IBM Kubernetes (IKS) Cluster Builder

ComputeIBM Cloud

Build IKS cluster configurations with worker pools, VPC zones, encryption, and monitoring integration.

Last verified: May 2026

IBM Kubernetes Service Configuration

Build IKS cluster configurations with worker pools, VPC zones, encryption, logging, and monitoring integration.

Required Fields

namekubeVersionproviderworkerPools

{
  "name": "prod-iks-cluster",
  "kubeVersion": "1.30",
  "provider": "vpc-gen2",
  "resourceGroup": "prod-resources",
  "vpcId": "vpc-prod-us-south",
  "podSubnet": "172.17.0.0/18",
  "serviceSubnet": "172.21.0.0/16",
  "workerPools": [
    {
      "name": "default",
      "flavor": "bx2.8x32",
      "diskEncryption": true,
      "zones": [
        { "id": "us-south-1", "subnetId": "subnet-worker-us-south-1", "workerCount": 2 },
        { "id": "us-south-2", "subnetId": "subnet-worker-us-south-2", "workerCount": 2 },
        { "id": "us-south-3", "subnetId": "subnet-worker-us-south-3", "workerCount": 2 }
      ],
      "labels": {
        "env": "production",
        "tier": "general"
      },
      "taints": []
    },
    {
      "name": "gpu-pool",
      "flavor": "gx3.16x80x1L4",
      "zones": [
        { "id": "us-south-1", "subnetId": "subnet-worker-us-south-1", "workerCount": 1 }
      ],
      "labels": { "workload": "gpu" },
      "taints": [
        { "key": "nvidia.com/gpu", "value": "true", "effect": "NoSchedule" }
      ]
    }
  ],
  "encryption": {
    "kmsInstance": "key-protect-prod",
    "crkId": "crk-worker-key-id"
  },
  "logging": {
    "enabled": true,
    "logAnalysisInstanceId": "log-instance-id"
  },
  "monitoring": {
    "enabled": true,
    "sysdigInstanceId": "monitor-instance-id"
  },
  "disablePublicServiceEndpoint": true
}

Generated Output

Output will appear here...

How This Tool Works

The builder collects cluster name, Kubernetes version, VPC, resource group, worker pool definitions (zone, profile, count, taints/labels), encryption config, and integrations (Cloud Monitoring, Log Analysis). It validates the Kubernetes version against currently-supported IKS versions, the worker profile against IKS-eligible profiles, and emits an `ibm_container_vpc_cluster` Terraform resource plus `ibm_container_vpc_worker_pool` resources for additional pools.

Overview

IBM Kubernetes Service (IKS) is IBM Cloud's managed Kubernetes offering, with worker pools spread across zones, integration with IBM Cloud IAM for access, and native logging/monitoring service hookups. The IBM Kubernetes Cluster Builder produces a complete cluster spec including worker pool sizes, zones, encryption (Key Protect/Hyper Protect Crypto Services), and monitoring integration. Output is `ibm_container_vpc_cluster` Terraform-ready.

How Engineers Use This

•Standing up a new IKS cluster across three zones for production workloads with key-protect encryption for etcd.
•Adding a GPU-enabled worker pool to an existing IKS cluster for machine learning workloads.
•Building a development cluster on smaller worker profiles in a single zone with reduced cost.
•Migrating an IKS Classic cluster configuration to IKS on VPC infrastructure with equivalent worker pools.

A Real Example

Your team's first IKS cluster runs everything on one auto-scaling pool. Every time the cluster autoscaler reclaims a node, CoreDNS pods migrate and DNS resolution stutters for 30-60 seconds across the cluster. You generate a revised cluster config with two pools (a tiny system pool of three fixed nodes for CoreDNS/ingress, an autoscaling app pool), apply through Terraform with `--auto-approve` after careful review, and DNS stability becomes a non-issue.

Tips & Gotchas

TIP

Always enable encryption with Key Protect or HPCS for production clusters. The cost overhead is minimal and the resulting evidence trail makes compliance audits dramatically easier.

TIP

Use separate worker pools for system workloads (CoreDNS, ingress, monitoring agents) and application workloads. A 'noisy neighbor' batch job in your app pool should never be able to take out cluster DNS.

Questions & Answers

What is the difference between IKS Classic and IKS on VPC?

IKS Classic runs on IBM's older bare-metal-and-virtual-machine infrastructure with its own networking model; IKS on VPC runs inside an IBM Cloud VPC with VPC-native networking, security groups, and integration with the modern VPC stack. IBM has been steering new clusters to IKS on VPC for years and the Classic offering is moving to maintenance mode. Pick IKS on VPC unless you have a specific reason to use Classic.

How do worker upgrades work?

Worker upgrades are rolling — IKS cordons and drains each worker, replaces it with a new one running the upgraded version, then moves to the next. PodDisruptionBudgets are respected. You can upgrade the master version separately from the workers, and workers can lag the master by up to two minor versions. Plan upgrades in 30-60-minute maintenance windows for large clusters.

Was this tool helpful?

Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.