Configuring Felix
The following tables detail the configuration file and
environment variable parameters. For FelixConfiguration
resource settings,
refer to Felix Configuration Resource.
Configuration for Felix is read from one of four possible locations, in order, as follows.
- Environment variables.
- The Felix configuration file.
- Host-specific
FelixConfiguration
resources (node.<nodename>
). - The global
FelixConfiguration
resource (default
).
The value of any configuration parameter is the value read from the first location containing a value. For example, if an environment variable contains a value, it takes top precedence.
If not set in any of these locations, most configuration parameters have defaults, and it should be rare to have to explicitly set them.
The full list of parameters which can be set is as follows.
Spec
Datastore connection
DatastoreType
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | DatastoreType |
Description | Controls which datastore driver Felix will use. Typically, this is detected from the environment
and it does not need to be set manually. (For example, if |
Schema | One of: etcdv3 , kubernetes (case insensitive) |
Default | etcdv3 |
Attribute | Value |
---|---|
Key | FELIX_DATASTORETYPE |
Description | Controls which datastore driver Felix will use. Typically, this is detected from the environment
and it does not need to be set manually. (For example, if |
Schema | One of: etcdv3 , kubernetes (case insensitive) |
Default | etcdv3 |
EtcdAddr
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | EtcdAddr |
Description | When using the |
Schema | String matching regex ^[^:/]+:\d+$ |
Default | 127.0.0.1:2379 |
Attribute | Value |
---|---|
Key | FELIX_ETCDADDR |
Description | When using the |
Schema | String matching regex ^[^:/]+:\d+$ |
Default | 127.0.0.1:2379 |
EtcdCaFile
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | EtcdCaFile |
Description | When using the |
Schema | Path to file, which must exist |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_ETCDCAFILE |
Description | When using the |
Schema | Path to file, which must exist |
Default | none |
EtcdCertFile
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | EtcdCertFile |
Description | When using the |
Schema | Path to file, which must exist |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_ETCDCERTFILE |
Description | When using the |
Schema | Path to file, which must exist |
Default | none |
EtcdEndpoints
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | EtcdEndpoints |
Description | When using the |
Schema | List of HTTP endpoints: comma-delimited list of http(s)://hostname:port |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_ETCDENDPOINTS |
Description | When using the |
Schema | List of HTTP endpoints: comma-delimited list of http(s)://hostname:port |
Default | none |
EtcdKeyFile
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | EtcdKeyFile |
Description | When using the |
Schema | Path to file, which must exist |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_ETCDKEYFILE |
Description | When using the |
Schema | Path to file, which must exist |
Default | none |
EtcdScheme
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | EtcdScheme |
Description | EtcdAddr: when using the |
Schema | One of: http , https (case insensitive) |
Default | http |
Attribute | Value |
---|---|
Key | FELIX_ETCDSCHEME |
Description | EtcdAddr: when using the |
Schema | One of: http , https (case insensitive) |
Default | http |
FelixHostname
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | FelixHostname |
Description | The name of this node, used to identify resources in the datastore that belong to this node. Auto-detected from the node's hostname if not provided. |
Schema | String matching regex ^[a-zA-Z0-9_.-]+$ |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_FELIXHOSTNAME |
Description | The name of this node, used to identify resources in the datastore that belong to this node. Auto-detected from the node's hostname if not provided. |
Schema | String matching regex ^[a-zA-Z0-9_.-]+$ |
Default | none |
TyphaAddr
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | TyphaAddr |
Description | If set, tells Felix to connect to Typha at the given address and port. Overrides TyphaK8sServiceName. |
Schema | String matching regex ^[^:/]+:\d+$ |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_TYPHAADDR |
Description | If set, tells Felix to connect to Typha at the given address and port. Overrides TyphaK8sServiceName. |
Schema | String matching regex ^[^:/]+:\d+$ |
Default | none |
TyphaCAFile
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | TyphaCAFile |
Description | Path to the TLS CA file to use when communicating with Typha. If this parameter is specified, the other TLS parameters must also be specified. |
Schema | Path to file, which must exist |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_TYPHACAFILE |
Description | Path to the TLS CA file to use when communicating with Typha. If this parameter is specified, the other TLS parameters must also be specified. |
Schema | Path to file, which must exist |
Default | none |
TyphaCN
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | TyphaCN |
Description | Common name to use when authenticating to Typha over TLS. If any TLS parameters are specified then one of TyphaCN and TyphaURISAN must be set. |
Schema | String |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_TYPHACN |
Description | Common name to use when authenticating to Typha over TLS. If any TLS parameters are specified then one of TyphaCN and TyphaURISAN must be set. |
Schema | String |
Default | none |
TyphaCertFile
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | TyphaCertFile |
Description | Path to the TLS certificate to use when communicating with Typha. If this parameter is specified, the other TLS parameters must also be specified. |
Schema | Path to file, which must exist |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_TYPHACERTFILE |
Description | Path to the TLS certificate to use when communicating with Typha. If this parameter is specified, the other TLS parameters must also be specified. |
Schema | Path to file, which must exist |
Default | none |
TyphaK8sNamespace
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | TyphaK8sNamespace |
Description | Namespace to look in when looking for Typha's service (see TyphaK8sServiceName). |
Schema | String |
Default | kube-system |
Attribute | Value |
---|---|
Key | FELIX_TYPHAK8SNAMESPACE |
Description | Namespace to look in when looking for Typha's service (see TyphaK8sServiceName). |
Schema | String |
Default | kube-system |
TyphaK8sServiceName
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | TyphaK8sServiceName |
Description | If set, tells Felix to connect to Typha by looking up the Endpoints of the given Kubernetes Service in namespace specified by TyphaK8sNamespace. |
Schema | String |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_TYPHAK8SSERVICENAME |
Description | If set, tells Felix to connect to Typha by looking up the Endpoints of the given Kubernetes Service in namespace specified by TyphaK8sNamespace. |
Schema | String |
Default | none |
TyphaKeyFile
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | TyphaKeyFile |
Description | Path to the TLS private key to use when communicating with Typha. If this parameter is specified, the other TLS parameters must also be specified. |
Schema | Path to file, which must exist |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_TYPHAKEYFILE |
Description | Path to the TLS private key to use when communicating with Typha. If this parameter is specified, the other TLS parameters must also be specified. |
Schema | Path to file, which must exist |
Default | none |
TyphaReadTimeout
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | TyphaReadTimeout |
Description | Read timeout when reading from the Typha connection. If typha sends no data for this long, Felix will exit and restart. (Note that Typha sends regular pings so traffic is always expected.) |
Schema | Seconds (floating point) |
Default | 30 |
Attribute | Value |
---|---|
Key | FELIX_TYPHAREADTIMEOUT |
Description | Read timeout when reading from the Typha connection. If typha sends no data for this long, Felix will exit and restart. (Note that Typha sends regular pings so traffic is always expected.) |
Schema | Seconds (floating point) |
Default | 30 |
TyphaURISAN
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | TyphaURISAN |
Description | URI SAN to use when authenticating to Typha over TLS. If any TLS parameters are specified then one of TyphaCN and TyphaURISAN must be set. |
Schema | String |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_TYPHAURISAN |
Description | URI SAN to use when authenticating to Typha over TLS. If any TLS parameters are specified then one of TyphaCN and TyphaURISAN must be set. |
Schema | String |
Default | none |
TyphaWriteTimeout
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | TyphaWriteTimeout |
Description | Write timeout when writing data to Typha. |
Schema | Seconds (floating point) |
Default | 10 |
Attribute | Value |
---|---|
Key | FELIX_TYPHAWRITETIMEOUT |
Description | Write timeout when writing data to Typha. |
Schema | Seconds (floating point) |
Default | 10 |
Process: Feature detection/overrides
FeatureDetectOverride
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | FeatureDetectOverride |
Description | Used to override feature detection based on auto-detected platform capabilities. Values are specified in a comma separated list with no spaces, example; "SNATFullyRandom=true,MASQFullyRandom=false,RestoreSupportsLock=". A value of "true" or "false" will force enable/disable feature, empty or omitted values fall back to auto-detection. |
Schema | Comma-delimited list of key=value pairs |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_FEATUREDETECTOVERRIDE |
Description | Used to override feature detection based on auto-detected platform capabilities. Values are specified in a comma separated list with no spaces, example; "SNATFullyRandom=true,MASQFullyRandom=false,RestoreSupportsLock=". A value of "true" or "false" will force enable/disable feature, empty or omitted values fall back to auto-detection. |
Schema | Comma-delimited list of key=value pairs |
Default | none |
FeatureGates
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | FeatureGates |
Description | Used to enable or disable tech-preview Calico features. Values are specified in a comma separated list with no spaces, example; "BPFConnectTimeLoadBalancingWorkaround=enabled,XyZ=false". This is used to enable features that are not fully production ready. |
Schema | Comma-delimited list of key=value pairs |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_FEATUREGATES |
Description | Used to enable or disable tech-preview Calico features. Values are specified in a comma separated list with no spaces, example; "BPFConnectTimeLoadBalancingWorkaround=enabled,XyZ=false". This is used to enable features that are not fully production ready. |
Schema | Comma-delimited list of key=value pairs |
Default | none |
Process: Go runtime
GoGCThreshold
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | GoGCThreshold |
