Felix configuration

A Felix configuration resource (FelixConfiguration) represents Felix configuration options for the cluster.

See Configuring Felix for more details.

Sample YAML

  1. apiVersion: projectcalico.org/v3
  2. kind: FelixConfiguration
  3. metadata:
  4. name: default
  5. spec:
  6. ipv6Support: false
  7. ipipMTU: 1400
  8. chainInsertMode: Append

Felix configuration definition

Metadata

FieldDescriptionAccepted ValuesSchema
nameUnique name to describe this resource instance. Required.Alphanumeric string with optional ., _, or -.string
  • Calico automatically creates a resource named default containing the global default configuration settings for Felix. You can use calicoctl to view and edit these settings
  • The resources with the name node.<nodename> contain the node-specific overrides, and will be applied to the node <nodename>. When deleting a node the FelixConfiguration resource associated with the node will also be deleted.

Spec

FieldDescriptionAccepted ValuesSchemaDefault
awsSrcDstCheckControls automatically setting source-destination-check on an AWS EC2 instance running Felix. Setting the value to Enable will set the check value in the instance description to true. For Disable, the check value will be false. Setting must be Disable if you want the EC2 instance to process traffic not matching the host interface IP address. For example, EKS cluster using Calico CNI with VXLANMode=CrossSubnet. Check IAM role and profile configuration for setting the necessary permission for this setting to work.DoNothing, Enable, DisablestringDoNothing
chainInsertModeControls whether Felix hooks the kernel’s top-level iptables chains by inserting a rule at the top of the chain or by appending a rule at the bottom. Insert is the safe default since it prevents Calico’s rules from being bypassed. If you switch to Append mode, be sure that the other rules in the chains signal acceptance by falling through to the Calico rules, otherwise the Calico policy will be bypassed.Insert, AppendstringInsert
healthTimeoutOverridesA list of overrides for Felix’s internal liveness/readiness timeouts.see belowList of HealthTimeoutOverride objects[]
dataplaneWatchdogTimeoutDeprecated, use healthTimeoutOverrides instead. Timeout before the main dataplane goroutine is determined to have hung and Felix will report non-live and non-ready. Can be increased if the liveness check incorrectly fails (for example if Felix is running slowly on a heavily loaded system).90s, 120s, 10m etc.duration90s
defaultEndpointToHostActionThis parameter controls what happens to traffic that goes from a workload endpoint to the host itself (after the traffic hits the endpoint egress policy). By default Calico blocks traffic from workload endpoints to the host itself with an iptables “DROP” action. If you want to allow some or all traffic from endpoint to host, set this parameter to Return or Accept. Use Return if you have your own rules in the iptables “INPUT” chain; Calico will insert its rules at the top of that chain, then Return packets to the “INPUT” chain once it has completed processing workload endpoint egress policy. Use Accept to unconditionally accept packets from workloads after processing workload endpoint egress policy.Drop, Return, AcceptstringDrop
deviceRouteSourceAddressIPv4 address to set as the source hint for routes programmed by Felix. When not set the source address for local traffic from host to workload will be determined by the kernel.IPv4string“”
deviceRouteSourceAddressIPv6IPv6 address to set as the source hint for routes programmed by Felix. When not set the source address for local traffic from host to workload will be determined by the kernel.IPv6string“”
deviceRouteProtocolThis defines the route protocol added to programmed device routes.ProtocolintRTPROT_BOOT
externalNodesCIDRListA comma-delimited list of CIDRs of external non-calico nodes that can source tunnel traffic for acceptance by calico-nodes.IPv4string“”
failsafeInboundHostPortsUDP/TCP/SCTP protocol/cidr/port groupings that Felix will allow incoming traffic to host endpoints on irrespective of the security policy. This is useful to avoid accidentally cutting off a host with incorrect configuration. The default value allows SSH access, etcd, BGP, DHCP and the Kubernetes API.List of ProtoPort

- net: “”
  protocol: tcp
  port: 22
- net: “”
  protocol: udp
  port: 68
- net: “”
  protocol: tcp
  port: 179
- net: “”
  protocol: tcp
  port: 2379
- net: “”
  protocol: tcp
  port: 2380
- net: “”
  protocol: tcp
  port: 5473
- net: “”
  protocol: tcp
  port: 6443
- net: “”
  protocol: tcp
  port: 6666
- net: “”
  protocol: tcp
  port: 6667

failsafeOutboundHostPortsUDP/TCP/SCTP protocol/port groupings that Felix will allow outgoing traffic from host endpoints to irrespective of the security policy. This is useful to avoid accidentally cutting off a host with incorrect configuration. The default value opens etcd’s standard ports to ensure that Felix does not get cut off from etcd as well as allowing DHCP, DNS, BGP and the Kubernetes API.List of ProtoPort

