Set spec.loadBalancerSourceRanges on a public LoadBalancer Service that you manage in CoreWeave Kubernetes Service (CKS). Specify the allowed client ranges in classless inter-domain routing (CIDR) notation. Keep the service.beta.kubernetes.io/coreweave-load-balancer-type: public annotation. Use /32 to allow a single IPv4 address.
CKS silently drops traffic from external sources outside the allowed ranges. Blocked connection attempts time out instead of returning a connection-refused error. An omitted or empty list applies no source-IP restriction.
For the manifest and verification steps, see Restrict access by source IP.
To restrict the cluster’s direct public Kubernetes API endpoint, use kubeApiAccess.public.allowCidrs in the Update Cluster API. This is a separate setting and doesn’t filter the legacy public API ingress.
Administrator Last modified on November 10, 2026
