Container Engine for Kubernetes

Oracle Cloud Infrastructure Container Engine for Kubernetes (OKE) is a managed Kubernetes service that simplifies the operations of enterprise-grade Kubernetes at scale. It reduces the time, cost, and effort needed to manage the complexities of the Kubernetes infrastructure. Container Engine for Kubernetes lets you deploy Kubernetes clusters and ensure reliable operations for both the control plane and the worker nodes with automatic scaling, upgrades, and security patching. Additionally, OKE provides a fully serverless Kubernetes experience with virtual nodes.

Oracle Engine for Kubernetes video
Oracle Container Engine for Kubernetes (OKE) (2:31)

OKE features

Operations

Serverless Kubernetes with virtual nodes

Virtual nodes provide a serverless Kubernetes experience to run containerized applications at scale without spending additional resources on managing, scaling, upgrading, and troubleshooting the infrastructure of your clusters.

Virtual nodes provide the abstraction of regular nodes to Kubernetes, delivering granular pod elasticity with per-pod pricing. You can scale your deployments without taking into consideration the cluster's capacity, simplifying the execution of scalable workloads, such as high-traffic web applications and data-processing jobs.

Managed nodes

Managed nodes are worker nodes created within a customer's tenancy and operated with shared responsibility between OKE and the customer. Customers can define the desired specifications for their worker node pools, and OKE streamlines the provisioning of these nodes. OKE offers features for automating and simplifying key ongoing operations for these worker nodes with on-demand cycling to automate updating worker nodes, self-healing of worker nodes upon detection of failure, autoscaling, and more. Managed nodes are suitable for customers who need worker nodes’ configuration or compute shapes that are not supported by virtual nodes.

Self-managed nodes

Self-managed nodes offer even more customization and control for running containerized workloads on OKE that require unique compute configurations or advanced setup across the stack that are not supported with managed nodes. Customers can leverage specialized infrastructure options, including RDMA-enabled bare metal HPC/GPU, confidential computing, or other specialized use cases. Customers still benefit from a managed control plane, but must manage the worker nodes themselves, including Kubernetes upgrades and OS patching.

Automatic Kubernetes upgrades

Trigger an upgrade of your Kubernetes version with one click. Virtual nodes automatically deliver seamless, on-the-fly updates and security patches of your worker nodes and underlying infrastructure, while respecting the availability of your applications.

Highly available Kubernetes with autoscaling

Increase the availability of applications using clusters that span multiple availability domains (data centers) in any commercial region or in Oracle Cloud Infrastructure (OCI) Dedicated Region. Scale pods horizontally and vertically and scale clusters too.

On-demand node cycling

On-demand node cycling significantly streamlines the task of updating managed worker nodes in OKE clusters, eliminating the need for time-consuming, manual rotation of nodes or the development of custom solutions. The new feature makes updating Kubernetes and host OS versions a significantly easier and more efficient. Additionally, you can effortlessly modify various node pool properties, including SSH keys, boot volume size, custom cloud-init scripts, and more.

Add-ons lifecycle management

You can easily expand and control the functionality of your Kubernetes cluster with a curated collection of configurable add-on software that is fully managed by OCI. This software includes a growing portfolio of operational software deployed on your cluster as well related apps and operators, including CNI, CoreDNS, Kubernetes Dashboard, Oracle Database Operator, WebLogic operator, and more.

OKE manages the lifecycle for the add-on software—from the initial deployment and configuration through ongoing operations, such as upgrades, patching, scaling, rolling configuration changes, and more.

Users can select add-ons and customize configurations during the cluster creation, including disabling specific add-ons, specifying the add-on version, and opting out of automatic updates or of certain OCI-provided add-ons to use their own software.

Cluster observability

Monitor and secure these applications with tools from Oracle Cloud Infrastructure, Datadog, Aqua Security, and other partners.

Self-healing cluster nodes

When it detects node failures, Container Engine for Kubernetes automatically provisions new worker nodes to maintain cluster availability.

Safe node delete

Safely delete your worker nodes without disrupting your applications with automated cordon and drain options.

Financially backed SLA

The service level agreement (SLA) included with OKE clusters provides financial support for the uptime and availability of the OKE control plane and worker nodes. The coverage for the worker nodes is equivalent to what the OCI Compute SLA provides.

Container Marketplace

Within the OCI ecosystem, you can access Container Marketplace which introduces a wide range of prepackaged containerized solutions finely tuned for optimal performance on the OKE infrastructure. Effortlessly discover, deploy, and manage containerized applications and services, all seamlessly integrated into the OCI environment.

Made for developers

One-click cluster creation

Deploy Kubernetes clusters, including the underlying virtual cloud networks, internet gateways, and NAT gateways, with a single click.

