Calico key and path prefixes

  • Operator
  • Manifest

This document does not apply to operator installations of Calico.

The paths listed here are the key or path prefixes that a particular Calico component needs access to in etcd to function successfully.

Calico key and path prefixes - 图1note

The path prefixes listed here may change in the future and at that point anything referencing them (like etcd roles) would need to be updated appropriately.

calico/node

PathAccess
/calico/felix/v1/RW
/calico/felix/v2/RW
/calico/ipam/v2/RW
/calico/resources/v3/projectcalico.org/felixconfigurations/RW
/calico/resources/v3/projectcalico.org/nodes/RW
/calico/resources/v3/projectcalico.org/workloadendpoints/RW
/calico/resources/v3/projectcalico.org/clusterinformations/RW
/calico/resources/v3/projectcalico.org/ippools/RW
/calico/resources/v3/projectcalico.org/*R

Felix as a stand alone process

PathAccess
/calico/felix/v1/RW
/calico/felix/v2/RW
/calico/resources/v3/projectcalico.org/*R

CNI-plugin

PathAccess
/calico/ipam/v2/RW
/calico/resources/v3/projectcalico.org/workloadendpoints/RW
/calico/resources/v3/projectcalico.org/ippools/R
/calico/resources/v3/projectcalico.org/clusterinformations/R
/calico/resources/v3/projectcalico.org/nodes/*R

calico/kube-controllers

PathAccess
/calico/ipam/v2/RW
/calico/resources/v3/projectcalico.org/profiles/RW
/calico/resources/v3/projectcalico.org/networkpolicies/RW
/calico/resources/v3/projectcalico.org/nodes/RW
/calico/resources/v3/projectcalico.org/clusterinformations/RW
/calico/resources/v3/projectcalico.org/hostendpoints/RW
/calico/resources/v3/projectcalico.org/kubecontrollersconfigurations/RW
/calico/resources/v3/projectcalico.org/R

Calico key and path prefixes - 图2note

By default, calico/kube-controllers performs periodic compaction of the etcd data store. If you limit it to just these paths it will be unauthorized to perform this compaction, as that operation requires root privileges on the etcd cluster. You should configure auto-compaction on your etcd cluster and disable calico/kube-controllers periodic compaction.

OpenStack Calico driver for Neutron

PathAccess
/calico/resources/v3/projectcalico.org/RW
/calico/dhcp/v1/RW
/calico/dhcp/v2/RW
/calico/compaction/v1/RW
/calico/openstack/v1/RW
/calico/openstack/v2/RW
/calico/felix/v1/R
/calico/felix/v2/R

OpenStack Calico DHCP agent

PathAccess
/calico/resources/v3/projectcalico.org/R
/calico/dhcp/v1/R
/calico/dhcp/v2/*R

calicoctl (read only access)

PathAccess
/calico/ipam/v2/R
/calico/resources/v3/projectcalico.org/R

calicoctl (policy editor access)

PathAccess
/calico/ipam/v2/R
/calico/resources/v3/projectcalico.org/R
/calico/resources/v3/projectcalico.org/globalnetworkpolicies/RW
/calico/resources/v3/projectcalico.org/globalnetworksets/RW
/calico/resources/v3/projectcalico.org/networkpolicies/RW
/calico/resources/v3/projectcalico.org/networksets/RW
/calico/resources/v3/projectcalico.org/profiles/*RW

calicoctl (full read/write access)

PathAccess
/calico/ipam/v2/RW
/calico/resources/v3/projectcalico.org/RW