{"id":"81a611aa-f851-414f-9f36-9894c578f1bd","shortId":"eQpUAu","kind":"skill","title":"kubesphere-network-extension-operations","tagline":"Operate the KubeSphere network extension. Use when Codex needs to install, upgrade, configure, enable, disable, or inspect the `network` extension; manage Calico `IPPool` resources, namespace bindings, migrations, or network isolation flows; or consult the bundled network extensi","description":"# KubeSphere Network Extension Operations\n\nOperate the `network` extension and its related resources with `kubectl` plus the bundled references in this skill. Prefer the live cluster state first, then use the copied extension references here to resolve packaging details, API shapes, and product behavior.\n\n## When to Use\n\n- Install, upgrade, enable, disable, or inspect the `network` extension\n- Edit `InstallPlan.spec.config` for IPPool or NetworkPolicy feature toggles\n- Verify packaging details such as version, images, dependencies, or installation mode\n- Manage Calico `IPPool` resources, namespace bindings, occupancy, and migration flows\n- Manage cluster, workspace, or project network isolation behavior\n- Create, inspect, or troubleshoot Kubernetes `NetworkPolicy` and namespace-level network isolation policies\n\n## Do Not Use\n\n- Manage unrelated extensions\n- Assume deprecated `network.kubesphere.io` IPPool CRDs are still the CRUD source of truth\n- Assume a non-Calico IPPool backend; the extension values currently support only `calico`\n- Patch workspace, namespace, or IPPool binding metadata without reading the current live object first\n\n## Read First\n\nRead only the references needed for the current request:\n\n- Product behavior and upgrade caveats: [references/README_zh.md](references/README_zh.md)\n- IPPool and NetworkPolicy API flows: [references/api_doc.md](references/api_doc.md)\n- Extension defaults and feature toggles: [references/values.yaml](references/values.yaml)\n- Packaging facts such as version, dependencies, images, and installation mode: [references/extension.yaml](references/extension.yaml)\n- Full endpoint schema details only when request or response fields matter: [references/swagger.yaml](references/swagger.yaml)\n\nUseful `rg` patterns for the larger references:\n\n```bash\nrg -n \"ippool|networkpol|isolate\" skills/kubesphere-network-extension-operations/references/api_doc.md\nrg -n \"^  /(kapis|apis)/.*(ippool|networkpol)\" skills/kubesphere-network-extension-operations/references/swagger.yaml\n```\n\n## Fixed Facts\n\n- Extension name: `network`\n- InstallPlan name: `network`\n- Installation mode from packaging: `Multicluster`\n- Current packaged version in the copied reference: `1.3.0`\n- Supported IPPool backend in values: `global.ippool.type=calico`\n- Main feature toggles:\n  - `global.ippool.enable`\n  - `global.ippool.webhook`\n  - `global.networkPolicy.enable`\n\n## Workflow\n\n1. Read the matching bundled references for the request.\n2. Inspect the current live extension, InstallPlan, and relevant cluster resources.\n3. Apply the smallest change that satisfies the request.\n4. Re-read the changed resources and verify the post-change state.\n\n## Preflight Checks\n\n- `kubectl` must already be configured for the target cluster.