Help Center/ Cloud Container Engine/ User Guide/ Networking/ Container Networks/ VPC Network Settings/ Deleting the Container CIDR Block of a Cluster That Uses a VPC Network
Updated on 2026-06-16 GMT+08:00
View PDF
Share

Deleting the Container CIDR Block of a Cluster That Uses a VPC Network

When deploying a cluster that uses a VPC network, you may not fully consider future needs during pod subnet planning. As a result, the container CIDR block is not properly planned. Alternatively, if the configuration of a new pod subnet is incorrect, you need to modify or delete the configuration. This section describes how to delete a container CIDR block to adjust the container network configuration.

This function is only available in some regions and will be launched in more regions.

Notes and Constraints

Function constraints:

  • Cluster version requirements:
    • v1.28.15-r60 or later
    • v1.29.15-r20 or later
    • v1.30.14-r20 or later
    • v1.31.10-r20 or later
    • v1.32.6-r20 or later
    • v1.33.5-r10 or later
  • After a container CIDR block is deleted, some nodes may still use it. In this case, the security group rule of the container CIDR block is not deleted from the node's default security group. You need to manually delete it. For details, see How Do I Delete a Security Group Rule?
  • After a container CIDR block is deleted, some nodes may have been pre-allocated with pod CIDR blocks from the container CIDR block (for details, see Pod IP Address Management). You are advised to reset the nodes or smoothly migrate related services to other nodes and then delete the original nodes.

You can use the API to modify the container CIDR block of a cluster that uses a VPC network. For details, see Updating a Specified Cluster. For details about how to call the API, see Making an API Request.

PUT /api/v3/projects/{project_id}/clusters/{cluster_id}

Parameter

Description

project_id

Project ID. For details about how to obtain a project ID, see How to Obtain Parameters in the API URI.

cluster_id

Cluster ID. For details about how to obtain a cluster ID, see How to Obtain Parameters in the API URI.

Example of the request body for updating the container CIDR block of a cluster:

{"spec":{"containerNetwork":{"containercidrs":["10.0.0.0/16"]}}}

You can configure multiple container CIDR blocks for containercidrs and sort them by priority.

The container CIDR block with a higher priority is preferentially used to allocate container IP addresses. After no IP address is available in this container CIDR block, a container CIDR block with a lower priority is used.

FAQ

  • How Do I Check Whether There Is a Node That Still Uses a Specific Container CIDR Block?

    For example, if you have deleted the container CIDR block 172.16.0.0/16, run the following kubectl command to check whether there are any resources that use 172.16.0.0/16 in the nnc object:

    kubectl get nnc -o yaml | grep -A5 "yangtse.io/vpc-router-subnets" | grep "172.16.0.0/16" | wc -l

    If "0" is output, no node uses the container CIDR block.

  • How Do I Delete a Security Group Rule?

    Before deleting the security group rule of a container CIDR block, ensure that there is no node that uses this container CIDR block. Otherwise, network communication will be abnormal. For details about how to check whether there are residual nodes, see How Do I Check Whether There Is a Node That Still Uses a Specific Container CIDR Block?

    1. Go to the VPC console.
    2. In the navigation pane, choose Security Groups. Find the security group used by the cluster node. The security group is named in the format of {cluster-name}-cce-node-{five-digit-hash-value} by default.
    3. Click the security group name, locate the security group rule of the deleted CIDR block, and click Delete.

Parent Topic: VPC Network Settings