feat: add filter for KubeSpan advertised networks by p2pdkivenko · Pull Request #12758 · siderolabs/talos

p2pdkivenko · 2026-02-09T15:08:06Z

Pull Request

What? (description)

Add a new advertisedNetworks filter under filters configuration that allows excluding specific networks (e.g., private IP ranges) from being advertised over KubeSpan when advertiseKubernetesNetworks is enabled.
#12358 - issues for this changes

Why? (reasoning)

This is useful for hybrid cloud environments where private pod CIDRs should not be routed through KubeSpan.

Acceptance

Please use the following checklist:

you linked an issue (if applicable)
you included tests (if applicable)
you ran conformance (make conformance)
you formatted your code (make fmt)
you linted your code (make lint)
you generated documentation (make docs)
you ran unit-tests (make unit-tests)

See make help for a description of the available targets.

internal/app/machined/pkg/controllers/cluster/local_affiliate.go

Copilot

Pull request overview

Adds support for filtering which Kubernetes networks (e.g., Pod CIDRs) get advertised over KubeSpan when advertiseKubernetesNetworks is enabled, enabling hybrid setups to avoid routing private ranges through KubeSpan.

Changes:

Introduces filters.advertisedNetworks in the machine config schema/docs and wires it through config providers and validation.
Extends the KubeSpan Config resource/API (proto + generated code) with advertised_network_filters.
Applies the configured filters when populating Affiliate.KubeSpan.AdditionalAddresses, with test coverage for both config parsing/validation and runtime behavior.

Reviewed changes

Copilot reviewed 23 out of 23 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
website/content/v1.13/schemas/config.schema.json	Documents `filters.advertisedNetworks` in the website schema for v1.13.
website/content/v1.13/reference/configuration/v1alpha1/networkkubespan.md	Adds `advertisedNetworks` to rendered v1alpha1 KubeSpan reference docs.
website/content/v1.13/reference/configuration/network/kubespanconfig.md	Adds `advertisedNetworks` examples and field table entry for KubeSpan config docs.
website/content/v1.13/reference/api.md	Adds `advertised_network_filters` to the published API reference table.
pkg/machinery/resources/kubespan/deep_copy.generated.go	Deep-copy support for `AdvertisedNetworkFilters`.
pkg/machinery/resources/kubespan/config.go	Adds `AdvertisedNetworkFilters` to the KubeSpan Config resource spec.
pkg/machinery/config/types/v1alpha1/v1alpha1_validation_test.go	Adds validation tests for good/bad advertised network filters.
pkg/machinery/config/types/v1alpha1/v1alpha1_validation.go	Validates `filters.advertisedNetworks` CIDR/address inputs.
pkg/machinery/config/types/v1alpha1/v1alpha1_types.go	Adds `advertisedNetworks` to the v1alpha1 KubeSpanFilters type.
pkg/machinery/config/types/v1alpha1/v1alpha1_provider.go	Exposes `AdvertisedNetworks()` via the provider interface implementation.
pkg/machinery/config/types/network/network_doc.go	Adds doc generation for the `advertisedNetworks` filter field and example.
pkg/machinery/config/types/network/kubespan_test.go	Adds unmarshal/interface/validate tests for advertised network filters.
pkg/machinery/config/types/network/kubespan.go	Adds `ConfigAdvertisedNetworks` field, docs, validation, and interface method.
pkg/machinery/config/types/network/deep_copy.generated.go	Deep-copy support for `ConfigAdvertisedNetworks`.
pkg/machinery/config/schemas/config.schema.json	Adds `advertisedNetworks` to the machinery JSON schema.
pkg/machinery/config/config/network.go	Extends `NetworkKubeSpanFilters` interface with `AdvertisedNetworks()`.
pkg/machinery/api/resource/definitions/kubespan/kubespan_vtproto.pb.go	vtproto marshal/size/unmarshal support for field 10.
pkg/machinery/api/resource/definitions/kubespan/kubespan.pb.go	Adds `AdvertisedNetworkFilters` to generated protobuf Go types.
internal/app/machined/pkg/controllers/kubespan/config_test.go	Ensures controller maps advertised network filters into KubeSpan config resource.
internal/app/machined/pkg/controllers/kubespan/config.go	Wires `filters.advertisedNetworks` into `ConfigSpec.AdvertisedNetworkFilters`.
internal/app/machined/pkg/controllers/cluster/local_affiliate_test.go	Tests filtering behavior for advertised Pod CIDRs at runtime.
internal/app/machined/pkg/controllers/cluster/local_affiliate.go	Applies `AdvertisedNetworkFilters` to `Affiliate.KubeSpan.AdditionalAddresses`.
api/resource/definitions/kubespan/kubespan.proto	Adds `repeated string advertised_network_filters = 10;` to the API.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

pkg/machinery/config/types/network/kubespan.go

pkg/machinery/config/types/v1alpha1/v1alpha1_validation_test.go

pkg/machinery/config/types/network/kubespan_test.go

pkg/machinery/config/types/v1alpha1/v1alpha1_validation.go

This is extracted part of PR siderolabs/talos#12758 The goal is to make each peer to publish its addresses and filters to the discovery service, so that other peers can apply the filters accordingly to build a proper view of advertised addresses. We don't apply filtering on "client" side as `Addresses` field is also used in generic discovery, so it's good to report all addresses and also KubeSpan-specific filter for advertised addresses. Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>