\n- Before any mutation, confirm the live extension state:\n\n```bash\nkubectl get extension network\nkubectl get installplan network -o yaml\nkubectl get extensionversion.kubesphere.io -l kubesphere.io/extension-ref=network\n```\n\n- Before any IPPool CRUD, confirm the Calico CRD exists:\n\n```bash\nkubectl get crd ippools.crd.projectcalico.org\n```\n\n- Before any network isolation mutation, inspect one live object of the same type first:\n\n```bash\nkubectl get workspace <workspace-name> -o yaml\nkubectl get namespace <namespace-name> -o yaml\n```\n\n## Extension Management\n\nUse fixed resource names:\n\n- extension: `network`\n- InstallPlan: `network`\n\nWhen creating or updating an InstallPlan:\n\n- Use the exact version requested by the user.\n- Keep `metadata.name` and `spec.extension.name` both equal to `network`.\n- Use `upgradeStrategy: Manual`.\n- Add `clusterScheduling` only when the user explicitly needs agent placement in member clusters.\n- Omit `spec.config` unless the user asked for non-default settings.\n- On upgrade, inspect the current config first and remove or update any pinned old image tags. The bundled README warns that stale tags can block new images from being deployed.\n\nMinimal default example:\n\n```yaml\napiVersion: kubesphere.io/v1alpha1\nkind: InstallPlan\nmetadata:\n  name: network\nspec:\n  enabled: true\n  extension:\n    name: network\n    version: <exact-version>\n  upgradeStrategy: Manual\n```\n\nOptional config snippet when the user asks to customize features:\n\n```yaml\nconfig: |\n  global:\n    ippool:\n      enable: true\n      type: calico\n      webhook: true\n    networkPolicy:\n      enable: true\n```\n\nPrefer this inspection flow before install or upgrade:\n\n```bash\nkubectl get extension network -o yaml\nkubectl get extensionversion network-<exact-version> -o yaml\nkubectl get installplan network -o yaml\n```\n\n## IPPool Operations\n\nTreat Calico IPPools as the CRUD source of truth:\n\n- Create, update, delete: `/apis/crd.projectcalico.org/v1/ippools`\n- IP usage and occupancy details:\n  - `/kapis/network.kubesphere.io/v1alpha2/ippools`\n  - `/kapis/network.kubesphere.io/v1alpha2/ippools/{name}`\n- Migration:\n  - `POST /kapis/network.kubesphere.io/v1alpha2/ippoolmigrations`\n  - `GET /kapis/network.kubesphere.io/v1alpha2/ippools/{name}/migrate`\n- Namespace available IPPools:\n  - `GET /kapis/network.kubesphere.io/v1alpha2/namespaces/{namespace}/ippools`\n\nOperational rules:\n\n- Do not recreate old KubeSphere-managed IPPool CRDs from `network.kubesphere.io`.\n- Before binding or unbinding a namespace to an IPPool, inspect a currently bound namespace and preserve the live label or annotation format already used by the cluster.\n- Before migrating an IPPool, inspect the source IPPool, bound namespaces, and current pod allocations first.\n- Use the examples in [references/api_doc.md](references/api_doc.md) for bound-namespace and pod-occupancy query shapes instead of inventing new label selectors.\n\nSuggested live inspection commands:\n\n```bash\nkubectl get ippools.crd.projectcalico.org\nkubectl get ippools.crd.projectcalico.org <ippool-name> -o yaml\nkubectl get namespace <namespace-name> -o yaml\nkubectl get pods -A -o wide\n```\n\n## NetworkPolicy Operations\n\n### Cluster-Scope and Namespace-Scope Kubernetes NetworkPolicy\n\nUse Kubernetes `networking.k8s.io/v1` endpoints for standard `NetworkPolicy` CRUD:\n\n- List:\n  - `/kapis/networking.k8s.io/v1/networkpolicies`\n  - `/kapis/networking.k8s.io/v1/namespaces/{namespace}/networkpolicies`\n- Create:\n  - `POST /kapis/networking.k8s.io/v1/namespaces/{namespace}/networkpolicies`\n- Delete:\n  - `DELETE /kapis/networking.k8s.io/v1/namespaces/{namespace}/networkpolicies/{name}`\n\n### Workspace and Project Isolation\n\nThe bundled API document uses inconsistent prose for the annotation key: its status-check text mentions `kubesphere.io/workspace-isolate`, while its patch examples use `kubesphere.io/network-isolate`.