- net: “”
  protocol: udp
  port: 53
- net: “”
  protocol: udp
  port: 67
- net: “”
  protocol: tcp
  port: 179
- net: “”
  protocol: tcp
  port: 2379
- net: “”
  protocol: tcp
  port: 2380
- net: “”
  protocol: tcp
  port: 5473
- net: “”
  protocol: tcp
  port: 6443
- net: “”
  protocol: tcp
  port: 6666
- net: “”
  protocol: tcp
  port: 6667

featureDetectOverrideIs used to override the feature detection. Values are specified in a comma separated list with no spaces, example; “SNATFullyRandom=true,MASQFullyRandom=false,RestoreSupportsLock=”. “true” or “false” will force the feature, empty or omitted values are auto-detected.stringstring“”
genericXDPEnabledWhen enabled, Felix can fallback to the non-optimized generic XDP mode. This should only be used for testing since it doesn’t improve performance over the non-XDP mode.true,falsebooleanfalse
interfaceExcludeA comma-separated list of interface names that should be excluded when Felix is resolving host endpoints. The default value ensures that Felix ignores Kubernetes’ internal kube-ipvs0 device. If you want to exclude multiple interface names using a single value, the list supports regular expressions. For regular expressions you must wrap the value with /. For example having values /^kube/,veth1 will exclude all interfaces that begin with kube and also the interface veth1.stringstringkube-ipvs0
interfacePrefixThe interface name prefix that identifies workload endpoints and so distinguishes them from host endpoint interfaces. Note: in environments other than bare metal, the orchestrators configure this appropriately. For example our Kubernetes and Docker integrations set the ‘cali’ value, and our OpenStack integration sets the ‘tap’ value.stringstringcali
ipipEnabledOptional, you shouldn’t need to change this setting as Felix calculates if IPIP should be enabled based on the existing IP Pools. When set, this overrides whether Felix should configure an IPinIP interface on the host. When explicitly disabled in FelixConfiguration, Felix will not clean up addresses from the tunl0 interface (use this if you need to add addresses to that interface and don’t want to have them removed).true, false, unsetoptional booleanunset
ipipMTUThe MTU to set on the tunnel device. Zero value means auto-detect. See Configuring MTUintint0
ipsetsRefreshIntervalPeriod at which Felix re-checks the IP sets in the dataplane to ensure that no other process has accidentally broken Calico’s rules. Set to 0 to disable IP sets refresh. Note: the default for this value is lower than the other refresh intervals as a workaround for a Linux kernel bug that was fixed in kernel version 4.11. If you are using v4.11 or greater you may want to set this to a higher value to reduce Felix CPU usage.5s, 10s, 1m etc.duration10s
iptablesFilterAllowActionThis parameter controls what happens to traffic that is accepted by a Felix policy chain in the iptables filter table (i.e. a normal policy chain). The default will immediately Accept the traffic. Use Return to send the traffic back up to the system chains for further processing.Accept, ReturnstringAccept
iptablesBackendThis parameter controls which variant of iptables Felix uses. If using Felix on a system that uses the netfilter-backed iptables binaries, set this to nft.Legacy, nft, AutostringAuto
iptablesLockFilePathLocation of the iptables lock file. You may need to change this if the lock file is not in its standard location (for example if you have mapped it into Felix’s container at a different path).stringstring/run/xtables.lock
iptablesLockProbeIntervalTime that Felix will wait between attempts to acquire the iptables lock if it is not available. Lower values make Felix more responsive when the lock is contended, but use more CPU.5s, 10s, 1m etc.duration50ms
iptablesLockTimeoutTime that Felix will wait for the iptables lock, or 0, to disable. To use this feature, Felix must share the iptables lock file with all other processes that also take the lock. When running Felix inside a container, this requires the /run directory of the host to be mounted into the calico/node or calico/felix container.5s, 10s, 1m etc.duration0 (Disabled)
iptablesMangleAllowActionThis parameter controls what happens to traffic that is accepted by a Felix policy chain in the iptables mangle table (i.e. a pre-DNAT policy chain). The default will immediately Accept the traffic. Use Return to send the traffic back up to the system chains for further processing.Accept, ReturnstringAccept
