Tencent Cloud Foreign Currency Card Top-up Tencent Cloud VPC Subnet IP Exhaustion: CVM & Pod Creation Failures

Tencent Cloud Foreign Currency Card Top-up If your CVM or TKE Pods won’t create and the console shows errors related to subnets or ENIs, you’re likely out of private IPs in the target subnet. Below is a field-tested guide to diagnose quickly, fix safely, and plan capacity so it doesn’t happen again—plus the account and payment details that often block the “obvious” fixes.

Quick Diagnosis: Confirm It’s Subnet IP Exhaustion

• Console path for IP availability:
  • Tencent Cloud Console > VPC > Subnets > locate the subnet > check “Available IP addresses”. If it’s zero or very low, that’s your culprit.
• Typical creation error messages:
  • For CVM: “The subnet does not have enough available IP addresses.”
  • For TKE Pods (VPC-CNI mode): “Insufficient IP addresses in the selected subnet(s)” or scheduling stuck with events indicating IP allocation failures.
• Check if other services are consuming IPs:
  • Private CLB, NAT Gateway internal interfaces, TKE Pod IPs, secondary ENIs, database instances with private endpoints, and other appliances all consume IPs.
• Rule out ENI/IP-per-ENI quotas:
  • Even with free IPs in the subnet, nodes may fail to host more Pods if the instance type has reached its ENI or IP-per-ENI limit. Check the node instance type’s ENI limits in the CVM instance family documentation or in the console (CVM > Instances > instance details > Network).

Why This Happens on Tencent Cloud (What’s Different in Practice)

• Subnets are hard-bounded. You cannot resize a subnet’s CIDR. When it fills, you must create a new subnet or free addresses.
• Reserved IPs exist. Each subnet has a handful of reserved addresses; plan using the “Available IP addresses” shown in console, not the raw CIDR math.
• TKE networking mode matters:
  • VPC-CNI mode: Every Pod receives a VPC IP from configured subnets. High-density workloads consume large amounts of subnet IPs.
  • Global Router/Flannel mode: Pods use overlay IPs; the subnet IP consumption mostly comes from nodes, not Pods.
• ENI/IP-per-ENI limits: Pod density on a node is capped by how many secondary IPs the node’s ENIs can hold. Small instance types run out faster.
• Hidden consumers: Private CLB, NAT internal interfaces, Transit features, and certain managed services quietly occupy IPs in your subnets.

Immediate Fix Options (Choose What Fits Your Blast Radius and Change Window)

Situation	Fastest Mitigation	Risk/Notes
CVM creation fails due to subnet full	Create a new subnet in the same VPC and AZ; place new CVMs there	Safe and immediate; ensure NACL/SG rules and route tables align
TKE Pods pending due to VPC-CNI IP shortage	Add additional subnets to the cluster’s Pod IP pool	No node restart required; confirm Pod subnet list in TKE networking settings
Node-level ENI/IP limits reached	Use larger instance types for nodes or reduce max Pods per node	Requires node replacement or scaling; cost impact
Busy production with no subnet left	Temporarily switch to overlay mode for new workloads, or add a dedicated Pod subnet	Overlay changes routing; test service-to-service latency before switching
Mixed services share the same small subnet	Segment: create separate subnets for Pods, nodes, databases, and appliances	Reduces future contention; might require SG/NACL updates

Tencent Cloud Foreign Currency Card Top-up Runbook A: CVM Creation Fails Due to Subnet IP Exhaustion

1. Identify the AZ: Confirm which AZ you need for data locality and CLB/NAT placement. If the original subnet’s AZ is X, create the new subnet in AZ X for same-zone traffic symmetry.
2. Create a new subnet:
   • Console > VPC > Subnets > Create. Pick the same VPC and AZ, assign a sufficiently large CIDR (see sizing section below).
3. Attach routing and security controls:
   • Ensure the subnet’s route table matches your VPC routing expectations (NAT Gateway, peering, VPN/Direct Connect).
   • Review NACLs for allow rules aligned with your application ports.
4. Place new CVMs in the new subnet:
   • When launching CVM, choose the new subnet and appropriate security groups. If needed, attach existing SGs.
5. Migrate gradually:
   • For stateful services, drain traffic via CLB weight adjustments or maintenance windows before cutover.

