Configure CIDR blocks in VPCs
Use the following YAML fields to assign CIDR ranges to each resource type when you create or edit a VPC configuration. The following example shows a single VPC containing multiple clusters, with different CIDR ranges assigned to different resources:Example vpc.yaml
CIDR block size guidelines
CIDR blocks for Nodes, Pods, Services, and Load Balancers have different subnet allocation limits. The following guidelines are based on the maximum number of resources each CIDR block can accommodate:| Key | Value | Description |
|---|---|---|
hostPrefixes | /18 | A /18 CIDR block supports up to 4,000 Nodes. Each Node requires 2 IP addresses. |
podCIDR | /13 | A /13 CIDR block supports up to 100 Pods per Node. |
serviceCIDR | /22 | A /22 CIDR block supports up to 1,000 Services. |
internalLbCIDR | /22 | A /22 CIDR block supports up to 1,000 Load Balancers. |
If you have a smaller environment, you can use smaller CIDR ranges. For example, if you plan only 500 Nodes for the cluster, a large CIDR block isn’t required. However, smaller CIDR ranges can limit future expansion, since Service IPs must be contiguous.
Plan CIDRs for connected VPCs
If your architecture connects multiple VPCs, plan address space carefully to avoid routing conflicts. When you connect two CoreWeave VPCs between CKS clusters, you must plan unique, non-overlapping address space across the clusters. At a minimum, the two clusters must have non-overlapping internal Load Balancer CIDR blocks. To simplify routing between VPCs, keep all CIDR ranges in each cluster non-overlapping, including the Pod, Service, and Load Balancer CIDRs. Set non-overlapping CIDR ranges when you create or edit each VPC in the Cloud Console. For the configuration flow, see Create and manage VPCs. For automation, you can provision VPCs and their prefixes with the VPC API (for example, with thehostPrefixes and vpcPrefixes fields).
Non-overlapping address space also benefits multi-cluster networking tools. If you use Liqo for multi-cluster networking, its network fabric prefers NAT-less communication when PodCIDRs are disjoint, and applies address translation only when overlaps exist.