Felix configuration

A Felix configuration resource (FelixConfiguration) represents Felix configuration options for the cluster.

For kubectl commands, the following case-insensitive aliases may be used to specify the resource type on the CLI: felixconfiguration.projectcalico.org, felixconfigurations.projectcalico.org as well as abbreviations such as felixconfiguration.p and felixconfigurations.p.

See Configuring Felix for more details.

Sample YAML

apiVersion: projectcalico.org/v3
kind: FelixConfiguration
metadata:
  name: default
spec:
  ipv6Support: false
  ipipMTU: 1400
  chainInsertMode: Append

Felix configuration definition

Metadata

Field	Description	Accepted Values	Schema
name	Unique name to describe this resource instance. Required.	Alphanumeric string with optional ., _, or -.	string

• Calico Enterprise automatically creates a resource named default containing the global default configuration settings for Felix. You can use calicoctl to view and edit these settings
• The resources with the name node.<nodename> contain the node-specific overrides, and will be applied to the node <nodename>. When deleting a node the FelixConfiguration resource associated with the node will also be deleted.

Spec

Datastore connection

Process: Feature detection/overrides

featureDetectOverride

Attribute	Value
Key	featureDetectOverride
Description	Used to override feature detection based on auto-detected platform capabilities. Values are specified in a comma separated list with no spaces, example; "SNATFullyRandom=true,MASQFullyRandom=false,RestoreSupportsLock=". A value of "true" or "false" will force enable/disable feature, empty or omitted values fall back to auto-detection.
Schema	String matching the regular expression ^([a-zA-Z0-9-_]+=(true|false|),)*([a-zA-Z0-9-_]+=(true|false|))?$.
Default	none

featureGates

Attribute	Value
Key	featureGates
Description	Used to enable or disable tech-preview Calico features. Values are specified in a comma separated list with no spaces, example; "BPFConnectTimeLoadBalancingWorkaround=enabled,XyZ=false". This is used to enable features that are not fully production ready.
Schema	String matching the regular expression ^([a-zA-Z0-9-_]+=([^=]+),)*([a-zA-Z0-9-_]+=([^=]+))?$.
Default	none

Process: Go runtime

goGCThreshold

Attribute	Value
Key	goGCThreshold
Description	Sets the Go runtime's garbage collection threshold. I.e. the percentage that the heap is allowed to grow before garbage collection is triggered. In general, doubling the value halves the CPU time spent doing GC, but it also doubles peak GC memory overhead. A special value of -1 can be used to disable GC entirely; this should only be used in conjunction with the GoMemoryLimitMB setting. This setting is overridden by the GOGC environment variable.
Schema	Integer: [-1,263-1]
Default	40

goMaxProcs

Attribute	Value
Key	goMaxProcs
Description	Sets the maximum number of CPUs that the Go runtime will use concurrently. A value of -1 means "use the system default"; typically the number of real CPUs on the system. this setting is overridden by the GOMAXPROCS environment variable.
Schema	Integer: [-1,263-1]
Default	-1

goMemoryLimitMB

Attribute	Value
Key	goMemoryLimitMB
Description	Sets a (soft) memory limit for the Go runtime in MB. The Go runtime will try to keep its memory usage under the limit by triggering GC as needed. To avoid thrashing, it will exceed the limit if GC starts to take more than 50% of the process's CPU time. A value of -1 disables the memory limit. Note that the memory limit, if used, must be considerably less than any hard resource limit set at the container or pod level. This is because felix is not the only process that must run in the container or pod. This setting is overridden by the GOMEMLIMIT environment variable.
Schema	Integer: [-1,263-1]
Default	-1

Process: Health port and timeouts

healthEnabled

Attribute	Value
Key	healthEnabled
Description	If set to true, enables Felix's health port, which provides readiness and liveness endpoints.
Schema	Boolean.
Default	false

healthHost

Attribute	Value
Key	healthHost
Description	The host that the health server should bind to.
Schema	String.
Default	localhost

healthPort

Attribute	Value
Key	healthPort
Description	The TCP port that the health server should bind to.
Schema	Integer: [0,65535]
Default	9099

healthTimeoutOverrides

Attribute	Value
Key	healthTimeoutOverrides
Description	Allows the internal watchdog timeouts of individual subcomponents to be overridden. This is useful for working around "false positive" liveness timeouts that can occur in particularly stressful workloads or if CPU is constrained. For a list of active subcomponents, see Felix's logs.
Schema	List of health timeout overrides: [{name: "<name>", timeout: "<duration>"}, ...] where <duration> is in the Go duration format, for example 1m30s.
Default	none

Process: Logging

logDebugFilenameRegex

Attribute	Value
Key	logDebugFilenameRegex
Description	Controls which source code files have their Debug log output included in the logs. Only logs from files with names that match the given regular expression are included. The filter only applies to Debug level logs.
Schema	String.
Default	none

logDropActionOverride

Attribute	Value
Key	logDropActionOverride
Description	Specifies whether or not to include the DropActionOverride in the logs when it is triggered.
Schema	Boolean.
Default	false

logFilePath

Attribute	Value
Key	logFilePath
Description	The full path to the Felix log. Set to none to disable file logging.
Schema	String.
Default	/var/log/calico/felix.log

logPrefix

Attribute	Value
Key	logPrefix
Description	The log prefix that Felix uses when rendering LOG rules.
Schema	String.
Default	calico-packet

logSeverityFile

Attribute	Value
Key	logSeverityFile
Description	The log severity above which logs are sent to the log file.
Schema	One of: Debug, Error, Fatal, Info, Warning.
Default	Info

logSeverityScreen

Attribute	Value
Key	logSeverityScreen
Description	The log severity above which logs are sent to the stdout.
Schema	One of: Debug, Error, Fatal, Info, Warning.
Default	Info

logSeveritySys

Attribute	Value
Key	logSeveritySys
Description	The log severity above which logs are sent to the syslog. Set to None for no logging to syslog.
Schema	One of: Debug, Error, Fatal, Info, Warning.
Default	Info

Process: Prometheus metrics

prometheusGoMetricsEnabled

Attribute	Value
Key	prometheusGoMetricsEnabled
Description	Disables Go runtime metrics collection, which the Prometheus client does by default, when set to false. This reduces the number of metrics reported, reducing Prometheus load.
Schema	Boolean.
Default	true

prometheusMetricsCAFile

Attribute	Value
Key	prometheusMetricsCAFile
Description	The path to the TLS CA file for the Prometheus metrics server.
Schema	String.
Default	none

prometheusMetricsCertFile

Attribute	Value
Key	prometheusMetricsCertFile
Description	The path to the TLS certificate file for the Prometheus metrics server.
Schema	String.
Default	none

prometheusMetricsEnabled

Attribute	Value
Key	prometheusMetricsEnabled
Description	Enables the Prometheus metrics server in Felix if set to true.
Schema	Boolean.
Default	false

prometheusMetricsHost

Attribute	Value
Key	prometheusMetricsHost
Description	The host that the Prometheus metrics server should bind to.
Schema	String.
Default	none

prometheusMetricsKeyFile

Attribute	Value
Key	prometheusMetricsKeyFile
Description	The path to the TLS private key file for the Prometheus metrics server.
Schema	String.
Default	none

prometheusMetricsPort

Attribute	Value
Key	prometheusMetricsPort
Description	The TCP port that the Prometheus metrics server should bind to.
Schema	Integer: [0,65535]
Default	9091

prometheusProcessMetricsEnabled

Attribute	Value
Key	prometheusProcessMetricsEnabled
Description	Disables process metrics collection, which the Prometheus client does by default, when set to false. This reduces the number of metrics reported, reducing Prometheus load.
Schema	Boolean.
Default	true

prometheusWireGuardMetricsEnabled

Attribute	Value
Key	prometheusWireGuardMetricsEnabled
Description	Disables wireguard metrics collection, which the Prometheus client does by default, when set to false. This reduces the number of metrics reported, reducing Prometheus load.
Schema	Boolean.
Default	true

Dataplane: Common

allowIPIPPacketsFromWorkloads

Attribute	Value
Key	allowIPIPPacketsFromWorkloads
Description	Controls whether Felix will add a rule to drop IPIP encapsulated traffic from workloads.
Schema	Boolean.
Default	false

allowVXLANPacketsFromWorkloads

Attribute	Value
Key	allowVXLANPacketsFromWorkloads
Description	Controls whether Felix will add a rule to drop VXLAN encapsulated traffic from workloads.
Schema	Boolean.
Default	false

chainInsertMode

Attribute	Value
Key	chainInsertMode
Description	Controls whether Felix hooks the kernel's top-level iptables chains by inserting a rule at the top of the chain or by appending a rule at the bottom. insert is the safe default since it prevents Calico's rules from being bypassed. If you switch to append mode, be sure that the other rules in the chains signal acceptance by falling through to the Calico rules, otherwise the Calico policy will be bypassed.
Schema	One of: Append, Insert.
Default	Insert

dataplaneDriver

Attribute	Value
Key	dataplaneDriver
Description	Filename of the external dataplane driver to use. Only used if UseInternalDataplaneDriver is set to false.
Schema	String.
Default	calico-iptables-plugin

dataplaneWatchdogTimeout

Attribute	Value
Key	dataplaneWatchdogTimeout
Description	The readiness/liveness timeout used for Felix's (internal) dataplane driver. Deprecated: replaced by the generic HealthTimeoutOverrides.
Schema	Duration string, for example 1m30s123ms or 1h5m.
Default	1m30s

defaultEndpointToHostAction

Attribute	Value
Key	defaultEndpointToHostAction
Description	Controls what happens to traffic that goes from a workload endpoint to the host itself (after the endpoint's egress policy is applied). By default, Calico blocks traffic from workload endpoints to the host itself with an iptables "DROP" action. If you want to allow some or all traffic from endpoint to host, set this parameter to RETURN or ACCEPT. Use RETURN if you have your own rules in the iptables "INPUT" chain; Calico will insert its rules at the top of that chain, then "RETURN" packets to the "INPUT" chain once it has completed processing workload endpoint egress policy. Use ACCEPT to unconditionally accept packets from workloads after processing workload endpoint egress policy.
Schema	One of: Accept, Drop, Return.
Default	Drop

deviceRouteProtocol

Attribute	Value
Key	deviceRouteProtocol
Description	Controls the protocol to set on routes programmed by Felix. The protocol is an 8-bit label used to identify the owner of the route.
Schema	Integer
Default	3

deviceRouteSourceAddress

Attribute	Value
Key	deviceRouteSourceAddress
Description	IPv4 address to set as the source hint for routes programmed by Felix. When not set the source address for local traffic from host to workload will be determined by the kernel.
Schema	String.
Default	none

deviceRouteSourceAddressIPv6

Attribute	Value
Key	deviceRouteSourceAddressIPv6
Description	IPv6 address to set as the source hint for routes programmed by Felix. When not set the source address for local traffic from host to workload will be determined by the kernel.
Schema	String.
Default	none

disableConntrackInvalidCheck

Attribute	Value
Key	disableConntrackInvalidCheck
Description	Disables the check for invalid connections in conntrack. While the conntrack invalid check helps to detect malicious traffic, it can also cause issues with certain multi-NIC scenarios.
Schema	Boolean.
Default	false

dropActionOverride

Attribute	Value
Key	dropActionOverride
Description	Overrides the Drop action in Felix, optionally changing the behavior to Accept, and optionally adding Log. Possible values are Drop, LogAndDrop, Accept, LogAndAccept.
Schema	One of: Accept, Drop, LogAndAccept, LogAndDrop.
Default	Drop