iptablesMarkMaskMask that Felix selects its IPTables Mark bits from. Should be a 32 bit hexadecimal number with at least 8 bits set, none of which clash with any other mark bits in use on the system.netmasknetmask0xff000000
iptablesNATOutgoingInterfaceFilterThis parameter can be used to limit the host interfaces on which Calico will apply SNAT to traffic leaving a Calico IPAM pool with “NAT outgoing” enabled. This can be useful if you have a main data interface, where traffic should be SNATted and a secondary device (such as the docker bridge) which is local to the host and doesn’t require SNAT. This parameter uses the iptables interface matching syntax, which allows + as a wildcard. Most users will not need to set this. Example: if your data interfaces are eth0 and eth1 and you want to exclude the docker bridge, you could set this to eth+stringstring“”
iptablesPostWriteCheckIntervalPeriod after Felix has done a write to the dataplane that it schedules an extra read back to check the write was not clobbered by another process. This should only occur if another application on the system doesn’t respect the iptables lock.5s, 10s, 1m etc.duration1s
iptablesRefreshIntervalPeriod at which Felix re-checks all iptables state to ensure that no other process has accidentally broken Calico’s rules. Set to 0 to disable iptables refresh.5s, 10s, 1m etc.duration90s
ipv6SupportIPv6 support for Felixtrue, falsebooleantrue
kubeNodePortRangesThis parameter holds a list of port ranges used for service node ports. Only used if felix detects kube-proxy running in IPVS mode.A list of stringsA list of port ranges30000:32767
logFilePathThe full path to the Felix log. Set to none to disable file logging.stringstring/var/log/calico/felix.log
logPrefixThe log prefix that Felix uses when rendering LOG rules.stringstringcalico-packet
logSeverityFileThe log severity above which logs are sent to the log file.Same as logSeveritySysstringInfo
logSeverityScreenThe log severity above which logs are sent to the stdout.Same as LogSeveritySysstringInfo
logSeveritySysThe log severity above which logs are sent to the syslog. Set to none for no logging to syslog.Debug, Info, Warning, Error, FatalstringInfo
logDebugFilenameRegexcontrols which source code files have their Debug log output included in the logs. Only logs from files with names that match the given regular expression are included. The filter only applies to Debug level logs.regexstring“”
maxIpsetSizeMaximum size for the ipsets used by Felix. Should be set to a number that is greater than the maximum number of IP addresses that are ever expected in a selector.intint1048576
metadataAddrThe IP address or domain name of the server that can answer VM queries for cloud-init metadata. In OpenStack, this corresponds to the machine running nova-api (or in Ubuntu, nova-api-metadata). A value of none (case-insensitive) means that Felix should not set up any NAT rule for the metadata path.IPv4, hostname, nonestring127.0.0.1
metadataPortThe port of the metadata server. This, combined with global.MetadataAddr (if not ‘None’), is used to set up a NAT rule, from 169.254.169.254:80 to MetadataAddr:MetadataPort. In most cases this should not need to be changed.intint8775
natOutgoingAddressThe source address to use for outgoing NAT. By default an iptables MASQUERADE rule determines the source address which will use the address on the host interface the traffic leaves on.IPV4string“”
openstackRegionThe name of the region that a particular Felix belongs to. In a multi-region Calico/OpenStack deployment, this must be configured somehow for each Felix (here in the datamodel, or in felix.cfg or the environment on each compute node), and must match the [calico] openstack_region value configured in neutron.conf on each node.string of lower case alphanumeric characters or ‘-‘, starting and ending with an alphanumeric characterstring“”
policySyncPathPrefixFile system path where Felix notifies services of policy changes over Unix domain sockets. This is only required if you’re configuring application layer policy. Set to “” to disable.stringstring“”