Description | Sets the Go runtime's garbage collection threshold. I.e. the percentage that the heap is allowed to grow before garbage collection is triggered. In general, doubling the value halves the CPU time spent doing GC, but it also doubles peak GC memory overhead. A special value of -1 can be used to disable GC entirely; this should only be used in conjunction with the GoMemoryLimitMB setting. This setting is overridden by the GOGC environment variable. |
Schema | Integer: [-1,263-1] |
Default | 40 |
Attribute | Value |
---|---|
Key | FELIX_GOGCTHRESHOLD |
Description | Sets the Go runtime's garbage collection threshold. I.e. the percentage that the heap is allowed to grow before garbage collection is triggered. In general, doubling the value halves the CPU time spent doing GC, but it also doubles peak GC memory overhead. A special value of -1 can be used to disable GC entirely; this should only be used in conjunction with the GoMemoryLimitMB setting. This setting is overridden by the GOGC environment variable. |
Schema | Integer: [-1,263-1] |
Default | 40 |
GoMaxProcs
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | GoMaxProcs |
Description | Sets the maximum number of CPUs that the Go runtime will use concurrently. A value of -1 means "use the system default"; typically the number of real CPUs on the system. this setting is overridden by the GOMAXPROCS environment variable. |
Schema | Integer: [-1,263-1] |
Default | -1 |
Attribute | Value |
---|---|
Key | FELIX_GOMAXPROCS |
Description | Sets the maximum number of CPUs that the Go runtime will use concurrently. A value of -1 means "use the system default"; typically the number of real CPUs on the system. this setting is overridden by the GOMAXPROCS environment variable. |
Schema | Integer: [-1,263-1] |
Default | -1 |
GoMemoryLimitMB
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | GoMemoryLimitMB |
Description | Sets a (soft) memory limit for the Go runtime in MB. The Go runtime will try to keep its memory usage under the limit by triggering GC as needed. To avoid thrashing, it will exceed the limit if GC starts to take more than 50% of the process's CPU time. A value of -1 disables the memory limit. Note that the memory limit, if used, must be considerably less than any hard resource limit set at the container or pod level. This is because felix is not the only process that must run in the container or pod. This setting is overridden by the GOMEMLIMIT environment variable. |
Schema | Integer: [-1,263-1] |
Default | -1 |
Attribute | Value |
---|---|
Key | FELIX_GOMEMORYLIMITMB |
Description | Sets a (soft) memory limit for the Go runtime in MB. The Go runtime will try to keep its memory usage under the limit by triggering GC as needed. To avoid thrashing, it will exceed the limit if GC starts to take more than 50% of the process's CPU time. A value of -1 disables the memory limit. Note that the memory limit, if used, must be considerably less than any hard resource limit set at the container or pod level. This is because felix is not the only process that must run in the container or pod. This setting is overridden by the GOMEMLIMIT environment variable. |
Schema | Integer: [-1,263-1] |
Default | -1 |
Process: Health port and timeouts
HealthEnabled
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | HealthEnabled |
Description | If set to true, enables Felix's health port, which provides readiness and liveness endpoints. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | false |
Attribute | Value |
---|---|
Key | FELIX_HEALTHENABLED |
Description | If set to true, enables Felix's health port, which provides readiness and liveness endpoints. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | false |
HealthHost
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | HealthHost |
Description | The host that the health server should bind to. |
Schema | String matching regex ^[a-zA-Z0-9:._+-]{1,64}$ |
Default | localhost |
Attribute | Value |
---|---|
Key | FELIX_HEALTHHOST |
Description | The host that the health server should bind to. |
Schema | String matching regex ^[a-zA-Z0-9:._+-]{1,64}$ |
Default | localhost |
HealthPort
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | HealthPort |
Description | The TCP port that the health server should bind to. |
Schema | Integer: [0,65535] |
Default | 9099 |
Attribute | Value |
---|---|
Key | FELIX_HEALTHPORT |
Description | The TCP port that the health server should bind to. |
Schema | Integer: [0,65535] |
Default | 9099 |
HealthTimeoutOverrides
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | HealthTimeoutOverrides |
Description | Allows the internal watchdog timeouts of individual subcomponents to be overridden. This is useful for working around "false positive" liveness timeouts that can occur in particularly stressful workloads or if CPU is constrained. For a list of active subcomponents, see Felix's logs. |
Schema | Comma-delimited list of <key>=<duration> pairs, where durations use Go's standard format (e.g. 1s, 1m, 1h3m2s) |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_HEALTHTIMEOUTOVERRIDES |
Description | Allows the internal watchdog timeouts of individual subcomponents to be overridden. This is useful for working around "false positive" liveness timeouts that can occur in particularly stressful workloads or if CPU is constrained. For a list of active subcomponents, see Felix's logs. |
Schema | Comma-delimited list of <key>=<duration> pairs, where durations use Go's standard format (e.g. 1s, 1m, 1h3m2s) |
Default | none |
Process: Logging
LogDebugFilenameRegex
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | LogDebugFilenameRegex |
Description | Controls which source code files have their Debug log output included in the logs. Only logs from files with names that match the given regular expression are included. The filter only applies to Debug level logs. |
Schema | Regular expression |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_LOGDEBUGFILENAMEREGEX |
Description | Controls which source code files have their Debug log output included in the logs. Only logs from files with names that match the given regular expression are included. The filter only applies to Debug level logs. |
Schema | Regular expression |
Default | none |
LogFilePath
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | LogFilePath |
Description | The full path to the Felix log. Set to none to disable file logging. |
Schema | Path to file |
Default | /var/log/calico/felix.log |
Attribute | Value |
---|---|
Key | FELIX_LOGFILEPATH |
Description | The full path to the Felix log. Set to none to disable file logging. |
Schema | Path to file |
Default | /var/log/calico/felix.log |
LogPrefix
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | LogPrefix |
Description | The log prefix that Felix uses when rendering LOG rules. |
Schema | String |
Default | calico-packet |
Attribute | Value |
---|---|
Key | FELIX_LOGPREFIX |
Description | The log prefix that Felix uses when rendering LOG rules. |
Schema | String |
Default | calico-packet |
LogSeverityFile
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | LogSeverityFile |
Description | The log severity above which logs are sent to the log file. |
Schema | One of: DEBUG , ERROR , FATAL , INFO , WARNING (case insensitive) |
Default | INFO |
Attribute | Value |
---|---|
Key | FELIX_LOGSEVERITYFILE |
Description | The log severity above which logs are sent to the log file. |
Schema | One of: DEBUG , ERROR , FATAL , INFO , WARNING (case insensitive) |
Default | INFO |
LogSeverityScreen
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | LogSeverityScreen |
Description | The log severity above which logs are sent to the stdout. |
Schema | One of: DEBUG , ERROR , FATAL , INFO , WARNING (case insensitive) |
Default | INFO |
Attribute | Value |
---|---|
Key | FELIX_LOGSEVERITYSCREEN |
Description | The log severity above which logs are sent to the stdout. |
Schema | One of: DEBUG , ERROR , FATAL , INFO , WARNING (case insensitive) |
Default | INFO |
LogSeveritySys
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | LogSeveritySys |
Description | The log severity above which logs are sent to the syslog. Set to None for no logging to syslog. |
Schema | One of: DEBUG , ERROR , FATAL , INFO , WARNING (case insensitive) |
Default | INFO |
Attribute | Value |
---|---|
Key | FELIX_LOGSEVERITYSYS |
Description | The log severity above which logs are sent to the syslog. Set to None for no logging to syslog. |
Schema | One of: DEBUG , ERROR , FATAL , INFO , WARNING (case insensitive) |
Default | INFO |
Process: Prometheus metrics
PrometheusGoMetricsEnabled
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | PrometheusGoMetricsEnabled |
Description | Disables Go runtime metrics collection, which the Prometheus client does by default, when set to false. This reduces the number of metrics reported, reducing Prometheus load. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | true |
Attribute | Value |
---|---|
Key | FELIX_PROMETHEUSGOMETRICSENABLED |
Description | Disables Go runtime metrics collection, which the Prometheus client does by default, when set to false. This reduces the number of metrics reported, reducing Prometheus load. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | true |
PrometheusMetricsEnabled
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | PrometheusMetricsEnabled |
Description | Enables the Prometheus metrics server in Felix if set to true. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | false |
Attribute | Value |
---|---|
Key | FELIX_PROMETHEUSMETRICSENABLED |
Description | Enables the Prometheus metrics server in Felix if set to true. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | false |
PrometheusMetricsHost
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | PrometheusMetricsHost |
Description | The host that the Prometheus metrics server should bind to. |
Schema | String matching regex ^[a-zA-Z0-9:._+-]{1,64}$ |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_PROMETHEUSMETRICSHOST |
Description | The host that the Prometheus metrics server should bind to. |
Schema | String matching regex ^[a-zA-Z0-9:._+-]{1,64}$ |
Default | none |
PrometheusMetricsPort
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | PrometheusMetricsPort |
Description | The TCP port that the Prometheus metrics server should bind to. |
Schema | Integer: [0,65535] |
Default | 9091 |
Attribute | Value |
---|---|
Key | FELIX_PROMETHEUSMETRICSPORT |
Description | The TCP port that the Prometheus metrics server should bind to. |
Schema | Integer: [0,65535] |
Default | 9091 |
PrometheusProcessMetricsEnabled
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | PrometheusProcessMetricsEnabled |
Description | Disables process metrics collection, which the Prometheus client does by default, when set to false. This reduces the number of metrics reported, reducing Prometheus load. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | true |
Attribute | Value |
---|---|
Key | FELIX_PROMETHEUSPROCESSMETRICSENABLED |
Description | Disables process metrics collection, which the Prometheus client does by default, when set to false. This reduces the number of metrics reported, reducing Prometheus load. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | true |