Runbook B: TKE Pods Won’t Schedule Due to IP Exhaustion (VPC-CNI)

1. Confirm networking mode:
   • Console > TKE > Cluster > Basic Information > Networking. If the cluster uses VPC-CNI, Pods need VPC IPs.
2. Add subnets to the Pod IP pool:
   • Create one or more new subnets in the same VPC (and AZs where your nodes live).
   • In TKE, edit cluster networking or node pool settings to include these subnets for Pod allocation.
3. Tencent Cloud Foreign Currency Card Top-up Review node ENI/IP capacity:
   • If Pods still won’t schedule, check if nodes reached ENI/IP limits. If so, scale nodes with larger instance types or reduce max Pods per node.
4. Clear orphaned ENIs and IPs:
   • Occasionally, deleted nodes leave ENIs or IP allocations. In VPC > ENIs, release unused attachments after verifying no dependencies.
5. Rebalance:
   • Use a rolling approach: cordon/drain nodes with poor capacity, then uncordon after scaling or subnet assignment changes.

Sizing and Capacity Planning That Actually Works

Don’t guess. Use a quick calculation and add headroom for sudden scale.

For VPC-CNI Clusters

• Inputs to collect:
  • Planned nodes per AZ and instance types (for ENI/IP-per-ENI limits)
  • Max Pods per node (node pool setting)
  • DaemonSets and system Pods per node (monitoring, service mesh, CNI)
  • Other subnet consumers (CLB private, NAT internal, databases)
• Rough formula:
  • Pod IPs needed ≈ (Max Pods per node − system Pods per node) × number of nodes
  • Add a 25–40% buffer for bursts, blue/green deployments, and rolling upgrades.
  • Keep a separate subnet for nodes to avoid contention with Pods unless you have strict IP governance and capacity tooling.

For Overlay Mode (Global Router/Flannel)

• Subnet IPs needed ≈ node count + headroom + other consumers. Pods won’t consume VPC IPs directly, but check the effect on cross-node traffic and NAT egress.

Instance Type ENI/IP Limits

• Each CVM instance family lists:
  • Max ENIs per instance
  • Max private IPs per ENI
• Tencent Cloud Foreign Currency Card Top-up To deploy high-density Pods in VPC-CNI mode, pick instance types with higher ENI/IP capacities. Test with your addon mix; sidecars add up fast.

Example Planning Scenario

Goal: 60 Pods per node, 30 nodes in one AZ, 6 system Pods per node.

• Pod IPs: (60 − 6) × 30 = 1,620
• Buffer 30%: ~486
• Total for Pods: ~2,106 IPs
• Choose Pod subnets totaling at least this count, e.g., a /20 (~4,000 usable minus reserved, subject to console report) or multiple /22s across AZs.
• Keep nodes on their own /23 or larger to prevent starvation during upgrades.

Tencent Cloud Foreign Currency Card Top-up Account Purchasing, KYC, Funding, and Why They Block Technical Fixes

Cloud Account Purchasing

• Avoid third-party or gray-market accounts. Subnet, EIP, or CLB purchases often hit risk control barriers on such accounts, and support may refuse quota increases.
• Register an official Tencent Cloud International account for global regions. If you need Mainland China regions, real-name verification with local requirements applies and differs from International.

Identity Verification (KYC)

• Tencent Cloud Foreign Currency Card Top-up Personal: Government ID and facial verification; sometimes manual review if region or activity flags risk rules.
• Enterprise: Business registration documents, legal representative info, and contact domain matching corporate email. Enterprise verification speeds up quota adjustments for ENIs, EIPs, and CLBs.
• Tip: Open a ticket before large network changes (adding many subnets, EIPs, NAT) to pre-clear risk control.

Account Funding and Renewals

• Tencent Cloud Foreign Currency Card Top-up Prepay balances for subscription resources (e.g., monthly CVMs, CLB instances). For pay-as-you-go, ensure valid payment methods and spending alerts.
• Auto-renew production nodes and NAT/CLB. Expired nodes during a tight IP window cause cascading failures: Pods reschedule, IP reuse attempts fail, and services flap.

Payment Methods That Actually Work

• Credit cards: Visa/Mastercard generally accepted. 3-D Secure challenges can fail on headless corporate cards; arrange with your bank or use a card that supports online verification.
• PayPal: Regionally available and often stable for pay-as-you-go; however, large top-ups can be flagged. Split transactions or verify your PayPal business account.
• Wire transfer (enterprise): Best for larger balances and reduces chargeback risk. Requires lead time; not suitable for an immediate IP emergency unless you already maintain a float.
• Virtual/fintech cards: Frequently trigger fraud checks. During urgent scaling, they can stall your purchase at the worst moment.

Risk Control and Compliance Reviews

• Sudden spikes (many new subnets, CLBs, or EIPs) may trigger manual review. Plan change windows and open support tickets noting the reason (product launch, migration).
• Abuse screening: High outbound traffic from many Pod IPs behind NAT can trigger anti-abuse. Keep your NAT EIP ownership consistent and document traffic patterns in tickets if you expect spikes.