endpointStatusPathPrefix

Attribute	Value
Key	endpointStatusPathPrefix
Description	The path to the directory where endpoint status will be written. Endpoint status file reporting is disabled if field is left empty. Chosen directory should match the directory used by the CNI plugin for PodStartupDelay.
Schema	String.
Default	/var/run/calico

externalNodesList

Attribute	Value
Key	externalNodesList
Description	A list of CIDR's of external, non-Calico nodes from which VXLAN/IPIP overlay traffic will be allowed. By default, external tunneled traffic is blocked to reduce attack surface.
Schema	List of strings: ["<string>", ...].
Default	none

failsafeInboundHostPorts

Attribute	Value
Key	failsafeInboundHostPorts
Description	A list of ProtoPort struct objects including UDP/TCP/SCTP ports and CIDRs that Felix will allow incoming traffic to host endpoints on irrespective of the security policy. This is useful to avoid accidentally cutting off a host with incorrect configuration. For backwards compatibility, if the protocol is not specified, it defaults to "tcp". If a CIDR is not specified, it will allow traffic from all addresses. To disable all inbound host ports, use the value "[]". The default value allows ssh access, DHCP, BGP, etcd and the Kubernetes API.
Schema	List of protocol/port objects with optional CIDR match: [{protocol: "TCP|UDP", port: <port>, net: "<cidr>"}, ...].
Default	[{"protocol":"tcp","port":22},{"protocol":"udp","port":68},{"protocol":"tcp","port":179},{"protocol":"tcp","port":2379},{"protocol":"tcp","port":2380},{"protocol":"tcp","port":5473},{"protocol":"tcp","port":6443},{"protocol":"tcp","port":6666},{"protocol":"tcp","port":6667}]

failsafeOutboundHostPorts

Attribute	Value
Key	failsafeOutboundHostPorts
Description	A list of PortProto struct objects including UDP/TCP/SCTP ports and CIDRs that Felix will allow outgoing traffic from host endpoints to irrespective of the security policy. This is useful to avoid accidentally cutting off a host with incorrect configuration. For backwards compatibility, if the protocol is not specified, it defaults to "tcp". If a CIDR is not specified, it will allow traffic from all addresses. To disable all outbound host ports, use the value "[]". The default value opens etcd's standard ports to ensure that Felix does not get cut off from etcd as well as allowing DHCP, DNS, BGP and the Kubernetes API.
Schema	List of protocol/port objects with optional CIDR match: [{protocol: "TCP|UDP", port: <port>, net: "<cidr>"}, ...].
Default	[{"protocol":"udp","port":53},{"protocol":"udp","port":67},{"protocol":"tcp","port":179},{"protocol":"tcp","port":2379},{"protocol":"tcp","port":2380},{"protocol":"tcp","port":5473},{"protocol":"tcp","port":6443},{"protocol":"tcp","port":6666},{"protocol":"tcp","port":6667}]

floatingIPs

Attribute	Value
Key	floatingIPs
Description	Configures whether or not Felix will program non-OpenStack floating IP addresses. (OpenStack-derived floating IPs are always programmed, regardless of this setting.)
Schema	One of: "Disabled", "Enabled".
Default	Disabled

ipForwarding

Attribute	Value
Key	ipForwarding
Description	Controls whether Felix sets the host sysctls to enable IP forwarding. IP forwarding is required when using Calico for workload networking. This should be disabled only on hosts where Calico is used solely for host protection. In BPF mode, due to a kernel interaction, either IPForwarding must be enabled or BPFEnforceRPF must be disabled.
Schema	One of: "Disabled", "Enabled".
Default	Enabled

interfaceExclude

Attribute	Value
Key	interfaceExclude
Description	A comma-separated list of interface names that should be excluded when Felix is resolving host endpoints. The default value ensures that Felix ignores Kubernetes' internal kube-ipvs0 device. If you want to exclude multiple interface names using a single value, the list supports regular expressions. For regular expressions you must wrap the value with /. For example having values /^kube/,veth1 will exclude all interfaces that begin with kube and also the interface veth1.
Schema	String.
Default	kube-ipvs0

interfacePrefix

Attribute	Value
Key	interfacePrefix
Description	The interface name prefix that identifies workload endpoints and so distinguishes them from host endpoint interfaces. Note: in environments other than bare metal, the orchestrators configure this appropriately. For example our Kubernetes and Docker integrations set the 'cali' value, and our OpenStack integration sets the 'tap' value.
Schema	String.
Default	cali

interfaceRefreshInterval

Attribute	Value
Key	interfaceRefreshInterval
Description	The period at which Felix rescans local interfaces to verify their state. The rescan can be disabled by setting the interval to 0.
Schema	Duration string, for example 1m30s123ms or 1h5m.
Default	1m30s

ipv6Support

Attribute	Value
Key	ipv6Support
Description	Controls whether Felix enables support for IPv6 (if supported by the in-use dataplane).
Schema	Boolean.
Default	true

kubeMasqueradeBit

Attribute	Value
Key	kubeMasqueradeBit
Description	Should be set to the same value as --iptables-masquerade-bit of kube-proxy when TPROXY is used. The default is the same as kube-proxy default thus only needs a change if kube-proxy is using a non-standard setting. Must be within the range of 0-31.
Schema	Integer
Default	14

mtuIfacePattern

Attribute	Value
Key	mtuIfacePattern
Description	A regular expression that controls which interfaces Felix should scan in order to calculate the host's MTU. This should not match workload interfaces (usually named cali...).
Schema	String.
Default	^((en|wl|ww|sl|ib)[Pcopsvx].*|(eth|wlan|wwan).*)

natOutgoingAddress

Attribute	Value
Key	natOutgoingAddress
Description	Specifies an address to use when performing source NAT for traffic in a natOutgoing pool that is leaving the network. By default the address used is an address on the interface the traffic is leaving on (i.e. it uses the iptables MASQUERADE target).
Schema	String.
Default	none

natPortRange

Attribute	Value
Key	natPortRange
Description	Specifies the range of ports that is used for port mapping when doing outgoing NAT. When unset the default behavior of the network stack is used.
Schema	String.
Default	0

nftablesDNSPolicyMode

Attribute	Value
Key	nftablesDNSPolicyMode
Description	Specifies how DNS policy programming will be handled for NFTables. DelayDeniedPacket - Felix delays any denied packet that traversed a policy that included egress domain matches, but did not match. The packet is released after a fixed time, or after the destination IP address was programmed. DelayDNSResponse - Felix delays any DNS response until related IPSets are programmed. This introduces some latency to all DNS packets (even when no IPSet programming is required), but it ensures policy hit statistics are accurate. This is the recommended setting when you are making use of staged policies or policy rule hit statistics. NoDelay - Felix does not introduce any delay to the packets. DNS rules may not have been programmed by the time the first packet traverses the policy rules. Client applications need to handle reconnection attempts if initial connection attempts fail. This may be problematic for some applications or for very low DNS TTLs.
Schema	One of: "DelayDNSResponse", "DelayDeniedPacket", "NoDelay".
Default	DelayDeniedPacket

nftablesMode

Attribute	Value
Key	nftablesMode
Description	Configures nftables support in Felix.
Schema	One of: "Auto", "Disabled", "Enabled".
Default	Disabled

netlinkTimeout

Attribute	Value
Key	netlinkTimeout
Description	The timeout when talking to the kernel over the netlink protocol, used for programming routes, rules, and other kernel objects.
Schema	Duration string, for example 1m30s123ms or 1h5m.
Default	10s

nfNetlinkBufSize

Attribute	Value
Key	nfNetlinkBufSize
Description	Controls the size of NFLOG messages that the kernel will try to send to Felix. NFLOG messages are used to report flow verdicts from the kernel. Warning: currently increasing the value may cause errors due to a bug in the netlink library.
Schema	String.
Default	65536

policySyncPathPrefix

Attribute	Value
Key	policySyncPathPrefix
Description	Used to by Felix to communicate policy changes to external services, like Application layer policy.
Schema	String.
Default	none

removeExternalRoutes

Attribute	Value
Key	removeExternalRoutes
Description	Controls whether Felix will remove unexpected routes to workload interfaces. Felix will always clean up expected routes that use the configured DeviceRouteProtocol. To add your own routes, you must use a distinct protocol (in addition to setting this field to false).
Schema	Boolean.
Default	true

routeRefreshInterval

Attribute	Value
Key	routeRefreshInterval
Description	The period at which Felix re-checks the routes in the dataplane to ensure that no other process has accidentally broken Calico's rules. Set to 0 to disable route refresh.
Schema	Duration string, for example 1m30s123ms or 1h5m.
Default	1m30s

routeSource

Attribute	Value
Key	routeSource
Description	Configures where Felix gets its routing information. - WorkloadIPs: use workload endpoints to construct routes. - CalicoIPAM: the default - use IPAM data to construct routes.
Schema	One of: CalicoIPAM, WorkloadIPs.
Default	CalicoIPAM

routeSyncDisabled

Attribute	Value
Key	routeSyncDisabled
Description	Will disable all operations performed on the route table. Set to true to run in network-policy mode only.
Schema	Boolean.
Default	false

routeTableRange

Attribute	Value
Key	routeTableRange
Description	Deprecated in favor of RouteTableRanges. Calico programs additional Linux route tables for various purposes. RouteTableRange specifies the indices of the route tables that Calico should use.
Schema	Route table range: {min:<n>, max<m>}.
Default	none

routeTableRanges

Attribute	Value
Key	routeTableRanges
Description	Calico programs additional Linux route tables for various purposes. RouteTableRanges specifies a set of table index ranges that Calico should use. DeprecatesRouteTableRange, overrides RouteTableRange.
Schema	List of route table ranges: [{min:<n>, max<m>}, ...].
Default	none

serviceLoopPrevention

Attribute	Value
Key	serviceLoopPrevention
Description	When service IP advertisement is enabled, prevent routing loops to service IPs that are not in use, by dropping or rejecting packets that do not get DNAT'd by kube-proxy. Unless set to "Disabled", in which case such routing loops continue to be allowed.
Schema	One of: Disabled, Drop, Reject.
Default	Drop

sidecarAccelerationEnabled

Attribute	Value
Key	sidecarAccelerationEnabled
Description	Enables experimental sidecar acceleration.
Schema	Boolean.
Default	false

useInternalDataplaneDriver

Attribute	Value
Key	useInternalDataplaneDriver
Description	If true, Felix will use its internal dataplane programming logic. If false, it will launch an external dataplane driver and communicate with it over protobuf.
Schema	Boolean.
Default	true

wafEventLogsFileDirectory

Attribute	Value
Key	wafEventLogsFileDirectory
Description	Sets the directory where WAFEvent log files are stored.
Schema	String.
Default	/var/log/calico/waf

wafEventLogsFileEnabled

Attribute	Value
Key	wafEventLogsFileEnabled
Description	Controls logging WAFEvent logs to a file. If false no WAFEvent logging to file will occur.
Schema	Boolean.
Default	false

wafEventLogsFileMaxFileSizeMB

Attribute	Value
Key	wafEventLogsFileMaxFileSizeMB
Description	Sets the max size in MB of WAFEvent log files before rotation.
Schema	Integer
Default	100

wafEventLogsFileMaxFiles

Attribute	Value
Key	wafEventLogsFileMaxFiles
Description	Sets the number of WAFEvent log files to keep.
Schema	Integer
Default	5

wafEventLogsFlushInterval

Attribute	Value
Key	wafEventLogsFlushInterval
Description	Configures the interval at which Felix exports WAFEvent logs.
Schema	Duration string, for example 1m30s123ms or 1h5m.
Default	15s

workloadSourceSpoofing

Attribute	Value
Key	workloadSourceSpoofing
Description	Controls whether pods can use the allowedSourcePrefixes annotation to send traffic with a source IP address that is not theirs. This is disabled by default. When set to "Any", pods can request any prefix.
Schema	One of: Any, Disabled.
Default	Disabled

