AdvFab Open source · Apache-2.0

Network evidence you can reason about.

AdvFab is an observe-first, provider-neutral network evidence controller for Kubernetes. It turns Linux, Cilium, FRR, DNS, Gateway API and declared topology facts into versioned observations, and never makes missing evidence look healthy.

Quick startExplore the code
Path assessments15
Ready nodes13/15
Trade-off triangles3
Observation episodes200+
Evidence fabricSelect a link, then toggle the apply gates.
Illustrative topology. Link states come from the public, hashed snapshot.

What it answers

Four questions, answered with evidence.

Collectors create versioned measurements, measurements become scoped evidence, and only compatible evidence contributes to an assessment.

01

Reachability

Which network paths are currently reachable and fresh?

NetworkPathAssessment resources carry state, scope and observation time.

02

Provenance

What evidence supports a routing or placement decision?

Every assessment references the measurements it was derived from.

03

Uncertainty

Which dimensions are unknown, stale, partial or contradictory?

Missing evidence is reported as unknown. It is never filled in as healthy.

04

Impact

Did a separately authorized change improve the same measured scope?

The O / S / I model keeps observed outcomes apart from assumptions about a change.

Stable boundaries

It owns evidence. Everything else keeps its authority.

Consumers use CRDs and the advertised Observation API. They never read internal ConfigMaps or depend on a release name, namespace or UI.

AdvFab owns

  • Measurement definitions · symbols, units, scopes, windows and uncertainty
  • Bounded collection · from Linux, Cilium, FRR, DNS and Gateway API
  • Observation resources · versioned CRDs under networking.advfab.org
  • Guarded apply · only when explicitly authorized

Stays with its owner

  • Kubernetes, Cilium, FRR · their own lifecycle and authority
  • Routers and DNS providers · configuration is never taken over
  • Telemetry storage · any metrics backend
  • Headlamp client · installed and released independently

Install

Public defaults are disabled.

The chart ships with no private inventory or credentials. Observation is enabled with a reviewed values file; mutation stays off.

  1. Install the signed OCI chart into its own namespace.
  2. Enable observation with a reviewed values file (applyEnabled: false).
  3. Read the assessments with kubectl or the Headlamp plugin.
Read the docs →
install.sh
# Install (observation disabled by default)
helm upgrade --install advanced-fabric \
  oci://ghcr.io/advanced-fabrics/charts/advanced-fabric \
  --version 1.0.0-rc.14 \
  --namespace advanced-fabric --create-namespace \
  --values my-values.yaml

# Inspect the evidence
kubectl get advancedfabrics.networking.advfab.org
kubectl get networkpathassessments.networking.advfab.org

Open-source cloud family

Three contracts that compose.

AdvFab produces path evidence, Public Edge consumes it to answer DNS, and Among Clusters connects clusters without sharing their keys. RE8CH Cloud runs all three as a managed service.

AdvFab

Network evidence controller for Kubernetes.

Open source Public Edge

Health-aware public ingress and authoritative DNS.

Open source Among Clusters

Sovereign cluster peering for BYOC services.

Open source RE8CH Cloud

The managed cluster network built on these projects.

Managed

Built in public.

AFEPs record standards decisions. Conformance claims bind to immutable artifacts. Releases include signatures, provenance and SBOMs. AdvFab is independently governed and is not a CNCF project.

Open the WikiGovernanceRoadmap