\n\nFollow this rule:\n\n- Inspect the live workspace or namespace annotations before patching.\n- Unless the live cluster proves otherwise, use the example payload key `kubesphere.io/network-isolate: enabled`.\n\nTypical patch body:\n\n```json\n{\n  \"metadata\": {\n    \"annotations\": {\n      \"kubesphere.io/network-isolate\": \"enabled\"\n    }\n  }\n}\n```\n\n### Namespace-Level Network Isolation Policies\n\nUse the KubeSphere API for project-specific isolation policies:\n\n- List:\n  - `GET /kapis/network.kubesphere.io/v1alpha1/namespaces/{namespace}/namespacenetworkpolicies`\n- Create:\n  - `POST /kapis/network.kubesphere.io/v1alpha1/namespaces/{namespace}/namespacenetworkpolicies`\n- Update:\n  - `PUT /kapis/network.kubesphere.io/v1alpha1/namespaces/{namespace}/namespacenetworkpolicies/{name}`\n- Delete:\n  - `DELETE /kapis/network.kubesphere.io/v1alpha1/namespaces/{namespace}/namespacenetworkpolicies/{name}`\n\nWhen creating or filtering these policies, preserve these labels exactly:\n\n- `kubesphere.io/policy-type=egress`\n- `kubesphere.io/policy-type=ingress`\n- `kubesphere.io/policy-traffic=inside`\n- `kubesphere.io/policy-traffic=outside`\n\n## Troubleshooting\n\nWhen the extension install or upgrade is stuck, gather state in this order:\n\n```bash\nkubectl describe extension network\nkubectl describe installplan network\nkubectl get installplan network -o jsonpath='{.status.targetNamespace}{\"\\n\"}'\nkubectl get pods,svc -n <target-namespace>\nkubectl get jobs -A | rg 'helm-upgrade-network|network'\nkubectl get pods -n kubesphere-system\n```\n\nIf the InstallPlan already points to a target namespace, inspect the Helm job pod logs and any extension pods in that namespace before changing manifests again.\n\n## Rules\n\n- Keep answers grounded in the bundled references and current live resource state.\n- Prefer exact version numbers and explicit resource reads over assumptions such as \"latest\" or \"default\" without verification.\n- Surface ambiguity when the copied docs and the live cluster object shape disagree.\n- Treat `extension`, `installplan`, Calico IPPools, and the live workspace or namespace objects as the source of truth.","tags":["kubesphere","network","extension","operations","agent-skills","cloud-native","cncf","devops","ebpf","hacktoberfest","kubernetes","llm"],"capabilities":["skill","source-kubesphere","skill-kubesphere-network-extension-operations","topic-agent-skills","topic-cloud-native","topic-cncf","topic-devops","topic-ebpf","topic-hacktoberfest","topic-kubernetes","topic-kubesphere","topic-llm","topic-multi-cluster","topic-multi-tenancy","topic-observability"],"categories":["kubesphere"],"synonyms":[],"warnings":[],"endpointUrl":"https://skills.sh/kubesphere/kubesphere/kubesphere-network-extension-operations","protocol":"skill","transport":"skills-sh","auth":{"type":"none","details":{"cli":"npx skills add kubesphere/kubesphere","source_repo":"https://github.com/kubesphere/kubesphere","install_from":"skills.sh"}},"qualityScore":"0.700","qualityRationale":"deterministic