Networking
Fabric topology, private networks, public addresses and private interconnect.
Every project gets its own private network. Cluster plans add a dedicated GPU fabric that is physically separate from it.
Networks on a node
| Interface | Purpose | Reachable from |
|---|---|---|
Fabric (ib0–ib7) |
GPU-to-GPU traffic between nodes | Nodes in the same cluster only |
Private (eth0) |
Storage, scheduler, your services | Your project’s private network |
Public (eth1) |
Optional internet access | Internet, filtered by your rules |
| Management | Serial console, power control | Cloister control plane only |
Fabric topology
Fabric ports are grouped by GPU index into rails. GPU 0 on every node connects to leaf switch 0, GPU 1 to leaf 1, and so on. Leaves connect to a spine layer with no oversubscription inside a cluster.
Because the switches serving your rails are assigned to your cluster alone, fabric traffic never shares a link with another customer.
Firewall rules
Public interfaces drop all inbound traffic by default. Allow what you need per project:
cloister firewall allow --port 22 --from 203.0.113.0/24
Private interconnect
An enclosure, or a project with the private interconnect add-on, can connect to your own network through a dedicated 10 or 100 Gb/s cross-connect, or through a cloud exchange. Traffic stays off the public internet and the port belongs to you.
Addresses
Each project receives an IPv6 /56. Dedicated IPv4 addresses are available individually.