Table of Contents

• Introduction
• Understanding the Virtual Application Network
• The Heart of the System: Skupper Router
• Communication Flows and Protocols
• Configuration Management and Control
• Security and Authentication
• Deployment Patterns and Topologies
• Service Discovery and Load Balancing
• Observability and Monitoring
• Architectural Evolution
• Deployment Considerations
• Conclusions

Introduction

In today’s technological landscape, organizations increasingly find themselves managing distributed applications across multiple cloud infrastructures, private data centers, and edge environments. This complexity has given rise to new challenges in ensuring secure and reliable communications between geographically distributed services. Skupper emerges as an innovative solution that redefines the concept of application networking through the Virtual Application Network paradigm.

One of Skupper’s key strengths lies in its simplicity and accessibility. Unlike traditional networking solutions that require complex administrative privileges and extensive infrastructure modifications, Skupper can be deployed with minimal overhead and standard user permissions. The platform demonstrates remarkable versatility by running seamlessly across diverse environments including Kubernetes clusters, Podman containers, and bare metal edge devices, making it an ideal choice for heterogeneous infrastructure deployments.

Skupper operates in the networking stack between Layer 4 (transport) and Layer 7 (application), providing intelligent application-aware routing while maintaining the reliability and performance characteristics of lower-level protocols. This positioning allows it to understand service semantics while abstracting the underlying network complexity, creating a unique value proposition in the modern networking landscape.

To facilitate understanding of this complex architecture, this article is accompanied by a series of detailed diagrams that illustrate different aspects of the system: from general architecture to communication flows, from security models to deployment patterns. These diagrams provide complementary visual representations to the technical descriptions, making advanced architectural concepts more accessible.

Understanding the Virtual Application Network

At the core of Skupper’s architecture lies the concept of Virtual Application Network, a virtual network that abstracts the complexity of the underlying infrastructure to provide direct and secure connectivity between applications. Unlike traditional VPN solutions that operate at the network level, Skupper works at the application level, creating an intelligent communication fabric that semantically understands services and their interactions.

The Virtual Application Network distinguishes itself from traditional TCP/IP-based solutions by eliminating the need for complex network configurations, firewall rule management, and exposed public endpoints. While traditional networking requires careful coordination of IP addressing, routing tables, and security policies across multiple environments, Skupper’s VAN creates a service-centric overlay that abstracts these concerns entirely.

The following diagram illustrates the general architecture of a Virtual Application Network extending across multiple cloud infrastructures, showing how different components collaborate to create a unified communication plane:

The Skupper Virtual Application Network distinguishes itself by its ability to operate without requiring modifications to existing applications or opening ports in the perimeter network. This approach eliminates many of the complexities associated with configuring traditional VPN tunnels and significantly reduces the attack surface for potential security threats.

The Heart of the System: Skupper Router

The fundamental element of Skupper’s architecture is the router, a high-performance software component based on the AMQP 1.0 protocol. This router represents a specialized fork of the qpid-dispatch project, optimized specifically for Skupper use cases and the needs of modern multi-cloud networking.

The Skupper router implements sophisticated routing logic that goes beyond simple packet forwarding. Each router maintains a complete view of the network topology and uses advanced algorithms to determine optimal paths for message delivery. This distributed intelligence enables the system to automatically adapt to changes in network topology, such as adding new sites or temporary loss of connectivity.

From an architectural perspective, Skupper routers can operate in different modes. Interior routers represent complete network nodes that actively participate in routing protocols and can serve as transit points for traffic destined for other nodes. Edge routers, on the other hand, are designed for lighter deployments and connect to interior routers to gain access to the wider network, without providing transit capabilities.

Communication Flows and Protocols

To fully understand the architecture’s operation, it’s essential to analyze communication flows between different system components. The following diagram illustrates the temporal sequence of interactions, from connection establishment phases to operational application communications:

The diagram shows how the AMQP 1.0 protocol is used not only for transporting application messages but also for managing routing protocols, authentication, and monitoring. This protocol unification reduces operational complexity and improves system observability.

Configuration Management and Control

Skupper infrastructure management is handled by a controller component that implements the reconciliation pattern typical of the Kubernetes ecosystem. This controller continuously monitors the desired configuration state, specified through Custom Resource Definitions, and works to maintain alignment between desired and actual infrastructure state.

The controller manages dynamic router configuration through a ConfigMap-based mechanism containing configuration in JSON format. This configuration includes listener definitions, connectors, SSL profiles, and routing rules. The reconciliation process ensures that any configuration changes are automatically propagated to all interested components.

Certificate management represents a critical aspect of the architecture. Skupper implements a flexible Public Key Infrastructure that allows users to provide their own certificates when necessary, while maintaining the ability to automatically generate certificates for simpler scenarios. Certificates are managed through Kubernetes secrets and used to establish secure TLS connections between routers.

Security and Authentication

Skupper’s security architecture is designed around the zero-trust principle, where every communication must be authenticated and encrypted. The system uses the SASL EXTERNAL authentication mechanism for mutual TLS authentication, ensuring that every connection is bidirectionally authenticated using X.509 certificates.

