Skip to main content
apiVersion: v1alpha1
kind: KubeSpanConfig
enabled: true # Enable the KubeSpan feature.
advertiseKubernetesNetworks: false # Control whether Kubernetes pod CIDRs are announced over KubeSpan from the node.
allowDownPeerBypass: false # Skip sending traffic via KubeSpan if the peer connection state is not up.
harvestExtraEndpoints: false # KubeSpan can collect and publish extra endpoints for each member of the cluster
mtu: 1420 # KubeSpan link MTU size.
# KubeSpan advanced filtering of network addresses.
filters:
    # Filter node addresses which will be advertised as KubeSpan endpoints for peer-to-peer Wireguard connections.
    endpoints:
        - 0.0.0.0/0
        - ::/0
    # Filter networks (e.g., host addresses, pod CIDRs if enabled) which will be advertised over KubeSpan.
    excludeAdvertisedNetworks:
        - 192.168.1.0/24
        - 2003::/16
FieldTypeDescriptionValue(s)
enabledboolEnable the KubeSpan feature.
Cluster discovery should be enabled with cluster.discovery.enabled for KubeSpan to be enabled.
advertiseKubernetesNetworksboolControl whether Kubernetes pod CIDRs are announced over KubeSpan from the node.
If disabled, CNI handles pod-to-pod traffic encapsulation.
If enabled, KubeSpan takes over pod-to-pod traffic directly.
allowDownPeerBypassboolSkip sending traffic via KubeSpan if the peer connection state is not up.
This provides configurable choice between connectivity and security.
harvestExtraEndpointsboolKubeSpan can collect and publish extra endpoints for each member of the cluster
based on Wireguard endpoint information for each peer.
Disabled by default. Do not enable with high peer counts (>50).
mtuuint32KubeSpan link MTU size.
Default value is 1420.
filtersKubeSpanFiltersConfigKubeSpan advanced filtering of network addresses.
Settings are optional and apply only to this node.

​
filters

KubeSpanFiltersConfig configures KubeSpan endpoint filters.
FieldTypeDescriptionValue(s)
endpoints[]stringFilter node addresses which will be advertised as KubeSpan endpoints for peer-to-peer Wireguard connections.

By default, all addresses are advertised, and KubeSpan cycles through all endpoints until it finds one that works.

Default value: no filtering.
excludeAdvertisedNetworks[]PrefixFilter networks (e.g., host addresses, pod CIDRs if enabled) which will be advertised over KubeSpan.

By default, all networks are advertised.
Use this filter to exclude some networks from being advertised.

Note: excluded networks will not be reachable over KubeSpan, so make sure
these networks are still reachable via some other route (e.g., direct connection).

Default value: no filtering.