# Kubesphere Network Extension Operations

Operate the KubeSphere network extension.

- Repository: https://github.com/kubesphere/kubesphere (17074 stars)
- Category: Engineering
- License: see repository
- Last updated: 2026-07-15
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add kubesphere/kubesphere --skill kubesphere-network-extension-operations -g -a claude-code -y`
Codex: `npx skills add kubesphere/kubesphere --skill kubesphere-network-extension-operations -g -a codex -y`
Cursor: `npx skills add kubesphere/kubesphere --skill kubesphere-network-extension-operations -g -a cursor -y`
Gemini CLI: `npx skills add kubesphere/kubesphere --skill kubesphere-network-extension-operations -g -a gemini-cli -y`

## Description

Operate the KubeSphere network extension. Use when Codex needs to install, upgrade, configure, enable, disable, or inspect the `network` extension; manage Calico `IPPool` resources, namespace bindings, migrations, or network isolation flows; or consult the bundled network extension references in this skill.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# KubeSphere Network Extension Operations

Operate the `network` extension and its related resources with `kubectl` plus the bundled references in this skill. Prefer the live cluster state first, then use the copied extension references here to resolve packaging details, API shapes, and product behavior.

## When to Use

- Install, upgrade, enable, disable, or inspect the `network` extension
- Edit `InstallPlan.spec.config` for IPPool or NetworkPolicy feature toggles
- Verify packaging details such as version, images, dependencies, or installation mode
- Manage Calico `IPPool` resources, namespace bindings, occupancy, and migration flows
- Manage cluster, workspace, or project network isolation behavior
- Create, inspect, or troubleshoot Kubernetes `NetworkPolicy` and namespace-level network isolation policies

## Do Not Use

- Manage unrelated extensions
- Assume deprecated `network.kubesphere.io` IPPool CRDs are still the CRUD source of truth
- Assume a non-Calico IPPool backend; the extension values currently support only `calico`
- Patch workspace, namespace, or IPPool binding metadata without reading the current live object first

## Read First

Read only the references needed for the current request:

- Product behavior and upgrade caveats: [references/README_zh.md](references/README_zh.md)
- IPPool and NetworkPolicy API flows: [references/api_doc.md](references/api_doc.md)
- Extension defaults and feature toggles: [references/values.yaml](references/values.yaml)
- Packaging facts such as version, dependencies, images, and installation mode: [references/extension.yaml](references/extension.yaml)
- Full endpoint schema details only when request or response fields matter: [references/swagger.yaml](references/swagger.yaml)

Useful `rg` patterns for the larger references:

The rest: https://github.com/kubesphere/kubesphere/blob/HEAD/skills/kubesphere-network-extension-operations/SKILL.md