Virtual Private Clouds provide network isolation and custom addressing for CKS clusters
CoreWeave Virtual Private Clouds () define the network isolation configuration for attached CoreWeave products, like CKS clusters. VPCs let clusters securely communicate with resources in a , and with the public internet if desired, while preserving the privacy and security of the cluster’s network.This page introduces how CoreWeave VPCs work, the default VPC behavior for new CKS clusters, the prefix types you can configure, and when to define a custom VPC.
Every CKS cluster attaches to a VPC because the VPC provides the network foundation the cluster depends on:
Isolation: The VPC defines the network isolation boundary for the cluster, so it can communicate securely with resources in a Region, and with the public internet when you allow it, while preserving the privacy of the cluster’s network.
Addressing: The VPC supplies the IP address ranges that cluster resources draw from. A VPC needs at least three unique prefixes to be compatible with a CKS cluster: a Pod CIDR, a Service CIDR, and an internal Load Balancer CIDR. Nodes draw their addresses from the VPC’s Host Prefixes.
Routing: VPC Prefixes let the cluster reach other VPCs in the same Region, remote cloud providers, or on-premises networks through a VPN or Direct Connect.
Because a cluster can’t function without this network configuration, CoreWeave creates a default VPC for you when you create your first cluster, unless you define a custom VPC. See Default VPCs.
If you’re creating a single cluster and don’t have specific addressing or external connectivity requirements, the default VPC is a safe choice. CoreWeave assigns the default Host Prefix for the Zone and creates working network isolation without upfront planning. See Default VPCs.When you define a custom VPC or customize the default VPC, you set the Pod, Service, and internal Load Balancer CIDR blocks yourself. The following block sizes from VPC CIDR blocks suit most first clusters:
Prefix
Recommended block size
Capacity
Host Prefix
/18
Up to 4,000 Nodes, with 2 IP addresses per Node.
Pod CIDR
/13
Up to 100 Pods per Node.
Service CIDR
/22
Up to 1,000 Services.
Internal LB CIDR
/22
Up to 1,000 Load Balancers.
For a smaller cluster, you can use smaller CIDR ranges. For example, if you plan only 500 Nodes, you don’t need a full /18 Host Prefix.However, smaller ranges can limit future growth because Service ClusterIPs are allocated from a contiguous Service CIDR block. Expanding that space later requires defining a new Service CIDR and recreating Services.Keep all CIDR ranges non-overlapping so you can connect to other VPCs later without routing conflicts.For sizing rules, example CIDR values, and multi-cluster planning, see VPC CIDR blocks.
Create a custom VPC when any of the following apply:
You plan to connect multiple clusters or VPCs. Connected VPCs need unique, non-overlapping address space, so you must plan CIDR ranges up front to avoid routing conflicts. See Plan CIDRs for connected VPCs.
You need to integrate with existing networks, such as on-premises networks or remote cloud providers through a VPN or Direct Connect. These integrations need known, non-overlapping IP ranges.
You need specific addressing or larger CIDR blocks than the defaults provide.
You can’t remove a Host Prefix after you add it to a VPC, so plan your addressing scheme before you create the custom VPC.To define a custom VPC, see Create and manage VPCs, or define one during cluster creation.
When you create your first CKS cluster through the Cloud Console, CoreWeave creates a default VPC in the same Zone as that cluster, unless you define a custom VPC. This default ensures that clusters have working network isolation without requiring upfront VPC configuration.
You can add custom VPC Prefixes to custom or default VPCs to allow communication with other VPCs in the same Region, with remote cloud providers, or with on-premises networks through a VPN or Direct Connect. Configure custom prefixes when your workloads need to reach networks outside the VPC. Add custom prefixes to a VPC through the Cloud Console during VPC creation, or during cluster creation at the network configuration step.You can configure two types of prefixes for VPCs:
Prefix type
Description
Host Prefixes
A range of IP addresses to assign to the Nodes within a VPC. Nodes use these addresses for network communications with other resources within the VPC.
VPC Prefixes
A range of IP addresses you can use to communicate with other VPCs in the same Region, with remote cloud providers, or with on-premises networks through a VPN or Direct Connect.
Each CoreWeave has a default Host Prefix, which CoreWeave assigns automatically unless you specify a different prefix.The default Host Prefixes for each AZ are:
You can’t modify or remove Host Prefixes after you add them to a VPC. CoreWeave assigns Host Prefixes when the Node boots, so you can’t modify them while the Node is running.
CoreWeave automatically creates a default VPC when you first create a cluster. The name of a new default VPC uses the following format:cw-vpc-[CLUSTER-NAME]-[SIX-DIGIT-STRING]To see the name of the default VPC, click the Customize option beside the default VPC selector during cluster creation.
When the default VPC doesn’t meet your network requirements, for example when you need custom addressing or connectivity to external networks, define a custom VPC instead. If you need a custom VPC configuration, define it by creating a VPC from the Cloud Console, or during the cluster creation process by defining a custom VPC.For more information, see VPC API reference.
