Skip to main content
A VM gets a pod-network address the moment it starts, reachable from inside the cluster. Everything on this page is about the two further questions: how traffic from outside reaches it, and how its address behaves when it moves. The VM detail page’s Networking tab collects the read-only side of this in one view: the internal and external addresses, network mode, MTU and queues, interfaces, routes, the services publishing the VM, and recent bandwidth.

​
Permissions

All VM actions are scoped to krn:vks:supervisor:<supervisor>:vm:<vm>; the pool actions are scoped to krn:vks:supervisor:<supervisor>:cilium:*.

​
Find out what to publish first

With qemu-guest-agent connected, Celum can list what the guest is actually listening on — port, protocol, and the process holding the socket. Each entry is flagged as exposable or not.
The exposable flag is advisory. A service bound only to localhost can still be published — the publish path validates the port number, not what the port is bound to. The result is a LoadBalancer address that accepts connections and then goes nowhere. Check the bind address before publishing.

​
Publishing through a LoadBalancer

This is the L4 path: a Service named <vm>-lb selecting the VM, given an address from the project’s LoadBalancer range.
Publishes a set of ports at once, replacing what was there. With no ports specified, Celum picks defaults from the detected guest OS:Detection reads the guest OS the agent reports — without the agent it falls through to the non-Windows default.

​
Opening the guest firewall

Publishing a port through Kubernetes does not open it inside the guest. For guests running ufw, Celum can open a single port for you. The command is built server-side from the validated port and protocol — you never supply a shell string.
Two different firewalls are in play. A published port that still refuses connections is usually blocked by the guest’s own firewall, not by Kubernetes.

​
Publishing through a Gateway

The L7 alternative. Instead of consuming a LoadBalancer address per VM, the port is routed through a Gateway with TLS terminated by cert-manager and HTTP redirected to HTTPS — the same path platform services use. The backing Service is a separate ClusterIP named <vm>-gw, so it never burns a LoadBalancer address and stays distinct from <vm>-lb. You can name a Gateway explicitly; otherwise the VM’s own project gateway is used, created if it does not exist yet, falling back to the platform’s shared gateway.
Gateway publication covers HTTP over TCP ports only. SSH and RDP cannot be published this way — use the LoadBalancer path for those.

​
Choosing between the two

​
The VM Identity Network

A VM’s pod address is volatile — it changes when the VM restarts or migrates. An identity address is a routable address that stays with the VM across live migration.

​
How pools work

A VM identity pool is a Cilium LoadBalancer IP pool that is deliberately disabled for normal allocation and labelled as an identity pool. Disabling it guarantees Cilium never hands its addresses out to Services, while the BGP bridge still advertises the pool’s aggregate to the fabric. The per-VM addresses themselves stay node-internal, which is what lets a VM keep its address when it lands on a different node.

​
Claiming an address

A VM claims an address at creation time — see Create a VM. The claim is allocated before the VM object exists, so a bad or exhausted pool fails cleanly.

​
Stale claims

If a pool is later resized so that an already-claimed address falls outside the new range, that VM’s claim is marked stale. A stale address is no longer advertised, so the VM becomes unreachable on it and must be re-addressed.
Shrinking an identity pool strands every claim outside the new range. Check which addresses are in use before resizing.

​
Checking connectivity

When something is unreachable, the connectivity check runs four probes inside the guest and reports each independently — which is usually enough to tell you which layer is broken:
All four probes run through the guest agent. Without it the check is unavailable — the endpoint returns 404 rather than a failure result.
For traffic that did happen rather than traffic you provoke, the VM also surfaces its recent flows and its peers, drawn from the same flow analytics that back the security topology.

​
What commonly goes wrong

Create a VM

Network mode and identity network are set at creation.

Projects

Where a VM’s LoadBalancer range, egress identity, and isolation come from.

Console & access

Reaching a VM that is not published at all.

VM lifecycle

Migration, and what a project move leaves behind.