PrometheusWireGuardMetricsEnabled
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | PrometheusWireGuardMetricsEnabled |
Description | Disables wireguard metrics collection, which the Prometheus client does by default, when set to false. This reduces the number of metrics reported, reducing Prometheus load. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | true |
Attribute | Value |
---|---|
Key | FELIX_PROMETHEUSWIREGUARDMETRICSENABLED |
Description | Disables wireguard metrics collection, which the Prometheus client does by default, when set to false. This reduces the number of metrics reported, reducing Prometheus load. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | true |
Dataplane: Common
AllowIPIPPacketsFromWorkloads
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | AllowIPIPPacketsFromWorkloads |
Description | Controls whether Felix will add a rule to drop IPIP encapsulated traffic from workloads. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | false |
Attribute | Value |
---|---|
Key | FELIX_ALLOWIPIPPACKETSFROMWORKLOADS |
Description | Controls whether Felix will add a rule to drop IPIP encapsulated traffic from workloads. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | false |
AllowVXLANPacketsFromWorkloads
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | AllowVXLANPacketsFromWorkloads |
Description | Controls whether Felix will add a rule to drop VXLAN encapsulated traffic from workloads. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | false |
Attribute | Value |
---|---|
Key | FELIX_ALLOWVXLANPACKETSFROMWORKLOADS |
Description | Controls whether Felix will add a rule to drop VXLAN encapsulated traffic from workloads. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | false |
ChainInsertMode
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | ChainInsertMode |
Description | Controls whether Felix hooks the kernel's top-level iptables chains by inserting a rule at the top of the chain or by appending a rule at the bottom. insert is the safe default since it prevents Calico's rules from being bypassed. If you switch to append mode, be sure that the other rules in the chains signal acceptance by falling through to the Calico rules, otherwise the Calico policy will be bypassed. |
Schema | One of: append , insert (case insensitive) |
Default | insert |
Attribute | Value |
---|---|
Key | FELIX_CHAININSERTMODE |
Description | Controls whether Felix hooks the kernel's top-level iptables chains by inserting a rule at the top of the chain or by appending a rule at the bottom. insert is the safe default since it prevents Calico's rules from being bypassed. If you switch to append mode, be sure that the other rules in the chains signal acceptance by falling through to the Calico rules, otherwise the Calico policy will be bypassed. |
Schema | One of: append , insert (case insensitive) |
Default | insert |
DataplaneDriver
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | DataplaneDriver |
Description | Filename of the external dataplane driver to use. Only used if UseInternalDataplaneDriver is set to false. |
Schema | Path to executable, which must exist. If not an absolute path, the directory containing this binary and the system path will be searched. |
Default | calico-iptables-plugin |
Attribute | Value |
---|---|
Key | FELIX_DATAPLANEDRIVER |
Description | Filename of the external dataplane driver to use. Only used if UseInternalDataplaneDriver is set to false. |
Schema | Path to executable, which must exist. If not an absolute path, the directory containing this binary and the system path will be searched. |
Default | calico-iptables-plugin |
DataplaneWatchdogTimeout
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | DataplaneWatchdogTimeout |
Description | The readiness/liveness timeout used for Felix's (internal) dataplane driver. Deprecated: replaced by the generic HealthTimeoutOverrides. |
Schema | Seconds (floating point) |
Default | 90 (1m30s) |
Attribute | Value |
---|---|
Key | FELIX_DATAPLANEWATCHDOGTIMEOUT |
Description | The readiness/liveness timeout used for Felix's (internal) dataplane driver. Deprecated: replaced by the generic HealthTimeoutOverrides. |
Schema | Seconds (floating point) |
Default | 90 (1m30s) |
DefaultEndpointToHostAction
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | DefaultEndpointToHostAction |
Description | Controls what happens to traffic that goes from a workload endpoint to the host itself (after the endpoint's egress policy is applied). By default, Calico blocks traffic from workload endpoints to the host itself with an iptables "DROP" action. If you want to allow some or all traffic from endpoint to host, set this parameter to RETURN or ACCEPT. Use RETURN if you have your own rules in the iptables "INPUT" chain; Calico will insert its rules at the top of that chain, then "RETURN" packets to the "INPUT" chain once it has completed processing workload endpoint egress policy. Use ACCEPT to unconditionally accept packets from workloads after processing workload endpoint egress policy. |
Schema | One of: ACCEPT , DROP , RETURN (case insensitive) |
Default | DROP |
Attribute | Value |
---|---|
Key | FELIX_DEFAULTENDPOINTTOHOSTACTION |
Description | Controls what happens to traffic that goes from a workload endpoint to the host itself (after the endpoint's egress policy is applied). By default, Calico blocks traffic from workload endpoints to the host itself with an iptables "DROP" action. If you want to allow some or all traffic from endpoint to host, set this parameter to RETURN or ACCEPT. Use RETURN if you have your own rules in the iptables "INPUT" chain; Calico will insert its rules at the top of that chain, then "RETURN" packets to the "INPUT" chain once it has completed processing workload endpoint egress policy. Use ACCEPT to unconditionally accept packets from workloads after processing workload endpoint egress policy. |
Schema | One of: ACCEPT , DROP , RETURN (case insensitive) |
Default | DROP |
DeviceRouteProtocol
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | DeviceRouteProtocol |
Description | Controls the protocol to set on routes programmed by Felix. The protocol is an 8-bit label used to identify the owner of the route. |
Schema | Integer |
Default | 3 |
Attribute | Value |
---|---|
Key | FELIX_DEVICEROUTEPROTOCOL |
Description | Controls the protocol to set on routes programmed by Felix. The protocol is an 8-bit label used to identify the owner of the route. |
Schema | Integer |
Default | 3 |
DeviceRouteSourceAddress
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | DeviceRouteSourceAddress |
Description | IPv4 address to set as the source hint for routes programmed by Felix. When not set the source address for local traffic from host to workload will be determined by the kernel. |
Schema | IPv4 address |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_DEVICEROUTESOURCEADDRESS |
Description | IPv4 address to set as the source hint for routes programmed by Felix. When not set the source address for local traffic from host to workload will be determined by the kernel. |
Schema | IPv4 address |
Default | none |
DeviceRouteSourceAddressIPv6
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | DeviceRouteSourceAddressIPv6 |
Description | IPv6 address to set as the source hint for routes programmed by Felix. When not set the source address for local traffic from host to workload will be determined by the kernel. |
Schema | IPv6 address |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_DEVICEROUTESOURCEADDRESSIPV6 |
Description | IPv6 address to set as the source hint for routes programmed by Felix. When not set the source address for local traffic from host to workload will be determined by the kernel. |
Schema | IPv6 address |
Default | none |
DisableConntrackInvalidCheck
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | DisableConntrackInvalidCheck |
Description | Disables the check for invalid connections in conntrack. While the conntrack invalid check helps to detect malicious traffic, it can also cause issues with certain multi-NIC scenarios. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | false |
Attribute | Value |
---|---|
Key | FELIX_DISABLECONNTRACKINVALIDCHECK |
Description | Disables the check for invalid connections in conntrack. While the conntrack invalid check helps to detect malicious traffic, it can also cause issues with certain multi-NIC scenarios. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | false |
EndpointStatusPathPrefix
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | EndpointStatusPathPrefix |
Description | The path to the directory where endpoint status will be written. Endpoint status file reporting is disabled if field is left empty. Chosen directory should match the directory used by the CNI plugin for PodStartupDelay. |
Schema | Path to file |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_ENDPOINTSTATUSPATHPREFIX |
Description | The path to the directory where endpoint status will be written. Endpoint status file reporting is disabled if field is left empty. Chosen directory should match the directory used by the CNI plugin for PodStartupDelay. |
Schema | Path to file |
Default | none |
ExternalNodesCIDRList
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | ExternalNodesCIDRList |
Description | A list of CIDR's of external, non-Calico nodes from which VXLAN/IPIP overlay traffic will be allowed. By default, external tunneled traffic is blocked to reduce attack surface. |
Schema | Comma-delimited list of CIDRs |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_EXTERNALNODESCIDRLIST |
Description | A list of CIDR's of external, non-Calico nodes from which VXLAN/IPIP overlay traffic will be allowed. By default, external tunneled traffic is blocked to reduce attack surface. |
Schema | Comma-delimited list of CIDRs |
Default | none |
FailsafeInboundHostPorts
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | FailsafeInboundHostPorts |
Description | A list of ProtoPort struct objects including UDP/TCP/SCTP ports and CIDRs that Felix will allow incoming traffic to host endpoints on irrespective of the security policy. This is useful to avoid accidentally cutting off a host with incorrect configuration. For backwards compatibility, if the protocol is not specified, it defaults to "tcp". If a CIDR is not specified, it will allow traffic from all addresses. To disable all inbound host ports, use the value "[]". The default value allows ssh access, DHCP, BGP, etcd and the Kubernetes API. |
Schema | Comma-delimited list of numeric ports with optional protocol and CIDR:(tcp|udp):<cidr>:<port> , (tcp|udp):<port> or <port> . IPv6 CIDRs must be enclosed in square brackets. |
Default | tcp:22,udp:68,tcp:179,tcp:2379,tcp:2380,tcp:5473,tcp:6443,tcp:6666,tcp:6667 |
Attribute | Value |
---|---|
Key | FELIX_FAILSAFEINBOUNDHOSTPORTS |
Description | A list of ProtoPort struct objects including UDP/TCP/SCTP ports and CIDRs that Felix will allow incoming traffic to host endpoints on irrespective of the security policy. This is useful to avoid accidentally cutting off a host with incorrect configuration. For backwards compatibility, if the protocol is not specified, it defaults to "tcp". If a CIDR is not specified, it will allow traffic from all addresses. To disable all inbound host ports, use the value "[]". The default value allows ssh access, DHCP, BGP, etcd and the Kubernetes API. |
