Set the pod and service CIDRs before you create the cluster, because they are fixed at creation and cannot change on a running cluster. Every cluster carves two private IP ranges out of `spec.clusterNetwork`: the pod CIDR and the service CIDR. A CIDR is simply the notation for a range of addresses. The only way to change a range later is to rebuild the cluster, so setting them correctly up front is worth the few minutes it takes.

## Default CIDR ranges

A new cluster uses ranges in the RFC 6598 carrier-grade NAT space (`100.64.0.0/10`):

```yaml title="cluster.yaml"
spec:
  clusterNetwork:
    pods:
      cidrBlocks: ["100.64.0.0/11"]
    services:
      cidrBlocks: ["100.96.0.0/16"]
    serviceDomain: "cluster.local"
```

RFC 6598 space is chosen deliberately. Most private networks you might connect to, such as an office LAN, a VPN, or another cloud VPC, live in RFC 1918 ranges (`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`). Putting the cluster's own ranges in `100.64.0.0/10` keeps them clear of those, so a pod's address never collides with a host you are trying to reach over a VPN.

Kubernetes assigns each node a slice of the pod range. On this platform that slice is a `/22`, so each node has room for far more pods than it will run. How many pods actually fit per node is bounded by the pod range slice together with the kubelet's `maxPods` cap; the exact numbers live in [Cluster variables](/docs/hetzner/apalla/reference/cluster-variables).

## Change the ranges before you create the cluster

If a default range overlaps a network you connect to, set your own under `spec.clusterNetwork` before you apply the `Cluster`:

```yaml title="cluster.yaml"
spec:
  clusterNetwork:
    pods:
      cidrBlocks: ["10.128.0.0/12"]
    services:
      cidrBlocks: ["10.144.0.0/16"]
    serviceDomain: "cluster.local"
```

Rules for the values:

- Each entry is an array of IPv4 CIDR strings.
- The pod and service ranges must not overlap each other, and neither may overlap a network you plan to reach (plan cross-network CIDRs before creation, see [Connect to on-prem or another VPC](/docs/hetzner/apalla/network/egress/connect-to-on-prem-or-vpc)).
- Size the pod range for the cluster you will grow into: a larger range allows more nodes, since each node takes a `/22`.
- `serviceDomain` sets the in-cluster DNS suffix (`cluster.local` by default). Change it only if you have a specific reason, because it affects every in-cluster name.

> [!WARNING]
> The CIDR blocks cannot be changed on a running cluster, only at creation. If you outgrow a range or encounter an overlap later, the remedy is a new cluster with the correct ranges and a migration onto it.

## Verify a node's ranges

Each node writes its resolved ranges to a file. Read it to confirm what the cluster actually uses:

```console
$ cat /etc/kubernetes/cluster-network
POD_CIDRS=100.64.0.0/11
SERVICE_CIDRS=100.96.0.0/16
```

An empty or missing file is a genuine problem: the node's tunnel refuses to route pod traffic without these ranges, which appears as the API server failing to reach pods. See [Debug node networking](/docs/hetzner/apalla/network/debug/debug-node-networking).

## Where to go next

- [Connect to on-prem or another VPC](/docs/hetzner/apalla/network/egress/connect-to-on-prem-or-vpc)
- [Give egress a stable IP with an egress gateway](/docs/hetzner/apalla/network/egress/route-egress-through-a-gateway)