prometheusGoMetricsEnabledSet to false to disable Go runtime metrics collection, which the Prometheus client does by default. This reduces the number of metrics reported, reducing Prometheus load.booleanbooleantrue
prometheusMetricsEnabledSet to true to enable the experimental Prometheus metrics server in Felix.booleanbooleanfalse
prometheusMetricsHostTCP network address that the Prometheus metrics server should bind to.IPv4, IPv6, Hostnamestring“”
prometheusMetricsPortTCP port that the Prometheus metrics server should bind to.intint9091
prometheusProcessMetricsEnabledSet to false to disable process metrics collection, which the Prometheus client does by default. This reduces the number of metrics reported, reducing Prometheus load.booleanbooleantrue
removeExternalRoutesWhether or not to remove device routes that have not been programmed by Felix. Disabling this will allow external applications to also add device routes.boolbooleantrue
reportingIntervalInterval at which Felix reports its status into the datastore. 0 means disabled and is correct for Kubernetes-only clusters. Must be non-zero in OpenStack deployments.5s, 10s, 1m etc.duration30s
reportingTTLTime-to-live setting for process-wide status reports.5s, 10s, 1m etc.duration90s
routeRefreshIntervalPeriod at which Felix re-checks the routes in the dataplane to ensure that no other process has accidentally broken Calico’s rules. Set to 0 to disable route refresh.5s, 10s, 1m etc.duration90s
routeTableRangedeprecated in favor of RouteTableRanges Calico programs additional Linux route tables for various purposes. RouteTableRange specifies the indices of the route tables that Calico should use.RouteTableRanges“”
routeTableRangesCalico programs additional Linux route tables for various purposes. RouteTableRanges specifies a set of table index ranges that Calico should use. Deprecates RouteTableRange, overrides RouteTableRangeRouteTableRanges[{“Min”: 1, “Max”: 250}]
routeSyncDisabledSet to true to disable Calico programming routes to local workloads.booleanbooleanfalse
serviceLoopPreventionWhen service IP advertisement is enabled, prevent routing loops to service IPs that are not in use, by dropping or rejecting packets that do not get DNAT’d by kube-proxy. Unless set to “Disabled”, in which case such routing loops continue to be allowed.Drop, Reject, DisabledstringDrop
workloadSourceSpoofingControls whether pods can enable source IP address spoofing with the cni.projectcalico.org/allowedSourcePrefixes annotation. When set to Any, pods can use this annotation to send packets from any IP address.Any, DisabledstringDisabled
sidecarAccelerationEnabledEnable experimental acceleration between application and proxy sidecar when using application layer policy. [Default: false]booleanbooleanfalse
usageReportingEnabledReports anonymous Calico version number and cluster size to projectcalico.org. Logs warnings returned by the usage server. For example, if a significant security vulnerability has been discovered in the version of Calico being used.booleanbooleantrue
usageReportingInitialDelayMinimum initial delay before first usage report.5s, 10s, 1m etc.duration300s
usageReportingIntervalThe interval at which Felix does usage reports. The default is 1 day.5s, 10s, 1m etc.duration24h
vxlanEnabledOptional, you shouldn’t need to change this setting as Felix calculates if VXLAN should be enabled based on the existing IP Pools. When set, this overrides whether Felix should create the VXLAN tunnel device for VXLAN networking.true, false, unsetoptional booleanunset
vxlanMTUMTU to use for the IPv4 VXLAN tunnel device. Zero value means auto-detect. Also controls NodePort MTU when eBPF enabled.intint0
vxlanMTUV6MTU to use for the IPv6 VXLAN tunnel device. Zero value means auto-detect. Also controls NodePort MTU when eBPF enabled.intint0
vxlanPortPort to use for VXLAN traffic. A value of 0 means “use the kernel default”.intint4789
vxlanVNIVirtual network ID to use for VXLAN traffic. A value of 0 means “use the kernel default”.intint4096
allowVXLANPacketsFromWorkloadsSet to true to allow VXLAN encapsulated traffic from workloads.booleanbooleanfalse
allowIPIPPacketsFromWorkloadsSet to true to allow IPIP encapsulated traffic from workloads.booleanbooleanfalse
windowsManageFirewallRulesConfigure whether or not Felix will program Windows Firewall rules. (to allow inbound access to its own metrics ports) [Default: Disabled]Enabled, DisabledstringDisabled