score 0.70 from registry signals: · indexed on github topic:agent-skills · 16934 github stars · SKILL.md body (8,756 chars)","verified":false,"liveness":"unknown","lastLivenessCheck":null,"agentReviews":{"count":0,"score_avg":null,"cost_usd_avg":null,"success_rate":null,"latency_p50_ms":null,"narrative_summary":null,"summary_updated_at":null},"enrichmentModel":"deterministic:skill-github:v1","enrichmentVersion":1,"enrichedAt":"2026-05-18T18:52:39.837Z","embedding":null,"createdAt":"2026-05-06T06:52:26.388Z","updatedAt":"2026-05-18T18:52:39.837Z","lastSeenAt":"2026-05-18T18:52:39.837Z","tsv":"'/apis/crd.projectcalico.org/v1/ippools':601 '/extension-ref=network':386 '/ippools':623 '/kapis/network.kubesphere.io/v1alpha1/namespaces':849,854,859,865 '/kapis/network.kubesphere.io/v1alpha2/ippoolmigrations':612 '/kapis/network.kubesphere.io/v1alpha2/ippools':607,608,614 '/kapis/network.kubesphere.io/v1alpha2/namespaces':621 '/kapis/networking.k8s.io/v1/namespaces':748,753,758 '/kapis/networking.k8s.io/v1/networkpolicies':747 '/migrate':616 '/namespacenetworkpolicies':851,856,861,867 '/network-isolate':793,829 '/network-isolate:':819 '/networkpolicies':750,755,760 '/policy-traffic=inside':887 '/policy-traffic=outside':890 '/policy-type=egress':881 '/policy-type=ingress':884 '/v1':740 '/v1alpha1':522 '/workspace-isolate':785 '1':307 '1.3.0':292 '2':316 '3':327 '4':336 'add':461 'agent':469 'alloc':677 'alreadi':354,659,947 'ambigu':1001 'annot':657,775,803,826 'answer':972 'api':81,215,268,768,840 'apivers':519 'appli':328 'ask':479,543 'assum':154,166 'assumpt':992 'avail':618 'backend':172,295 'bash':258,369,396,415,568,705,905 'behavior':85,134,206 'bind':31,122,185,638 'block':509 'bodi':823 'bound':649,672,687 'bound-namespac':686 'bundl':40,59,311,502,767,976 'calico':27,118,170,179,299,393,554,590,1016 'caveat':209 'chang':331,341,348,967 'check':351,780 'cluster':67,128,325,360,473,663,728,809,1009 'cluster-scop':727 'clusterschedul':462 'codex':13 'command':704 'config':490,538,548 'configur':18,356 'confirm':364,391 'consult':38 'copi':73,290,1004 'crd':394,399 'crds':158,634 'creat':135,437,598,751,852,870 'crud':162,390,594,745 'current':176,190,203,285,319,489,648,675,979 'custom':545 'default':220,483,516,997 'delet':600,756,757,863,864 'depend':113,231 'deploy':514 'deprec':155 'describ':907,911 'detail':80,108,241,606 'disabl':20,92 'disagre':1012 'doc':1005 'document':769 'edit':98 'enabl':19,91,529,551,558,820,830 'endpoint':239,741 'equal':455 'exact':444,878,984 'exampl':517,681,789,814 'exist':395 'explicit':467,988 'extens':4,10,25,45,50,74,97,153,174,219,274,321,367,372,426,432,531,571,894,908,961,1014 'extensi':42 'extensionvers':577 'extensionversion.kubesphere.io':382 'fact':227,273 'featur':104,222,301,546 'field':247 'filter':872 'first':69,193,195,414,491,678 'fix':272,429 'flow':36,126,216,563 'follow':794 'format':658 'full':238 'gather':900 'get':371,375,381,398,417,422,570,576,582,613,620,707,710,715,720,848,915,923,928,938 'global':549 'global.ippool.enable':303 'global.ippool.type':298 'global.ippool.webhook':304 'global.networkpolicy.enable':305 'ground':973 'helm':933,955 'helm-upgrade-network':932 'imag':112,232,499,511 'inconsist':771 'inspect':22,94,136,317,406,487,562,646,668,703,797,953 'instal':16,89,115,234,280,565,895 'installplan':277,322,376,434,441,524,583,912,916,946,1015 'installplan.spec.config':99 'instead':695 'invent':697 'ip':602 