Dataplane: iptables

ipsetsRefreshInterval

Attribute	Value
Key	ipsetsRefreshInterval
Description	Controls the period at which Felix re-checks all IP sets to look for discrepancies. Set to 0 to disable the periodic refresh.
Schema	Duration string, for example 1m30s123ms or 1h5m.
Default	1m30s

iptablesBackend

Attribute	Value
Key	iptablesBackend
Description	Controls which backend of iptables will be used. The default is Auto. Warning: changing this on a running system can leave "orphaned" rules in the "other" backend. These should be cleaned up to avoid confusing interactions.
Schema	One of: Auto, Legacy, NFT.
Default	Auto

iptablesFilterAllowAction

Attribute	Value
Key	iptablesFilterAllowAction
Description	Controls what happens to traffic that is accepted by a Felix policy chain in the iptables filter table (which is used for "normal" policy). The default will immediately Accept the traffic. Use Return to send the traffic back up to the system chains for further processing.
Schema	One of: Accept, Return.
Default	Accept

iptablesFilterDenyAction

Attribute	Value
Key	iptablesFilterDenyAction
Description	Controls what happens to traffic that is denied by network policy. By default Calico blocks traffic with an iptables "DROP" action. If you want to use "REJECT" action instead you can configure it in here.
Schema	One of: Drop, Reject.
Default	Drop

iptablesLockFilePath

Attribute	Value
Key	iptablesLockFilePath
Description	The location of the iptables lock file. You may need to change this if the lock file is not in its standard location (for example if you have mapped it into Felix's container at a different path).
Schema	String.
Default	/run/xtables.lock

iptablesLockProbeInterval

Attribute	Value
Key	iptablesLockProbeInterval
Description	When IptablesLockTimeout is enabled: the time that Felix will wait between attempts to acquire the iptables lock if it is not available. Lower values make Felix more responsive when the lock is contended, but use more CPU.
Schema	Duration string, for example 1m30s123ms or 1h5m.
Default	50ms

iptablesLockTimeout

Attribute	Value
Key	iptablesLockTimeout
Description	The time that Felix itself will wait for the iptables lock (rather than delegating the lock handling to the iptables command). Deprecated: iptables-restore v1.8+ always takes the lock, so enabling this feature results in deadlock.
Schema	Duration string, for example 1m30s123ms or 1h5m.
Default	0s

iptablesMangleAllowAction

Attribute	Value
Key	iptablesMangleAllowAction
Description	Controls what happens to traffic that is accepted by a Felix policy chain in the iptables mangle table (which is used for "pre-DNAT" policy). The default will immediately Accept the traffic. Use Return to send the traffic back up to the system chains for further processing.
Schema	One of: Accept, Return.
Default	Accept

iptablesMarkMask

Attribute	Value
Key	iptablesMarkMask
Description	The mask that Felix selects its IPTables Mark bits from. Should be a 32 bit hexadecimal number with at least 8 bits set, none of which clash with any other mark bits in use on the system.
Schema	Unsigned 32-bit integer.
Default	0xffff0000

iptablesNATOutgoingInterfaceFilter

Attribute	Value
Key	iptablesNATOutgoingInterfaceFilter
Description	This parameter can be used to limit the host interfaces on which Calico will apply SNAT to traffic leaving a Calico IPAM pool with "NAT outgoing" enabled. This can be useful if you have a main data interface, where traffic should be SNATted and a secondary device (such as the docker bridge) which is local to the host and doesn't require SNAT. This parameter uses the iptables interface matching syntax, which allows + as a wildcard. Most users will not need to set this. Example: if your data interfaces are eth0 and eth1 and you want to exclude the docker bridge, you could set this to eth+.
Schema	String.
Default	none

iptablesPostWriteCheckInterval

Attribute	Value
Key	iptablesPostWriteCheckInterval
Description	The period after Felix has done a write to the dataplane that it schedules an extra read back in order to check the write was not clobbered by another process. This should only occur if another application on the system doesn't respect the iptables lock.
Schema	Duration string, for example 1m30s123ms or 1h5m.
Default	5s

iptablesRefreshInterval

Attribute	Value
Key	iptablesRefreshInterval
Description	The period at which Felix re-checks the IP sets in the dataplane to ensure that no other process has accidentally broken Calico's rules. Set to 0 to disable IP sets refresh. Note: the default for this value is lower than the other refresh intervals as a workaround for a Linux kernel bug that was fixed in kernel version 4.11. If you are using v4.11 or greater you may want to set this to, a higher value to reduce Felix CPU usage.
Schema	Duration string, for example 1m30s123ms or 1h5m.
Default	3m0s

kubeNodePortRanges

Attribute	Value
Key	kubeNodePortRanges
Description	Holds list of port ranges used for service node ports. Only used if felix detects kube-proxy running in ipvs mode. Felix uses these ranges to separate host and workload traffic. .
Schema	List of ports: [<port>, ...] where <port> is a port number (integer) or range (string), for example 80, 8080:8089.
Default	["30000:32767"]

maxIpsetSize

Attribute	Value
Key	maxIpsetSize
Description	The maximum number of IP addresses that can be stored in an IP set. Not applicable if using the nftables backend.
Schema	Integer
Default	1048576

Dataplane: nftables

nftablesFilterAllowAction

Attribute	Value
Key	nftablesFilterAllowAction
Description	Controls the nftables action that Felix uses to represent the "allow" policy verdict in the filter table. The default is to ACCEPT the traffic, which is a terminal action. Alternatively, RETURN can be used to return the traffic back to the top-level chain for further processing by your rules.
Schema	One of: Accept, Return.
Default	Accept

nftablesFilterDenyAction

Attribute	Value
Key	nftablesFilterDenyAction
Description	Controls what happens to traffic that is denied by network policy. By default, Calico blocks traffic with a "drop" action. If you want to use a "reject" action instead you can configure it here.
Schema	One of: Drop, Reject.
Default	Drop

nftablesMangleAllowAction

Attribute	Value
Key	nftablesMangleAllowAction
Description	Controls the nftables action that Felix uses to represent the "allow" policy verdict in the mangle table. The default is to ACCEPT the traffic, which is a terminal action. Alternatively, RETURN can be used to return the traffic back to the top-level chain for further processing by your rules.
Schema	One of: Accept, Return.
Default	Accept

nftablesMarkMask

Attribute	Value
Key	nftablesMarkMask
Description	The mask that Felix selects its nftables Mark bits from. Should be a 32 bit hexadecimal number with at least 8 bits set, none of which clash with any other mark bits in use on the system.
Schema	Unsigned 32-bit integer.
Default	0xffff0000

nftablesRefreshInterval

Attribute	Value
Key	nftablesRefreshInterval
Description	Controls the interval at which Felix periodically refreshes the nftables rules.
Schema	Duration string, for example 1m30s123ms or 1h5m.
Default	3m0s

Dataplane: eBPF

bpfCTLBLogFilter

Attribute	Value
Key	bpfCTLBLogFilter
Description	Specifies, what is logged by connect time load balancer when BPFLogLevel is debug. Currently has to be specified as 'all' when BPFLogFilters is set to see CTLB logs.
Schema	String.
Default	none

bpfConnectTimeLoadBalancing

Attribute	Value
Key	bpfConnectTimeLoadBalancing
Description	When in BPF mode, controls whether Felix installs the connect-time load balancer. The connect-time load balancer is required for the host to be able to reach Kubernetes services and it improves the performance of pod-to-service connections.When set to TCP, connect time load balancing is available only for services with TCP ports.
Schema	One of: "Disabled", "Enabled", "TCP".
Default	TCP

bpfConnectTimeLoadBalancingEnabled

Attribute	Value
Key	bpfConnectTimeLoadBalancingEnabled
Description	When in BPF mode, controls whether Felix installs the connection-time load balancer. The connect-time load balancer is required for the host to be able to reach Kubernetes services and it improves the performance of pod-to-service connections. The only reason to disable it is for debugging purposes. Deprecated: Use BPFConnectTimeLoadBalancing.
Schema	Boolean.
Default	none

bpfConntrackMode

Attribute	Value
Key	bpfConntrackMode
Description	Controls how BPF conntrack entries are cleaned up. Auto will use a BPF program if supported, falling back to userspace if not. Userspace will always use the userspace cleanup code. BPFProgram will always use the BPF program (failing if not supported). /To be deprecated in future versions as conntrack map type changed to lru_hash and userspace cleanup is the only mode that is supported.
Schema	One of: "Auto", "BPFProgram", "Userspace".
Default	Auto

bpfConntrackLogLevel

Attribute	Value
Key	bpfConntrackLogLevel
Description	Controls the log level of the BPF conntrack cleanup program, which runs periodically to clean up expired BPF conntrack entries. .
Schema	One of: "Debug", "Off".
Default	Off

bpfConntrackTimeouts

Attribute	Value
Key	bpfConntrackTimeouts
Description	BPFConntrackTimers overrides the default values for the specified conntrack timer if set. Each value can be either a duration or Auto to pick the value from a Linux conntrack timeout. Configurable timers are: CreationGracePeriod, TCPSynSent, TCPEstablished, TCPFinsSeen, TCPResetSeen, UDPTimeout, GenericTimeout, ICMPTimeout. Unset values are replaced by the default values with a warning log for incorrect values.
Schema
Default	none

bpfDNSPolicyMode

Attribute	Value
Key	bpfDNSPolicyMode
Description	Specifies how DNS policy programming will be handled. Inline - BPF parses DNS response inline with DNS response packet processing. This guarantees the DNS rules reflect any change immediately. NoDelay - Felix does not introduce any delay to the packets. DNS rules may not have been programmed by the time the first packet traverses the policy rules. Client applications need to handle reconnection attempts if initial connection attempts fail. This may be problematic for some applications or for very low DNS TTLs.
Schema
Default	Inline

bpfDSROptoutCIDRs

Attribute	Value
Key	bpfDSROptoutCIDRs
Description	A list of CIDRs which are excluded from DSR. That is, clients in those CIDRs will access service node ports as if BPFExternalServiceMode was set to Tunnel.
Schema	List of CIDRs: ["<cidr>", ...].
Default	none

bpfDataIfacePattern

Attribute	Value
Key	bpfDataIfacePattern
Description	A regular expression that controls which interfaces Felix should attach BPF programs to in order to catch traffic to/from the network. This needs to match the interfaces that Calico workload traffic flows over as well as any interfaces that handle incoming traffic to nodeports and services from outside the cluster. It should not match the workload interfaces (usually named cali...) or any other special device managed by Calico itself (e.g., tunnels).
Schema	String.
Default	^((en|wl|ww|sl|ib)[Popsx].*|(eth|wlan|wwan|bond).*)

bpfDisableGROForIfaces

Attribute	Value
Key	bpfDisableGROForIfaces
Description	A regular expression that controls which interfaces Felix should disable the Generic Receive Offload [GRO] option. It should not match the workload interfaces (usually named cali...).
Schema	String.
Default	none

bpfDisableUnprivileged

Attribute	Value
Key	bpfDisableUnprivileged
Description	If enabled, Felix sets the kernel.unprivileged_bpf_disabled sysctl to disable unprivileged use of BPF. This ensures that unprivileged users cannot access Calico's BPF maps and cannot insert their own BPF programs to interfere with Calico's.
Schema	Boolean.
Default	true

bpfEnabled

Attribute	Value
Key	bpfEnabled
Description	If enabled Felix will use the BPF dataplane.
Schema	Boolean.
Default	false