wireguardEnabledEnable encryption for IPv4 on WireGuard supported nodes in cluster. When enabled, pod to pod traffic will be sent over encrypted tunnels between the nodes.true, falsebooleanfalse
wireguardEnabledV6Enable encryption for IPv6 on WireGuard supported nodes in cluster. When enabled, pod to pod traffic will be sent over encrypted tunnels between the nodes.true, falsebooleanfalse
wireguardInterfaceNameName of the IPv4 WireGuard interface created by Felix. If you change the name, and want to clean up the previously-configured interface names on each node, this is a manual process. Felix expect the name to end with either .cali or .calico suffix.stringstringwireguard.cali
wireguardInterfaceNameV6Name of the IPv6 WireGuard interface created by Felix. If you change the name, and want to clean up the previously-configured interface names on each node, this is a manual process. Felix expect the name to end with either .cali or .calico suffix.stringstringwg-v6.cali
wireguardListeningPortPort used by IPv4 WireGuard tunnels. Felix sets up an IPv4 WireGuard tunnel on each node specified by this port. Available for configuration only in the global FelixConfiguration resource; setting it per host, config-file or environment variable will not work.1-65535int51820
wireguardListeningPortV6Port used by IPv6 WireGuard tunnels. Felix sets up an IPv6 WireGuard tunnel on each node specified by this port. Available for configuration only in the global FelixConfiguration resource; setting it per host, config-file or environment variable will not work.1-65535int51821
wireguardMTUMTU set on the IPv4 WireGuard interface created by Felix. Zero value means auto-detect. See Configuring MTU.intint0
wireguardMTUV6MTU set on the IPv6 WireGuard interface created by Felix. Zero value means auto-detect. See Configuring MTU.intint0
wireguardRoutingRulePriorityWireGuard routing rule priority value set up by Felix. If you change the default value, set it to a value most appropriate to routing rules for your nodes.1-32765int99
wireguardHostEncryptionEnabledExperimental: Adds host-namespace workload IP’s to WireGuard’s list of peers. Should not be enabled when WireGuard is enabled on a cluster’s control plane node, as networking deadlock can occur.true, falsebooleanfalse
wireguardKeepAliveWireguardKeepAlive controls Wireguard PersistentKeepalive option. Set 0 to disable. [Default: 0]5s, 10s, 1m etc.duration0
xdpRefreshIntervalPeriod at which Felix re-checks the XDP state in the dataplane to ensure that no other process has accidentally broken Calico’s rules. Set to 0 to disable XDP refresh.5s, 10s, 1m etc.duration90s
xdpEnabledWhen bpfEnabled is false: enable XDP acceleration for host endpoint policies. When bpfEnabled is true, XDP is automatically used for Calico policy where that makes sense, regardless of this setting. [Default: true]true,falsebooleantrue
bpfEnabledEnable eBPF dataplane mode. eBPF mode has some limitations, see the HOWTO guide for more details.true, falsebooleanfalse
bpfDisableUnprivilegedIf true, Felix sets the kernel.unprivileged_bpf_disabled sysctl to disable unprivileged use of BPF. This ensures that unprivileged users cannot access Calico’s BPF maps and cannot insert their own BPF programs to interfere with the ones that Calico installs.true, falsebooleantrue
bpfLogLevelIn eBPF dataplane mode, the log level used by the BPF programs. The logs are emitted to the BPF trace pipe, accessible with the command tc exec bpf debug.Off,Info,DebugstringOff
bpfDataIfacePatternIn eBPF dataplane mode, controls which interfaces Felix should attach BPF programs to catch traffic to/from the external network. This needs to match the interfaces that Calico workload traffic flows over as well as any interfaces that handle incoming traffic to NodePorts and services from outside the cluster. It should not match the workload interfaces (usually named cali…)..regular expressionstring^(en.|eth.|tunl0$)
bpfL3IfacePatternIn eBPF dataplane mode, allows to list tunnel devices like wireguard or vxlan (i.e., L3 devices) in addition to BPFDataIfacePattern. That is, tunnel interfaces not created by Calico, that Calico workload traffic flows over as well as any interfaces that handle incoming traffic to nodeports and services from outside the cluster.regular expressionstring“”