The security model implements multiple layers of protection, from Certificate Authority management for each site to the use of dedicated SSL profiles for each connection type. The following diagram illustrates the complete PKI structure and access control mechanisms:

Inter-router connections exclusively use encrypted TLS channels, with each router presenting its own certificate during the connection handshake. This architecture eliminates the need for pre-shared keys or other more fragile authentication mechanisms.

Regarding external cluster access, Skupper supports multiple service exposure strategies. It can integrate with LoadBalancers, OpenShift Routes, standard Kubernetes Ingress Controllers, and more recently with the Gateway API. This flexibility allows adaptation of deployments to specific security policies and underlying infrastructure capabilities.

Deployment Patterns and Topologies

Skupper supports various deployment topologies to adapt to different architectural scenarios. Supported topological patterns include full mesh configurations for high availability scenarios where every site needs direct connectivity with all others, hub-and-spoke topologies for centralized architectures with many edge sites, and multi-tier hierarchical deployments that reflect enterprise infrastructure organizational structure.

The following diagram illustrates these different approaches and their specific characteristics in detail:

A distinctive feature of the architecture is its ability to operate through NAT and firewalls without requiring specific configurations. Routers can establish outbound connections to other routers, eliminating the need to open inbound ports in perimeter firewalls. This capability is particularly valuable in enterprise environments where security policies strictly limit inbound connectivity.

Resilience is built into the architecture through automatic failover mechanisms and routing reconvergence. When a router becomes unreachable, the routing protocol automatically adapts to route traffic through alternative paths. This self-healing occurs without manual intervention and with minimal service interruption.

Service Discovery and Load Balancing

Skupper’s service discovery system operates through automatic propagation of service information across the network. When a service is exposed at a site, this information is automatically propagated to all other sites in the Virtual Application Network, making the service immediately available for connection by remote clients.

Load balancing is implemented at the router level using various configurable strategies. Balancing can be based on round-robin, least connections, or other more sophisticated algorithms. The system maintains information about service endpoint health status and can automatically exclude unresponsive endpoints from the balancing pool.

An advanced feature of the system is its ability to understand application protocol semantics. For HTTP protocols, for example, the router can implement routing based on headers, paths, or other protocol elements, providing service mesh capabilities without the complexity of a traditional service mesh deployment.

Observability and Monitoring

The architecture includes dedicated components for network observability and monitoring. The network observer is a separate component that connects to the Virtual Application Network to collect operational telemetry from all sites. This data is exposed through standard APIs and Prometheus metrics, providing complete visibility into network status and performance.

The system collects detailed metrics on latency, throughput, error rate, and resource utilization. This information is crucial for troubleshooting, performance optimization, and capacity planning. The Skupper web console provides intuitive visualization of these metrics, including topological network maps and real-time performance dashboards.

Architectural Evolution

Skupper version 2 represents a significant architectural evolution from the previous version. The main focus has been on supporting a fully declarative model that facilitates automation and integration with CI/CD frameworks. The introduction of Custom Resource Definitions provides a more intuitive and flexible interface for Kubernetes users.

Architectural improvements in the main components have increased system modularity and maintainability. The new design clearly separates responsibilities between controller, router, and observability components, facilitating testing, debugging, and future system evolution.

Deployment Considerations

When designing a Skupper deployment, several architectural considerations influence design decisions. The choice between mesh and hub-and-spoke topologies depends on application traffic patterns and latency requirements. Deployments requiring low latency between all sites might benefit from direct connections, while architectures with predominantly centralized traffic might prefer a hub-and-spoke model.

Capacity planning must consider not only application traffic throughput but also routing protocol and telemetry overhead. Skupper routers are designed to be efficient, but in large deployments with many sites and services, resources dedicated to maintaining network state can become significant.

Security strategy must balance management ease with compliance requirements. While Skupper can operate with auto-generated certificates for simplicity, enterprise environments might require integration with existing Certificate Authorities and more rigorous certificate rotation processes.

Conclusions

Skupper’s architecture represents an innovative approach to modern multi-cloud networking challenges. Through its Virtual Application Network, it provides an elegant solution that abstracts infrastructure complexity while maintaining high performance and robust security. Its modular design and support for declarative deployments make it particularly suitable for cloud-native environments and modern DevOps practices.

The architectural diagrams presented in this article illustrate the sophistication of Skupper’s design: from orchestration of distributed components to granular security management, from advanced communication protocols to flexibility of topological patterns. This visual representation highlights how every aspect of the architecture has been designed to operate synergistically, creating a system that is greater than the sum of its parts.

The ability to operate without modifications to existing applications and without opening perimeter firewall ports makes it a pragmatic solution for organizations requiring multi-cloud connectivity without the operational complexity of traditional VPN solutions. As technology continues to evolve, Skupper positions itself as a fundamental component in the arsenal of architects designing modern distributed systems, offering an optimal balance between operational simplicity, robust security, and architectural flexibility.