Introduction

On Service Portal Cloudeka, your organization/project pair is a single Kubernetes namespace, named:

loft-<organization>-v-<project>

For example, organization acme and project inference-1 gives you namespace loft-acme-v-inference-1. All your workloads, storage, network objects, and billing records live inside this one namespace. You do not have access to other tenants' namespaces, and resources outside the loft-*-v-* naming pattern are not billed or quota-checked. Your namespace is created for you by the platform team, pre-configured with your billing model, prices, and quota. You do not create your own namespace.

Getting kubectl access

Access is granted via a CloudekaUser object (provisioned by the platform team — see (cloudekauser). It results in:

• A ServiceAccount and a token Secret in your namespace.

• RBAC bindings (ClusterRole/Role) scoping what you can do.

• A rate limit and an expiry date on your access.

You'll receive a kubeconfig (or the token to build one) from the platform team. Once configured:

kubectl config use-context <your-context>
kubectl get pods -n loft-<organization>-v-<project>

If your access has expired, requests will fail authentication — contact platform support to renew (spec.expiredAt on your CloudekaUser object controls this; see the CRD reference).

The request lifecycle, in short

Create a workload resource

You kubectl apply/create a Pod, PVC, or LoadBalancer Service.

Admission Check

An admission webhook intercepts the request before it's stored, computes the resource's hourly cost, and checks it against your quota/balance.

Reject, if you get an error back immediately (nothing is created)

Accept is meaning the object is created normally.

Billing resource creation

The platform creates a matching billing CRD:

• CloudekaResource for Pods

• CloudekaResourceStorage for PVCs

• CloudekaFloatingIP for LoadBalancer Services

These show the live hourly charge.

Hourly billing

Once per hour, the platform bills the hour that just ended against your balance.

Daily charge accumulation

Once per day, a CloudekaCharge object accumulates that day's total. Full detail: Quota & Limits, Workload Rules, Billing & Balance.

kubectl cheat sheet

All CRDs below are namespaced — always pass -n <your-namespace>, or set your context's default namespace so you can drop the flag.

# See everything at once
kubectl get tenant,rquota,charge,cvpc -n loft-<organization>-v-<project>

# Your current balance and billing type
kubectl get tenant -n loft-<organization>-v-<project>

# Your quota allocation and live usage
kubectl get rquota -n loft-<organization>-v-<project> -o yaml

# Today's charge breakdown
kubectl get charge -n loft-<organization>-v-<project>

# Per-workload cost
kubectl get container -n loft-<organization>-v-<project>
kubectl get storage -n loft-<organization>-v-<project>

Short name	Full Kind
tenant	CloudekaTenant
rquota	CloudekaResourceQuota
price	CloudekaPrice
container	CloudekaResource
storage	CloudekaResourceStorage
charge	CloudekaCharge
topup	CloudekaTopup
cfip	CloudekaFloatingIP
cip	CloudekaIPPool
cvpc	CloudekaVPC
guard	CloudekaGuard
default	CloudekaDefault
user	CloudekaUser

Tip: kubectl describe <short-name> <object-name> -n <namespace> is usually more readable than -o yaml for a first look — it prints the same spec/status fields plus recent Events (useful when something didn't reconcile as expected).