bpfConnectTimeLoadBalancingEnabledIn eBPF dataplane mode, controls whether Felix installs the connect-time load balancer. In the current release, the connect-time load balancer is required for the host to reach kubernetes services.true,falsebooleantrue
bpfConnectTimeLoadBalancingIn eBPF dataplane mode, controls whether Felix installs the connect-time load balancer. It improves the performance of pod-to-service connections. When set to TCP (default), connect-time load balancing is available only for services with TCP ports. If set to Enabled, it is enabled for any protocol - with that, UDP applications may keep sending data to a service (e.g., DNS) backend that does not exist anymore. When set to Disabled or TCP, bpfHostNetworkedNATWithoutCTLB must be set to Enabled for host networked processed to be able to reach all service correctly. If ebpf is used with a service mesh that uses sidecars like Istio, set this option to Disabled and bpfHostNetworkedNATWithoutCTLB to Enabled (default). That allows the mesh to intercept service IPs before they get resolved.TCP,Enabled,DisabledstringTCP
bpfHostNetworkedNATWithoutCTLBIn eBPF dataplane mode, controls whether Felix resolves service (NAT) without CTLB for host networked processes. This along with BPFConnectTimeLoadBalancing determines the behavior of connect-time load balancer.Enabled,DisabledstringEnabled
bpfExternalServiceModeIn eBPF dataplane mode, controls how traffic from outside the cluster to NodePorts and ClusterIPs is handled. In Tunnel mode, packet is tunneled from the ingress host to the host with the backing pod and back again. In DSR mode, traffic is tunneled to the host with the backing pod and then returned directly; this requires a network that allows direct return.Tunnel,DSRstringTunnel
bpfKubeProxyIptablesCleanupEnabledIn eBPF dataplane mode, controls whether Felix will clean up the iptables rules created by the Kubernetes kube-proxy; should only be enabled if kube-proxy is not running.true,falsebooleantrue
bpfKubeProxyMinSyncPeriodIn eBPF dataplane mode, controls the minimum time between dataplane updates for Felix’s embedded kube-proxy implementation.5s, 10s, 1m etc.duration1s
BPFKubeProxyEndpointSlicesEnabledIn eBPF dataplane mode, controls whether Felix’s embedded kube-proxy derives its services from Kubernetes’ EndpointSlices resources. Using EndpointSlices is more efficient but it requires EndpointSlices support to be enabled at the Kubernetes API server.true,falsebooleanfalse
bpfMapSizeConntrackIn eBPF dataplane mode, controls the size of the conntrack map.intint512000
bpfMapSizeIPSetsIn eBPF dataplane mode, controls the size of the ipsets map.intint1048576
bpfMapSizeNATAffinityIn eBPF dataplane mode, controls the size of the NAT affinity map.intint65536
bpfMapSizeNATFrontendIn eBPF dataplane mode, controls the size of the NAT front end map.intint65536
bpfMapSizeNATBackendIn eBPF dataplane mode, controls the size of the NAT back end map.intint262144
bpfMapSizeRouteIn eBPF dataplane mode, controls the size of the route map.intint262144
bpfPolicyDebugEnabledIn eBPF dataplane mode, controls whether felix will collect policy dump for each interface.true, falsebooleantrue
routeSourceWhere Felix gets is routing information from for VXLAN and the BPF dataplane. The CalicoIPAM setting is more efficient because it supports route aggregation, but it only works when Calico’s IPAM or host-local IPAM is in use. Use the WorkloadIPs setting if you are using Calico’s VXLAN or BPF dataplane and not using Calico IPAM or host-local IPAM.CalicoIPAM,WorkloadIPsstringCalicoIPAM
mtuIfacePatternPattern used to discover the host’s interface for MTU auto-detection.regexstring^((en|wl|ww|sl|ib)[opsvx].|(eth|wlan|wwan).)
bpfForceTrackPacketsFromIfacesForces traffic from these interfaces in BPF mode to skip Calico’s iptables NOTRACK rule, allowing traffic from those interfaces to be tracked by Linux conntrack. Use only for interfaces that are not used for the Calico fabric, for example, a docker bridge device for non-Calico-networked containers.A list of stringsA list of stringsdocker+
bpfDisableGROForIfacesBPFDisableGROForIfaces is a regular expression that controls which interfaces Felix should disable the Generic Receive Offload [GRO] option. It should not match the workload interfaces (usually named cali…).regexstring“”

