About non-cluster hosts

Big picture

Secure non-cluster hosts by installing Calico for networking and/or networking policy.

Value

Not all hosts in your environment run pods/workloads. You may have physical machines or legacy applications that you cannot move into a Kubernetes cluster, but still need to securely communicate with pods in your cluster. Calico lets you enforce policy on these non-cluster hosts using the same robust Calico network policy that you use for pods.

Concepts

Non-cluster hosts and host endpoints

A non-cluster host is a computer that is running an application that is not part of a Kubernetes cluster. Using Calico network policy, you can secure these host interfaces using host endpoints. Host endpoints can have labels, and work the same as labels on pods/workload endpoints.

The advantage is, you can write network policy rules to apply to both workload endpoints and host endpoints using label selectors; where each selector can refer to the either type (or be a mix of the two). For example, you can write a cluster-wide policy for non-cluster hosts that is immediately applied to every host. To learn how to restrict traffic to/from hosts using Calico network policy see, Protect hosts.

If you are using the etcd3 database, you can also install Calico with networking as described below.

Install options for non-cluster hosts

Install Calico with...	Requires	Use case	Supported install methods
Policy only	An etcd3 or Kubernetes datastore	Use Calico network policy to control firewalls on non-cluster hosts.	Binary install with/ without a package manager
Networking and network policy	An etcd3 datastore	Networking Use Calico networking (BGP, or overlay with VXLAN or IP-in-IP) to handle these communications: - pod ↔ pod - pod ↔ host Note: Calico does not handle host ↔ host networking; your underlying network must already be set up to handle this. Policy Use Calico network policy to control firewalls on your non-cluster hosts.	Docker container

Before you begin

Supported

• All platforms in this release, except Windows

Required

• Non-cluster host meets system requirements for Calico. If you want to use a package manager for installation, the non-cluster host must be a system derived from Ubuntu or RedHat.
• Set up a datastore; if Calico is installed on a cluster, you already have a datastore
• Install kubectl or calicoctl. (kubectl works only with the Kubernetes datastore.)

Next steps

Select an install method.

note

Calico must be installed on each non-cluster host that you want to control with networking and/or policy.

Install method	Networking	Policy
Docker container	✓	✓
Binary install with package manager		✓
Binary install without package manager		✓