BGP Filter

A BGP filter resource (BGPFilter) represents a way to control routes imported by and exported to BGP peers specified using a BGP peer resource (BGPPeer).

The BGPFilter rules are applied sequentially: the action for the first rule that matches is executed immediately. If an address does not match any explicit BGP filter rule, the default action is Accept.

In order for a BGPFilter to be used in a BGP peering, its name must be added to filters of the corresponding BGPPeer resource.

For kubectl commands, the following case-sensitive aliases may be used to specify the resource type on the CLI: bgpfilters.crd.projectcalico.org

Sample YAML

  1. apiVersion: projectcalico.org/v3
  2. kind: BGPFilter
  3. metadata:
  4.   name: my-filter
  5. spec:
  6.   exportV4:
  7.     - action: Accept
  8.       matchOperator: In
  9.       cidr: 77.0.0.0/16
  10.       source: RemotePeers
  11.     - action: Reject
  12.       interface: '*.calico'
  13.   importV4:
  14.     - action: Reject
  15.       matchOperator: NotIn
  16.       cidr: 44.0.0.0/16
  17.   exportV6:
  18.     - action: Reject
  19.       source: RemotePeers
  20.     - action: Reject
  21.       interface: '*.calico'
  22.   importV6:
  23.     - action: Accept
  24.       matchOperator: Equal
  25.       cidr: 5000::0/64
  26.     - action: Reject

BGP filter definition

Metadata

FieldDescriptionAccepted ValuesSchema
nameUnique name to describe this resource instance. Must be specified.Alphanumeric string with optional ., _, or -.string

Spec

FieldDescriptionAccepted ValuesSchemaDefault
exportV4List of v4 CIDRs and export actionBGP Filter Rule v4
importV4List of v4 CIDRs and import actionBGP Filter Rule v4
exportV6List of v6 CIDRs and export actionBGP Filter Rule v6
importV6List of v6 CIDRs and import actionBGP Filter Rule v6

BGP Filter Rule v4

FieldDescriptionAccepted ValuesSchemaDefault
cidrIPv6 rangeA valid IPv6 CIDRstring
matchOperatorMethod by which to match candidate routesIn, NotIn, Equal, NotEqualstring
sourceIndicator of the source of routeRemotePeers means any route learned from other BGP peersstring
interfaceString to match interface namesA valid pattern to match interfaces. “*” can be used as a wildcard.string
actionAction to be taken for this ruleAccept or Rejectstring

BGP Filter Rule v6

FieldDescriptionAccepted ValuesSchemaDefault
cidrIPv6 rangeA valid IPv6 CIDRstring
matchOperatorMethod by which to match candidate routesIn, NotIn, Equal, NotEqualstring
sourceIndicator of the source of routeRemotePeers means any route learned from other BGP peersstring
interfaceString to match interface namesA valid pattern to match interfaces. “*” can be used as a wildcard.string
actionAction to be taken for this ruleAccept or Rejectstring

Supported operations

Datastore typeCreate/DeleteUpdateGet/ListNotes
Kubernetes API serverYesYesYes