Docs

Volcengine Kubernetes Engine

Cluster network

Expanding cluster subnets

When you create a cluster, you need to select a virtual private network (VPC) and subnets for the cluster, such as the node network and the Pod network. As the cluster is used and expanded, IP addresses may be insufficient in the cluster subnets. This topic describes how to expand the subnets of a cluster by using a secondary CIDR block.

Background information

After the VPC and subnets of a cluster are created, you cannot modify the CIDR blocks of the networks. When IP addresses in the VPC of the cluster are insufficient or the CIDR block needs to be modified, you can only create a larger VPC to address the issue. In this case, the configured network features need to be configured again, and ECS instances need to be migrated between VPCs, which is costly.

Volcengine Kubernetes Engine (VKE) clusters allow you to use secondary CIDR blocks in VPCs. You can add a new secondary CIDR block to the original CIDR block and use the primary or secondary CIDR block to expand the subnets of a cluster.

Usage limits

The secondary CIDR block must be in the same CIDR block as the primary CIDR block of the target VPC. For example, if the primary CIDR block of the target VPC belongs to 192.168.0.0/16-/24, the secondary CIDR block must also belong to 192.168.0.0/16-/24, and cannot belong to 10.0.0.0/8-/24 or 172.16.0.0/12-/24.

If the primary CIDR block of the target VPC is already the largest CIDR block, such as 192.168.0.0/16, you cannot add a secondary CIDR block.

The secondary CIDR block cannot overlap with other CIDR blocks of the target VPC.

After a secondary CIDR block is added, it cannot be modified.

tip

For more details about secondary CIDR blocks, see Adding or deleting a secondary CIDR.

Procedure

Step 1: Create a secondary CIDR block

In the left navigation bar, click VPC.

In the VPC list on the right, find the target VPC and click Add Secondary CIDR Block in the Actions column.

Configure the secondary CIDR block.

Click Add to complete the configuration.

Step 2: Create a subnet

In the left navigation bar, click Subnet.

Click Create Subnet to create subnets in different availability zones by using the secondary CIDR block.

Step 3: Use the secondary CIDR block to expand cluster subnets

Warning

When you expand the subnet, the selected secondary CIDR block must not overlap with the Service CIDR block.

Expanding cluster subnets with a secondary CIDR block may restart kube-apiserver. We recommend that you perform the expansion during off-peak hours.

Expanding the node subnet

You can directly use a secondary CIDR block when you create or update a node pool to expand the node network. This topic uses the creation of a node pool as an example.

In the left navigation bar, click Cluster. On the page that appears, click the name of the target cluster.

In the left navigation bar of the cluster management page, click Nodes > Node pool.

Click Create node pool, configure the new node pool, and then select the created secondary CIDR block to expand the node subnet. For configuration details, see Creating node pools.

Expanding the pod subnet

In the left navigation bar, click Cluster.

Click the name of the target cluster, and in the left navigation bar, click Overview.

On the Overview tab, find Cluster network configuration, click Add under Pod subnets.

In the panel that appears, select the secondary CIDR block and click Confirm to expand the pod subnet.

Step 4: Check security groups

Normal communication between nodes and pods in the cluster is always important. After you expand the cluster subnet using a secondary CIDR block, we recommend that you check the security groups of the cluster to verify that the security groups allow traffic from the secondary CIDR block. The following content provides an example configuration. In your scenario, replace the source addresses and port numbers with your desired ones.

tip

In addition to the security group of the VKE cluster, you also need to confirm that the security groups of other services (for example, the vePFS service) accessed by the cluster allow the secondary CIDR.

In the left navigation bar, click Security Group. On the Security Group page, find the target security group.

Click the security group name to enter the details page. Click the Access rules tab, and on the Inbound rule sub-tab, confirm that the security group allows traffic from the newly added secondary CIDR block.

If traffic from the CIDR block is not allowed, click Add rule to add an inbound rule for the CIDR block. For configuration details, see Adding rules to a security group.

Last updated: 2026.07.24 14:51:36