Complete REST API and command line interface (CLI) support

Automate Kubernetes operations with web-based REST API and CLI for all actions, including Kubernetes cluster creation, scaling, and operations.

A comprehensive range of compute options

Optimize cost and performance by choosing the most appropriate compute shapes from a wide range of bare metal, high-performance computing (HPC), and virtual machine options. Manage GPU and Arm-based applications in a Kubernetes environment with OKE. Support multiarchitecture images with Oracle Container Image Registry.

Tight integration with other OCI services

Container Engine for Kubernetes seamlessly integrates with Oracle Cloud Infrastructure (OCI) services, including OCI Container Registry, DevOps CI/CD, networking, storage, and more. By leveraging Oracle Cloud Infrastructure (OCI) Service Operator for Kubernetes, you gain the ability to directly manage your OCI services from your OKE cluster.

With OCI Service Operator for Kubernetes, you can effortlessly create, manage, and establish connections with OCI resources, such as Autonomous Database and MySQL Database, using the Kubernetes API and tooling. Once you have installed OCI Service Operator for Kubernetes, you can perform actions on OCI resources through the Kubernetes API, eliminating the need for the OCI Console, CLI, or other developer tools.

Built on open source, works with your DevOps toolchain

Container Engine for Kubernetes is built on open standards and is fully conformant with open source upstream Kubernetes. This enables you to leverage ecosystem solutions and easily integrate with your dev tools, such as Argo CD, Gitlab, Jenkins, and others.


Security

Coming soon: Kubernetes governance with Oracle Cloud Guard

Oracle Cloud Guard offers out-of-the-box Kubernetes governance, delivering automated security and adherence to Kubernetes best practices when deploying resources on OKE. This is accomplished by automatically identifying configuration issues using policies curated by Cloud Guard, enabling you to effortlessly secure and maintain compliance on your OKE clusters.

Encryption

Encrypt Kubernetes secrets at-rest using the Key Management service.

Oracle always encrypts block volumes, boot volumes, and volume backups at rest using the Advanced Encryption Standard (AES) algorithm with 256-bit encryption. You can also manage the lifecycle of your own encryption keys using Oracle Cloud Infrastructure Vault.

Compliance

OCI Container Engine for Kubernetes complies with regulatory frameworks, such as HIPAA, PCI, and SOC 2.

Private Kubernetes clusters and Bastion

With private clusters, you can restrict access to the Kubernetes API endpoint to your on-premises network or a Bastion host, improving your security posture. To easily access fully private clusters, you can now use Oracle Cloud Infrastructure (OCI) Bastion.

Strong isolation at the pod level

Virtual nodes provide strong isolation to each Kubernetes pod. Pods do not share any underlying kernel, memory, or CPU resources. This pod-level isolation enables you to run untrusted workloads, multitenant applications, and sensitive data.

Network security groups for your Kubernetes clusters

Container Engine for Kubernetes supports network security groups (NSGs) for all cluster components. An NSG consists of a set of ingress and egress security rules that apply to virtual network interface cards (VNICs) in your virtual cloud network (VCN). With NSG, you can separate your virtual cloud network architecture from your cluster components’ security requirements.

Authentication and authorization

Control access and permissions using native OCI Identity and Access Management (IAM), Oracle Identity Cloud Service, and Kubernetes role-based access control. You can also configure OCI IAM multifactor authentication.

Workload Identity enables you to establish secure authentication at the pod level for OCI APIs and services. By implementing the principle of “least privilege” for your workloads, you can ensure users only have access to necessary resources. This enhances your security posture by minimizing the potential of security breaches or unauthorized access.

Container image scanning, signing, and verification

OKE supports container image scanning, signing, and verification so you can ensure that your application images are free of serious security vulnerabilities and that the integrity of the container images is preserved when deployed by enforcing image signing.

Audit the Kubernetes activity

All Kubernetes audit events are made available in the OCI Audit service.

Flexibility and performance

Build apps that work across on-premises and other clouds

Container Engine for Kubernetes uses unmodified open source Kubernetes that complies with the Cloud Native Computing Foundation (CNCF) and Open Container Initiative (OCI) standards for application portability.

Flexibility to use any tool for cluster management

Bring your own tools, or take advantage of Oracle's partners for security, federation, observability, and build automation.

End-to-end container lifecycle management

Manage containers’ lifecycle from start to finish. Build and test images with OCI DevOps, deploy from Container Registry, integrate with Autonomous Database, and more.

DevOps automation

Highly available Kubernetes with autoscaling

Increase the availability of applications using clusters that span multiple availability domains (data centers) in any commercial region or in Oracle Dedicated Region Cloud@Customer. Scale pods horizontally and vertically, and scale clusters too.

