> ## Documentation Index
> Fetch the complete documentation index at: https://docs.siderolabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

> KubeSpanConfig is a config document to configure KubeSpan.

# KubeSpanConfig

```yaml theme={null}
apiVersion: v1alpha1
kind: KubeSpanConfig
enabled: true # Enable the KubeSpan feature.
advertiseKubernetesNetworks: false # Control whether Kubernetes pod CIDRs are announced over KubeSpan from the node.
allowDownPeerBypass: false # Skip sending traffic via KubeSpan if the peer connection state is not up.
harvestExtraEndpoints: false # KubeSpan can collect and publish extra endpoints for each member of the cluster
mtu: 1420 # KubeSpan link MTU size.
# KubeSpan advanced filtering of network addresses.
filters:
    # Filter node addresses which will be advertised as KubeSpan endpoints for peer-to-peer Wireguard connections.
    endpoints:
        - 0.0.0.0/0
        - ::/0
    # Filter networks (e.g., host addresses, pod CIDRs if enabled) which will be advertised over KubeSpan.
    excludeAdvertisedNetworks:
        - 192.168.1.0/24
        - 2003::/16
```

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Description</th>
      <th>Value(s)</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`enabled`</td>
      <td>bool</td>
      <td>Enable the KubeSpan feature.<br />Cluster discovery should be enabled with cluster.discovery.enabled for KubeSpan to be enabled.</td>

      <td />
    </tr>

    <tr>
      <td>`advertiseKubernetesNetworks`</td>
      <td>bool</td>
      <td>Control whether Kubernetes pod CIDRs are announced over KubeSpan from the node.<br />If disabled, CNI handles pod-to-pod traffic encapsulation.<br />If enabled, KubeSpan takes over pod-to-pod traffic directly.</td>

      <td />
    </tr>

    <tr>
      <td>`allowDownPeerBypass`</td>
      <td>bool</td>
      <td>Skip sending traffic via KubeSpan if the peer connection state is not up.<br />This provides configurable choice between connectivity and security.</td>

      <td />
    </tr>

    <tr>
      <td>`harvestExtraEndpoints`</td>
      <td>bool</td>
      <td>KubeSpan can collect and publish extra endpoints for each member of the cluster<br />based on Wireguard endpoint information for each peer.<br />Disabled by default. Do not enable with high peer counts (>50).</td>

      <td />
    </tr>

    <tr>
      <td>`mtu`</td>
      <td>uint32</td>
      <td>KubeSpan link MTU size.<br />Default value is 1420.</td>

      <td />
    </tr>

    <tr>
      <td>`filters`</td>
      <td><a href="#filters">KubeSpanFiltersConfig</a></td>
      <td>KubeSpan advanced filtering of network addresses.<br />Settings are optional and apply only to this node.</td>

      <td />
    </tr>
  </tbody>
</table>

## filters

KubeSpanFiltersConfig configures KubeSpan endpoint filters.

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Description</th>
      <th>Value(s)</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`endpoints`</td>
      <td>\[]string</td>
      <td>Filter node addresses which will be advertised as KubeSpan endpoints for peer-to-peer Wireguard connections.<br /><br />By default, all addresses are advertised, and KubeSpan cycles through all endpoints until it finds one that works.<br /><br />Default value: no filtering.</td>

      <td />
    </tr>

    <tr>
      <td>`excludeAdvertisedNetworks`</td>
      <td>\[]Prefix</td>
      <td>Filter networks (e.g., host addresses, pod CIDRs if enabled) which will be advertised over KubeSpan.<br /><br />By default, all networks are advertised.<br />Use this filter to exclude some networks from being advertised.<br /><br />Note: excluded networks will not be reachable over KubeSpan, so make sure<br />these networks are still reachable via some other route (e.g., direct connection).<br /><br />Default value: no filtering.</td>

      <td />
    </tr>
  </tbody>
</table>