bpfEnforceRPF

Attribute	Value
Key	bpfEnforceRPF
Description	Enforce strict RPF on all host interfaces with BPF programs regardless of what is the per-interfaces or global setting. Possible values are Disabled, Strict or Loose.
Schema	One of: Disabled, Loose, Strict.
Default	Loose

bpfExcludeCIDRsFromNAT

Attribute	Value
Key	bpfExcludeCIDRsFromNAT
Description	A list of CIDRs that are to be excluded from NAT resolution so that host can handle them. A typical usecase is node local DNS cache.
Schema	List of CIDRs: ["<cidr>", ...].
Default	none

bpfExportBufferSizeMB

Attribute	Value
Key	bpfExportBufferSizeMB
Description	In BPF mode, controls the buffer size used for sending BPF events to felix.
Schema	Integer
Default	1

bpfExtToServiceConnmark

Attribute	Value
Key	bpfExtToServiceConnmark
Description	In BPF mode, controls a 32bit mark that is set on connections from an external client to a local service. This mark allows us to control how packets of that connection are routed within the host and how is routing interpreted by RPF check.
Schema	Integer
Default	0

bpfExternalServiceMode

Attribute	Value
Key	bpfExternalServiceMode
Description	In BPF mode, controls how connections from outside the cluster to services (node ports and cluster IPs) are forwarded to remote workloads. If set to "Tunnel" then both request and response traffic is tunneled to the remote node. If set to "DSR", the request traffic is tunneled but the response traffic is sent directly from the remote node. In "DSR" mode, the remote node appears to use the IP of the ingress node; this requires a permissive L2 network.
Schema	One of: DSR, Tunnel.
Default	Tunnel

bpfForceTrackPacketsFromIfaces

Attribute	Value
Key	bpfForceTrackPacketsFromIfaces
Description	In BPF mode, forces traffic from these interfaces to skip Calico's iptables NOTRACK rule, allowing traffic from those interfaces to be tracked by Linux conntrack. Should only be used for interfaces that are not used for the Calico fabric. For example, a docker bridge device for non-Calico-networked containers.
Schema	List of interface names (may use + as a wildcard: ["<name>", ...].
Default	["docker+"]

bpfHostConntrackBypass

Attribute	Value
Key	bpfHostConntrackBypass
Description	Controls whether to bypass Linux conntrack in BPF mode for workloads and services.
Schema	Boolean.
Default	false

bpfHostNetworkedNATWithoutCTLB

Attribute	Value
Key	bpfHostNetworkedNATWithoutCTLB
Description	When in BPF mode, controls whether Felix does a NAT without CTLB. This along with BPFConnectTimeLoadBalancing determines the CTLB behavior.
Schema
Default	Enabled

bpfKubeProxyEndpointSlicesEnabled

Attribute	Value
Key	bpfKubeProxyEndpointSlicesEnabled
Description	Deprecated and has no effect. BPF kube-proxy always accepts endpoint slices. This option will be removed in the next release.
Schema	Boolean.
Default	true

bpfKubeProxyIptablesCleanupEnabled

Attribute	Value
Key	bpfKubeProxyIptablesCleanupEnabled
Description	If enabled in BPF mode, Felix will proactively clean up the upstream Kubernetes kube-proxy's iptables chains. Should only be enabled if kube-proxy is not running.
Schema	Boolean.
Default	true

bpfKubeProxyMinSyncPeriod

Attribute	Value
Key	bpfKubeProxyMinSyncPeriod
Description	In BPF mode, controls the minimum time between updates to the dataplane for Felix's embedded kube-proxy. Lower values give reduced set-up latency. Higher values reduce Felix CPU usage by batching up more work.
Schema	Duration string, for example 1m30s123ms or 1h5m.
Default	1s

bpfL3IfacePattern

Attribute	Value
Key	bpfL3IfacePattern
Description	A regular expression that allows to list tunnel devices like wireguard or vxlan (i.e., L3 devices) in addition to BPFDataIfacePattern. That is, tunnel interfaces not created by Calico, that Calico workload traffic flows over as well as any interfaces that handle incoming traffic to nodeports and services from outside the cluster.
Schema	String.
Default	none

bpfLogFilters

Attribute	Value
Key	bpfLogFilters
Description	A map of key=values where the value is a pcap filter expression and the key is an interface name with 'all' denoting all interfaces, 'weps' all workload endpoints and 'heps' all host endpoints. When specified as an env var, it accepts a comma-separated list of key=values.
Schema
Default	none

bpfLogLevel

Attribute	Value
Key	bpfLogLevel
Description	Controls the log level of the BPF programs when in BPF dataplane mode. One of "Off", "Info", or "Debug". The logs are emitted to the BPF trace pipe, accessible with the command tc exec bpf debug. .
Schema	One of: Debug, Info, Off.
Default	Off

bpfMapSizeConntrack

Attribute	Value
Key	bpfMapSizeConntrack
Description	Sets the size for the conntrack map. This map must be large enough to hold an entry for each active connection. Warning: changing the size of the conntrack map can cause disruption.
Schema	Integer
Default	512000

bpfMapSizeConntrackCleanupQueue

Attribute	Value
Key	bpfMapSizeConntrackCleanupQueue
Description	Sets the size for the map used to hold NAT conntrack entries that are queued for cleanup. This should be big enough to hold all the NAT entries that expire within one cleanup interval.
Schema	Integer
Default	100000

bpfMapSizeConntrackScaling

Attribute	Value
Key	bpfMapSizeConntrackScaling
Description	Controls whether and how we scale the conntrack map size depending on its usage. 'Disabled' make the size stay at the default or whatever is set by BPFMapSizeConntrack*. 'DoubleIfFull' doubles the size when the map is pretty much full even after cleanups.
Schema	One of: Disabled, DoubleIfFull.
Default	DoubleIfFull

bpfMapSizeIPSets

Attribute	Value
Key	bpfMapSizeIPSets
Description	Sets the size for ipsets map. The IP sets map must be large enough to hold an entry for each endpoint matched by every selector in the source/destination matches in network policy. Selectors such as "all()" can result in large numbers of entries (one entry per endpoint in that case).
Schema	Integer
Default	1048576

bpfMapSizeIfState

Attribute	Value
Key	bpfMapSizeIfState
Description	Sets the size for ifstate map. The ifstate map must be large enough to hold an entry for each device (host + workloads) on a host.
Schema	Integer
Default	1000

bpfMapSizeNATAffinity

Attribute	Value
Key	bpfMapSizeNATAffinity
Description	Sets the size of the BPF map that stores the affinity of a connection (for services that enable that feature.
Schema	Integer
Default	65536

bpfMapSizeNATBackend

Attribute	Value
Key	bpfMapSizeNATBackend
Description	Sets the size for NAT back end map. This is the total number of endpoints. This is mostly more than the size of the number of services.
Schema	Integer
Default	262144

bpfMapSizeNATFrontend

Attribute	Value
Key	bpfMapSizeNATFrontend
Description	Sets the size for NAT front end map. FrontendMap should be large enough to hold an entry for each nodeport, external IP and each port in each service.
Schema	Integer
Default	65536

bpfMapSizePerCpuConntrack

Attribute	Value
Key	bpfMapSizePerCpuConntrack
Description	Determines the size of conntrack map based on the number of CPUs. If set to a non-zero value, overrides BPFMapSizeConntrack with BPFMapSizePerCPUConntrack * (Number of CPUs). This map must be large enough to hold an entry for each active connection. Warning: changing the size of the conntrack map can cause disruption.
Schema	Integer
Default	0

bpfMapSizeRoute

Attribute	Value
Key	bpfMapSizeRoute
Description	Sets the size for the routes map. The routes map should be large enough to hold one entry per workload and a handful of entries per host (enough to cover its own IPs and tunnel IPs).
Schema	Integer
Default	262144

bpfPSNATPorts

Attribute	Value
Key	bpfPSNATPorts
Description	Sets the range from which we randomly pick a port if there is a source port collision. This should be within the ephemeral range as defined by RFC 6056 (1024–65535) and preferably outside the ephemeral ranges used by common operating systems. Linux uses 32768–60999, while others mostly use the IANA defined range 49152–65535. It is not necessarily a problem if this range overlaps with the operating systems. Both ends of the range are inclusive.
Schema	String.
Default	20000:29999

bpfPolicyDebugEnabled

Attribute	Value
Key	bpfPolicyDebugEnabled
Description	When true, Felix records detailed information about the BPF policy programs, which can be examined with the calico-bpf command-line tool.
Schema	Boolean.
Default	true

bpfProfiling

Attribute	Value
Key	bpfProfiling
Description	Controls profiling of BPF programs. At the monent, it can be Disabled or Enabled.
Schema	One of: "Disabled", "Enabled".
Default	Disabled

bpfRedirectToPeer

Attribute	Value
Key	bpfRedirectToPeer
Description	Controls which whether it is allowed to forward straight to the peer side of the workload devices. It is allowed for any host L2 devices by default (L2Only), but it breaks TCP dump on the host side of workload device as it bypasses it on ingress. Value of Enabled also allows redirection from L3 host devices like IPIP tunnel or Wireguard directly to the peer side of the workload's device. This makes redirection faster, however, it breaks tools like tcpdump on the peer side. Use Enabled with caution.
Schema	One of: "Disabled", "Enabled", "L2Only".
Default	Disabled

Dataplane: Windows

windowsDnsCacheFile

Attribute	Value
Key	windowsDnsCacheFile
Description	The name of the file that Felix uses to preserve learnt DNS information when restarting. .
Schema	String.
Default	c:\TigeraCalico\felix-dns-cache.txt

windowsDnsExtraTTL

Attribute	Value
Key	windowsDnsExtraTTL
Description	Extra time to keep IPs and alias names that are learnt from DNS, in addition to each name or IP's advertised TTL. The default value is 120s which is same as the default value of ServicePointManager.DnsRefreshTimeout on .net framework. .
Schema	Duration string, for example 1m30s123ms or 1h5m.
Default	2m0s

windowsFlowLogsFileDirectory

Attribute	Value
Key	windowsFlowLogsFileDirectory
Description	Sets the directory where flow logs files are stored on Windows nodes. .
Schema	String.
Default	c:\TigeraCalico\flowlogs

windowsFlowLogsPositionFilePath

Attribute	Value
Key	windowsFlowLogsPositionFilePath
Description	Used to specify the position of the external pipeline that reads flow logs on Windows nodes. . This parameter only takes effect when FlowLogsDynamicAggregationEnabled is set to true.
Schema	String.
Default	c:\TigeraCalico\flowlogs\flows.log.pos

windowsManageFirewallRules

Attribute	Value
Key	windowsManageFirewallRules
Description	Configures whether or not Felix will program Windows Firewall rules (to allow inbound access to its own metrics ports).
Schema	One of: "Disabled", "Enabled".
Default	Disabled

windowsNetworkName

Attribute	Value
Key	windowsNetworkName
Description	Specifies which Windows HNS networks Felix should operate on. The default is to match networks that start with "calico". Supports regular expression syntax.
Schema	String.
Default	(?i)calico.*

windowsStatsDumpFilePath

Attribute	Value
Key	windowsStatsDumpFilePath
Description	Used to specify the path of the stats dump file on Windows nodes.
Schema	String.
Default	c:\TigeraCalico\stats\dump