Streamline development and operations of Kubernetes clusters

Automate deployment of cloud native applications with Oracle Visual Builder Studio or any third-party tool. Monitor and secure these applications with tools from Oracle Cloud Infrastructure, Datadog, Aqua Security, and other partners.

Automatic Kubernetes upgrades

Easily and quickly upgrade container clusters, with zero downtime, to keep them up to date with the latest stable version of Kubernetes.

Self-healing cluster nodes

When it detects node failures, Container Engine for Kubernetes automatically provisions new worker nodes to maintain cluster availability.

Easy administration of worker nodes

Use the well-known, Docker-based container runtime for worker nodes, with full access via Secure Shell (SSH).


Elastic Kubernetes service for portability and flexibility

Build apps that work across on-premises and other clouds

OKE uses unmodified open source Kubernetes that complies with the Cloud Native Computing Foundation (CNCF) and Open Container Initiative (OCI) standards for application portability.

Flexibility to use any tool for cluster management

Bring your own tools, OCI cloud services, or take advantage of Oracle's partners for security, federation, observability, and build automation.

A comprehensive range of compute options

Optimize both cost and performance by choosing the most appropriate compute shapes from a wide range of bare metal, high-performance computing (HPC), and virtual machine options.

End-to-end container lifecycle management

Manage container lifecycles from start to finish. Build and test images with Visual Builder Studio, deploy from Registry, and integrate with Autonomous Database.


Kubernetes security and performance

Better price-performance than other providers

When compared to AWS, Oracle Cloud provides more than 3X better compute price-performance and 20X the IOPS for half the price.

Tight integration with infrastructure, Autonomous Database, and Oracle WebLogic Server

Container Engine for Kubernetes easily integrates with Oracle Cloud Infrastructure services, Autonomous Database using the Service Broker, and WebLogic Server using the WebLogic Operator.

Encryption and compliance

Encrypt Kubernetes secrets at-rest using the Key Management service, and stay in compliance with HIPAA, PCI, and SOC 2.

Private Kubernetes clusters and security

Leverage private Kubernetes clusters. Control access and permissions using native Identity and Access Management, Identity Cloud Service and Kubernetes Role-Based Access Control (RBAC).

“With OKE, we're able to quickly expand agentless scanning of workloads on OCI, which allows us to focus on delivering value rather than on infrastructure management. This focus has allowed us to grow exponentially in a short period of time, becoming one of the fastest-growing software companies ever.”

Oron Noah
Wiz, Director of Product Management

“We run billions of voice AI queries on OCI, using a mix of Kubernetes infrastructure with OKE, GPUs, HPC, and other services. We've seen a 50-60% performance boost compared to our previous cloud, along with 2x cost reduction – all while doubling our usage.”

Get started with Container Engine for Kubernetes

  • Deploy a simple containerized app using OKE managed nodes

    Deploy simple microservices that are packaged as Docker containers and communicate via a common API.


  • Deploy a cluster with virtual nodes

    OKE virtual nodes provide the easiest way to run your apps on Kubernetes—freeing yourself from the complexities of infrastructure management with a complete, serverless Kubernetes experience. Discover the best practices for effectively using OKE virtual nodes and simplify the deployment of an OKE cluster with a virtual node pool using the provided Terraform automation and reference architecture.


  • Patterns for optimizing your Kubernetes resources

    Discover how Tryg Insurance reduces their Kubernetes cloud costs by 50% by implementing dynamic right-sizing of Kubernetes for their large-scale environment.


March 20, 2023

Kubernetes at scale just got a lot easier with new Container Engine for Kubernetes enhancements

Mickey Boxell, Principal Product Manager, Oracle

Less than a decade old, Kubernetes has gone mainstream, seeing unprecedented growth in adoption, particularly in the last couple of years. Increasingly, customers are standardizing on Kubernetes and using Kubernetes for ETL jobs, pipelines, HPC workloads, and even databases—all running on Oracle Container Engine for Kubernetes (OKE).

Read the complete post

Kubernetes resources

Related Kubernetes products

Registry

Secure, standards-based service for working with container images

Functions

Serverless platform driven by events and APIs

DevOps CI/CD

Automate application delivery across build, test, and deployments

Resource Manager

Terraform-based cloud infrastructure automation

Get started with Oracle Container Engine for Kubernetes


Oracle Cloud Free Tier

Get 30 days of access to CI/CD tools, managed Terraform, telemetry, and more.


Architecture Center

Explore deployable reference architectures and solutions playbooks.


Oracle Cloud Native services

Empower app development with Kubernetes, Docker, serverless, APIs, and more.


Contact us

Reach our associates for sales, support, and other questions.