Configuration

antrea-agent

Command line options

  1. --config string                    The path to the configuration file
  2. --v Level                          number for the log level verbosity

Use antrea-agent -h to see complete options.

Configuration

  1. # clientConnection specifies the kubeconfig file and client connection settings for the agent
  2. # to communicate with the apiserver.
  3. #clientConnection:
  4.   # Path of the kubeconfig file that is used to configure access to a K8s cluster.
  5.   # If not specified, InClusterConfig will be used.
  6.   #kubeconfig: <PATH_TO_KUBE_CONF>
  8. # antreaClientConnection specifies the kubeconfig file and client connection settings for the
  9. # agent to communicate with the Antrea Controller apiserver.
  10. #antreaClientConnection:
  11.   # Path of the kubeconfig file that is used to configure access to the Antrea Controller
  12.   # apiserver. If not specified, InClusterConfig will be used.
  13.   #kubeconfig: <PATH_TO_ANTREA_KUBE_CONF>
  15. # Name of the OpenVSwitch bridge antrea-agent will create and use.
  16. # Make sure it doesn't conflict with your existing OpenVSwitch bridges.
  17. #ovsBridge: br-int
  19. # Datapath type to use for the OpenVSwitch bridge created by Antrea. Supported values are:
  20. # - system
  21. # - netdev
  22. # 'system' is the default value and corresponds to the kernel datapath. Use 'netdev' to run
  23. # OVS in userspace mode. Userspace mode requires the tun device driver to be available.
  24. #ovsDatapathType: system
  26. # Name of the gateway interface for the local Pod subnet. antrea-agent will create the interface on the OVS bridge.
  27. # Make sure it doesn't conflict with your existing interfaces.
  28. #hostGateway: antrea-gw0
  30. # Encapsulation mode for communication between Pods across Nodes, supported values:
  31. # - geneve (default)
  32. # - vxlan
  33. # - gre
  34. # - stt
  35. #tunnelType: geneve
  37. # Whether or not to enable IPsec encryption of tunnel traffic. IPsec encryption is only supported
  38. # for the GRE tunnel type.
  39. #enableIPSecTunnel: false
  41. # Default MTU to use for the host gateway interface and the network interface of each Pod.
  42. # If omitted, antrea-agent will discover the MTU of the Node's primary interface and
  43. # also adjust MTU to accommodate for tunnel encapsulation overhead (if applicable).
  44. #defaultMTU: 1450
  46. # CIDR Range for services in cluster. It's required to support egress network policy, should
  47. # be set to the same value as the one specified by --service-cluster-ip-range for kube-apiserver.
  48. #serviceCIDR: 10.96.0.0/12
  50. # Mount location of the /proc directory. The default is "/host", which is appropriate when
  51. # antrea-agent is run as part of the Antrea DaemonSet (and the host's /proc directory is mounted
  52. # as /host/proc in the antrea-agent container). When running antrea-agent as a process,
  53. # hostProcPathPrefix should be set to "/" in the YAML config.
  54. #hostProcPathPrefix: /host
  56. # The port for the antrea-agent APIServer to serve on.
  57. #apiPort: 10350

antrea-controller

Command line options

  1. --config string                    The path to the configuration file
  2. --v Level                          number for the log level verbosity

Use antrea-controller -h to see complete options.

Configuration

  1. # clientConnection specifies the kubeconfig file and client connection settings for the 
  2. # controller to communicate with the apiserver.
  3. clientConnection:
  4.   # Path of the kubeconfig file that is used to configure access to a K8s cluster.
  5.   # If not specified, InClusterConfig will be used, which handles API host discovery and authentication automatically.
  6.   #kubeconfig: <PATH_TO_KUBE_CONF>
  8. # The port for the antrea-controller APIServer to serve on.
  9. #apiPort: 10349
  11. # Indicates whether to use auto-generated self-signed TLS certificate.
  12. # If false, A Secret named "antrea-controller-tls" must be provided with the following keys:
  13. #   ca.crt: <CA certificate>
  14. #   tls.crt: <TLS certificate>
  15. #   tls.key: <TLS private key>
  16. # And the Secret must be mounted to directory "/var/run/antrea/antrea-controller-tls" of the
  17. # antrea-controller container.
  18. #selfSignedCert: true

CNI configuration

A typical CNI configuration looks like this:

  1.   {
  2.     "cniVersion":"0.3.0",
  3.     "name": "antrea",
  4.     "plugins": [
  5.       {
  6.         "type": "antrea",
  7.         "ipam": {
  8.           "type": "host-local"
  9.         }
  10.       },
  11.       {
  12.         "type": "portmap",
  13.         "capabilities": {
  14.           "portMappings": true
  15.         }
  16.       }
  17.     ]
  18.   }

You can also set the MTU (for the Pod’s network interface) in the CNI configuration using "mtu": <MTU_SIZE>. When using an antrea.yml manifest, the MTU should be set with the antrea-agent defaultMTU configuration parameter, which will apply to all Pods and the host gateway interface on every Node. It is strongly discouraged to set the "mtu" field in the CNI configuration to a value that does not match the defaultMTU parameter, as it may lead to performance degradation or packet drops.

Antrea enables portmap CNI plugin by default to support hostPort functionality for Pods. In order to disable the portmap plugin, remove the following from Antrea CNI config:

  1. {
  2.   "type": "portmap",
  3.   "capabilities": {
  4.     "portMappings": true
  5.   }
  6. }