> For the complete documentation index, see [llms.txt](https://docs.cloudeka.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cloudeka.ai/guidance-for-enterprise/service-limit/introduction.md).

# Introduction

On Service Portal Cloudeka, your organization/project pair is a single Kubernetes **namespace**, named:

```bash
loft-<organization>-v-<project>
```

For example, organization `acme` and project `inference-1` gives you namespace `loft-acme-v-inference-1`. All your workloads, storage, network objects, and billing records live inside this one namespace. You do not have access to other tenants' namespaces, and resources outside the `loft-*-v-*` naming pattern are not billed or quota-checked. Your namespace is created for you by the platform team, pre-configured with your billing model, prices, and quota. You do not create your own namespace.

## Getting `kubectl` access

Access is granted via a `CloudekaUser` object (provisioned by the platform team — see ([cloudekauser](/guidance-for-enterprise/service-limit/crds/cloudeka-user.md)). It results in:

* A ServiceAccount and a token Secret in your namespace.
* RBAC bindings (ClusterRole/Role) scoping what you can do.
* A rate limit and an expiry date on your access.

You'll receive a kubeconfig (or the token to build one) from the platform team. Once configured:

```bash
kubectl config use-context <your-context>
kubectl get pods -n loft-<organization>-v-<project>
```

If your access has expired, requests will fail authentication — contact platform support to renew (`spec.expiredAt` on your `CloudekaUser` object controls this; see the CRD reference).

## The request lifecycle, in short

### Create a workload resource

You `kubectl apply`/`create` a Pod, PVC, or LoadBalancer Service.

### Admission Check

An **admission webhook** intercepts the request before it's stored, computes the resource's hourly cost, and checks it against your quota/balance.

{% hint style="warning" %}
Reject, if you get an error back immediately (nothing is created)
{% endhint %}

{% hint style="success" %}
Accept is meaning the object is created normally.
{% endhint %}

### Billing resource creation

The platform creates a matching billing CRD:

* [`CloudekaResource`](/guidance-for-enterprise/service-limit/crds/cloudeka-resource.md) for Pods
* [`CloudekaResourceStorage`](/guidance-for-enterprise/service-limit/crds/cloudeka-resource-storage.md) for PVCs
* [`CloudekaFloatingIP`](/guidance-for-enterprise/service-limit/crds/cloudeka-floating-ip.md) for LoadBalancer Services

These show the live hourly charge.

### Hourly billing

Once per hour, the platform bills the hour that just ended against your balance.

### Daily charge accumulation

Once per day, a `CloudekaCharge` object accumulates that day's total. Full detail: [Quota & Limits](/guidance-for-enterprise/service-limit/quota-and-limits.md), [Workload Rules](/guidance-for-enterprise/service-limit/workload-rules.md), [Billing & Balance.](/guidance-for-enterprise/service-limit/billing-and-balance.md)

## `kubectl` cheat sheet

All CRDs below are **namespaced** — always pass `-n <your-namespace>`, or set your context's default namespace so you can drop the flag.

```bash
# See everything at once
kubectl get tenant,rquota,charge,cvpc -n loft-<organization>-v-<project>

# Your current balance and billing type
kubectl get tenant -n loft-<organization>-v-<project>

# Your quota allocation and live usage
kubectl get rquota -n loft-<organization>-v-<project> -o yaml

# Today's charge breakdown
kubectl get charge -n loft-<organization>-v-<project>

# Per-workload cost
kubectl get container -n loft-<organization>-v-<project>
kubectl get storage -n loft-<organization>-v-<project>
```

<table><thead><tr><th width="188.83343505859375">Short name</th><th>Full Kind</th></tr></thead><tbody><tr><td><code>tenant</code></td><td><a href="/pages/dbe5b51f614991216db5a3d5b67c431bf168602a">CloudekaTenant</a></td></tr><tr><td><code>rquota</code></td><td><a href="/pages/a045692745a7c817d336cd0b68dc39574791bb34">CloudekaResourceQuota</a></td></tr><tr><td><code>price</code></td><td><a href="/pages/3c91373717b41abf74dbb0aabf3f9c12d34d7c37">CloudekaPrice</a></td></tr><tr><td><code>container</code></td><td><a href="/pages/abcd659ab9ff1c7f7278ff170ba77ddfc1fd62e1">CloudekaResource</a></td></tr><tr><td><code>storage</code></td><td><a href="/pages/72d0e4c48fb05726bc9b456d9e880ffa7f27f702">CloudekaResourceStorage</a></td></tr><tr><td><code>charge</code></td><td><a href="/pages/eea552433ab391322f85980274284f497968138d">CloudekaCharge</a></td></tr><tr><td><code>topup</code></td><td><a href="/pages/034794b989aeb57fffef9e0d1179919af21f714e">CloudekaTopup</a></td></tr><tr><td><code>cfip</code></td><td><a href="/pages/40af3ce7bd7f01236942cfc0b041f35bd1f114ae">CloudekaFloatingIP</a></td></tr><tr><td><code>cip</code></td><td><a href="/pages/18f689b81fc94517cad8a340a01dc611e8f53b28">CloudekaIPPool</a></td></tr><tr><td><code>cvpc</code></td><td><a href="/pages/1a54df5389e2d58dfb4aed5e925fbd4ffce6c982">CloudekaVPC</a></td></tr><tr><td><code>guard</code></td><td><a href="/pages/849941f16a89d6b9471778a9b0def0ab889a6acd">CloudekaGuard</a></td></tr><tr><td><code>default</code></td><td><a href="/pages/c8f4674a575b06ca624f3ed2c247c97b294b04be">CloudekaDefault</a></td></tr><tr><td><code>user</code></td><td><a href="/pages/0843e7384564caeca441fa0b9457feadae497a8a">CloudekaUser</a></td></tr></tbody></table>

{% hint style="info" %}
**Tip:** `kubectl describe <short-name> <object-name> -n <namespace>` is usually more readable than `-o yaml` for a first look — it prints the same spec/status fields plus recent Events (useful when something didn't reconcile as expected).
{% endhint %}