'ippool':28,101,119,157,171,184,212,261,269,294,389,550,587,591,619,633,645,667,671,1017 'ippools.crd.projectcalico.org':400,708,711 'isol':35,133,146,263,404,765,835,845 'job':929,956 'json':824 'jsonpath':919 'kapi':267 'keep':450,971 'key':776,816 'kind':523 'kubectl':56,352,370,374,380,397,416,421,569,575,581,706,709,714,719,906,910,914,922,927,937 'kubernet':139,734,737 'kubespher':2,8,43,631,839,942 'kubesphere-manag':630 'kubesphere-network-extension-oper':1 'kubesphere-system':941 'kubesphere.io':385,521,784,792,818,828,880,883,886,889 'kubesphere.io/extension-ref=network':384 'kubesphere.io/network-isolate':791,827 'kubesphere.io/network-isolate:':817 'kubesphere.io/policy-traffic=inside':885 'kubesphere.io/policy-traffic=outside':888 'kubesphere.io/policy-type=egress':879 'kubesphere.io/policy-type=ingress':882 'kubesphere.io/v1alpha1':520 'kubesphere.io/workspace-isolate':783 'l':383 'label':655,699,877 'larger':256 'latest':995 'level':144,833 'list':746,847 'live':66,191,320,366,408,654,702,799,808,980,1008,1020 'log':958 'main':300 'manag':26,117,127,151,427,632 'manifest':968 'manual':460,536 'match':310 'matter':248 'member':472 'mention':782 'metadata':186,525,825 'metadata.name':451 'migrat':32,125,610,665 'minim':515 'mode':116,235,281 'multiclust':284 'must':353 'mutat':363,405 'n':260,266,921,926,940 'name':275,278,431,526,532,609,615,761,862,868 'namespac':30,121,143,182,423,617,622,642,650,673,688,716,732,749,754,759,802,832,850,855,860,866,952,965,1023 'namespace-level':142,831 'namespace-scop':731 'need':14,200,468 'network':3,9,24,34,41,44,49,96,132,145,276,279,373,377,403,433,435,457,527,533,572,578,584,834,909,913,917,935,936 'network.kubesphere.io':156,636 'networking.k8s.io':739 'networking.k8s.io/v1':738 'networkpol':262,270 'networkpolici':103,140,214,557,725,735,744 'new':510,698 'non':169,482 'non-calico':168 'non-default':481 'number':986 'o':378,419,424,573,579,585,712,717,723,918 'object':192,409,1010,1024 'occup':123,605,692 'old':498,629 'omit':474 'one':407 'oper':5,6,46,47,588,624,726 'option':537 'order':904 'otherwis':811 'packag':79,107,226,283,286 'patch':180,788,805,822 'pattern':253 'payload':815 'pin':497 'placement':470 'plus':57 'pod':676,691,721,924,939,957,962 'pod-occup':690 'point':948 'polici':147,836,846,874 'post':347,611,752,853 'post-chang':346 'prefer':64,560,983 'preflight':350 'preserv':652,875 'product':84,205 'project':131,764,843 'project-specif':842 'prose':772 'prove':810 'put':858 'queri':693 're':338 're-read':337 'read':188,194,196,308,339,990 'readm':503 'recreat':628 'refer':60,75,199,257,291,312,977 'references/api_doc.md':217,218,683,684 'references/extension.yaml':236,237 'references/readme_zh.md':210,211 'references/swagger.yaml':249,250 'references/values.yaml':224,225 'relat':53 'relev':324 'remov':493 'request':204,244,315,335,446 'resolv':78 'resourc':29,54,120,326,342,430,981,989 'respons':246 'rg':252,259,265,931 'rule':625,796,970 'satisfi':333 'schema':240 'scope':729,733 'selector':700 'set':484 'shape':82,694,1011 'skill':63 'skill-kubesphere-network-extension-operations' 'skills/kubesphere-network-extension-operations/references/api_doc.md':264 'skills/kubesphere-network-extension-operations/references/swagger.yaml':271 'smallest':330 'snippet':539 'sourc':163,595,670,1027 'source-kubesphere' 'spec':528 'spec.config':475 'spec.extension.name':453 'specif':844 'stale':506 'standard':743 