Network Isolation
Managed cluster workloads get outbound internet access, DNS, and pod-to-pod traffic within their own cluster, and nothing else. This page covers what is allowed, what is blocked, and how cluster API access and ingress differ from outbound workload traffic.
What your workloads can reach
Section titled “What your workloads can reach”| Destination | Allowed | Notes |
|---|---|---|
| Public internet | Yes | Any external IP or hostname |
| DNS | Yes | Cluster DNS resolves normally |
| Same-cluster pods | Yes | Pod-to-pod within your cluster works |
| Other tenants’ clusters | No | Blocked by network policy |
| Platform services | No | Blocked (monitoring, auth, secrets) |
| Cluster nodes | No | Blocked (kubelet, etcd, API server) |
| Cloud metadata / link-local | No | Blocked (169.254.0.0/16, incl. 169.254.169.254) |
| CGNAT range | No | Blocked (100.64.0.0/10) |
How it works
Section titled “How it works”Managed clusters apply network policies that:
- Allow DNS: your pods can resolve hostnames normally
- Allow same-cluster traffic: pods within your cluster communicate freely
- Allow internet egress: outbound to any public IP
- Block internal ranges: RFC 1918 private ranges (10.x, 172.16.x, 192.168.x), link-local (169.254.0.0/16, which covers the cloud metadata endpoint 169.254.169.254), and CGNAT (100.64.0.0/10) are all blocked
Workloads operate normally, while infrastructure belonging to the platform or to other tenants stays unreachable.
Cluster API access
Section titled “Cluster API access”Your cluster’s Kubernetes API is accessible via a public endpoint:
https://<cluster>.<tenant>.clusters.kupe.cloudThis endpoint uses TLS passthrough with OIDC authentication, the same security model used by managed Kubernetes providers such as EKS, GKE, and AKS. No VPN is required.
Ingress
Section titled “Ingress”Inbound traffic to your workloads flows through the shared Gateway API infrastructure. Create HTTPRoutes to expose your services; the platform handles TLS termination and routing.
Your pods receive traffic from the gateway proxy only. Direct inbound connections from the internet to pod IPs are not possible.
Related pages
Section titled “Related pages”- Cluster Policies: admission-time enforcement
- Container Security: pod security requirements
- HTTP Routes: exposing services externally