Dataplane: OpenStack support

endpointReportingDelay

Attribute	Value
Key	endpointReportingDelay
Description	Open source-only parameter; OpenStack is not supported in Calico Enterprise/Cloud. The delay before Felix reports endpoint status to the datastore. This is only used by the OpenStack integration.
Schema	Duration string, for example 1m30s123ms or 1h5m.
Default	1s

endpointReportingEnabled

Attribute	Value
Key	endpointReportingEnabled
Description	Open source-only parameter; OpenStack is not supported in Calico Enterprise/Cloud. Controls whether Felix reports endpoint status to the datastore. This is only used by the OpenStack integration.
Schema	Boolean.
Default	false

metadataAddr

Attribute	Value
Key	metadataAddr
Description	Open source-only parameter; OpenStack is not supported in Calico Enterprise/Cloud. The IP address or domain name of the server that can answer VM queries for cloud-init metadata. In OpenStack, this corresponds to the machine running nova-api (or in Ubuntu, nova-api-metadata). A value of none (case-insensitive) means that Felix should not set up any NAT rule for the metadata path.
Schema	String.
Default	127.0.0.1

metadataPort

Attribute	Value
Key	metadataPort
Description	Open source-only parameter; OpenStack is not supported in Calico Enterprise/Cloud. The port of the metadata server. This, combined with global.MetadataAddr (if not 'None'), is used to set up a NAT rule, from 169.254.169.254:80 to MetadataAddr:MetadataPort. In most cases this should not need to be changed .
Schema	Integer: [0,65535]
Default	8775

openstackRegion

Attribute	Value
Key	openstackRegion
Description	Open source-only parameter; OpenStack is not supported in Calico Enterprise/Cloud. The name of the region that a particular Felix belongs to. In a multi-region Calico/OpenStack deployment, this must be configured somehow for each Felix (here in the datamodel, or in felix.cfg or the environment on each compute node), and must match the [calico] openstack_region value configured in neutron.conf on each node.
Schema	String.
Default	none

reportingInterval

Attribute	Value
Key	reportingInterval
Description	Open source-only parameter; OpenStack is not supported in Calico Enterprise/Cloud. The interval at which Felix reports its status into the datastore or 0 to disable. Must be non-zero in OpenStack deployments.
Schema	Duration string, for example 1m30s123ms or 1h5m.
Default	30s

reportingTTL

Attribute	Value
Key	reportingTTL
Description	Open source-only parameter; OpenStack is not supported in Calico Enterprise/Cloud. The time-to-live setting for process-wide status reports.
Schema	Duration string, for example 1m30s123ms or 1h5m.
Default	1m30s

Dataplane: XDP acceleration for iptables dataplane

genericXDPEnabled

Attribute	Value
Key	genericXDPEnabled
Description	Enables Generic XDP so network cards that don't support XDP offload or driver modes can use XDP. This is not recommended since it doesn't provide better performance than iptables.
Schema	Boolean.
Default	false

xdpEnabled

Attribute	Value
Key	xdpEnabled
Description	Enables XDP acceleration for suitable untracked incoming deny rules.
Schema	Boolean.
Default	false

xdpRefreshInterval

Attribute	Value
Key	xdpRefreshInterval
Description	The period at which Felix re-checks all XDP state to ensure that no other process has accidentally broken Calico's BPF maps or attached programs. Set to 0 to disable XDP refresh.
Schema	Duration string, for example 1m30s123ms or 1h5m.
Default	1m30s

Overlay: VXLAN overlay

vxlanEnabled

Attribute	Value
Key	vxlanEnabled
Description	Overrides whether Felix should create the VXLAN tunnel device for IPv4 VXLAN networking. Optional as Felix determines this based on the existing IP pools.
Schema	Boolean.
Default	none

vxlanMTU

Attribute	Value
Key	vxlanMTU
Description	The MTU to set on the IPv4 VXLAN tunnel device. Optional as Felix auto-detects the MTU based on the MTU of the host's interfaces.
Schema	Integer
Default	0

vxlanMTUV6

Attribute	Value
Key	vxlanMTUV6
Description	The MTU to set on the IPv6 VXLAN tunnel device. Optional as Felix auto-detects the MTU based on the MTU of the host's interfaces.
Schema	Integer
Default	0

vxlanPort

Attribute	Value
Key	vxlanPort
Description	The UDP port number to use for VXLAN traffic.
Schema	Integer
Default	4789

vxlanVNI

Attribute	Value
Key	vxlanVNI
Description	The VXLAN VNI to use for VXLAN traffic. You may need to change this if the default value is in use on your system.
Schema	Integer
Default	4096

Overlay: IP-in-IP

ipipEnabled

Attribute	Value
Key	ipipEnabled
Description	Overrides whether Felix should configure an IPIP interface on the host. Optional as Felix determines this based on the existing IP pools.
Schema	Boolean.
Default	none

ipipMTU

Attribute	Value
Key	ipipMTU
Description	Controls the MTU to set on the IPIP tunnel device. Optional as Felix auto-detects the MTU based on the MTU of the host's interfaces.
Schema	Integer
Default	0

Overlay: Wireguard

wireguardEnabled

Attribute	Value
Key	wireguardEnabled
Description	Controls whether Wireguard is enabled for IPv4 (encapsulating IPv4 traffic over an IPv4 underlay network).
Schema	Boolean.
Default	false

wireguardEnabledV6

Attribute	Value
Key	wireguardEnabledV6
Description	Controls whether Wireguard is enabled for IPv6 (encapsulating IPv6 traffic over an IPv6 underlay network).
Schema	Boolean.
Default	false

wireguardHostEncryptionEnabled

Attribute	Value
Key	wireguardHostEncryptionEnabled
Description	Controls whether Wireguard host-to-host encryption is enabled.
Schema	Boolean.
Default	false

wireguardInterfaceName

Attribute	Value
Key	wireguardInterfaceName
Description	Specifies the name to use for the IPv4 Wireguard interface.
Schema	String.
Default	wireguard.cali

wireguardInterfaceNameV6

Attribute	Value
Key	wireguardInterfaceNameV6
Description	Specifies the name to use for the IPv6 Wireguard interface.
Schema	String.
Default	wg-v6.cali

wireguardListeningPort

Attribute	Value
Key	wireguardListeningPort
Description	Controls the listening port used by IPv4 Wireguard.
Schema	Integer
Default	51820

wireguardListeningPortV6

Attribute	Value
Key	wireguardListeningPortV6
Description	Controls the listening port used by IPv6 Wireguard.
Schema	Integer
Default	51821

wireguardMTU

Attribute	Value
Key	wireguardMTU
Description	Controls the MTU on the IPv4 Wireguard interface. See Configuring MTU.
Schema	Integer
Default	0

wireguardMTUV6

Attribute	Value
Key	wireguardMTUV6
Description	Controls the MTU on the IPv6 Wireguard interface. See Configuring MTU.
Schema	Integer
Default	0

wireguardKeepAlive

Attribute	Value
Key	wireguardKeepAlive
Description	Controls Wireguard PersistentKeepalive option. Set 0 to disable.
Schema	Duration string, for example 1m30s123ms or 1h5m.
Default	0s

wireguardRoutingRulePriority

Attribute	Value
Key	wireguardRoutingRulePriority
Description	Controls the priority value to use for the Wireguard routing rule.
Schema	Integer
Default	99

wireguardThreadingEnabled

Attribute	Value
Key	wireguardThreadingEnabled
Description	Controls whether Wireguard has Threaded NAPI enabled. This increases the maximum number of packets a Wireguard interface can process. Consider threaded NAPI only if you have high packets per second workloads that are causing dropping packets due to a saturated softirq CPU core. There is a [known issue](https://lore.kernel.org/netdev/CALrw=nEoT2emQ0OAYCjM1d_6Xe_kNLSZ6dhjb5FxrLFYh4kozA@mail.gmail.com/T/) with this setting that may cause NAPI to get stuck holding the global rtnl_mutex when a peer is removed. Workaround: Make sure your Linux kernel [includes this patch](https://github.com/torvalds/linux/commit/56364c910691f6d10ba88c964c9041b9ab777bd6) to unwedge NAPI.
Schema	Boolean.
Default	false

Overlay: IPSec

ipsecAllowUnsecuredTraffic

Attribute	Value
Key	ipsecAllowUnsecuredTraffic
Description	Controls whether non-IPsec traffic is allowed in addition to IPsec traffic. Enabling this negates the anti-spoofing protections of IPsec but it is useful when migrating to/from IPsec.
Schema	Boolean.
Default	false

ipsecESPAlgorithm

Attribute	Value
Key	ipsecESPAlgorithm
Description	IPSecESAlgorithm sets IPSec ESP algorithm. Default is NIST suite B recommendation.
Schema	String.
Default	aes128gcm16-ecp256

ipsecIKEAlgorithm

Attribute	Value
Key	ipsecIKEAlgorithm
Description	Sets IPSec IKE algorithm. Default is NIST suite B recommendation.
Schema	String.
Default	aes128gcm16-prfsha256-ecp256

ipsecLogLevel

Attribute	Value
Key	ipsecLogLevel
Description	Controls log level for IPSec components. Set to None for no logging. A generic log level terminology is used [None, Notice, Info, Debug, Verbose].
Schema	One of: Debug, Info, None, Notice, Verbose.
Default	Info

ipsecMode

Attribute	Value
Key	ipsecMode
Description	Controls which mode IPSec is operating on. Default value means IPSec is not enabled.
Schema	String.
Default	none

ipsecPolicyRefreshInterval

Attribute	Value
Key	ipsecPolicyRefreshInterval
Description	The interval at which Felix will check the kernel's IPsec policy tables and repair any inconsistencies.
Schema	Duration string, for example 1m30s123ms or 1h5m.
Default	10m0s

Flow logs: Prometheus reports

deletedMetricsRetentionSecs

Attribute	Value
Key	deletedMetricsRetentionSecs
Description	Controls how long metrics are retianed after the flow is gone.
Schema	Integer.
Default	30s

prometheusReporterCAFile

Attribute	Value
Key	prometheusReporterCAFile
Description	The path to the TLS CA file for the Prometheus per-flow metrics reporter.
Schema	String.
Default	none

prometheusReporterCertFile

Attribute	Value
Key	prometheusReporterCertFile
Description	The path to the TLS certificate file for the Prometheus per-flow metrics reporter.
Schema	String.
Default	none

prometheusReporterEnabled

Attribute	Value
Key	prometheusReporterEnabled
Description	Controls whether the Prometheus per-flow metrics reporter is enabled. This is used to show real-time flow metrics in the UI.
Schema	Boolean.
Default	false

prometheusReporterKeyFile

Attribute	Value
Key	prometheusReporterKeyFile
Description	The path to the TLS private key file for the Prometheus per-flow metrics reporter.
Schema	String.
Default	none

prometheusReporterPort

Attribute	Value
Key	prometheusReporterPort
Description	The port that the Prometheus per-flow metrics reporter should bind to.
Schema	Integer: [0,65535]
Default	9092

Flow logs: Syslog reports

syslogReporterAddress

Attribute	Value
Key	syslogReporterAddress
Description	The address to dial to when writing to Syslog. For TCP and UDP networks, the address has the form "host:port". The host must be a literal IP address, or a host name that can be resolved to IP addresses. The port must be a literal port number or a service name. For more, see: https://pkg.go.dev/net#Dial.
Schema	String.
Default	none

syslogReporterEnabled

Attribute	Value
Key	syslogReporterEnabled
Description	Turns on the feature to write logs to Syslog. Please note that this can incur significant disk space usage when running felix on non-cluster hosts.
Schema	Boolean.
Default	false

syslogReporterNetwork

Attribute	Value
Key	syslogReporterNetwork
Description	The network to dial to when writing to Syslog. Known networks are "tcp", "tcp4" (IPv4-only), "tcp6" (IPv6-only), "udp", "udp4" (IPv4-only), "udp6" (IPv6-only), "ip", "ip4" (IPv4-only), "ip6" (IPv6-only), "unix", "unixgram" and "unixpacket". For more, see: https://pkg.go.dev/net#Dial.
Schema	String.
Default	none