Schema | Comma-delimited list of numeric ports with optional protocol and CIDR:(tcp|udp):<cidr>:<port> , (tcp|udp):<port> or <port> . IPv6 CIDRs must be enclosed in square brackets. |
Default | tcp:22,udp:68,tcp:179,tcp:2379,tcp:2380,tcp:5473,tcp:6443,tcp:6666,tcp:6667 |
FailsafeOutboundHostPorts
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | FailsafeOutboundHostPorts |
Description | A list of PortProto struct objects including UDP/TCP/SCTP ports and CIDRs that Felix will allow outgoing traffic from host endpoints to irrespective of the security policy. This is useful to avoid accidentally cutting off a host with incorrect configuration. For backwards compatibility, if the protocol is not specified, it defaults to "tcp". If a CIDR is not specified, it will allow traffic from all addresses. To disable all outbound host ports, use the value "[]". The default value opens etcd's standard ports to ensure that Felix does not get cut off from etcd as well as allowing DHCP, DNS, BGP and the Kubernetes API. |
Schema | Comma-delimited list of numeric ports with optional protocol and CIDR:(tcp|udp):<cidr>:<port> , (tcp|udp):<port> or <port> . IPv6 CIDRs must be enclosed in square brackets. |
Default | udp:53,udp:67,tcp:179,tcp:2379,tcp:2380,tcp:5473,tcp:6443,tcp:6666,tcp:6667 |
Attribute | Value |
---|---|
Key | FELIX_FAILSAFEOUTBOUNDHOSTPORTS |
Description | A list of PortProto struct objects including UDP/TCP/SCTP ports and CIDRs that Felix will allow outgoing traffic from host endpoints to irrespective of the security policy. This is useful to avoid accidentally cutting off a host with incorrect configuration. For backwards compatibility, if the protocol is not specified, it defaults to "tcp". If a CIDR is not specified, it will allow traffic from all addresses. To disable all outbound host ports, use the value "[]". The default value opens etcd's standard ports to ensure that Felix does not get cut off from etcd as well as allowing DHCP, DNS, BGP and the Kubernetes API. |
Schema | Comma-delimited list of numeric ports with optional protocol and CIDR:(tcp|udp):<cidr>:<port> , (tcp|udp):<port> or <port> . IPv6 CIDRs must be enclosed in square brackets. |
Default | udp:53,udp:67,tcp:179,tcp:2379,tcp:2380,tcp:5473,tcp:6443,tcp:6666,tcp:6667 |
FloatingIPs
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | FloatingIPs |
Description | Configures whether or not Felix will program non-OpenStack floating IP addresses. (OpenStack-derived floating IPs are always programmed, regardless of this setting.) |
Schema | One of: Disabled , Enabled (case insensitive) |
Default | Disabled |
Attribute | Value |
---|---|
Key | FELIX_FLOATINGIPS |
Description | Configures whether or not Felix will program non-OpenStack floating IP addresses. (OpenStack-derived floating IPs are always programmed, regardless of this setting.) |
Schema | One of: Disabled , Enabled (case insensitive) |
Default | Disabled |
IPForwarding
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | IPForwarding |
Description | Controls whether Felix sets the host sysctls to enable IP forwarding. IP forwarding is required when using Calico for workload networking. This should be disabled only on hosts where Calico is used solely for host protection. |
Schema | One of: Disabled , Enabled (case insensitive) |
Default | Enabled |
Attribute | Value |
---|---|
Key | FELIX_IPFORWARDING |
Description | Controls whether Felix sets the host sysctls to enable IP forwarding. IP forwarding is required when using Calico for workload networking. This should be disabled only on hosts where Calico is used solely for host protection. |
Schema | One of: Disabled , Enabled (case insensitive) |
Default | Enabled |
InterfaceExclude
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | InterfaceExclude |
Description | A comma-separated list of interface names that should be excluded when Felix is resolving host endpoints. The default value ensures that Felix ignores Kubernetes' internal |
Schema | Comma-delimited list of Linux interface names/regex patterns. Regex patterns must start/end with / . |
Default | kube-ipvs0 |
Attribute | Value |
---|---|
Key | FELIX_INTERFACEEXCLUDE |
Description | A comma-separated list of interface names that should be excluded when Felix is resolving host endpoints. The default value ensures that Felix ignores Kubernetes' internal |
Schema | Comma-delimited list of Linux interface names/regex patterns. Regex patterns must start/end with / . |
Default | kube-ipvs0 |
InterfacePrefix
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | InterfacePrefix |
Description | The interface name prefix that identifies workload endpoints and so distinguishes them from host endpoint interfaces. Note: in environments other than bare metal, the orchestrators configure this appropriately. For example our Kubernetes and Docker integrations set the 'cali' value, and our OpenStack integration sets the 'tap' value. |
Schema | String matching regex ^[a-zA-Z0-9_-]{1,15}(,[a-zA-Z0-9_-]{1,15})*$ |
Default | cali |
Attribute | Value |
---|---|
Key | FELIX_INTERFACEPREFIX |
Description | The interface name prefix that identifies workload endpoints and so distinguishes them from host endpoint interfaces. Note: in environments other than bare metal, the orchestrators configure this appropriately. For example our Kubernetes and Docker integrations set the 'cali' value, and our OpenStack integration sets the 'tap' value. |
Schema | String matching regex ^[a-zA-Z0-9_-]{1,15}(,[a-zA-Z0-9_-]{1,15})*$ |
Default | cali |
InterfaceRefreshInterval
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | InterfaceRefreshInterval |
Description | The period at which Felix rescans local interfaces to verify their state. The rescan can be disabled by setting the interval to 0. |
Schema | Seconds (floating point) |
Default | 90 (1m30s) |
Attribute | Value |
---|---|
Key | FELIX_INTERFACEREFRESHINTERVAL |
Description | The period at which Felix rescans local interfaces to verify their state. The rescan can be disabled by setting the interval to 0. |
Schema | Seconds (floating point) |
Default | 90 (1m30s) |
Ipv6Support
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | Ipv6Support |
Description | Controls whether Felix enables support for IPv6 (if supported by the in-use dataplane). |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | true |
Attribute | Value |
---|---|
Key | FELIX_IPV6SUPPORT |
Description | Controls whether Felix enables support for IPv6 (if supported by the in-use dataplane). |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | true |
MTUIfacePattern
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | MTUIfacePattern |
Description | A regular expression that controls which interfaces Felix should scan in order to calculate the host's MTU. This should not match workload interfaces (usually named cali...). |
Schema | Regular expression |
Default | ^((en|wl|ww|sl|ib)[Pcopsvx].*|(eth|wlan|wwan).*) |
Attribute | Value |
---|---|
Key | FELIX_MTUIFACEPATTERN |
Description | A regular expression that controls which interfaces Felix should scan in order to calculate the host's MTU. This should not match workload interfaces (usually named cali...). |
Schema | Regular expression |
Default | ^((en|wl|ww|sl|ib)[Pcopsvx].*|(eth|wlan|wwan).*) |
NATOutgoingAddress
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | NATOutgoingAddress |
Description | Specifies an address to use when performing source NAT for traffic in a natOutgoing pool that is leaving the network. By default the address used is an address on the interface the traffic is leaving on (i.e. it uses the iptables MASQUERADE target). |
Schema | IPv4 address |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_NATOUTGOINGADDRESS |
Description | Specifies an address to use when performing source NAT for traffic in a natOutgoing pool that is leaving the network. By default the address used is an address on the interface the traffic is leaving on (i.e. it uses the iptables MASQUERADE target). |
Schema | IPv4 address |
Default | none |
NATPortRange
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | NATPortRange |
Description | Specifies the range of ports that is used for port mapping when doing outgoing NAT. When unset the default behavior of the network stack is used. |
Schema | Port range: either a single number in [0,65535] or a range of numbers n:m |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_NATPORTRANGE |
Description | Specifies the range of ports that is used for port mapping when doing outgoing NAT. When unset the default behavior of the network stack is used. |
Schema | Port range: either a single number in [0,65535] or a range of numbers n:m |
Default | none |
NFTablesMode
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | NFTablesMode |
Description | Configures nftables support in Felix. |
Schema | One of: Disabled , Enabled (case insensitive) |
Default | Disabled |
Attribute | Value |
---|---|
Key | FELIX_NFTABLESMODE |
Description | Configures nftables support in Felix. |
Schema | One of: Disabled , Enabled (case insensitive) |
Default | Disabled |
NetlinkTimeoutSecs
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | NetlinkTimeoutSecs |
Description | The timeout when talking to the kernel over the netlink protocol, used for programming routes, rules, and other kernel objects. |
Schema | Seconds (floating point) |
Default | 10 (10s) |
Attribute | Value |
---|---|
Key | FELIX_NETLINKTIMEOUTSECS |
Description | The timeout when talking to the kernel over the netlink protocol, used for programming routes, rules, and other kernel objects. |
Schema | Seconds (floating point) |
Default | 10 (10s) |
PolicySyncPathPrefix
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | PolicySyncPathPrefix |
Description | Used to by Felix to communicate policy changes to external services, like Application layer policy. |
Schema | Path to file |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_POLICYSYNCPATHPREFIX |
Description | Used to by Felix to communicate policy changes to external services, like Application layer policy. |
Schema | Path to file |
Default | none |
RemoveExternalRoutes
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | RemoveExternalRoutes |
Description | Controls whether Felix will remove unexpected routes to workload interfaces. Felix will always clean up expected routes that use the configured DeviceRouteProtocol. To add your own routes, you must use a distinct protocol (in addition to setting this field to false). |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | true |
Attribute | Value |
---|---|
Key | FELIX_REMOVEEXTERNALROUTES |
Description | Controls whether Felix will remove unexpected routes to workload interfaces. Felix will always clean up expected routes that use the configured DeviceRouteProtocol. To add your own routes, you must use a distinct protocol (in addition to setting this field to false). |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | true |
