> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rafftechnologies.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Kubernetes networking

> VPC, CIDRs, the gateway, firewall, ingress and MetalLB

<sub>Updated August 24, 2026</sub>

Each cluster runs in its **own VPC**; nodes have private IPs only. The gateway holds the cluster's public IP and is the only way in or out.

## Address ranges

| Network                          | Default            | Notes                                                   |
| -------------------------------- | ------------------ | ------------------------------------------------------- |
| VPC (nodes)                      | auto-allocated /24 | one per cluster                                         |
| Pod network (`cluster_cidr`)     | `10.42.0.0/16`     | overridable at create: private IPv4, /12–/24            |
| Service network (`service_cidr`) | `10.43.0.0/16`     | same rules; must not overlap the pod network or the VPC |

## What the gateway forwards

The gateway load-balances at **TCP level** across your nodes:

* **6443** → the Kubernetes API (your kubeconfig endpoint `https://<cluster-id>.k8s.raffusercloud.com:6443`)
* **80 / 443** → into the cluster for ingress (Traefik, or App Hub exposes)
* **Custom TCP ports** → created when exposing an app over TCP (e.g. a database); manage them on the cluster page or [API](/api-reference/kubernetes/list-tcp-ports)
* Everything else is blocked by the **firewall**: the platform baseline already permits exactly 80, 443 and 6443 with nothing to configure. If you attach one of your own security groups instead, make sure it allows those three ports. Change the active firewall any time in **Settings → Firewall**:

<Frame>
  <img src="https://mintcdn.com/rafftechnologiesllc/pydLUQqixwIwkrCw/images/products/compute/kubernetes/firewall-settings.png?fit=max&auto=format&n=pydLUQqixwIwkrCw&q=85&s=e477da19ad43280f00bf55cfdafa940b" alt="Cluster Settings with the firewall section — active security group and assignment" width="1650" height="940" data-path="images/products/compute/kubernetes/firewall-settings.png" />
</Frame>

**Health checks & failover:** the gateway health-checks the nodes behind it and removes unhealthy ones from rotation automatically; nodes added by scaling or autoscaling are picked up automatically. On a standard cluster the gateway is a single managed instance, restarted automatically on failure; with [HA](/products/build/kubernetes/concepts/control-plane-and-ha) it is a redundant pair with automatic IP failover (VRRP).

**Limits:** there are no platform limits on connections, requests or Ingress hosts. Throughput is bounded by your cluster's own gateway; it is not shared with other customers.

## MetalLB

With MetalLB enabled, `Service type=LoadBalancer` allocates private IPs from a reserved block inside the VPC (resizable up to 32 addresses). Combine with TCP port forwards to publish them externally.