Flow logs: file reports

flowLogsAggregationThresholdBytes

Attribute	Value
Key	flowLogsAggregationThresholdBytes
Description	Used specify how far behind the external pipeline that reads flow logs can be. Default is 8192 bytes. This parameter only takes effect when FlowLogsDynamicAggregationEnabled is set to true.
Schema	Integer
Default	8192

flowLogsCollectProcessInfo

Attribute	Value
Key	flowLogsCollectProcessInfo
Description	If enabled Felix will load the kprobe BPF programs to collect process info.
Schema	Boolean.
Default	false

flowLogsCollectProcessPath

Attribute	Value
Key	flowLogsCollectProcessPath
Description	When FlowLogsCollectProcessPath and FlowLogsCollectProcessInfo are both enabled, each flow log will include information about the process that is sending or receiving the packets in that flow: the process_name field will contain the full path of the process executable, and the process_args field will have the arguments with which the executable was invoked. Process information will not be reported for connections which use raw sockets.
Schema	Boolean.
Default	false

flowLogsCollectTcpStats

Attribute	Value
Key	flowLogsCollectTcpStats
Description	Enables flow logs reporting TCP socket stats.
Schema	Boolean.
Default	false

flowLogsCollectorDebugTrace

Attribute	Value
Key	flowLogsCollectorDebugTrace
Description	When FlowLogsCollectorDebugTrace is set to true, enables the logs in the collector to be printed in their entirety.
Schema	Boolean.
Default	false

flowLogsDestDomainsByClient

Attribute	Value
Key	flowLogsDestDomainsByClient
Description	Used to configure if the source IP is used in the mapping of top level destination domains.
Schema	Boolean.
Default	true

flowLogsDynamicAggregationEnabled

Attribute	Value
Key	flowLogsDynamicAggregationEnabled
Description	Used to enable/disable dynamically changing aggregation levels. Default is true.
Schema	Boolean.
Default	false

flowLogsEnableHostEndpoint

Attribute	Value
Key	flowLogsEnableHostEndpoint
Description	Enables Flow logs reporting for HostEndpoints.
Schema	Boolean.
Default	false

flowLogsEnableNetworkSets

Attribute	Value
Key	flowLogsEnableNetworkSets
Description	Enables Flow logs reporting for GlobalNetworkSets.
Schema	Boolean.
Default	false

flowLogsFileAggregationKindForAllowed

Attribute	Value
Key	flowLogsFileAggregationKindForAllowed
Description	Used to choose the type of aggregation for flow log entries created for allowed connections. . Accepted values are 0, 1 and 2. 0 - No aggregation. 1 - Source port based aggregation. 2 - Pod prefix name based aggreagation.
Schema	One of: 0, 1, 2.
Default	2

flowLogsFileAggregationKindForDenied

Attribute	Value
Key	flowLogsFileAggregationKindForDenied
Description	Used to choose the type of aggregation for flow log entries created for denied connections. . Accepted values are 0, 1 and 2. 0 - No aggregation. 1 - Source port based aggregation. 2 - Pod prefix name based aggregation. 3 - No destination ports based aggregation.
Schema	One of: 0, 1, 2, 3.
Default	1

flowLogsFileDirectory

Attribute	Value
Key	flowLogsFileDirectory
Description	Sets the directory where flow logs files are stored.
Schema	String.
Default	/var/log/calico/flowlogs

flowLogsFileDomainsLimit

Attribute	Value
Key	flowLogsFileDomainsLimit
Description	Used to configure the number of (destination) domains to include in the flow log. These are not included for workload or host endpoint destinations.
Schema	Integer
Default	5

flowLogsFileEnabled

Attribute	Value
Key	flowLogsFileEnabled
Description	When set to true, enables logging flow logs to a file. If false no flow logging to file will occur.
Schema	Boolean.
Default	false

flowLogsFileEnabledForAllowed

Attribute	Value
Key	flowLogsFileEnabledForAllowed
Description	Used to enable/disable flow logs entries created for allowed connections. Default is true. This parameter only takes effect when FlowLogsFileReporterEnabled is set to true.
Schema	Boolean.
Default	true

flowLogsFileEnabledForDenied

Attribute	Value
Key	flowLogsFileEnabledForDenied
Description	Used to enable/disable flow logs entries created for denied flows. Default is true. This parameter only takes effect when FlowLogsFileReporterEnabled is set to true.
Schema	Boolean.
Default	true

flowLogsFileIncludeLabels

Attribute	Value
Key	flowLogsFileIncludeLabels
Description	Used to configure if endpoint labels are included in a Flow log entry written to file.
Schema	Boolean.
Default	false

flowLogsFileIncludePolicies

Attribute	Value
Key	flowLogsFileIncludePolicies
Description	Used to configure if policy information are included in a Flow log entry written to file.
Schema	Boolean.
Default	false

flowLogsFileIncludeService

Attribute	Value
Key	flowLogsFileIncludeService
Description	Used to configure if the destination service is included in a Flow log entry written to file. The service information can only be included if the flow was explicitly determined to be directed at the service (e.g. when the pre-DNAT destination corresponds to the service ClusterIP and port).
Schema	Boolean.
Default	false

flowLogsFileMaxFileSizeMB

Attribute	Value
Key	flowLogsFileMaxFileSizeMB
Description	Sets the max size in MB of flow logs files before rotation.
Schema	Integer
Default	100

flowLogsFileMaxFiles

Attribute	Value
Key	flowLogsFileMaxFiles
Description	Sets the number of log files to keep.
Schema	Integer
Default	5

flowLogsFileNatOutgoingPortLimit

Attribute	Value
Key	flowLogsFileNatOutgoingPortLimit
Description	Used to specify the maximum number of distinct post SNAT ports that will appear in the flowLogs. Default value is 3.
Schema	Integer
Default	3

flowLogsFilePerFlowProcessArgsLimit

Attribute	Value
Key	flowLogsFilePerFlowProcessArgsLimit
Description	Used to specify the maximum number of distinct process args that will appear in the flowLogs. Default value is 5.
Schema	Integer
Default	5

flowLogsFilePerFlowProcessLimit

Attribute	Value
Key	flowLogsFilePerFlowProcessLimit
Description	Used to specify the maximum number of flow log entries with distinct process information beyond which process information will be aggregated.
Schema	Integer
Default	2

flowLogsFlushInterval

Attribute	Value
Key	flowLogsFlushInterval
Description	Configures the interval at which Felix exports flow logs.
Schema	Duration string, for example 1m30s123ms or 1h5m.
Default	5m0s

flowLogsGoldmaneServer

Attribute	Value
Key	flowLogsGoldmaneServer
Description	FlowLogGoldmaneServer is the flow server endpoint to which flow data should be published.
Schema	String.
Default	none

flowLogsMaxOriginalIPsIncluded

Attribute	Value
Key	flowLogsMaxOriginalIPsIncluded
Description	Specifies the number of unique IP addresses (if relevant) that should be included in Flow logs.
Schema	Integer
Default	50

flowLogsPolicyEvaluationMode

Attribute	Value
Key	flowLogsPolicyEvaluationMode
Description	Defines how policies are evaluated and reflected in flow logs. OnNewConnection - In this mode, staged policies are only evaluated when new connections are made in the dataplane. Staged/active policy changes will not be reflected in the pending_policies field of flow logs for long lived connections. Continuous - Felix evaluates active flows on a regular basis to determine the rule traces in the flow logs. Any policy updates that impact a flow will be reflected in the pending_policies field, offering a near-real-time view of policy changes across flows.
Schema	String.
Default	Continuous

flowLogsPolicyScope

Attribute	Value
Key	flowLogsPolicyScope
Description	Controls which policies are included in flow logs. AllPolicies - Processes both transit policies for the local node and endpoint policies derived from packet source/destination IPs. Provides comprehensive visibility into all policy evaluations but increases log volume. EndpointPolicies - Processes only policies for endpoints identified as the source or destination of the packet (whether workload or host endpoints).
Schema	String.
Default	EndpointPolicies

flowLogsPositionFilePath

Attribute	Value
Key	flowLogsPositionFilePath
Description	Used specify the position of the external pipeline that reads flow logs. Default is /var/log/calico/flows.log.pos. This parameter only takes effect when FlowLogsDynamicAggregationEnabled is set to true.
Schema	String.
Default	/var/log/calico/flows.log.pos

DNS logs / policy

dnsCacheEpoch

Attribute	Value
Key	dnsCacheEpoch
Description	An arbitrary number that can be changed, at runtime, to tell Felix to discard all its learnt DNS information. .
Schema	Integer
Default	0

dnsCacheFile

Attribute	Value
Key	dnsCacheFile
Description	The name of the file that Felix uses to preserve learnt DNS information when restarting. .
Schema	String.
Default	/var/run/calico/felix-dns-cache.txt

dnsCacheSaveInterval

Attribute	Value
Key	dnsCacheSaveInterval
Description	The periodic interval at which Felix saves learnt DNS information to the cache file. .
Schema	Duration string, for example 1m30s123ms or 1h5m.
Default	1m0s

dnsExtraTTL

Attribute	Value
Key	dnsExtraTTL
Description	Extra time to keep IPs and alias names that are learnt from DNS, in addition to each name or IP's advertised TTL. .
Schema	Duration string, for example 1m30s123ms or 1h5m.
Default	0s

dnsLogsFileAggregationKind

Attribute	Value
Key	dnsLogsFileAggregationKind
Description	Used to choose the type of aggregation for DNS log entries. . Accepted values are 0 and 1. 0 - No aggregation. 1 - Aggregate over clients with the same name prefix.
Schema	One of: 0, 1.
Default	1

dnsLogsFileDirectory

Attribute	Value
Key	dnsLogsFileDirectory
Description	Sets the directory where DNS log files are stored.
Schema	String.
Default	/var/log/calico/dnslogs

dnsLogsFileEnabled

Attribute	Value
Key	dnsLogsFileEnabled
Description	Controls logging DNS logs to a file. If false no DNS logging to file will occur.
Schema	Boolean.
Default	false

dnsLogsFileIncludeLabels

Attribute	Value
Key	dnsLogsFileIncludeLabels
Description	Used to configure if endpoint labels are included in a DNS log entry written to file.
Schema	Boolean.
Default	true

dnsLogsFileMaxFileSizeMB

Attribute	Value
Key	dnsLogsFileMaxFileSizeMB
Description	Sets the max size in MB of DNS log files before rotation.
Schema	Integer
Default	100

dnsLogsFileMaxFiles

Attribute	Value
Key	dnsLogsFileMaxFiles
Description	Sets the number of DNS log files to keep.
Schema	Integer
Default	5

dnsLogsFilePerNodeLimit

Attribute	Value
Key	dnsLogsFilePerNodeLimit
Description	Limit on the number of DNS logs that can be emitted within each flush interval. When this limit has been reached, Felix counts the number of unloggable DNS responses within the flush interval, and emits a WARNING log with that count at the same time as it flushes the buffered DNS logs.
Schema	Integer
Default	0

dnsLogsFlushInterval

Attribute	Value
Key	dnsLogsFlushInterval
Description	Configures the interval at which Felix exports DNS logs.
Schema	Duration string, for example 1m30s123ms or 1h5m.
Default	5m0s

dnsLogsLatency

Attribute	Value
Key	dnsLogsLatency
Description	Indicates to include measurements of DNS request/response latency in each DNS log.
Schema	Boolean.
Default	true

dnsPacketsNfqueueID

Attribute	Value
Key	dnsPacketsNfqueueID
Description	The NFQUEUE ID to use for capturing DNS packets to ensure programming IPSets occurs before the response is released. Used when DNSPolicyMode is DelayDNSResponse.
Schema	Integer
Default	101