RouteRefreshInterval
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | RouteRefreshInterval |
Description | The period at which Felix re-checks the routes in the dataplane to ensure that no other process has accidentally broken Calico's rules. Set to 0 to disable route refresh. |
Schema | Seconds (floating point) |
Default | 90 (1m30s) |
Attribute | Value |
---|---|
Key | FELIX_ROUTEREFRESHINTERVAL |
Description | The period at which Felix re-checks the routes in the dataplane to ensure that no other process has accidentally broken Calico's rules. Set to 0 to disable route refresh. |
Schema | Seconds (floating point) |
Default | 90 (1m30s) |
RouteSource
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | RouteSource |
Description | Configures where Felix gets its routing information. - WorkloadIPs: use workload endpoints to construct routes. - CalicoIPAM: the default - use IPAM data to construct routes. |
Schema | One of: CalicoIPAM , WorkloadIPs (case insensitive) |
Default | CalicoIPAM |
Attribute | Value |
---|---|
Key | FELIX_ROUTESOURCE |
Description | Configures where Felix gets its routing information. - WorkloadIPs: use workload endpoints to construct routes. - CalicoIPAM: the default - use IPAM data to construct routes. |
Schema | One of: CalicoIPAM , WorkloadIPs (case insensitive) |
Default | CalicoIPAM |
RouteSyncDisabled
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | RouteSyncDisabled |
Description | Will disable all operations performed on the route table. Set to true to run in network-policy mode only. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | false |
Attribute | Value |
---|---|
Key | FELIX_ROUTESYNCDISABLED |
Description | Will disable all operations performed on the route table. Set to true to run in network-policy mode only. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | false |
RouteTableRange
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | RouteTableRange |
Description | Deprecated in favor of RouteTableRanges. Calico programs additional Linux route tables for various purposes. RouteTableRange specifies the indices of the route tables that Calico should use. |
Schema | Range of route table indices n-m , where n and m are integers in [0,250]. |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_ROUTETABLERANGE |
Description | Deprecated in favor of RouteTableRanges. Calico programs additional Linux route tables for various purposes. RouteTableRange specifies the indices of the route tables that Calico should use. |
Schema | Range of route table indices n-m , where n and m are integers in [0,250]. |
Default | none |
RouteTableRanges
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | RouteTableRanges |
Description | Calico programs additional Linux route tables for various purposes. RouteTableRanges specifies a set of table index ranges that Calico should use. Deprecates |
Schema | Comma or space-delimited list of route table ranges of the form n-m where n and m are integers in [0,4294967295]. The sum of the sizes of all ranges may not exceed 65535. |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_ROUTETABLERANGES |
Description | Calico programs additional Linux route tables for various purposes. RouteTableRanges specifies a set of table index ranges that Calico should use. Deprecates |
Schema | Comma or space-delimited list of route table ranges of the form n-m where n and m are integers in [0,4294967295]. The sum of the sizes of all ranges may not exceed 65535. |
Default | none |
ServiceLoopPrevention
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | ServiceLoopPrevention |
Description | When service IP advertisement is enabled, prevent routing loops to service IPs that are not in use, by dropping or rejecting packets that do not get DNAT'd by kube-proxy. Unless set to "Disabled", in which case such routing loops continue to be allowed. |
Schema | One of: Disabled , Drop , Reject (case insensitive) |
Default | Drop |
Attribute | Value |
---|---|
Key | FELIX_SERVICELOOPPREVENTION |
Description | When service IP advertisement is enabled, prevent routing loops to service IPs that are not in use, by dropping or rejecting packets that do not get DNAT'd by kube-proxy. Unless set to "Disabled", in which case such routing loops continue to be allowed. |
Schema | One of: Disabled , Drop , Reject (case insensitive) |
Default | Drop |
SidecarAccelerationEnabled
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | SidecarAccelerationEnabled |
Description | Enables experimental sidecar acceleration. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | false |
Attribute | Value |
---|---|
Key | FELIX_SIDECARACCELERATIONENABLED |
Description | Enables experimental sidecar acceleration. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | false |
UseInternalDataplaneDriver
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | UseInternalDataplaneDriver |
Description | If true, Felix will use its internal dataplane programming logic. If false, it will launch an external dataplane driver and communicate with it over protobuf. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | true |
Attribute | Value |
---|---|
Key | FELIX_USEINTERNALDATAPLANEDRIVER |
Description | If true, Felix will use its internal dataplane programming logic. If false, it will launch an external dataplane driver and communicate with it over protobuf. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | true |
WorkloadSourceSpoofing
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | WorkloadSourceSpoofing |
Description | Controls whether pods can use the allowedSourcePrefixes annotation to send traffic with a source IP address that is not theirs. This is disabled by default. When set to "Any", pods can request any prefix. |
Schema | One of: Any , Disabled (case insensitive) |
Default | Disabled |
Attribute | Value |
---|---|
Key | FELIX_WORKLOADSOURCESPOOFING |
Description | Controls whether pods can use the allowedSourcePrefixes annotation to send traffic with a source IP address that is not theirs. This is disabled by default. When set to "Any", pods can request any prefix. |
Schema | One of: Any , Disabled (case insensitive) |
Default | Disabled |
Dataplane: iptables
IpsetsRefreshInterval
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | IpsetsRefreshInterval |
Description | Controls the period at which Felix re-checks all IP sets to look for discrepancies. Set to 0 to disable the periodic refresh. |
Schema | Seconds (floating point) |
Default | 90 (1m30s) |
Attribute | Value |
---|---|
Key | FELIX_IPSETSREFRESHINTERVAL |
Description | Controls the period at which Felix re-checks all IP sets to look for discrepancies. Set to 0 to disable the periodic refresh. |
Schema | Seconds (floating point) |
Default | 90 (1m30s) |
IptablesBackend
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | IptablesBackend |
Description | Controls which backend of iptables will be used. The default is Warning: changing this on a running system can leave "orphaned" rules in the "other" backend. These should be cleaned up to avoid confusing interactions. |
Schema | One of: auto , legacy , nft (case insensitive) |
Default | auto |
Attribute | Value |
---|---|
Key | FELIX_IPTABLESBACKEND |
Description | Controls which backend of iptables will be used. The default is Warning: changing this on a running system can leave "orphaned" rules in the "other" backend. These should be cleaned up to avoid confusing interactions. |
Schema | One of: auto , legacy , nft (case insensitive) |
Default | auto |
IptablesFilterAllowAction
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | IptablesFilterAllowAction |
Description | Controls what happens to traffic that is accepted by a Felix policy chain in the iptables filter table (which is used for "normal" policy). The default will immediately |
Schema | One of: ACCEPT , RETURN (case insensitive) |
Default | ACCEPT |
Attribute | Value |
---|---|
Key | FELIX_IPTABLESFILTERALLOWACTION |
Description | Controls what happens to traffic that is accepted by a Felix policy chain in the iptables filter table (which is used for "normal" policy). The default will immediately |
Schema | One of: ACCEPT , RETURN (case insensitive) |
Default | ACCEPT |
IptablesFilterDenyAction
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | IptablesFilterDenyAction |
Description | Controls what happens to traffic that is denied by network policy. By default Calico blocks traffic with an iptables "DROP" action. If you want to use "REJECT" action instead you can configure it in here. |
Schema | One of: DROP , REJECT (case insensitive) |
Default | DROP |
Attribute | Value |
---|---|
Key | FELIX_IPTABLESFILTERDENYACTION |
Description | Controls what happens to traffic that is denied by network policy. By default Calico blocks traffic with an iptables "DROP" action. If you want to use "REJECT" action instead you can configure it in here. |
Schema | One of: DROP , REJECT (case insensitive) |
Default | DROP |
IptablesLockFilePath
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | IptablesLockFilePath |
Description | The location of the iptables lock file. You may need to change this if the lock file is not in its standard location (for example if you have mapped it into Felix's container at a different path). |
Schema | Path to file |
Default | /run/xtables.lock |
Attribute | Value |
---|---|
Key | FELIX_IPTABLESLOCKFILEPATH |
Description | The location of the iptables lock file. You may need to change this if the lock file is not in its standard location (for example if you have mapped it into Felix's container at a different path). |
Schema | Path to file |
Default | /run/xtables.lock |
IptablesLockProbeIntervalMillis
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | IptablesLockProbeIntervalMillis |
Description | When IptablesLockTimeout is enabled: the time that Felix will wait between attempts to acquire the iptables lock if it is not available. Lower values make Felix more responsive when the lock is contended, but use more CPU. |
Schema | Milliseconds (floating point) |
Default | 50 (50ms) |
Attribute | Value |
---|---|
Key | FELIX_IPTABLESLOCKPROBEINTERVALMILLIS |
Description | When IptablesLockTimeout is enabled: the time that Felix will wait between attempts to acquire the iptables lock if it is not available. Lower values make Felix more responsive when the lock is contended, but use more CPU. |
Schema | Milliseconds (floating point) |
Default | 50 (50ms) |
IptablesLockTimeoutSecs
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | IptablesLockTimeoutSecs |
Description | The time that Felix itself will wait for the iptables lock (rather than delegating the lock handling to the Deprecated: |
Schema | Seconds (floating point) |
Default | 0 (0s) |
Attribute | Value |
---|---|
Key | FELIX_IPTABLESLOCKTIMEOUTSECS |
Description | The time that Felix itself will wait for the iptables lock (rather than delegating the lock handling to the Deprecated: |
Schema | Seconds (floating point) |
Default | 0 (0s) |
IptablesMangleAllowAction
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | IptablesMangleAllowAction |
Description | Controls what happens to traffic that is accepted by a Felix policy chain in the iptables mangle table (which is used for "pre-DNAT" policy). The default will immediately |
