Bring your own network (BYO VPC)
By default, the edge location onboarding script creates a new VPC/network, subnets, and security groups or firewall rules for each edge location, and edge nodes connect back to the main cluster through a public load balancer. Both defaults can be changed when you create the edge location:
- Bring your own network: reuse networking resources you already manage instead of letting OMNI create new ones.
- Private load balancer: expose the k0s control plane and Liqo gateway servers through an internal load balancer, keeping control plane and tunnel traffic off the public internet.
Both options are set at edge location creation via the Create edge location API.
Using an existing VPC or network
If you prefer to reuse networking resources you already manage (for example, a VPC that's already peered with your main cluster), provide their identifiers when creating the edge location. When provided, OMNI uses your resources instead of creating new ones.
| Cloud provider | Fields to provide | Notes |
|---|---|---|
| AWS | aws.networking.vpcId, aws.networking.subnetIds (map of zone names to subnet IDs), aws.networking.securityGroupId | All three are required together. |
| GCP | gcp.networking.networkName, gcp.networking.subnetName, gcp.networking.tags | All three are required together. tags are applied to the provisioned resources and the firewall rule. |
| OCI | oci.networking.vcnId, oci.networking.subnetId | Both are required together. |
NoteWhen you bring your own network, you're responsible for its routing, firewall rules, and security groups, including allowing the traffic described in the network requirements. OMNI's cloud resource reconciliation checks that the referenced resources exist; if they're deleted or misconfigured, the edge location transitions to a Failed status.
Private connectivity to the main cluster
By default, edge nodes connect back to the main cluster through public load balancers: one exposing the k0s control plane and one exposing the Liqo gateway servers. If your edge location's network is already privately connected to the main cluster's network, you can expose these services through internal (private) load balancers instead, so all control plane and tunnel traffic stays off the public internet.
With peering in place, the two networks behave as one routed private network: the edge nodes reach the internal load balancers in the main cluster's VPC directly, with no public endpoints involved.
To enable this, set the peering flag when creating the edge location, together with your existing network (see Using an existing VPC or network):
- AWS (EKS main cluster): set
aws.networking.vpcPeered: true(requiresaws.networking.vpcIdto be provided). - OCI: set
oci.networking.vcnPeered: true(requiresoci.networking.vcnIdto be provided).
WarningThe flag only switches the load balancer to internal; it does not create the network connectivity itself. Before enabling it, you must establish private connectivity between the edge location's VPC/VCN and the main cluster's VPC, for example using AWS VPC peering, OCI FastConnect, or GCP Cloud Interconnect. Without that connectivity in place, edge nodes won't be able to reach the internal load balancer and will fail to join.
Updated 4 days ago