Copilot

Pull request overview

Copilot reviewed 39 out of 40 changed files in this pull request and generated 9 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

website/content/v1.13/schemas/config.schema.json

website/content/v1.13/reference/configuration/network/kubespanconfig.md

website/content/v1.13/reference/api.md

pkg/machinery/config/types/v1alpha1/v1alpha1_provider.go

website/content/v1.13/reference/configuration/v1alpha1/networkkubespan.md

website/content/v1.13/reference/configuration/network/kubespanconfig.md

website/content/v1.13/reference/api.md

pkg/machinery/resources/kubespan/config.go

smira · 2026-02-11T17:33:40Z

website/content/v1.13/reference/configuration/v1alpha1/networkkubespan.md

this file shouldn't have been there in the first place, it was a leftover from previous refactoring, so gc it

smira · 2026-02-11T17:34:13Z

internal/app/machined/pkg/controllers/kubespan/peer_spec.go

 					builder.Add(ip)
 				}

+				for _, ipPrefix := range spec.KubeSpan.ExcludeAdvertisedNetworks {


these 3 lines are the gist of this PR, everything else is distributing excludeAdvertiseNetworks across peers

Copilot

Pull request overview

Copilot reviewed 39 out of 40 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Add advertisedNetworks filter to KubeSpan configuration that allows filtering which additional networks (e.g., pod CIDRs) are advertised over KubeSpan when advertiseKubernetesNetworks is enabled. Signed-off-by: Daniil Kivenko <daniil.kivenko@p2p.org> Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>

smira · 2026-02-12T11:38:48Z

/m

github-project-automation bot added this to Planning Feb 9, 2026

github-project-automation bot moved this to To Do in Planning Feb 9, 2026

talos-bot moved this from To Do to In Review in Planning Feb 9, 2026

p2pdkivenko force-pushed the feat/kubespan-advertised-networks-filter branch 3 times, most recently from 90a5619 to c9846c6 Compare February 10, 2026 01:52

smira self-assigned this Feb 10, 2026

smira reviewed Feb 10, 2026

View reviewed changes

internal/app/machined/pkg/controllers/cluster/local_affiliate.go Outdated Show resolved Hide resolved

smira requested a review from Copilot February 10, 2026 15:41

Copilot started reviewing on behalf of smira February 10, 2026 15:42 View session

Copilot AI reviewed Feb 10, 2026

View reviewed changes

smira mentioned this pull request Feb 10, 2026

feat: add advertised filters to discovery data siderolabs/discovery-api#10

Merged

smira force-pushed the feat/kubespan-advertised-networks-filter branch 2 times, most recently from 1ef30ff to 3da81d7 Compare February 11, 2026 16:59

smira added the integration/misc-1 label Feb 11, 2026

smira requested a review from Copilot February 11, 2026 16:59

Copilot started reviewing on behalf of smira February 11, 2026 17:00 View session

smira force-pushed the feat/kubespan-advertised-networks-filter branch 2 times, most recently from 70554a1 to 7b8264f Compare February 11, 2026 17:03

smira added this to Backports to v1.12 Feb 11, 2026

github-project-automation bot moved this to Proposed in Backports to v1.12 Feb 11, 2026

Copilot AI reviewed Feb 11, 2026

View reviewed changes

smira force-pushed the feat/kubespan-advertised-networks-filter branch 3 times, most recently from d0f9a82 to 25742e0 Compare February 11, 2026 17:32

smira requested a review from Copilot February 11, 2026 17:32

Copilot started reviewing on behalf of smira February 11, 2026 17:33 View session

smira reviewed Feb 11, 2026

View reviewed changes

Copilot AI reviewed Feb 11, 2026

View reviewed changes

oguzkilcan approved these changes Feb 11, 2026

View reviewed changes

github-project-automation bot moved this from In Review to Approved in Planning Feb 11, 2026

smira force-pushed the feat/kubespan-advertised-networks-filter branch from 25742e0 to 70c6c21 Compare February 12, 2026 11:03

talos-bot added the status/ok-to-merge label Feb 12, 2026

talos-bot merged commit 70c6c21 into siderolabs:main Feb 12, 2026
58 checks passed

github-project-automation bot moved this from Approved to Done in Planning Feb 12, 2026

smira moved this from Proposed to Accepted in Backports to v1.12 Feb 12, 2026

smira moved this from Accepted to In Progress in Backports to v1.12 Feb 12, 2026

smira mentioned this pull request Feb 12, 2026

backports: for v1.12.4 #12777

Merged

smira moved this from In Progress to Backported in Backports to v1.12 Feb 12, 2026

Uh oh!

Conversation

p2pdkivenko commented Feb 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request

What? (description)

Why? (reasoning)

Acceptance

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

smira Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

smira Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

smira commented Feb 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

p2pdkivenko commented Feb 9, 2026 •

edited

Loading