# Ensure Kubernetes Cluster Is Attached to a Private Network

- Source: https://support.icompaas.com/support/solutions/articles/a_1791826030083969-ensure-kubernetes-cluster-is-attached-to-a-private-network
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [OVH Cloud](https://support.icompaas.com/support/solutions/c_1791819364512367) › [checks](https://support.icompaas.com/support/solutions/folders/f_1791819376721251)
- Last updated: 2026-10-12
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure production Managed Kubernetes clusters are created with their nodes attached to a private network (vRack), so that traffic between nodes and other private services, such as databases, stays off the public internet.

**Rationale**

When nodes use only public networking, traffic between the cluster and other services must cross the internet and the nodes are directly reachable from outside. A private network keeps internal traffic isolated and allows private connections to databases and other services.

**Impact**

-   Cluster traffic to private services stays isolated
    
-   Reduces public exposure of nodes
    
-   The private network can only be chosen when the cluster is created
    

**Default Value**

By default, clusters use public networking unless a private network is selected at creation. After a cluster is created, its region and private network cannot be changed.

**Pre-Requisites**

-   Permission to manage Kubernetes clusters
    
-   A vRack and a private network with a subnet in the cluster's region
    

**Test Plan**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Public Cloud and choose your project.
    
3.  In the left-hand menu, select Managed Kubernetes Service, then click the cluster name to open it.
    
4.  On the cluster's Service tab, check whether a private network is attached.
    
5.  If no private network is attached, follow the implementation steps.
    

**Implementation Steps**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Public Cloud and choose your project.
    
3.  Create a new Managed Kubernetes cluster and, in the network step, select the private network (and Gateway if needed).
    
4.  Migrate the workloads to the new cluster.
    
5.  Delete the old cluster once the migration is confirmed.
    

**Backout Plan**

1.  Keep the original cluster running until the new one is confirmed, and switch workloads back if needed.
    

**Reference**

-   [https://docs.ovhcloud.com/en/guides/public-cloud/containers-orchestration/managed-kubernetes/create-cluster](https://docs.ovhcloud.com/en/guides/public-cloud/containers-orchestration/managed-kubernetes/create-cluster)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.