What OKE does differently, and what 3B needs as a result. The install itself is the same as on any cluster: follow the Helm installation guide. Building the cluster, load balancer, TLS, and DNS is yours to design and own.
Platform behavior described here was accurate in August 2026. Oracle changes OKE node images, Kubernetes versions, and defaults over time, and we update these guides as we learn of changes. The node compatibility check in the installation guide is always the authority for your own cluster. If something here is out of date, please tell Tines Support.
Cluster and node requirements
These are requirements rather than recommendations, so decide them before you build the cluster:
An Enhanced cluster with a managed node pool. 3B ships its own gVisor runtime, so it needs control over the node OS and containerd that virtual nodes don’t give you.
Oracle Linux 8 on x86_64 (an AMD E-series shape). 3B images and the sandbox are amd64-only, so Ampere shapes will not run it.
Kubernetes 1.33 or newer for the node pool. 3B’s
apiandworkerpods run withhostUsers: falsefor gVisor sandbox isolation, which needs containerd 2.x and a kernel of 6.3 or newer. The OL8 node images provide both from that version onward.
Verify it on your actual nodes with the node compatibility check in the installation guide before installing anything else.
If pods start but later fail under load with “too many open user namespaces”, the per-node limit is too low for the sandbox churn. The chart ships a DaemonSet that raises it:
usernsbox: enabled: true
Load balancing
Route to the chart’s nginx service on port 80 and nothing else. It host-routes all four hostnames internally, so one load balancer covers the whole deployment, and you need no ingress controller at all.
On OKE a Kubernetes Service of type LoadBalancer is all it takes: OKE provisions an OCI load balancer that terminates TLS and forwards to nginx, with nothing extra for you to maintain. That’s what we suggest by default here.
If your platform standards call for a managed L7 ingress instead, the OCI Native Ingress Controller (available as a cluster add-on) and the Gateway API are both actively maintained and work fine. Avoid the community ingress-nginx controller for a new deployment: it reached end of life in March 2026 and receives no further security patches.
TLS
One ordering requirement is specific to OCI: if the load balancer terminates TLS from a Kubernetes secret, that secret must already exist when the service is created, or OCI rejects it with an sslConfiguration violation. Create the certificate secret before the load balancer, whether you issue certificates with cert-manager, the OCI Certificates service, or your own CA.
Whatever issues it, the certificate must cover all your hostnames in one SAN or wildcard certificate. Terminating at the chart’s nginx instead is equally supported. See TLS termination.
Storage
OKE’s default oci-bv StorageClass, backed by OCI Block Volume, satisfies the chart’s persistent volume claims with no configuration. See sizing for volume sizes.
Troubleshooting
apiorworkerpods stuck creating with aprocorrootfsmount error — the node image doesn’t support user namespaces. Move the node pool to Kubernetes 1.33 or newer and re-run the node compatibility check.“too many open user namespaces” under load — raise the per-node limit, for example with
usernsbox.enabled: true.Load balancer
EXTERNAL-IPstays<pending>— usually the cluster’s load balancer subnet isn’t public.Load balancer fails with an
sslConfigurationviolation — the TLS secret didn’t exist when the service was created.ImagePullBackOff— the pull secret is missing or its credentials are wrong.