Loading
Operate the KubeSphere network extension. Use when Codex needs to install, upgrade, configure, enable, disable, or inspect the `network` extension; manage Calico `IPPool` resources, namespace bindings
The skill file stays in the publisher's repository.
Paste the copied command in a terminal. It installs this SKILL.md into that agent.
npx skills add kubesphere/kubesphere --skill kubesphere-network-extension-operations -a cursor -y
Operate the KubeSphere network extension. Use when Codex needs to install, upgrade, configure, enable, disable, or inspect the `network` extension; manage Calico `IPPool` resources, namespace bindings, migrations, or network isolation flows; or consult the bundled network extension references in this skill.
Operate the KubeSphere network extension. Use when Codex needs to install, upgrade, configure, enable, disable, or inspect the `network` extension; manage Calico `IPPool` resources, namespace bindings, migrations, or network isolation flows; or consult the bundled network extension references in this skill.
network extension; manage Calico resources, namespace bindings, migrations, or network isolation flows; or consult the bundled network extension references in this skill.IPPoolOperate the network extension and its related resources with kubectl plus the bundled references in this skill. Prefer the live cluster state first, then use the copied extension references here to resolve packaging details, API shapes, and product behavior.
network extensionInstallPlan.spec.config for IPPool or NetworkPolicy feature togglesIPPool resources, namespace bindings, occupancy, and migration flowsNetworkPolicy and namespace-level network isolation policiesnetwork.kubesphere.io IPPool CRDs are still the CRUD source of truthcalicoRead only the references needed for the current request:
Useful rg patterns for the larger references:
rg -n "ippool|networkpol|isolate" skills/kubesphere-network-extension-operations/references/api_doc.md
rg -n "^ /(kapis|apis)/.*(ippool|networkpol)" skills/kubesphere-network-extension-operations/references/swagger.yaml
networknetworkMulticluster1.3.0global.ippool.type=calicoglobal.ippool.enableglobal.ippool.webhookglobal.networkPolicy.enablekubectl must already be configured for the target cluster.kubectl get extension network
kubectl get installplan network -o yaml
kubectl get extensionversion.kubesphere.io -l kubesphere.io/extension-ref=network
kubectl get crd ippools.crd.projectcalico.org
kubectl get workspace <workspace-name> -o yaml
kubectl get namespace <namespace-name> -o yaml
Use fixed resource names:
networknetworkWhen creating or updating an InstallPlan:
metadata.name and spec.extension.name both equal to network.upgradeStrategy: Manual.clusterScheduling only when the user explicitly needs agent placement in member clusters.spec.config unless the user asked for non-default settings.Minimal default example:
apiVersion: kubesphere.io/v1alpha1
kind: InstallPlan
metadata:
name: network
spec:
enabled: true
extension:
name: network
version: <exact-version>
upgradeStrategy: Manual
Optional config snippet when the user asks to customize features:
config: |
global:
ippool:
enable: true
type: calico
webhook: true
networkPolicy:
enable: true
Prefer this inspection flow before install or upgrade:
kubectl get extension network -o yaml
kubectl get extensionversion network-<exact-version> -o yaml
kubectl get installplan network -o yaml
Treat Calico IPPools as the CRUD source of truth:
/apis/crd.projectcalico.org/v1/ippools/kapis/network.kubesphere.io/v1alpha2/ippools/kapis/network.kubesphere.io/v1alpha2/ippools/{name}POST /kapis/network.kubesphere.io/v1alpha2/ippoolmigrationsGET /kapis/network.kubesphere.io/v1alpha2/ippools/{name}/migrateGET /kapis/network.kubesphere.io/v1alpha2/namespaces/{namespace}/ippoolsOperational rules:
network.kubesphere.io.Suggested live inspection commands:
kubectl get ippools.crd.projectcalico.org
kubectl get ippools.crd.projectcalico.org <ippool-name> -o yaml
kubectl get namespace <namespace-name> -o yaml
kubectl get pods -A -o wide
Use Kubernetes networking.k8s.io/v1 endpoints for standard NetworkPolicy CRUD:
/kapis/networking.k8s.io/v1/networkpolicies/kapis/networking.k8s.io/v1/namespaces/{namespace}/networkpoliciesPOST /kapis/networking.k8s.io/v1/namespaces/{namespace}/networkpoliciesDELETE /kapis/networking.k8s.io/v1/namespaces/{namespace}/networkpolicies/{name}The bundled API document uses inconsistent prose for the annotation key: its status-check text mentions kubesphere.io/workspace-isolate, while its patch examples use kubesphere.io/network-isolate.
Follow this rule:
kubesphere.io/network-isolate: enabled.Typical patch body:
{
"metadata": {
"annotations": {
"kubesphere.io/network-isolate": "enabled"
}
}
}
Use the KubeSphere API for project-specific isolation policies:
GET /kapis/network.kubesphere.io/v1alpha1/namespaces/{namespace}/namespacenetworkpoliciesPOST /kapis/network.kubesphere.io/v1alpha1/namespaces/{namespace}/namespacenetworkpoliciesPUT /kapis/network.kubesphere.io/v1alpha1/namespaces/{namespace}/namespacenetworkpolicies/{name}DELETE /kapis/network.kubesphere.io/v1alpha1/namespaces/{namespace}/namespacenetworkpolicies/{name}When creating or filtering these policies, preserve these labels exactly:
kubesphere.io/policy-type=egresskubesphere.io/policy-type=ingresskubesphere.io/policy-traffic=insidekubesphere.io/policy-traffic=outsideWhen the extension install or upgrade is stuck, gather state in this order:
kubectl describe extension network
kubectl describe installplan network
kubectl get installplan network -o jsonpath='{.status.targetNamespace}{"\n"}'
kubectl get pods,svc -n <target-namespace>
kubectl get jobs -A | rg 'helm-upgrade-network|network'
kubectl get pods -n kubesphere-system
If the InstallPlan already points to a target namespace, inspect the Helm job pod logs and any extension pods in that namespace before changing manifests again.
extension, installplan, Calico IPPools, and the live workspace or namespace objects as the source of truth.