This version is under construction, please use an official release version

Validated Maximums

Each capability is identified by its corresponding Kubermatic Virtualization or Kubernetes resource; the Description column states the platform-neutral concept. Most of these figures are validated lower bounds: the run reached a configured cap while the cluster showed no strain, which indicates that the true ceiling is higher. Where a figure is a genuine hard limit, this is noted in the technical reference.

Capability (KubeV resource)Validated maximumDescription
VPCs per cluster10,000Network tenants per cluster
Subnets per cluster11,822Layer-3 subnets cluster-wide
Subnets per VPC8,001Subnets within one network tenant
NetworkPolicies per namespace30,001Stateful firewall policies within a single namespace
NetworkPolicies per cluster120,001Stateful firewall policies across all namespaces
SecurityGroups per cluster5,606Reusable firewall scopes
Services per cluster1,001Routable, load-balanced service addresses
Static routes per VPC3,830Next-hop routes on a single tenant’s router
NICs per VM36Secondary network interfaces on a single virtual machine
vCPUs per VM94Virtual CPUs on a single virtual machine
Memory per VM180 GiBRAM on a single virtual machine
Pods per worker node1,185Container workloads scheduled concurrently on one host
Pod-to-pod latencysame-host 167 µs · cross-host 532 µsBest-case network round-trip on an idle cluster

Tenant density before workload performance degrades is reported separately. On the reference cluster, virtual-machine-to-virtual-machine latency remained stable through 120 tenants and 600 running virtual machines (the run’s configured cap), with a worst case of 13 % above baseline and no observed slowdown. This is a degradation measurement rather than a capacity maximum, and therefore is not assigned a row above. See Degradation for detail.

How each maximum was determined

Every figure is produced by the same procedure, executed by the ConfigMax tool against a freshly cleaned reference cluster:

  1. Create the objects in progressively larger batches until a stop condition is met.
  2. After each batch, verify that the objects are functional rather than merely stored. A pod placed in a new subnet must obtain an IP address and reach its gateway, and a service must respond through a live backend.
  3. Sample the control plane against fixed danger thresholds, including etcd database size, Kube-OVN control-plane memory and CPU, and control-plane host memory.
  4. Stop when a danger threshold is crossed (the count immediately prior is the ceiling), when an object ceases to function, or when the configured cap is reached with no strain (the figure is then a lower bound).

The published maximum is the highest count that was both reached and verified to be functional.

Technical reference

The following table lists, for each capability, the validated ceiling, the reason the run stopped, and the component expected to be the first limiting factor.

Capability (KubeV resource)Validated ceilingStop reasonLimiting component
VPCs / cluster10,000Configured cap reached; no strainetcd database size (closest to its budget, approximately 77 %)
Subnets / cluster11,822Controller completed programming this count within the settle windowKube-OVN controller programming throughput
Subnets / VPC8,001Configured cap reached; no strainNone approached its danger line
NetworkPolicies / namespace30,001Configured cap reached; no strainNone approached its danger line
NetworkPolicies / cluster120,001Configured cap reached; no strainNone approached its danger line
SecurityGroups / cluster5,606Kube-OVN controller instability at higher counts (upstream fix tracked)Kube-OVN controller stability
Services / cluster1,001Configured cap reached; no strainPod-wiring throughput at higher counts
Static routes / VPC3,830Configured cap reachedKube-OVN controller programming cadence
NICs / VM36Hard wall at 40 NICs (interfaces never finish wiring)Per-node network-sandbox wiring; a longer boot timeout does not lift it
vCPUs / VM94Host core count (hardware)Worker physical cores
Memory / VM180 GiBHost RAM (hardware)Worker RAM
Pods / worker node1,185kubelet --max-pods ceilingkubelet (a configuration limit, not a network limit)
Pod-to-pod latency (idle)same-host 167 µs · cross-host 532 µsDirect measurement, not a scaling runIncreases with logical-object count; every run begins from a clean cluster

Enforced rules. Each NetworkPolicy compiles into several low-level allow and deny entries within the network (approximately six per policy in these runs). The policy count above is the figure that an operator defines and manages; the underlying enforcement load is higher. At the cluster maximum, 120,001 policies programmed approximately 355,000 enforced rules with no observed strain.