%) 0 (0%) ibm-system ibm-cloud-provider-ip-169-46-17-2-76fcb4965d-2z64r 5m (0%) 0 (0%) 10Mi (0%) 0 (0%) ``` {: screen} You labeled worker nodes in a worker pool with `dedicated=edge` and redeployed all the existing NLBs to the edge nodes. All subsequent NLBs that are added to the cluster are also deployed to an edge node in your edge worker pool. Next, prevent other [workloads from running on edge worker nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-edge-workload-prevent&format=markdown) and [block inbound traffic to NodePorts on worker nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-network_policies&format=markdown#block_ingress).