Account Usage Restrictions That Impact Networking

• Tencent Cloud Foreign Currency Card Top-up New accounts often have low default quotas for:
  • EIPs per region
  • CLB instances
  • ENIs per instance or per region
• Mainland China regions require real-name verification aligned with local regulations; International KYC is not enough.
• Some regions have stricter risk scoring; if your card or company is registered in a different geography than the resource region, expect extra checks.

Cost Implications of Each Fix

• Creating new subnets: Free. No charge for VPC/subnet objects.
• Switching from overlay to VPC-CNI or vice versa:
  • VPC-CNI: More Pod IPs means larger subnets, more NAT SNAT connections, and possibly more EIPs for throughput and connection limits.
  • Overlay: Fewer IPs, but potential cross-node overlay overhead. Measure latency/CPU costs.
• Scaling node sizes for more ENIs/IPs: Higher instance cost; may allow fewer nodes total, which can offset cost if utilization stays high.
• NAT/CLB:
  • More EIPs for NAT can distribute SNAT connections and improve reliability at additional cost.
  • Private CLB consumes subnet IPs; public CLB doesn’t consume subnet IPs the same way but has its own billing model.
• Cross-AZ patterns: If you spread Pods across multiple AZ-specific subnets, watch inter-AZ traffic charges and CLB billing differences.

Regional Differences That Trip Teams Up

• International vs Mainland China accounts: Different KYC and availability of regions. Don’t plan VPC-CNI subnets in Mainland regions with an International-only account.
• AZ parity: Some services or instance types are temporarily capacity-constrained per AZ. If a specific AZ subnet is full and the other AZs subnets are empty, consider cross-AZ node pools while evaluating cost and latency.
• NAT and CLB flavors differ slightly by region in supported features. Check service limits before assuming a one-size plan.

Case Study: Pod Subnet Exhaustion During a Product Launch

A SaaS team deployed TKE with VPC-CNI. They sized a single /24 subnet for Pods in one AZ and put 20 nodes with 40 Pods each (30 app Pods + 10 system/sidecars).

• Planned Pod IPs: ~600, leaving minimal headroom in a /24 once reserved IPs and overhead were considered.
• Launch day surge added a new service with 180 Pods and a blue/green upgrade. Pod scheduling failed, and rollouts stuck.
• Fix applied:
  • Created two new Pod subnets (/23 each) in the same AZ.
  • Updated TKE cluster to include the new subnets for Pod allocation.
  • Scaled out NAT with additional EIPs to avoid SNAT port pressure.
  • Opened a support ticket for ENI quota increase and pre-approved planned launch spikes.
• Tencent Cloud Foreign Currency Card Top-up Post-incident changes:
  • Split nodes and Pods into separate subnets.
  • Reduced max Pods per node to respect ENI/IP-per-ENI limits and improved scheduling predictability.
  • Added a staging subnet to support blue/green without starving production.

Common Mistakes and How to Avoid Them

• Using a small /26 or /27 for Pod-heavy clusters. Fix: Use at least /22 or larger for Pods, or multiple subnets per AZ with a buffer.
• Combining nodes, Pods, databases, and appliances in one subnet. Fix: Segment by function to prevent starvation.
• Ignoring ENI/IP-per-ENI limits on small instance types. Fix: Pick instance types that match your Pod density goals.
• Not accounting for system Pods, sidecars, and DaemonSets. Fix: Inventory all per-node Pods, not just app deployments.
• Letting orphaned ENIs accumulate after node terminations. Fix: Periodic audit in VPC > ENIs and automated cleanup scripts with tagging policies.
• Assuming you can “resize” a subnet CIDR. Fix: Plan multiple subnets per AZ from day one; migrate rather than resize.
• Forgetting NAT SNAT limits when thousands of Pods egress via one EIP. Fix: Distribute SNAT across multiple EIPs or NAT Gateways as needed.

Decision Guide: Which Networking Mode Should You Use?

