> For the complete documentation index, see [llms.txt](https://docs.cloudeka.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cloudeka.ai/guidance-for-enterprise/service-limit/networking.md).

# Networking

Your namespace gets a default private network at setup. You can view and, for some objects, manage networking directly through CRDs instead of touching underlying infrastructure (kube-ovn, Cilium, MetalLB) yourself.

## CloudekaVPC — your private network

A `CloudekaVPC` (`cvpc`) represents one virtual network. A `default` one is created automatically for your namespace. **You can create additional VPCs yourself.**

```bash
kubectl get cvpc -n <your-namespace>
```

```yaml
apiVersion: tenants.cloudeka.ai/v1alpha2
kind: CloudekaVPC
metadata:
  name: my-second-network
  namespace: <your-namespace>
spec:
  isolate: true   # true = no outbound NAT (fully isolated); false = outbound internet via NAT
```

After creation, check `.status` for the assigned CIDR and gateway:

```bash
kubectl get cvpc my-second-network -n <your-namespace> -o yaml
```

{% hint style="info" %}
Full reference: [cloudekavpc](/guidance-for-enterprise/service-limit/crds/cloudeka-vpc.md) Billing type × charge type
{% endhint %}

## CloudekaGuard — network policy

A `CloudekaGuard` (`guard`) is a firewall/network-policy rule for your namespace, expressed using the standard **Cilium policy rule schema** (`endpointSelector`, `ingress`, `egress`). **You manage these yourself** to control what can talk to what inside your namespace.

```yaml
apiVersion: tenants.cloudeka.ai/v1alpha2
kind: CloudekaGuard
metadata:
  name: allow-frontend-to-backend
  namespace: <your-namespace>
spec:
  endpointSelector:
    matchLabels:
      app: backend
  ingress:
    - fromEndpoints:
        - matchLabels:
            app: frontend
```

Deleting a `CloudekaGuard` removes the underlying policy cleanly — no stray firewall rules are left behind.

Cilium policy language reference (rule shape, selectors, L3/L4/L7 fields) is the same as upstream Cilium `CiliumNetworkPolicy` — see Cilium's own documentation for the full schema.

Full reference: [cloudekaguard](/guidance-for-enterprise/service-limit/crds/cloudeka-guard.md)

## CloudekaFloatingIP — public IP exposure

You don't create this directly — it's created automatically when you make a `Service` of `type: LoadBalancer` (see [Workload Rules](/guidance-for-enterprise/service-limit/workload-rules.md)). Use it to check your assigned external IP and its hourly cost:

```bash
kubectl get cfip -n <your-namespace>
```

Full reference: [cloudekafloatingip](/guidance-for-enterprise/service-limit/crds/cloudeka-floating-ip.md)

## CloudekaIPPool — address pool capacity

View-only. Shows the address pools your Floating IPs are allocated from and their remaining capacity. Useful to understand *why* a LoadBalancer Service might be slow to get an IP (pool exhaustion is a platform-level concern — contact support if a pool shows `used == capacity`).

```bash
kubectl get cip -n <your-namespace>
```

Full reference: [cloudekaippool](/guidance-for-enterprise/service-limit/crds/cloudeka-ippool.md)

## Summary

| CRD                | You manage it?    | Purpose                                  |
| ------------------ | ----------------- | ---------------------------------------- |
| CloudekaVPC        | Yes               | Private networks; isolate/NAT toggle     |
| CloudekaGuard      | Yes               | Firewall / network policy (Cilium rules) |
| CloudekaFloatingIP | No (auto-created) | Public IP tracking + cost                |
| CloudekaIPPool     | No (view-only)    | Address pool capacity                    |