genericXDPEnabled and xdpRefreshInterval are only relevant when bpfEnabled is false and xdpEnabled is true; in other words when XDP is being used to accelerate denial-of-service prevention policies in the iptables dataplane.

When bpfEnabled is true the “xdp” settings all have no effect; in BPF mode the implementation of policy is always accelerated, using the best available BPF technology.

Health Timeout Overrides

Felix has internal liveness and readiness watchdog timers that monitor its various loops. If a loop fails to “check in” within the allotted timeout then Felix will report non-Ready or non-Live on its health port (which is monitored by Kubelet in a Kubernetes system). If Felix reports non-Live, this can result in the Pod being restarted.

In Kubernetes, if you see the calico-node Pod readiness or liveness checks fail intermittently, check the calico-node Pod log for a log from Felix that gives the overall health status (the list of components will depend on which features are enabled):

  1. +---------------------------+---------+----------------+-----------------+--------+
  2. | COMPONENT | TIMEOUT | LIVENESS | READINESS | DETAIL |
  3. +---------------------------+---------+----------------+-----------------+--------+
  4. | CalculationGraph | 30s | reporting live | reporting ready | |
  5. | FelixStartup | 0s | reporting live | reporting ready | |
  6. | InternalDataplaneMainLoop | 1m30s | reporting live | reporting ready | |
  7. +---------------------------+---------+----------------+-----------------+--------+

If some health timeouts show as “timed out” it may help to apply an override using the healthTimeoutOverrides field:

  1. ...
  2. spec:
  3. healthTimeoutOverrides:
  4. - name: InternalDataplaneMainLoop
  5. timeout: "5m"
  6. - name: CalculationGraph
  7. timeout: "1m30s"
  8. ...

A timeout value of 0 disables the timeout.

ProtoPort

FieldDescriptionAccepted ValuesSchema
portThe exact port match0-65535int
protocolThe protocol matchtcp, udp, sctpstring
netThe CIDR matchany valid CIDR (e.g. 192.168.0.0/16)string

Keep in mind that in the following example, net: "" and net: "0.0.0.0/0" are processed as the same in the policy enforcement.

  1. ...
  2. spec:
  3. failsafeInboundHostPorts:
  4. - net: "192.168.1.1/32"
  5. port: 22
  6. protocol: tcp
  7. - net: ""
  8. port: 67
  9. protocol: udp
  10. failsafeOutboundHostPorts:
  11. - net: "0.0.0.0/0"
  12. port: 67
  13. protocol: udp
  14. ...

RouteTableRange

The RouteTableRange option is now deprecated in favor of RouteTableRanges.

FieldDescriptionAccepted ValuesSchema
minMinimum index to use1-250int
maxMaximum index to use1-250int

RouteTableRanges

RouteTableRanges is a list of RouteTableRange objects:

FieldDescriptionAccepted ValuesSchema
minMinimum index to use1 - 4294967295int
maxMaximum index to use1 - 4294967295int

Each item in the RouteTableRanges list designates a range of routing tables available to Calico. By default, Calico will use a single range of 1-250. If a range spans Linux’s reserved table range (253-255) then those tables are automatically excluded from the list. It’s possible that other table ranges may also be reserved by third-party systems unknown to Calico. In that case, multiple ranges can be defined to target tables below and above the sensitive ranges:

  1. target tables 65-99, and 256-1000, skipping 100-255
  2. calicoctl patch felixconfig default --type=merge -p '{"spec":{"routeTableRanges": [{"Min": 65, "Max": 99}, {"Min": 256, "Max": 1000}] }}

Note, for performance reasons, the maximum total number of routing tables that Felix will accept is 65535 (or 2*16).

Specifying both the RouteTableRange and RouteTableRanges arguments is not supported and will result in an error from the api.

AWS IAM Role/Policy for source-destination-check configuration

Setting awsSrcDstCheck to Disable will automatically disable source-destination-check on EC2 instances in a cluster, provided necessary IAM roles and policies are set. One of the policies assigned to IAM role of cluster nodes must contain a statement similar to the following:

  1. {
  2. "Effect": "Allow",
  3. "Action": [
  4. "ec2:DescribeInstances",
  5. "ec2:ModifyNetworkInterfaceAttribute"
  6. ],
  7. "Resource": "*"
  8. }

If there are no policies attached to node roles containing the above statement, attach a new policy. For example, if a node role is test-cluster-nodeinstance-role, click on the IAM role in AWS console. In the Permission policies list, add a new inline policy with the above statement to the new policy JSON definition. For detailed information, see AWS documentation.

For an EKS cluster, the necessary IAM role and policy is available by default. No further actions are needed.

Supported operations

Datastore typeCreateDeleteDelete (Global default)UpdateGet/ListNotes
etcdv3YesYesNoYesYes
Kubernetes API serverYesYesNoYesYes