'state':68,349,368,901,982 'status':779 'status-check':778 'status.targetnamespace':920 'still':160 'stuck':899 'suggest':701 'support':177,293 'surfac':1000 'svc':925 'system':943 'tag':500,507 'target':359,951 'text':781 'toggl':105,223,302 'topic-agent-skills' 'topic-cloud-native' 'topic-cncf' 'topic-devops' 'topic-ebpf' 'topic-hacktoberfest' 'topic-kubernetes' 'topic-kubesphere' 'topic-llm' 'topic-multi-cluster' 'topic-multi-tenancy' 'topic-observability' 'treat':589,1013 'troubleshoot':138,891 'true':530,552,556,559 'truth':165,597,1029 'type':413,553 'typic':821 'unbind':640 'unless':476,806 'unrel':152 'updat':439,495,599,857 'upgrad':17,90,208,486,567,897,934 'upgradestrategi':459,535 'usag':603 'use':11,71,88,150,251,428,442,458,660,679,736,770,790,812,837 'user':449,466,478,542 'valu':175,297 'verif':999 'verifi':106,344 'version':111,230,287,445,534,985 'warn':504 'webhook':555 'wide':724 'without':187,998 'workflow':306 'workspac':129,181,418,762,800,1021 'yaml':379,420,425,518,547,574,580,586,713,718","prices":[{"id":"e8bc8370-93dc-4a35-8931-412ee816af99","listingId":"81a611aa-f851-414f-9f36-9894c578f1bd","amountUsd":"0","unit":"free","nativeCurrency":null,"nativeAmount":null,"chain":null,"payTo":null,"paymentMethod":"skill-free","isPrimary":true,"details":{"org":"kubesphere","category":"kubesphere","install_from":"skills.sh"},"createdAt":"2026-05-06T06:52:26.388Z"}],"sources":[{"listingId":"81a611aa-f851-414f-9f36-9894c578f1bd","source":"github","sourceId":"kubesphere/kubesphere/kubesphere-network-extension-operations","sourceUrl":"https://github.com/kubesphere/kubesphere/tree/master/skills/kubesphere-network-extension-operations","isPrimary":false,"firstSeenAt":"2026-05-06T06:52:26.388Z","lastSeenAt":"2026-05-18T18:52:39.837Z"}],"details":{"listingId":"81a611aa-f851-414f-9f36-9894c578f1bd","quickStartSnippet":null,"exampleRequest":null,"exampleResponse":null,"schema":null,"openapiUrl":null,"agentsTxtUrl":null,"citations":[],"useCases":[],"bestFor":[],"notFor":[],"kindDetails":{"org":"kubesphere","slug":"kubesphere-network-extension-operations","github":{"repo":"kubesphere/kubesphere","stars":16934,"topics":["agent-skills","ai","cloud-native","cncf","devops","ebpf","hacktoberfest","kubernetes","kubesphere","llm","multi-cluster","multi-tenancy","observability","servicemesh","skills","skills-sh","skillsmp"],"license":"other","html_url":"https://github.com/kubesphere/kubesphere","pushed_at":"2026-05-06T07:16:53Z","description":"The container platform tailored for Kubernetes multi-cloud, datacenter, and edge management ⎈ 🖥 ☁️","skill_md_sha":"c78b1362f575a64d57720fa1bb93623ce9ef1a22","skill_md_path":"skills/kubesphere-network-extension-operations/SKILL.md","default_branch":"master","skill_tree_url":"https://github.com/kubesphere/kubesphere/tree/master/skills/kubesphere-network-extension-operations"},"layout":"multi","source":"github","category":"kubesphere","frontmatter":{"name":"kubesphere-network-extension-operations","description":"Operate the KubeSphere network extension. Use when Codex needs to install, upgrade, configure, enable, disable, or inspect the `network` extension; manage Calico `IPPool` resources, namespace bindings, migrations, or network isolation flows; or consult the bundled network extension references in this skill."},"skills_sh_url":"https://skills.sh/kubesphere/kubesphere/kubesphere-network-extension-operations"},"updatedAt":"2026-05-18T18:52:39.837Z"}}