SD-WAN operator: Cilium Mesh -- SD-WAN integration

The SD-WAN operator is a simple Kubernetes controller that enforces Cilium Mesh traffic management policies across a Cisco SD-WAN network substrate. The operator uses the Δ-controller Kubernetes operator framework.

• A Kubernetes cluster (v1.28+)
• kubectl access to the cluster
• A Cisco vManage instance with API access credentials
• helm v3+

Create a values.yaml with your vManage connection details:

vmanage:
  url: https://<vmanage-host>:443
  username: admin
  password: <your-password>
  insecure: false
  # in-place-update: true  # experimental, see below

By default every change deactivates the operator's central policy, edits its lists and app-route definition, and activates it again; while it is deactivated (about 8 s per change), the edges route all annotated Services without the policy. With in-place-update: true (or the -in-place-update flag, inPlaceUpdate: true in the chart's values) the operator edits the objects of the active policy instead, so the policy is never off. vManage answers such an edit with an edit session (processId) and the device templates it affects (masterTemplatesAffected, the vSmarts' template); the operator pushes those templates with their device inputs marked as edited, as vManage's UI does for an edited policy definition (POST /template/device/config/attachcli for a CLI template, as the vSmarts' usually is, attachfeature for a feature template), which applies the edit and ends the session. Without affected templates it reactivates the policy (POST /template/policy/vsmart/activate/<id>?confirm=true with {"isEdited":true}). If vManage reports the policy locked (POLICY0013), the operator applies that change with a deactivate/activate cycle, which ends the session. This mode is experimental: check on your vManage version that the push takes effect before relying on it.

helm repo add sdwan-operator https://l7mp.github.io/sdwan-operator/
helm repo update
helm install sdwan-operator sdwan-operator/sdwan-operator \
  --namespace sdwan-operator \
  --create-namespace \
  -f values.yaml

kubectl get pods -n sdwan-operator

This project was featured in the CNCF blog post Connecting distributed Kubernetes with Cilium and SD-WAN: Building an intelligent network fabric.

Copyright 2025-2026 by its authors. Some rights reserved. See AUTHORS.

Apache License - see LICENSE for full text.