Oracle Cloud Infrastructure Documentation

Deploying the WebLogic Kubernetes Operator Add-on

On Private Cloud Appliance, you can enable the WebLogic Kubernetes Operator add-on when you create a cluster or for an existing cluster.

Note

To bring the WebLogic Server to the running state, create additional rules in separate WebLogic Server security lists for the control plane and worker subnets, and for the pod subnet if you're using VCN-Native Pod Networking. See Specifiy Ports Required by WebLogic Server.

Add-on installation remains in Accepted state and waits until the cluster is in the Active state.

After the cluster is in the Active state, the WebLogic Kubernetes Operator is in Needs Attention state until a node pool is created for the cluster.

When a node-pool has been created for the cluster, the add-on is reconciled, and the add-on is in Ready state unless some other problem exists. See Add-on Reconciliation.

Note

Enabling the WebLogic Kubernetes Operator add-on on a VCN-Native Pod Networking cluster requires an entry for 169.254.169.254 in crio-noproxy node metadata for the nodepools where the add-on pods might be scheduled. See "Proxy settings" in the OCI CLI procedure in Creating an OKE Worker Node Pool.

Note

The WebLogic Kubernetes Operator add-on is not supported on GPU-only node pools.

Before you install the WebLogic Kubernetes Operator add-on on an existing cluster, check the cluster's certificate authority.

Check the Cluster's Certificate Authority

To install the WebLogic Kubernetes Operator add-on on an existing cluster that is using a certificate that's not the certificate that's specific to the Private Cloud Appliance, perform the following steps on the cluster where you want to install the add-on:

  1. Perform certificate rotation. See Updating the Certificate Authority Bundle.

  2. Perform any updates to node pool configuration that are required, such as boot volume size change or shape changes, for example.

  3. Cycle worker nodes as described in Node Cycling an OKE Node Pool.

  4. Enable or install the WebLogic Kubernetes Operator add-on as described in this procedure.

Install the Add-on

See Install an Add-on When You Create a Cluster or Install an Add-on for an Existing Cluster.

Specifiy Ports Required by WebLogic Server

This section describes additional security rules needed to specify ports that are required to bring the WebLogic Server to the running state.

Create additional rules in separate WebLogic Server security lists for the control plane and worker subnets, and for the pod subnet if you are using VCN-Native Pod Networking.

The following rules are for the control plane subnet. These rules are used for both Flannel Overlay networking and VCN-Native Pod Networking.

WebLogic Server Security Rules for the Control Plane Subnet

Compute Web UI property

OCI CLI property

Ingress Rule 1

  • Stateless: uncheck the box

  • Ingress CIDR: kmi_cidr

  • IP Protocol: TCP

    • Destination Port Range: 8084

  • Description: "This service port is the default for the WebLogic Server Console and is used to manage WebLogic Server domains."

Ingress Rule 1

  • isStateless: false

  • source: kmi_cidr

  • sourceType: CIDR_BLOCK

  • protocol: 6

  • tcpOptions

    destinationPortRange

    • max: 8084

    • min: 8084

  • description: "This service port is the default for the WebLogic Server Console and is used to manage WebLogic Server domains."

Ingress Rule 2

  • Stateless: uncheck the box

  • Ingress CIDR: worker_cidr

  • IP Protocol: UDP

    • Destination Port Range: 8472

  • Description: "WebLogic Server administration."

Ingress Rule 2

  • isStateless: false

  • source: worker_cidr

  • sourceType: CIDR_BLOCK

  • protocol: 17

  • udpOptions

    destinationPortRange

    • max: 8472

    • min: 8472

  • description: "WebLogic Server administration."

The following rules are for the worker subnet. These rules are used for both Flannel Overlay networking and VCN-Native Pod Networking.

WebLogic Server Security Rules for the Worker Subnet

Compute Web UI property

OCI CLI property

Ingress Rule 1

  • Stateless: uncheck the box

  • Ingress CIDR: kmi_cidr

  • IP Protocol: TCP

    • Destination Port Range: 8084

  • Description: "This service port is the default for the WebLogic Server Console and is used to manage WebLogic Server domains."

Ingress Rule 1

  • isStateless: false

  • source: kmi_cidr

  • sourceType: CIDR_BLOCK

  • protocol: 6

  • tcpOptions

    destinationPortRange

    • max: 8084

    • min: 8084

  • description: "This service port is the default for the WebLogic Server Console and is used to manage WebLogic Server domains."

Ingress Rule 2

  • Stateless: uncheck the box

  • Ingress CIDR: kmi_cidr

  • IP Protocol: UDP

    • Destination Port Range: 8472

  • Description: "WebLogic Server administration."

Ingress Rule 2

  • isStateless: false

  • source: kmi_cidr

  • sourceType: CIDR_BLOCK

  • protocol: 17

  • udpOptions

    destinationPortRange

    • max: 8472

    • min: 8472

  • description: "WebLogic Server administration."

Ingress Rule 3

  • Stateless: uncheck the box

  • Ingress CIDR: worker_cidr

  • IP Protocol: UDP

    • Destination Port Range: 7001-9000

  • Description: "These ports are used by WebLogic Server."

Ingress Rule 3

  • isStateless: false

  • source: worker_cidr

  • sourceType: CIDR_BLOCK

  • protocol: 17

  • udpOptions

    destinationPortRange

    • max: 9000

    • min: 7001

  • description: "These ports are used by WebLogic Server."

The following rules are for the pod subnet. These rules are used for VCN-Native Pod Networking.

WebLogic Server Security Rules for the Pod Subnet

Compute Web UI property

OCI CLI property

Ingress Rule 1

  • Stateless: uncheck the box

  • Ingress CIDR: kmi_cidr

  • IP Protocol: TCP

    • Destination Port Range: 8084

  • Description: "This service port is the default for the WebLogic Server Console and is used to manage WebLogic Server domains."

Ingress Rule 1

  • isStateless: false

  • source: kmi_cidr

  • sourceType: CIDR_BLOCK

  • protocol: 6

  • tcpOptions

    destinationPortRange

    • max: 8084

    • min: 8084

  • description: "This service port is the default for the WebLogic Server Console and is used to manage WebLogic Server domains."

Ingress Rule 2

  • Stateless: uncheck the box

  • Ingress CIDR: worker_cidr

  • IP Protocol: UDP

    • Destination Port Range: 8472

  • Description: "WebLogic Server administration."

Ingress Rule 2

  • isStateless: false

  • source: worker_cidr

  • sourceType: CIDR_BLOCK

  • protocol: 17

  • udpOptions

    destinationPortRange

    • max: 8472

    • min: 8472

  • description: "WebLogic Server administration."