Networking Architecture
OSC networking separates the physical transport network from the virtual networks used by customer workloads.
The physical underlay connects compute, storage and routing systems across the region. It is operated by OSC and is not directly visible to customer clusters. On top of it, OSC creates isolated virtual networks for projects and Shoot clusters.
Each virtual network belongs to a separate logical network domain. Traffic is encapsulated across the regional fabric, which allows multiple customer networks to use the same physical infrastructure without becoming part of the same address space.
Customers use private network ranges inside their environments. External access is added explicitly through platform services such as load balancers, NAT gateways, public addresses, VPN connections or network peering. This keeps inbound and outbound connectivity controlled and understandable.
A load balancer exposes selected application ports and forwards traffic to the intended service. A NAT gateway provides outbound internet access for private workloads without assigning a public address to every node. Peering and VPN services connect networks where required by the application architecture.
Network isolation does not replace Kubernetes security controls.
Customers should still use NetworkPolicies, namespace separation and carefully scoped services inside their Shoot clusters. OSC provides the isolated network foundation; customers define the permitted communication between their applications.