Criterion	VPC-CNI	Overlay (Global Router/Flannel)
Pod-to-VPC integration	Direct IPs in VPC, easy security policies per Pod	Pods behind node IP; less granular VPC-level control
Subnet IP consumption	High; requires large subnets and careful IPAM	Low; mainly node IPs
ENI/IP quota pressure	High; node limits matter	Low
Egress via NAT	Many source IPs; distribute SNAT	Fewer source IPs; simpler SNAT planning
Operational complexity	Higher IPAM effort; clearer L3 visibility	Simpler IPAM; overlay performance considerations

Raising Quotas and Getting Fast Approvals

• Before a major scale event:
  • Open a ticket specifying: regions, AZs, target number of subnets, expected new ENIs, EIPs, CLBs, and date/time windows.
  • If on a personal account, consider enterprise verification for faster responses and higher default ceilings.
• Document use cases:
  • Provide architecture diagrams, expected traffic, and abuse-prevention steps (rate limiting, WAF, egress controls). This short-circuits many risk control queries.

Funding Playbook During an Incident

• Tencent Cloud Foreign Currency Card Top-up Immediate:
  • Check current balance and any pending payments. If a failed card charge blocks resource creation, switch to a verified backup method.
  • Reduce spend spikes: pause non-critical scale-outs until the new subnet is live.
• Next 24 hours:
  • Top up via wire transfer if you anticipate many EIPs/NAT/CLBs. Keep the receipt and attach to a support ticket to expedite crediting when possible.
  • Enable budget alerts with SMS/Email to avoid renewal misses during the recovery window.

Frequently Asked Questions

Q1: Can I expand a full subnet’s CIDR?

No. Create additional subnets in the same VPC and migrate or add new workloads there.

Tencent Cloud Foreign Currency Card Top-up Q2: How do I make TKE use the new subnets for Pods?

Edit the cluster’s networking or node pool settings to include the new subnets in the Pod IP allocation list. Ensure the subnets are in the same VPC and AZs as your nodes.

Q3: We still have free IPs, but Pods won’t schedule. Why?

Likely ENI/IP-per-ENI limits on the node instance type. Either reduce max Pods per node, switch to larger node types, or add nodes to spread ENI/IP usage.

Q4: Do EIPs consume subnet IPs?

No. EIPs are public addresses. However, private CLBs and NAT internal interfaces do consume VPC subnet IPs. Always account for these.

Q5: Is there a recommended subnet size for Pod-heavy clusters?

Common practice is at least /22 per AZ for Pods when using VPC-CNI, or multiple /23 subnets with ~30% headroom. Validate against your Pod density and node instance limits.

Q6: We use a virtual corporate card and see failed payments when adding subnets/EIPs. What should we do?

Switch to a primary corporate card with 3-D Secure, or pre-fund via wire transfer. Virtual cards are frequently flagged by risk control during burst purchases.

Q7: Do new accounts have hidden caps?

Yes. Default quotas for EIPs, CLBs, and ENIs may be low. File quota increase requests with business justification, preferably under an enterprise-verified account.

Q8: Can I move existing IPs or “free up” addresses quickly?

Terminate unused ENIs, private CLBs, or idle instances. Avoid drastic deletions; verify dependencies first. For immediate relief, new subnets are safer.

Q9: Does switching to overlay mode solve IP exhaustion?

It reduces Pod IP pressure but introduces overlay trade-offs. Test performance and visibility impacts; don’t switch during a high-risk window without staging.

Q10: Why did support ask for more documents when I tried to add many EIPs?

Risk control checks large-scale IP requests. Provide company verification, architecture description, and intended use to speed approvals.

Operational Checklist for the Next Quarter

• Tag subnets by purpose: pod-az1, nodes-az1, db-az1, appliances-az1.
• Set alerts when subnet available IPs drop below 20%.
• Align node instance types with target Pod density; review ENI/IP limits quarterly.
• Pre-approve quotas for EIPs, CLBs, and ENIs before marketing events.
• Keep two payment methods and a pre-funded balance for emergency scaling.
• Run quarterly cleanup of orphaned ENIs and stale private CLBs.

If You’re Starting Fresh: A Minimal, Resilient Design

• Per AZ:
  • 1 large Pod subnet (or multiple medium subnets) dedicated to VPC-CNI Pods.
  • 1 dedicated node subnet.
  • 1 small subnet for appliances (private CLB, NAT internal, bastion).
• Separate security groups for nodes vs Pods vs databases.
• Budget for at least 30% free IPs at steady state.
• Document the ENI/IP-per-ENI selection criteria for node instance families.
• Have a tested runbook for adding subnets and updating TKE Pod subnet lists.

Closing Notes You Can Act On Today

• Check “Available IP addresses” for your busiest subnets right now; if below 25%, schedule expansion.
• List your node instance types and their ENI/IP-per-ENI limits; compare with current max Pods per node.
• Prepare a quota increase ticket template with business justification and diagrams so you can file it in minutes, not hours, during incidents.
• Add a secondary payment method and enable billing alerts to prevent funding-related deployment failures.