--- title: "TIR Kubernetes FAQ" description: "Short answers about TIR Kubernetes, from regions and versions to kubeconfig access, worker pools, autoscaling, load balancers, storage, billing, and deleting." content_type: "faq" product: "tir-kubernetes" platform: "TIR" url: "/tir/tir-kubernetes/faq/" --- # TIR Kubernetes FAQ For step-by-step fixes, see [Troubleshooting TIR Kubernetes](/tir/tir-kubernetes/troubleshooting/tir-kubernetes/). ## Choosing and creating a cluster ### What is TIR Kubernetes, and when should I use it instead of an instance? TIR Kubernetes is managed Kubernetes in a TIR project. E2E sets up and runs the control plane. You choose the Kubernetes version, the control plane's size and plan, the worker pools, and the VPC. You then work with the cluster through its kubeconfig and `kubectl`. Choose it to run containerised apps across several nodes. You get worker pools you can resize or autoscale, Services on public addresses, and volumes that keep their data. For work on one machine, see [TIR Instance](/tir/tir-instance/). For an overview, see [TIR Kubernetes](/tir/tir-kubernetes/). ### In which regions can I run a cluster? Delhi and Chennai. A cluster belongs to one project and the region you create it in. You see the clusters of the project and region you have selected. See [Create a Kubernetes cluster](/tir/tir-kubernetes/how-to/create-a-cluster/). ### What do I need before I create a cluster? An **Active** VPC with a subnet in the same project and region, and permission to create Kubernetes clusters. On a prepaid account, you also need enough credit for every pool. To give Services public addresses later, you need at least one public reserved IP. See [Create a Kubernetes cluster](/tir/tir-kubernetes/how-to/create-a-cluster/). ### Should I choose one or three control plane nodes? Choose three for a cluster you depend on: three nodes give the control plane redundancy, and the cluster keeps its number of control plane nodes from then on. Three is the default. See [How a TIR Kubernetes cluster works](/tir/tir-kubernetes/concepts/how-a-cluster-works/). ### Which Kubernetes versions can I choose? You choose from the versions offered when you create the cluster. The **Kubernetes version** list on the create form shows them, newest first, with the newest selected. See [Create a Kubernetes cluster](/tir/tir-kubernetes/how-to/create-a-cluster/). ### How do I upgrade my cluster to a newer Kubernetes version? A cluster keeps the Kubernetes version you create it with; it cannot be upgraded in place. To run a newer version, create a new cluster with it and move your workloads across. See [Create a Kubernetes cluster](/tir/tir-kubernetes/how-to/create-a-cluster/). ### Can I change a cluster's VPC after I create it? No. You choose the VPC when you create the cluster, and the cluster cannot move to another VPC later. See [Create a Kubernetes cluster](/tir/tir-kubernetes/how-to/create-a-cluster/). ### What stays fixed after I create a cluster? The Kubernetes version, the VPC, and the control plane's node count, plan, and commitment policy cannot be changed once the cluster exists. Worker pools stay flexible: you can add, resize, autoscale, and delete them while the cluster is **Ready**, except that a committed pool keeps its size until its term ends. See [Create a Kubernetes cluster](/tir/tir-kubernetes/how-to/create-a-cluster/). ### Can I choose the pod and Service address ranges? No. Every cluster uses `172.30.0.0/16` for pods and `172.31.0.0/16` for Services, so keep your VPC ranges, and the networks you route to, clear of them. See [How a TIR Kubernetes cluster works](/tir/tir-kubernetes/concepts/how-a-cluster-works/). ### Can I install a different network plugin or choose add-ons? No. Cilium is the network plugin on every cluster, managed by the platform, and installing a second one breaks networking. The platform also chooses and installs the add-ons. See [How a TIR Kubernetes cluster works](/tir/tir-kubernetes/concepts/how-a-cluster-works/). ### What happens to my cluster if my free credit runs out? On an account that runs on unverified free credit, TIR deletes the cluster if the account's credits become negative. You accept this in a confirmation when you create the cluster. See [Create a Kubernetes cluster](/tir/tir-kubernetes/how-to/create-a-cluster/#create-the-cluster). ## Access and connecting ### Can I SSH into the nodes of my cluster? No. You manage the cluster with its kubeconfig and the Kubernetes API, through `kubectl`. See [Connect to a Kubernetes cluster](/tir/tir-kubernetes/how-to/connect-to-a-cluster/). ### When can I download the kubeconfig, and who can download it? Once the cluster reaches **Worker Joined** or **Ready**. Anyone with permission to read Kubernetes in the project can download it. **Download kubeconfig** is in the details page header and in the list's **Actions** menu. See [Connect to a Kubernetes cluster](/tir/tir-kubernetes/how-to/connect-to-a-cluster/). ### Can I rotate or revoke a kubeconfig? No. The kubeconfig gives full administrative access to the