Schema | One of: ACCEPT , RETURN (case insensitive) |
Default | ACCEPT |
Attribute | Value |
---|---|
Key | FELIX_IPTABLESMANGLEALLOWACTION |
Description | Controls what happens to traffic that is accepted by a Felix policy chain in the iptables mangle table (which is used for "pre-DNAT" policy). The default will immediately |
Schema | One of: ACCEPT , RETURN (case insensitive) |
Default | ACCEPT |
IptablesMarkMask
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | IptablesMarkMask |
Description | The mask that Felix selects its IPTables Mark bits from. Should be a 32 bit hexadecimal number with at least 8 bits set, none of which clash with any other mark bits in use on the system. |
Schema | 32-bit bitmask (hex or deccimal allowed) with at least 2 bits set, example: 0xffff0000 |
Default | 0xffff0000 |
Attribute | Value |
---|---|
Key | FELIX_IPTABLESMARKMASK |
Description | The mask that Felix selects its IPTables Mark bits from. Should be a 32 bit hexadecimal number with at least 8 bits set, none of which clash with any other mark bits in use on the system. |
Schema | 32-bit bitmask (hex or deccimal allowed) with at least 2 bits set, example: 0xffff0000 |
Default | 0xffff0000 |
IptablesNATOutgoingInterfaceFilter
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | IptablesNATOutgoingInterfaceFilter |
Description | This parameter can be used to limit the host interfaces on which Calico will apply SNAT to traffic leaving a Calico IPAM pool with "NAT outgoing" enabled. This can be useful if you have a main data interface, where traffic should be SNATted and a secondary device (such as the docker bridge) which is local to the host and doesn't require SNAT. This parameter uses the iptables interface matching syntax, which allows + as a wildcard. Most users will not need to set this. Example: if your data interfaces are eth0 and eth1 and you want to exclude the docker bridge, you could set this to eth+. |
Schema | String matching regex ^[a-zA-Z0-9:._+-]{1,15}$ |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_IPTABLESNATOUTGOINGINTERFACEFILTER |
Description | This parameter can be used to limit the host interfaces on which Calico will apply SNAT to traffic leaving a Calico IPAM pool with "NAT outgoing" enabled. This can be useful if you have a main data interface, where traffic should be SNATted and a secondary device (such as the docker bridge) which is local to the host and doesn't require SNAT. This parameter uses the iptables interface matching syntax, which allows + as a wildcard. Most users will not need to set this. Example: if your data interfaces are eth0 and eth1 and you want to exclude the docker bridge, you could set this to eth+. |
Schema | String matching regex ^[a-zA-Z0-9:._+-]{1,15}$ |
Default | none |
IptablesPostWriteCheckIntervalSecs
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | IptablesPostWriteCheckIntervalSecs |
Description | The period after Felix has done a write to the dataplane that it schedules an extra read back in order to check the write was not clobbered by another process. This should only occur if another application on the system doesn't respect the iptables lock. |
Schema | Seconds (floating point) |
Default | 5 (5s) |
Attribute | Value |
---|---|
Key | FELIX_IPTABLESPOSTWRITECHECKINTERVALSECS |
Description | The period after Felix has done a write to the dataplane that it schedules an extra read back in order to check the write was not clobbered by another process. This should only occur if another application on the system doesn't respect the iptables lock. |
Schema | Seconds (floating point) |
Default | 5 (5s) |
IptablesRefreshInterval
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | IptablesRefreshInterval |
Description | The period at which Felix re-checks the IP sets in the dataplane to ensure that no other process has accidentally broken Calico's rules. Set to 0 to disable IP sets refresh. Note: the default for this value is lower than the other refresh intervals as a workaround for a Linux kernel bug that was fixed in kernel version 4.11. If you are using v4.11 or greater you may want to set this to, a higher value to reduce Felix CPU usage. |
Schema | Seconds (floating point) |
Default | 180 (3m0s) |
Attribute | Value |
---|---|
Key | FELIX_IPTABLESREFRESHINTERVAL |
Description | The period at which Felix re-checks the IP sets in the dataplane to ensure that no other process has accidentally broken Calico's rules. Set to 0 to disable IP sets refresh. Note: the default for this value is lower than the other refresh intervals as a workaround for a Linux kernel bug that was fixed in kernel version 4.11. If you are using v4.11 or greater you may want to set this to, a higher value to reduce Felix CPU usage. |
Schema | Seconds (floating point) |
Default | 180 (3m0s) |
KubeNodePortRanges
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | KubeNodePortRanges |
Description | Holds list of port ranges used for service node ports. Only used if felix detects kube-proxy running in ipvs mode. Felix uses these ranges to separate host and workload traffic. . |
Schema | List of port ranges: comma-delimited list of either single numbers in range [0,65535] or a ranges of numbers n:m |
Default | 30000:32767 |
Attribute | Value |
---|---|
Key | FELIX_KUBENODEPORTRANGES |
Description | Holds list of port ranges used for service node ports. Only used if felix detects kube-proxy running in ipvs mode. Felix uses these ranges to separate host and workload traffic. . |
Schema | List of port ranges: comma-delimited list of either single numbers in range [0,65535] or a ranges of numbers n:m |
Default | 30000:32767 |
MaxIpsetSize
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | MaxIpsetSize |
Description | The maximum number of IP addresses that can be stored in an IP set. Not applicable if using the nftables backend. |
Schema | Integer |
Default | 1048576 |
Attribute | Value |
---|---|
Key | FELIX_MAXIPSETSIZE |
Description | The maximum number of IP addresses that can be stored in an IP set. Not applicable if using the nftables backend. |
Schema | Integer |
Default | 1048576 |
Dataplane: nftables
NftablesFilterAllowAction
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | NftablesFilterAllowAction |
Description | Controls the nftables action that Felix uses to represent the "allow" policy verdict in the filter table. The default is to |
Schema | One of: ACCEPT , RETURN (case insensitive) |
Default | ACCEPT |
Attribute | Value |
---|---|
Key | FELIX_NFTABLESFILTERALLOWACTION |
Description | Controls the nftables action that Felix uses to represent the "allow" policy verdict in the filter table. The default is to |
Schema | One of: ACCEPT , RETURN (case insensitive) |
Default | ACCEPT |
NftablesFilterDenyAction
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | NftablesFilterDenyAction |
Description | Controls what happens to traffic that is denied by network policy. By default, Calico blocks traffic with a "drop" action. If you want to use a "reject" action instead you can configure it here. |
Schema | One of: DROP , REJECT (case insensitive) |
Default | DROP |
Attribute | Value |
---|---|
Key | FELIX_NFTABLESFILTERDENYACTION |
Description | Controls what happens to traffic that is denied by network policy. By default, Calico blocks traffic with a "drop" action. If you want to use a "reject" action instead you can configure it here. |
Schema | One of: DROP , REJECT (case insensitive) |
Default | DROP |
NftablesMangleAllowAction
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | NftablesMangleAllowAction |
Description | Controls the nftables action that Felix uses to represent the "allow" policy verdict in the mangle table. The default is to |
Schema | One of: ACCEPT , RETURN (case insensitive) |
Default | ACCEPT |
Attribute | Value |
---|---|
Key | FELIX_NFTABLESMANGLEALLOWACTION |
Description | Controls the nftables action that Felix uses to represent the "allow" policy verdict in the mangle table. The default is to |
Schema | One of: ACCEPT , RETURN (case insensitive) |
Default | ACCEPT |
NftablesMarkMask
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | NftablesMarkMask |
Description | The mask that Felix selects its nftables Mark bits from. Should be a 32 bit hexadecimal number with at least 8 bits set, none of which clash with any other mark bits in use on the system. |
Schema | 32-bit bitmask (hex or deccimal allowed) with at least 2 bits set, example: 0xffff0000 |
Default | 0xffff0000 |
Attribute | Value |
---|---|
Key | FELIX_NFTABLESMARKMASK |
Description | The mask that Felix selects its nftables Mark bits from. Should be a 32 bit hexadecimal number with at least 8 bits set, none of which clash with any other mark bits in use on the system. |
Schema | 32-bit bitmask (hex or deccimal allowed) with at least 2 bits set, example: 0xffff0000 |
Default | 0xffff0000 |
NftablesRefreshInterval
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | NftablesRefreshInterval |
Description | Controls the interval at which Felix periodically refreshes the nftables rules. |
Schema | Seconds (floating point) |
Default | 180 (3m0s) |
Attribute | Value |
---|---|
Key | FELIX_NFTABLESREFRESHINTERVAL |
Description | Controls the interval at which Felix periodically refreshes the nftables rules. |
Schema | Seconds (floating point) |
Default | 180 (3m0s) |
Dataplane: eBPF
BPFCTLBLogFilter
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | BPFCTLBLogFilter |
Description | Specifies, what is logged by connect time load balancer when BPFLogLevel is debug. Currently has to be specified as 'all' when BPFLogFilters is set to see CTLB logs. |
Schema | One of: all (case insensitive) |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_BPFCTLBLOGFILTER |
Description | Specifies, what is logged by connect time load balancer when BPFLogLevel is debug. Currently has to be specified as 'all' when BPFLogFilters is set to see CTLB logs. |
Schema | One of: all (case insensitive) |
Default | none |
BPFConnectTimeLoadBalancing
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | BPFConnectTimeLoadBalancing |
Description | When in BPF mode, controls whether Felix installs the connect-time load balancer. The connect-time load balancer is required for the host to be able to reach Kubernetes services and it improves the performance of pod-to-service connections.When set to TCP, connect time load balancing is available only for services with TCP ports. |
Schema | One of: Disabled , Enabled , TCP (case insensitive) |
Default | TCP |
Attribute | Value |
---|---|
Key | FELIX_BPFCONNECTTIMELOADBALANCING |
Description | When in BPF mode, controls whether Felix installs the connect-time load balancer. The connect-time load balancer is required for the host to be able to reach Kubernetes services and it improves the performance of pod-to-service connections.When set to TCP, connect time load balancing is available only for services with TCP ports. |
Schema | One of: Disabled , Enabled , TCP (case insensitive) |
Default | TCP |
BPFConnectTimeLoadBalancingEnabled
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | BPFConnectTimeLoadBalancingEnabled |
