Networking

Your namespace gets a default private network at setup. You can view and, for some objects, manage networking directly through CRDs instead of touching underlying infrastructure (kube-ovn, Cilium, MetalLB) yourself.

CloudekaVPC — your private network

A CloudekaVPC (cvpc) represents one virtual network. A default one is created automatically for your namespace. You can create additional VPCs yourself.

kubectl get cvpc -n <your-namespace>

apiVersion: tenants.cloudeka.ai/v1alpha2
kind: CloudekaVPC
metadata:
  name: my-second-network
  namespace: <your-namespace>
spec:
  isolate: true   # true = no outbound NAT (fully isolated); false = outbound internet via NAT

After creation, check .status for the assigned CIDR and gateway:

kubectl get cvpc my-second-network -n <your-namespace> -o yaml

Full reference: cloudekavpc Billing type × charge type

CloudekaGuard — network policy

A CloudekaGuard (guard) is a firewall/network-policy rule for your namespace, expressed using the standard Cilium policy rule schema (endpointSelector, ingress, egress). You manage these yourself to control what can talk to what inside your namespace.

apiVersion: tenants.cloudeka.ai/v1alpha2
kind: CloudekaGuard
metadata:
  name: allow-frontend-to-backend
  namespace: <your-namespace>
spec:
  endpointSelector:
    matchLabels:
      app: backend
  ingress:
    - fromEndpoints:
        - matchLabels:
            app: frontend

Deleting a CloudekaGuard removes the underlying policy cleanly — no stray firewall rules are left behind.

Cilium policy language reference (rule shape, selectors, L3/L4/L7 fields) is the same as upstream Cilium CiliumNetworkPolicy — see Cilium's own documentation for the full schema.

Full reference: cloudekaguard

CloudekaFloatingIP — public IP exposure

You don't create this directly — it's created automatically when you make a Service of type: LoadBalancer (see Workload Rules). Use it to check your assigned external IP and its hourly cost:

kubectl get cfip -n <your-namespace>

Full reference: cloudekafloatingip

CloudekaIPPool — address pool capacity

View-only. Shows the address pools your Floating IPs are allocated from and their remaining capacity. Useful to understand why a LoadBalancer Service might be slow to get an IP (pool exhaustion is a platform-level concern — contact support if a pool shows used == capacity).

kubectl get cip -n <your-namespace>

Full reference: cloudekaippool

Summary

CRD	You manage it?	Purpose
CloudekaVPC	Yes	Private networks; isolate/NAT toggle
CloudekaGuard	Yes	Firewall / network policy (Cilium rules)
CloudekaFloatingIP	No (auto-created)	Public IP tracking + cost
CloudekaIPPool	No (view-only)	Address pool capacity