cluster, so keep it as you would a private key. If it leaks, delete the cluster and create a new one. Copy your data out first, because deleting removes the volumes, and a committed term's upfront charge is not refunded. See [Delete a Kubernetes cluster](/tir/tir-kubernetes/how-to/delete-a-cluster/). ### Which port does the cluster's API server use? Port 6443, on a public address that the kubeconfig points at, so `kubectl` reaches it over the internet from your own computer. A firewall between your computer and the cluster must allow outbound connections on port 6443. See [Troubleshooting TIR Kubernetes](/tir/tir-kubernetes/troubleshooting/tir-kubernetes/#kubectl-cannot-connect-to-the-cluster). ### Why do I not see Create Cluster, or why is a button unavailable? Buttons follow your role and the cluster's status. Your role decides which buttons you see, and the status decides which of them are available. Hold the pointer over a button that the status blocks to see why. For example, worker pools change only while the cluster is **Ready** or **Worker Joined**. See [A button is missing or unavailable](/tir/tir-kubernetes/troubleshooting/tir-kubernetes/#a-button-is-missing-or-unavailable). ### Is there a security group setting for a cluster? No. The cluster screens have no security group setting. See [How a TIR Kubernetes cluster works](/tir/tir-kubernetes/concepts/how-a-cluster-works/#the-vpc). ## Worker pools and scaling ### How many nodes can one worker pool have? From 1 to 25. A cluster needs at least one worker pool, and it can hold any number of pools. See [Add and delete worker pools](/tir/tir-kubernetes/how-to/manage-worker-pools/). ### Can I delete the last worker pool, or reuse a deleted pool's name? A cluster always keeps at least one worker pool, so its last pool stays until you delete the cluster. You can reuse the name of a pool you have deleted, because a name only has to differ from the pools the cluster has now. See [Add and delete worker pools](/tir/tir-kubernetes/how-to/manage-worker-pools/). ### Does a worker pool scale itself up and down with load? Yes, if you turn on autoscaling where the region offers CPU and memory autoscaling. **Autoscale** keeps an hourly pool between a minimum and a maximum number of nodes. It adds and removes nodes to stay near a CPU or memory use target. Committed pools keep a fixed size. See [Resize or autoscale a worker pool](/tir/tir-kubernetes/how-to/resize-or-autoscale-a-worker-pool/). ### Is CPU and memory autoscaling available in every region? Autoscaling needs CPU and memory readings from the region. Until a region has those readings, the **Autoscale** panel says "CPU and memory autoscaling are not available in this region yet. Use a static size instead.", and you set the pool to a fixed size. See [Resize or autoscale a worker pool](/tir/tir-kubernetes/how-to/resize-or-autoscale-a-worker-pool/). ### Can I move an autoscaled pool to a committed plan? Yes, once you give it a fixed size. Set the size with **Static resize**, which replaces the autoscaling, then select **Convert to Committed Plan**. See [Manage committed plans for worker pools](/tir/tir-kubernetes/how-to/manage-committed-plans/). ### Why can I not change the number of nodes in my committed pool? Because a committed pool's billing is fixed for its term: you paid upfront for its number of nodes. It keeps that size for the whole term, and becomes resizable once it moves to hourly billing at the end of a term. That happens with **Switch to hourly billing**, or with **Auto-renew the committed plan** when the account lacks the credit to renew. To add capacity during the term, add another pool. See [Billing options for TIR Kubernetes](/tir/tir-kubernetes/concepts/billing-options/). ### Does a failed worker pool take the cluster down? No. A pool that fails leaves the cluster **Ready** while another pool is serving. Add a new pool, then delete the failed one. See [Troubleshooting TIR Kubernetes](/tir/tir-kubernetes/troubleshooting/tir-kubernetes/#a-worker-pool-shows-failed). ### How many labels and taints can a worker pool have? Up to 20 labels and 10 taints a pool. Every key starts with `node.e2enetworks.com/`, and pods use the full key. Labels and taints are for worker pools only. See [Set node labels and taints](/tir/tir-kubernetes/how-to/set-node-labels-and-taints/). ### What happens if I change a pool's labels or taints with kubectl? TIR puts them back. It manages a pool's labels and taints on every node of the pool, so a label or taint removed or changed directly on a node is restored. Change them in **Manage labels and taints** on the **Node Pool** tab instead. See [Set node labels and taints](/tir/tir-kubernetes/how-to/set-node-labels-and-taints/#change-them-in-tir). ### Do my pods run on the control plane nodes? No. `kubectl get nodes` lists the control plane nodes beside the workers, but your workloads run on the worker pools only. See [How a TIR Kubernetes cluster works](/tir/tir-kubernetes/concepts/how-a-cluster-works/#the-control-plane). ## Workloads, networking, and storage ### How do I put my app on a public IP? Attach a public reserved IP to the cluster on its **LB IP Pool** tab, then create a Service of type LoadBalancer. The Service takes one of the attached addresses. See [Expose services with a load balancer](/tir/tir-kubernetes/how-to/expose-services-with-a-load-balancer/). ### Can I use a VPC IP for a LoadBalancer Service? No. The LB IP pool takes public reserved IPs only, and refuses a VPC IP. See [Expose services with a load balancer](/tir/tir-kubernetes/how-to/expose-services-with-a-load-balancer/). ### Can one reserved IP be used by two clusters? No. An address can be in one cluster's LB IP pool at a time, and TIR refuses an address that is already attached to another cluster. Detach it from that cluster first, or attach a different address. See [Expose services with a load balancer](/tir/tir-kubernetes/how-to/expose-services-with-a-load-balancer/#attach-reserved-ips-to-the-cluster). ### Can several sites share one public IP? Yes. Run an ingress controller, which routes incoming web traffic by hostname and path. Its one LoadBalancer Service holds one address, and any number of sites can share it. See [Set up an ingress controller with HTTPS](/tir/tir-kubernetes/how-to/set-up-an-ingress-controller/). ### Can pods on different nodes write to the same volume, or can I mount SFS in the cluster? No. The cluster's built-in storage offers ReadWriteOnce volumes only, which one node mounts at a time. TIR Shared File System and Parallel File System are not mounted into Kubernetes clusters. See [Use persistent volumes](/tir/tir-kubernetes/how-to/use-persistent-volumes/), which keep their data when a pod restarts. ### Can my pods pull private images from TIR Container Registry? Yes. Create a pull secret with the registry's address, username, and password, and name it under `imagePullSecrets` in the pod. See [Pull images from Container Registry](/tir/tir-kubernetes/how-to/pull-from-container-registry/). ### Where can I see CPU and memory use for my cluster's nodes? On the cluster's **Monitoring** tab, which is built in. It covers the nodes only: their health, CPU, memory, disk, and network. For pods and namespaces, run Prometheus and Grafana in the cluster. See [Monitor a Kubernetes cluster](/tir/tir-kubernetes/how-to/monitor-a-cluster/). ## Billing ### How is a cluster billed, and is the control plane charged? Per node pool. The control plane is a pool on its own plan, billed for its nodes from when it is ready until you delete the cluster. Each worker pool has its own plan, hourly or committed, and an hourly pool is billed for each node while it is up and ready. Prices are on [E2E's pricing page](https://www.e2enetworks.com/pricing). See [Billing options for TIR Kubernetes](/tir/tir-kubernetes/concepts/billing-options/). ### Am I charged for pods and Services? No. Only the nodes are billed, and the pods, Services, and jobs you run on them are included. See [Billing options for TIR Kubernetes](/tir/tir-kubernetes/concepts/billing-options/). ### Does a failed cluster cost anything? Yes. A **Failed** cluster stops billing its worker pools, but its control plane is billed until you delete the cluster. See [Delete a Kubernetes cluster](/tir/tir-kubernetes/how-to/delete-a-cluster/). ### Can I move an hourly pool to a committed plan, and what happens at the end of the term? Yes. A **Ready** hourly pool can move to a committed plan, which charges the whole term upfront. When the term ends, the pool's commitment policy decides what happens. The pool either renews for another term, if the account has enough credit, or moves to hourly billing. You can change the policy during the term. See [Manage committed plans for worker pools](/tir/tir-kubernetes/how-to/manage-committed-plans/). ### Do I get a refund if I delete a committed pool early? No. A committed term is paid upfront, and it is not refunded, even if you delete the pool or the cluster before the term ends. See [Billing options for TIR Kubernetes](/tir/tir-kubernetes/concepts/billing-options/). ## Failures and deleting ### How long does it take to create a cluster? Usually 10 to 30 minutes. A cluster whose provisioning hits a problem stops at **Failed** instead of waiting indefinitely. See [Troubleshooting TIR Kubernetes](/tir/tir-kubernetes/troubleshooting/tir-kubernetes/#the-cluster-stays-in-queued-cluster-provisioning-or-worker-joining). ### Can I retry a failed cluster? No. Delete the failed cluster and create a new one. See [Troubleshooting TIR Kubernetes](/tir/tir-kubernetes/troubleshooting/tir-kubernetes/#the-cluster-shows-failed). ### I deleted my cluster. Am I still charged, and what happens to my volumes? Hourly pools stop being billed when you ask to delete, and the control plane is billed until the deletion finishes. The cluster's volumes are deleted with it. A committed pool's term keeps running, and its upfront charge is final. Reserved IPs that were attached go back to the project and stay billed until you delete them. See [Delete a Kubernetes cluster](/tir/tir-kubernetes/how-to/delete-a-cluster/).