Description | When in BPF mode, controls whether Felix installs the connection-time load balancer. The connect-time load balancer is required for the host to be able to reach Kubernetes services and it improves the performance of pod-to-service connections. The only reason to disable it is for debugging purposes. Deprecated: Use BPFConnectTimeLoadBalancing. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_BPFCONNECTTIMELOADBALANCINGENABLED |
Description | When in BPF mode, controls whether Felix installs the connection-time load balancer. The connect-time load balancer is required for the host to be able to reach Kubernetes services and it improves the performance of pod-to-service connections. The only reason to disable it is for debugging purposes. Deprecated: Use BPFConnectTimeLoadBalancing. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | none |
BPFDSROptoutCIDRs
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | BPFDSROptoutCIDRs |
Description | A list of CIDRs which are excluded from DSR. That is, clients in those CIDRs will access service node ports as if BPFExternalServiceMode was set to Tunnel. |
Schema | Comma-delimited list of CIDRs |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_BPFDSROPTOUTCIDRS |
Description | A list of CIDRs which are excluded from DSR. That is, clients in those CIDRs will access service node ports as if BPFExternalServiceMode was set to Tunnel. |
Schema | Comma-delimited list of CIDRs |
Default | none |
BPFDataIfacePattern
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | BPFDataIfacePattern |
Description | A regular expression that controls which interfaces Felix should attach BPF programs to in order to catch traffic to/from the network. This needs to match the interfaces that Calico workload traffic flows over as well as any interfaces that handle incoming traffic to nodeports and services from outside the cluster. It should not match the workload interfaces (usually named cali...). |
Schema | Regular expression |
Default | ^((en|wl|ww|sl|ib)[Popsx].*|(eth|wlan|wwan|bond).*|tunl0$|vxlan.calico$|vxlan-v6.calico$|wireguard.cali$|wg-v6.cali$|egress.calico$) |
Attribute | Value |
---|---|
Key | FELIX_BPFDATAIFACEPATTERN |
Description | A regular expression that controls which interfaces Felix should attach BPF programs to in order to catch traffic to/from the network. This needs to match the interfaces that Calico workload traffic flows over as well as any interfaces that handle incoming traffic to nodeports and services from outside the cluster. It should not match the workload interfaces (usually named cali...). |
Schema | Regular expression |
Default | ^((en|wl|ww|sl|ib)[Popsx].*|(eth|wlan|wwan|bond).*|tunl0$|vxlan.calico$|vxlan-v6.calico$|wireguard.cali$|wg-v6.cali$|egress.calico$) |
BPFDisableGROForIfaces
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | BPFDisableGROForIfaces |
Description | A regular expression that controls which interfaces Felix should disable the Generic Receive Offload [GRO] option. It should not match the workload interfaces (usually named cali...). |
Schema | Regular expression |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_BPFDISABLEGROFORIFACES |
Description | A regular expression that controls which interfaces Felix should disable the Generic Receive Offload [GRO] option. It should not match the workload interfaces (usually named cali...). |
Schema | Regular expression |
Default | none |
BPFDisableUnprivileged
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | BPFDisableUnprivileged |
Description | If enabled, Felix sets the kernel.unprivileged_bpf_disabled sysctl to disable unprivileged use of BPF. This ensures that unprivileged users cannot access Calico's BPF maps and cannot insert their own BPF programs to interfere with Calico's. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | true |
Attribute | Value |
---|---|
Key | FELIX_BPFDISABLEUNPRIVILEGED |
Description | If enabled, Felix sets the kernel.unprivileged_bpf_disabled sysctl to disable unprivileged use of BPF. This ensures that unprivileged users cannot access Calico's BPF maps and cannot insert their own BPF programs to interfere with Calico's. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | true |
BPFEnabled
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | BPFEnabled |
Description | If enabled Felix will use the BPF dataplane. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | false |
Attribute | Value |
---|---|
Key | FELIX_BPFENABLED |
Description | If enabled Felix will use the BPF dataplane. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | false |
BPFEnforceRPF
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | BPFEnforceRPF |
Description | Enforce strict RPF on all host interfaces with BPF programs regardless of what is the per-interfaces or global setting. Possible values are Disabled, Strict or Loose. |
Schema | One of: Disabled , Loose , Strict (case insensitive) |
Default | Loose |
Attribute | Value |
---|---|
Key | FELIX_BPFENFORCERPF |
Description | Enforce strict RPF on all host interfaces with BPF programs regardless of what is the per-interfaces or global setting. Possible values are Disabled, Strict or Loose. |
Schema | One of: Disabled , Loose , Strict (case insensitive) |
Default | Loose |
BPFExcludeCIDRsFromNAT
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | BPFExcludeCIDRsFromNAT |
Description | A list of CIDRs that are to be excluded from NAT resolution so that host can handle them. A typical usecase is node local DNS cache. |
Schema | Comma-delimited list of CIDRs |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_BPFEXCLUDECIDRSFROMNAT |
Description | A list of CIDRs that are to be excluded from NAT resolution so that host can handle them. A typical usecase is node local DNS cache. |
Schema | Comma-delimited list of CIDRs |
Default | none |
BPFExtToServiceConnmark
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | BPFExtToServiceConnmark |
Description | In BPF mode, controls a 32bit mark that is set on connections from an external client to a local service. This mark allows us to control how packets of that connection are routed within the host and how is routing interpreted by RPF check. |
Schema | Integer |
Default | 0 |
Attribute | Value |
---|---|
Key | FELIX_BPFEXTTOSERVICECONNMARK |
Description | In BPF mode, controls a 32bit mark that is set on connections from an external client to a local service. This mark allows us to control how packets of that connection are routed within the host and how is routing interpreted by RPF check. |
Schema | Integer |
Default | 0 |
BPFExternalServiceMode
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | BPFExternalServiceMode |
Description | In BPF mode, controls how connections from outside the cluster to services (node ports and cluster IPs) are forwarded to remote workloads. If set to "Tunnel" then both request and response traffic is tunneled to the remote node. If set to "DSR", the request traffic is tunneled but the response traffic is sent directly from the remote node. In "DSR" mode, the remote node appears to use the IP of the ingress node; this requires a permissive L2 network. |
Schema | One of: dsr , tunnel (case insensitive) |
Default | tunnel |
Attribute | Value |
---|---|
Key | FELIX_BPFEXTERNALSERVICEMODE |
Description | In BPF mode, controls how connections from outside the cluster to services (node ports and cluster IPs) are forwarded to remote workloads. If set to "Tunnel" then both request and response traffic is tunneled to the remote node. If set to "DSR", the request traffic is tunneled but the response traffic is sent directly from the remote node. In "DSR" mode, the remote node appears to use the IP of the ingress node; this requires a permissive L2 network. |
Schema | One of: dsr , tunnel (case insensitive) |
Default | tunnel |
BPFForceTrackPacketsFromIfaces
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | BPFForceTrackPacketsFromIfaces |
Description | In BPF mode, forces traffic from these interfaces to skip Calico's iptables NOTRACK rule, allowing traffic from those interfaces to be tracked by Linux conntrack. Should only be used for interfaces that are not used for the Calico fabric. For example, a docker bridge device for non-Calico-networked containers. |
Schema | Comma-delimited list of strings, each matching the regex ^[a-zA-Z0-9:._+-]{1,15}$ |
Default | docker+ |
Attribute | Value |
---|---|
Key | FELIX_BPFFORCETRACKPACKETSFROMIFACES |
Description | In BPF mode, forces traffic from these interfaces to skip Calico's iptables NOTRACK rule, allowing traffic from those interfaces to be tracked by Linux conntrack. Should only be used for interfaces that are not used for the Calico fabric. For example, a docker bridge device for non-Calico-networked containers. |
Schema | Comma-delimited list of strings, each matching the regex ^[a-zA-Z0-9:._+-]{1,15}$ |
Default | docker+ |
BPFHostConntrackBypass
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | BPFHostConntrackBypass |
Description | Controls whether to bypass Linux conntrack in BPF mode for workloads and services. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | true |
Attribute | Value |
---|---|
Key | FELIX_BPFHOSTCONNTRACKBYPASS |
Description | Controls whether to bypass Linux conntrack in BPF mode for workloads and services. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | true |
BPFHostNetworkedNATWithoutCTLB
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | BPFHostNetworkedNATWithoutCTLB |
Description | When in BPF mode, controls whether Felix does a NAT without CTLB. This along with BPFConnectTimeLoadBalancing determines the CTLB behavior. |
Schema | One of: Disabled , Enabled (case insensitive) |
Default | Enabled |
Attribute | Value |
---|---|
Key | FELIX_BPFHOSTNETWORKEDNATWITHOUTCTLB |
Description | When in BPF mode, controls whether Felix does a NAT without CTLB. This along with BPFConnectTimeLoadBalancing determines the CTLB behavior. |
Schema | One of: Disabled , Enabled (case insensitive) |
Default | Enabled |
BPFKubeProxyEndpointSlicesEnabled
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | BPFKubeProxyEndpointSlicesEnabled |
Description | Deprecated and has no effect. BPF kube-proxy always accepts endpoint slices. This option will be removed in the next release. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | true |
Attribute | Value |
---|---|
Key | FELIX_BPFKUBEPROXYENDPOINTSLICESENABLED |
Description | Deprecated and has no effect. BPF kube-proxy always accepts endpoint slices. This option will be removed in the next release. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | true |
BPFKubeProxyIptablesCleanupEnabled
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | BPFKubeProxyIptablesCleanupEnabled |
Description | If enabled in BPF mode, Felix will proactively clean up the upstream Kubernetes kube-proxy's iptables chains. Should only be enabled if kube-proxy is not running. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | true |
Attribute | Value |
---|---|
Key | FELIX_BPFKUBEPROXYIPTABLESCLEANUPENABLED |
Description | If enabled in BPF mode, Felix will proactively clean up the upstream Kubernetes kube-proxy's iptables chains. Should only be enabled if kube-proxy is not running. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | true |