dnsPacketsNfqueueMaxHoldDuration

Attribute	Value
Key	dnsPacketsNfqueueMaxHoldDuration
Description	The max length of time to hold on to a DNS response while waiting for the the dataplane to be programmed. Used when DNSPolicyMode is DelayDNSResponse.
Schema	Duration string, for example 1m30s123ms or 1h5m.
Default	3s

dnsPacketsNfqueueSize

Attribute	Value
Key	dnsPacketsNfqueueSize
Description	The size of the NFQUEUE for captured DNS packets. This is the maximum number of DNS packets that may be queued awaiting programming in the dataplane. Used when DNSPolicyMode is DelayDNSResponse.
Schema	Integer
Default	100

dnsPolicyMode

Attribute	Value
Key	dnsPolicyMode
Description	Specifies how DNS policy programming will be handled. DelayDeniedPacket - Felix delays any denied packet that traversed a policy that included egress domain matches, but did not match. The packet is released after a fixed time, or after the destination IP address was programmed. DelayDNSResponse - Felix delays any DNS response until related IPSets are programmed. This introduces some latency to all DNS packets (even when no IPSet programming is required), but it ensures policy hit statistics are accurate. This is the recommended setting when you are making use of staged policies or policy rule hit statistics. NoDelay - Felix does not introduce any delay to the packets. DNS rules may not have been programmed by the time the first packet traverses the policy rules. Client applications need to handle reconnection attempts if initial connection attempts fail. This may be problematic for some applications or for very low DNS TTLs. Inline - Parses DNS response inline with DNS response packet processing within IPTables. This guarantees the DNS rules reflect any change immediately. This mode works for iptables only and matches the same mode for BPFDNSPolicyMode. This setting is ignored on Windows and "NoDelay" is always used. This setting is ignored by eBPF and BPFDNSPolicyMode is used instead. This field has no effect in NFTables mode. Please use NFTablesDNSPolicyMode instead.
Schema	One of: "DelayDNSResponse", "DelayDeniedPacket", "Inline", "NoDelay".
Default	DelayDeniedPacket

dnsPolicyNfqueueID

Attribute	Value
Key	dnsPolicyNfqueueID
Description	The NFQUEUE ID to use for DNS Policy re-evaluation when the domains IP hasn't been programmed to ipsets yet. Used when DNSPolicyMode is DelayDeniedPacket.
Schema	Integer
Default	100

dnsPolicyNfqueueSize

Attribute	Value
Key	dnsPolicyNfqueueSize
Description	DNSPolicyNfqueueID is the size of the NFQUEUE for DNS policy re-evaluation. This is the maximum number of denied packets that may be queued up pending re-evaluation. Used when DNSPolicyMode is DelayDeniedPacket.
Schema	Integer
Default	255

dnsTrustedServers

Attribute	Value
Key	dnsTrustedServers
Description	The DNS servers that Felix should trust. Each entry here must be <ip>[:<port>] - indicating an explicit DNS server IP - or k8s-service:[<namespace>/]<name>[:port] - indicating a Kubernetes DNS service. <port> defaults to the first service port, or 53 for an IP, and <namespace> to kube-system. An IPv6 address with a port must use the square brackets convention, for example [fd00:83a6::12]:5353.Note that Felix (calico-node) will need RBAC permission to read the details of each service specified by a k8s-service:... form. .
Schema	List of strings: ["<string>", ...].
Default	none

L7 logs

l7LogsFileAggregationDestinationInfo

Attribute	Value
Key	l7LogsFileAggregationDestinationInfo
Description	Used to choose the type of aggregation for the destination metadata on L7 log entries. . Accepted values are IncludeL7DestinationInfo and ExcludeL7DestinationInfo. IncludeL7DestinationInfo - Include destination metadata in the logs. ExcludeL7DestinationInfo - Aggregate over all other fields ignoring the destination aggregated name, namespace, and type.
Schema	One of: ExcludeL7DestinationInfo, IncludeL7DestinationInfo.
Default	IncludeL7DestinationInfo

l7LogsFileAggregationHTTPHeaderInfo

Attribute	Value
Key	l7LogsFileAggregationHTTPHeaderInfo
Description	Used to choose the type of aggregation for HTTP header data on L7 log entries. . Accepted values are IncludeL7HTTPHeaderInfo and ExcludeL7HTTPHeaderInfo. IncludeL7HTTPHeaderInfo - Include HTTP header data in the logs. ExcludeL7HTTPHeaderInfo - Aggregate over all other fields ignoring the user agent and log type.
Schema	One of: ExcludeL7HTTPHeaderInfo, IncludeL7HTTPHeaderInfo.
Default	ExcludeL7HTTPHeaderInfo

l7LogsFileAggregationHTTPMethod

Attribute	Value
Key	l7LogsFileAggregationHTTPMethod
Description	Used to choose the type of aggregation for the HTTP request method on L7 log entries. . Accepted values are IncludeL7HTTPMethod and ExcludeL7HTTPMethod. IncludeL7HTTPMethod - Include HTTP method in the logs. ExcludeL7HTTPMethod - Aggregate over all other fields ignoring the HTTP method.
Schema	One of: ExcludeL7HTTPMethod, IncludeL7HTTPMethod.
Default	IncludeL7HTTPMethod

l7LogsFileAggregationNumURLPath

Attribute	Value
Key	l7LogsFileAggregationNumURLPath
Description	Used to choose the number of components in the url path to display. This allows for the url to be truncated in case parts of the path provide no value. Setting this value to negative will allow all parts of the path to be displayed. .
Schema	Integer
Default	5

l7LogsFileAggregationResponseCode

Attribute	Value
Key	l7LogsFileAggregationResponseCode
Description	Used to choose the type of aggregation for the response code on L7 log entries. . Accepted values are IncludeL7ResponseCode and ExcludeL7ResponseCode. IncludeL7ResponseCode - Include the response code in the logs. ExcludeL7ResponseCode - Aggregate over all other fields ignoring the response code.
Schema	One of: ExcludeL7ResponseCode, IncludeL7ResponseCode.
Default	IncludeL7ResponseCode

l7LogsFileAggregationServiceInfo

Attribute	Value
Key	l7LogsFileAggregationServiceInfo
Description	Used to choose the type of aggregation for the service data on L7 log entries. . Accepted values are IncludeL7ServiceInfo and ExcludeL7ServiceInfo. IncludeL7ServiceInfo - Include service data in the logs. ExcludeL7ServiceInfo - Aggregate over all other fields ignoring the service name, namespace, and port.
Schema	One of: ExcludeL7ServiceInfo, IncludeL7ServiceInfo.
Default	IncludeL7ServiceInfo

l7LogsFileAggregationSourceInfo

Attribute	Value
Key	l7LogsFileAggregationSourceInfo
Description	L7LogsFileAggregationExcludeSourceInfo is used to choose the type of aggregation for the source metadata on L7 log entries. . Accepted values are IncludeL7SourceInfo, IncludeL7SourceInfoNoPort, and ExcludeL7SourceInfo. IncludeL7SourceInfo - Include source metadata in the logs. IncludeL7SourceInfoNoPort - Include source metadata in the logs excluding the source port. ExcludeL7SourceInfo - Aggregate over all other fields ignoring the source aggregated name, namespace, and type.
Schema	One of: ExcludeL7SourceInfo, IncludeL7SourceInfo, IncludeL7SourceInfoNoPort.
Default	IncludeL7SourceInfoNoPort

l7LogsFileAggregationTrimURL

Attribute	Value
Key	l7LogsFileAggregationTrimURL
Description	Used to choose the type of aggregation for the url on L7 log entries. . Accepted values: IncludeL7FullURL - Include the full URL up to however many path components are allowed by L7LogsFileAggregationNumURLPath. TrimURLQuery - Aggregate over all other fields ignoring the query parameters on the URL. TrimURLQueryAndPath - Aggregate over all other fields and the base URL only. ExcludeL7URL - Aggregate over all other fields ignoring the URL entirely.
Schema	One of: ExcludeL7URL, IncludeL7FullURL, TrimURLQuery, TrimURLQueryAndPath.
Default	IncludeL7FullURL

l7LogsFileAggregationURLCharLimit

Attribute	Value
Key	l7LogsFileAggregationURLCharLimit
Description	Limit on the length of the URL collected in L7 logs. When a URL length reaches this limit it is sliced off, and the sliced URL is sent to log storage.
Schema	Integer
Default	250

l7LogsFileDirectory

Attribute	Value
Key	l7LogsFileDirectory
Description	Sets the directory where L7 log files are stored.
Schema	String.
Default	/var/log/calico/l7logs

l7LogsFileEnabled

Attribute	Value
Key	l7LogsFileEnabled
Description	Controls logging L7 logs to a file. If false no L7 logging to file will occur.
Schema	Boolean.
Default	true

l7LogsFileMaxFileSizeMB

Attribute	Value
Key	l7LogsFileMaxFileSizeMB
Description	Sets the max size in MB of L7 log files before rotation.
Schema	Integer
Default	100

l7LogsFileMaxFiles

Attribute	Value
Key	l7LogsFileMaxFiles
Description	Sets the number of L7 log files to keep.
Schema	Integer
Default	5

l7LogsFilePerNodeLimit

Attribute	Value
Key	l7LogsFilePerNodeLimit
Description	Limit on the number of L7 logs that can be emitted within each flush interval. When this limit has been reached, Felix counts the number of unloggable L7 responses within the flush interval, and emits a WARNING log with that count at the same time as it flushes the buffered L7 logs. A value of 0 means no limit.
Schema	Integer
Default	1500

l7LogsFlushInterval

Attribute	Value
Key	l7LogsFlushInterval
Description	Configures the interval at which Felix exports L7 logs.
Schema	Duration string, for example 1m30s123ms or 1h5m.
Default	5m0s

AWS integration

awsRequestTimeout

Attribute	Value
Key	awsRequestTimeout
Description	The timeout on AWS API requests.
Schema	Duration string, for example 1m30s123ms or 1h5m.
Default	30s

awsSecondaryIPRoutingRulePriority

Attribute	Value
Key	awsSecondaryIPRoutingRulePriority
Description	Controls the priority that Felix will use for routing rules when programming them for AWS Secondary IP support.
Schema	Integer: [0,4294967295]
Default	101

awsSecondaryIPSupport

Attribute	Value
Key	awsSecondaryIPSupport
Description	Controls whether Felix will try to provision AWS secondary ENIs for workloads that have IPs from IP pools that are configured with an AWS subnet ID. If the field is set to "EnabledENIPerWorkload" then each workload with an AWS-backed IP will be assigned its own secondary ENI. If set to "Enabled" then each workload with an AWS-backed IP pool will be allocated a secondary IP address on a secondary ENI; this mode requires additional IP pools to be provisioned for the host to claim IPs for the primary IP of the secondary ENIs. Accepted value must be one of "Enabled", "EnabledENIPerWorkload" or "Disabled".
Schema	One of: Disabled, Enabled, EnabledENIPerWorkload.
Default	Disabled

awsSrcDstCheck

Attribute	Value
Key	awsSrcDstCheck
Description	Controls whether Felix will try to change the "source/dest check" setting on the EC2 instance on which it is running. A value of "Disable" will try to disable the source/dest check. Disabling the check allows for sending workload traffic without encapsulation within the same AWS subnet.
Schema	One of: "Disable", "DoNothing", "Enable".
Default	DoNothing

Egress gateway

egressGatewayPollFailureCount

Attribute	Value
Key	egressGatewayPollFailureCount
Description	The minimum number of poll failures before a remote Egress Gateway is considered to have failed.
Schema	Integer
Default	3

egressGatewayPollInterval

Attribute	Value
Key	egressGatewayPollInterval
Description	The interval at which Felix will poll remote egress gateways to check their health. Only Egress Gateways with a named "health" port will be polled in this way. Egress Gateways that fail the health check will be taken our of use as if they have been deleted.
Schema	Duration string, for example 1m30s123ms or 1h5m.
Default	10s

egressIPRoutingRulePriority

Attribute	Value
Key	egressIPRoutingRulePriority
Description	Controls the priority value to use for the egress IP routing rule.
Schema	Integer
Default	100

egressIPSupport

Attribute	Value
Key	egressIPSupport
Description	Defines three different support modes for egress IP function. - Disabled: Egress IP function is disabled. - EnabledPerNamespace: Egress IP function is enabled and can be configured on a per-namespace basis; per-pod egress annotations are ignored. - EnabledPerNamespaceOrPerPod: Egress IP function is enabled and can be configured per-namespace or per-pod, with per-pod egress annotations overriding namespace annotations.
Schema	One of: Disabled, EnabledPerNamespace, EnabledPerNamespaceOrPerPod.
Default	Disabled

egressIPVXLANPort

Attribute	Value
Key	egressIPVXLANPort
Description	The port number of vxlan tunnel device for egress traffic.
Schema	Integer
Default	4790

egressIPVXLANVNI

Attribute	Value
Key	egressIPVXLANVNI
Description	The VNI ID of vxlan tunnel device for egress traffic.
Schema	Integer
Default	4097

External network support

externalNetworkRoutingRulePriority

Attribute	Value
Key	externalNetworkRoutingRulePriority
Description	Controls the priority value to use for the external network routing rule.
Schema	Integer
Default	102

externalNetworkSupport

Attribute	Value
Key	externalNetworkSupport
Description	Defines two different support modes for external network function. - Disabled: External network function is disabled. - Enabled: External network function is enabled.
Schema	One of: Disabled, Enabled.
Default	Disabled

Packet capture

captureDir

Attribute	Value
Key	captureDir
Description	Controls directory to store file capture.
Schema	String.
Default	/var/log/calico/pcap

captureMaxFiles

Attribute	Value
Key	captureMaxFiles
Description	Controls number of rotated capture file to keep.
Schema	Integer
Default	2

captureMaxSizeBytes

Attribute	Value
Key	captureMaxSizeBytes
Description	Controls the max size of a file capture.
Schema	Integer
Default	10000000

captureRotationSeconds

Attribute	Value
Key	captureRotationSeconds
Description	Controls the time rotation of a packet capture.
Schema	Integer
Default	3600

L7 proxy

tproxyMode

Attribute	Value
Key	tproxyMode
Description	Sets whether traffic is directed through a transparent proxy for further processing or not and how is the proxying done.
Schema	One of: Disabled, Enabled, EnabledAllServices.
Default	Disabled

tproxyPort

Attribute	Value
Key	tproxyPort
Description	Sets to which port proxied traffic should be redirected.
Schema	Integer
Default	16001

tproxyUpstreamConnMark

Attribute	Value
Key	tproxyUpstreamConnMark
Description	Tells Felix which mark is used by the proxy for its upstream connections so that Felix can program the dataplane correctly.
Schema	Unsigned 32-bit integer.
Default	0x17

Debug/test-only (generally unsupported)

debugDisableLogDropping

Attribute	Value
Key	debugDisableLogDropping
Description	Disables the dropping of log messages when the log buffer is full. This can significantly impact performance if log write-out is a bottleneck.
Schema	Boolean.
Default	false

debugHost

Attribute	Value
Key	debugHost
Description	The host IP or hostname to bind the debug port to. Only used if DebugPort is set.
Schema	String.
Default	localhost

debugMemoryProfilePath

Attribute	Value
Key	debugMemoryProfilePath
Description	The path to write the memory profile to when triggered by signal.
Schema	String.
Default	none

debugPort

Attribute	Value
Key	debugPort
Description	If set, enables Felix's debug HTTP port, which allows memory and CPU profiles to be retrieved. The debug port is not secure, it should not be exposed to the internet.
Schema	Integer: [0,65535]
Default	none

debugSimulateCalcGraphHangAfter

Attribute	Value
Key	debugSimulateCalcGraphHangAfter
Description	Used to simulate a hang in the calculation graph after the specified duration. This is useful in tests of the watchdog system only!
Schema	Duration string, for example 1m30s123ms or 1h5m.
Default	0s

debugSimulateDataplaneApplyDelay

Attribute	Value
Key	debugSimulateDataplaneApplyDelay
Description	Adds an artificial delay to every dataplane operation. This is useful for simulating a heavily loaded system for test purposes only.
Schema	Duration string, for example 1m30s123ms or 1h5m.
Default	0s

debugSimulateDataplaneHangAfter

Attribute	Value
Key	debugSimulateDataplaneHangAfter
Description	Used to simulate a hang in the dataplane after the specified duration. This is useful in tests of the watchdog system only!
Schema	Duration string, for example 1m30s123ms or 1h5m.
Default	0s

statsDumpFilePath

Attribute	Value
Key	statsDumpFilePath
Description	The path to write a diagnostic flow logs statistics dump to when triggered by signal.
Schema	String.
Default	/var/log/calico/stats/dump

Usage reporting

usageReportingEnabled

Attribute	Value
Key	usageReportingEnabled
Description	Unused in Calico Enterprise, usage reporting is permanently disabled.
Schema	Boolean.
Default	true

usageReportingInitialDelay

Attribute	Value
Key	usageReportingInitialDelay
Description	Unused in Calico Enterprise, usage reporting is permanently disabled.
Schema	Duration string, for example 1m30s123ms or 1h5m.
Default	5m0s

usageReportingInterval

Attribute	Value
Key	usageReportingInterval
Description	Unused in Calico Enterprise, usage reporting is permanently disabled.
Schema	Duration string, for example 1m30s123ms or 1h5m.
Default	24h0m0s

Health Timeout Overrides

Felix has internal liveness and readiness watchdog timers that monitor its various loops. If a loop fails to "check in" within the allotted timeout then Felix will report non-Ready or non-Live on its health port (which is monitored by Kubelet in a Kubernetes system). If Felix reports non-Live, this can result in the Pod being restarted.

In Kubernetes, if you see the calico-node Pod readiness or liveness checks fail intermittently, check the calico-node Pod log for a log from Felix that gives the overall health status (the list of components will depend on which features are enabled):

+---------------------------+---------+----------------+-----------------+--------+
|         COMPONENT         | TIMEOUT |    LIVENESS    |    READINESS    | DETAIL |
+---------------------------+---------+----------------+-----------------+--------+
| CalculationGraph          | 30s     | reporting live | reporting ready |        |
| FelixStartup              | 0s      | reporting live | reporting ready |        |
| InternalDataplaneMainLoop | 1m30s   | reporting live | reporting ready |        |
+---------------------------+---------+----------------+-----------------+--------+

If some health timeouts show as "timed out" it may help to apply an override using the healthTimeoutOverrides field:

...
spec:
  healthTimeoutOverrides:
  - name: InternalDataplaneMainLoop
    timeout: "5m"
  - name: CalculationGraph
    timeout: "1m30s"
  ...

A timeout value of 0 disables the timeout.

ProtoPort

Field	Description	Accepted Values	Schema
port	The exact port match	0-65535	int
protocol	The protocol match	tcp, udp, sctp	string
net	The CIDR match	any valid CIDR (e.g. 192.168.0.0/16)	string

Keep in mind that in the following example, net: "" and net: "0.0.0.0/0" are processed as the same in the policy enforcement.

  ...
spec:
  failsafeInboundHostPorts:
  - net: "192.168.1.1/32"
    port: 22
    protocol: tcp
  - net: ""
    port: 67
    protocol: udp
failsafeOutboundHostPorts:
  - net: "0.0.0.0/0"
    port: 67
    protocol: udp
  ...

AggregationKind

Value	Description
0	No aggregation
1	Aggregate all flows that share a source port on each node
2	Aggregate all flows that share source ports or are from the same ReplicaSet on each node

DNSPolicyMode

Value	Description
DelayDeniedPacket	Felix delays any denied packet that traversed a policy that included egress domain matches, but did not match. The packet is released after a fixed time, or after the destination IP address was programmed.
DelayDNSResponse	Felix delays any DNS response until related IPSets are programmed. This introduces some latency to all DNS packets (even when no IPSet programming is required), but it ensures policy hit statistics are accurate. This is the recommended setting when you are making use of staged policies or policy rule hit statistics. A Linux kernel version of 3.13 or greater is required to use DelayDNSResponse. For earlier kernel versions, this value is modified to DelayDeniedPacket.
NoDelay	Felix does not introduce any delay to the packets. DNS rules may not have been programmed by the time the first packet traverses the policy rules. Client applications need to handle reconnection attempts if initial connection attempts fail. This may be problematic for some applications or for very low DNS TTLs.

On Windows, or when using the eBPF dataplane, this setting is ignored. Windows always uses NoDelay while eBPF has its own BPFDNSPolicyMode option.

BPFDNSPolicyMode

Value	Description
Inline	Felix does not introduce any delay to any packets. Felix's eBPF programs parse DNS responses and program policy rules immediately, before the DNS response is passed to the application. This only applies to wildcard prefixes: *.x.y.z will be processed in this manner, but wildcards such as x.*.y.z will not match. A Linux kernel version of 5.17 or greater is required.
NoDelay	Felix does not introduce any delay to the packets. DNS rules may not have been programmed by the time the first packet traverses the policy rules. Client applications need to handle reconnection attempts if initial connection attempts fail. This may be problematic for some applications or for very low DNS TTLs.

RouteTableRange

The RouteTableRange option is now deprecated in favor of RouteTableRanges.

Field	Description	Accepted Values	Schema
min	Minimum index to use	1-250	int
max	Maximum index to use	1-250	int

RouteTableRanges

RouteTableRanges is a list of RouteTableRange objects:

Field	Description	Accepted Values	Schema
min	Minimum index to use	1 - 4294967295	int
max	Maximum index to use	1 - 4294967295	int

Each item in the RouteTableRanges list designates a range of routing tables available to Calico. By default, Calico will use a single range of 1-250. If a range spans Linux's reserved table range (253-255) then those tables are automatically excluded from the list. It's possible that other table ranges may also be reserved by third-party systems unknown to Calico. In that case, multiple ranges can be defined to target tables below and above the sensitive ranges:

 target tables 65-99, and 256-1000, skipping 100-255
calicoctl patch felixconfig default --type=merge -p '{"spec":{"routeTableRanges": [{"min": 65, "max": 99}, {"min": 256, "max": 1000}] }}

Note, for performance reasons, the maximum total number of routing tables that Felix will accept is 65535 (or 2*16).

Specifying both the RouteTableRange and RouteTableRanges arguments is not supported and will result in an error from the api.

AWS IAM Role/Policy for source-destination-check configuration

Setting awsSrcDstCheck to Disable will automatically disable source-destination-check on EC2 instances in a cluster, provided necessary IAM roles and policies are set. One of the policies assigned to IAM role of cluster nodes must contain a statement similar to the following:

{
    "Effect": "Allow",
        "Action": [
            "ec2:DescribeInstances",
            "ec2:ModifyNetworkInterfaceAttribute"
        ],
    "Resource": "*"
}

If there are no policies attached to node roles containing the above statement, attach a new policy. For example, if a node role is test-cluster-nodeinstance-role, click on the IAM role in AWS console. In the Permission policies list, add a new inline policy with the above statement to the new policy JSON definition. For detailed information, see AWS documentation.

For an EKS cluster, the necessary IAM role and policy is available by default. No further actions are needed.

Supported operations

Datastore type	Create	Delete	Delete (Global default)	Update	Get/List	Notes
Kubernetes API server	Yes	Yes	No	Yes	Yes