BPFKubeProxyMinSyncPeriod
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | BPFKubeProxyMinSyncPeriod |
Description | In BPF mode, controls the minimum time between updates to the dataplane for Felix's embedded kube-proxy. Lower values give reduced set-up latency. Higher values reduce Felix CPU usage by batching up more work. |
Schema | Seconds (floating point) |
Default | 1 (1s) |
Attribute | Value |
---|---|
Key | FELIX_BPFKUBEPROXYMINSYNCPERIOD |
Description | In BPF mode, controls the minimum time between updates to the dataplane for Felix's embedded kube-proxy. Lower values give reduced set-up latency. Higher values reduce Felix CPU usage by batching up more work. |
Schema | Seconds (floating point) |
Default | 1 (1s) |
BPFL3IfacePattern
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | BPFL3IfacePattern |
Description | A regular expression that allows to list tunnel devices like wireguard or vxlan (i.e., L3 devices) in addition to BPFDataIfacePattern. That is, tunnel interfaces not created by Calico, that Calico workload traffic flows over as well as any interfaces that handle incoming traffic to nodeports and services from outside the cluster. |
Schema | Regular expression |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_BPFL3IFACEPATTERN |
Description | A regular expression that allows to list tunnel devices like wireguard or vxlan (i.e., L3 devices) in addition to BPFDataIfacePattern. That is, tunnel interfaces not created by Calico, that Calico workload traffic flows over as well as any interfaces that handle incoming traffic to nodeports and services from outside the cluster. |
Schema | Regular expression |
Default | none |
BPFLogFilters
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | BPFLogFilters |
Description | A map of key=values where the value is a pcap filter expression and the key is an interface name with 'all' denoting all interfaces, 'weps' all workload endpoints and 'heps' all host endpoints. When specified as an env var, it accepts a comma-separated list of key=values. |
Schema | Comma-delimited list of key=value pairs |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_BPFLOGFILTERS |
Description | A map of key=values where the value is a pcap filter expression and the key is an interface name with 'all' denoting all interfaces, 'weps' all workload endpoints and 'heps' all host endpoints. When specified as an env var, it accepts a comma-separated list of key=values. |
Schema | Comma-delimited list of key=value pairs |
Default | none |
BPFLogLevel
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | BPFLogLevel |
Description | Controls the log level of the BPF programs when in BPF dataplane mode. One of "Off", "Info", or "Debug". The logs are emitted to the BPF trace pipe, accessible with the command |
Schema | One of: debug , info , off (case insensitive) |
Default | off |
Attribute | Value |
---|---|
Key | FELIX_BPFLOGLEVEL |
Description | Controls the log level of the BPF programs when in BPF dataplane mode. One of "Off", "Info", or "Debug". The logs are emitted to the BPF trace pipe, accessible with the command |
Schema | One of: debug , info , off (case insensitive) |
Default | off |
BPFMapSizeConntrack
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | BPFMapSizeConntrack |
Description | Sets the size for the conntrack map. This map must be large enough to hold an entry for each active connection. Warning: changing the size of the conntrack map can cause disruption. |
Schema | Integer |
Default | 512000 |
Attribute | Value |
---|---|
Key | FELIX_BPFMAPSIZECONNTRACK |
Description | Sets the size for the conntrack map. This map must be large enough to hold an entry for each active connection. Warning: changing the size of the conntrack map can cause disruption. |
Schema | Integer |
Default | 512000 |
BPFMapSizeIPSets
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | BPFMapSizeIPSets |
Description | Sets the size for ipsets map. The IP sets map must be large enough to hold an entry for each endpoint matched by every selector in the source/destination matches in network policy. Selectors such as "all()" can result in large numbers of entries (one entry per endpoint in that case). |
Schema | Integer |
Default | 1048576 |
Attribute | Value |
---|---|
Key | FELIX_BPFMAPSIZEIPSETS |
Description | Sets the size for ipsets map. The IP sets map must be large enough to hold an entry for each endpoint matched by every selector in the source/destination matches in network policy. Selectors such as "all()" can result in large numbers of entries (one entry per endpoint in that case). |
Schema | Integer |
Default | 1048576 |
BPFMapSizeIfState
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | BPFMapSizeIfState |
Description | Sets the size for ifstate map. The ifstate map must be large enough to hold an entry for each device (host + workloads) on a host. |
Schema | Integer |
Default | 1000 |
Attribute | Value |
---|---|
Key | FELIX_BPFMAPSIZEIFSTATE |
Description | Sets the size for ifstate map. The ifstate map must be large enough to hold an entry for each device (host + workloads) on a host. |
Schema | Integer |
Default | 1000 |
BPFMapSizeNATAffinity
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | BPFMapSizeNATAffinity |
Description | Sets the size of the BPF map that stores the affinity of a connection (for services that enable that feature. |
Schema | Integer |
Default | 65536 |
Attribute | Value |
---|---|
Key | FELIX_BPFMAPSIZENATAFFINITY |
Description | Sets the size of the BPF map that stores the affinity of a connection (for services that enable that feature. |
Schema | Integer |
Default | 65536 |
BPFMapSizeNATBackend
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | BPFMapSizeNATBackend |
Description | Sets the size for NAT back end map. This is the total number of endpoints. This is mostly more than the size of the number of services. |
Schema | Integer |
Default | 262144 |
Attribute | Value |
---|---|
Key | FELIX_BPFMAPSIZENATBACKEND |
Description | Sets the size for NAT back end map. This is the total number of endpoints. This is mostly more than the size of the number of services. |
Schema | Integer |
Default | 262144 |
BPFMapSizeNATFrontend
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | BPFMapSizeNATFrontend |
Description | Sets the size for NAT front end map. FrontendMap should be large enough to hold an entry for each nodeport, external IP and each port in each service. |
Schema | Integer |
Default | 65536 |
Attribute | Value |
---|---|
Key | FELIX_BPFMAPSIZENATFRONTEND |
Description | Sets the size for NAT front end map. FrontendMap should be large enough to hold an entry for each nodeport, external IP and each port in each service. |
Schema | Integer |
Default | 65536 |
BPFMapSizeRoute
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | BPFMapSizeRoute |
Description | Sets the size for the routes map. The routes map should be large enough to hold one entry per workload and a handful of entries per host (enough to cover its own IPs and tunnel IPs). |
Schema | Integer |
Default | 262144 |
Attribute | Value |
---|---|
Key | FELIX_BPFMAPSIZEROUTE |
Description | Sets the size for the routes map. The routes map should be large enough to hold one entry per workload and a handful of entries per host (enough to cover its own IPs and tunnel IPs). |
Schema | Integer |
Default | 262144 |
BPFPSNATPorts
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | BPFPSNATPorts |
Description | Sets the range from which we randomly pick a port if there is a source port collision. This should be within the ephemeral range as defined by RFC 6056 (1024–65535) and preferably outside the ephemeral ranges used by common operating systems. Linux uses 32768–60999, while others mostly use the IANA defined range 49152–65535. It is not necessarily a problem if this range overlaps with the operating systems. Both ends of the range are inclusive. |
Schema | Port range: either a single number in [0,65535] or a range of numbers n:m |
Default | 20000:29999 |
Attribute | Value |
---|---|
Key | FELIX_BPFPSNATPORTS |
Description | Sets the range from which we randomly pick a port if there is a source port collision. This should be within the ephemeral range as defined by RFC 6056 (1024–65535) and preferably outside the ephemeral ranges used by common operating systems. Linux uses 32768–60999, while others mostly use the IANA defined range 49152–65535. It is not necessarily a problem if this range overlaps with the operating systems. Both ends of the range are inclusive. |
Schema | Port range: either a single number in [0,65535] or a range of numbers n:m |
Default | 20000:29999 |
BPFPolicyDebugEnabled
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | BPFPolicyDebugEnabled |
Description | When true, Felix records detailed information about the BPF policy programs, which can be examined with the calico-bpf command-line tool. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | true |
Attribute | Value |
---|---|
Key | FELIX_BPFPOLICYDEBUGENABLED |
Description | When true, Felix records detailed information about the BPF policy programs, which can be examined with the calico-bpf command-line tool. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | true |
BPFRedirectToPeer
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | BPFRedirectToPeer |
Description | Controls which whether it is allowed to forward straight to the peer side of the workload devices. It is allowed for any host L2 devices by default (L2Only), but it breaks TCP dump on the host side of workload device as it bypasses it on ingress. Value of Enabled also allows redirection from L3 host devices like IPIP tunnel or Wireguard directly to the peer side of the workload's device. This makes redirection faster, however, it breaks tools like tcpdump on the peer side. Use Enabled with caution. |
Schema | One of: Disabled , Enabled , L2Only (case insensitive) |
Default | L2Only |
Attribute | Value |
---|---|
Key | FELIX_BPFREDIRECTTOPEER |
Description | Controls which whether it is allowed to forward straight to the peer side of the workload devices. It is allowed for any host L2 devices by default (L2Only), but it breaks TCP dump on the host side of workload device as it bypasses it on ingress. Value of Enabled also allows redirection from L3 host devices like IPIP tunnel or Wireguard directly to the peer side of the workload's device. This makes redirection faster, however, it breaks tools like tcpdump on the peer side. Use Enabled with caution. |
Schema | One of: Disabled , Enabled , L2Only (case insensitive) |
Default | L2Only |
Dataplane: Windows
WindowsManageFirewallRules
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | WindowsManageFirewallRules |
Description | Configures whether or not Felix will program Windows Firewall rules (to allow inbound access to its own metrics ports). |
Schema | One of: Disabled , Enabled (case insensitive) |
Default | Disabled |
Attribute | Value |
---|---|
Key | FELIX_WINDOWSMANAGEFIREWALLRULES |
Description | Configures whether or not Felix will program Windows Firewall rules (to allow inbound access to its own metrics ports). |
Schema | One of: Disabled , Enabled (case insensitive) |
Default | Disabled |
Dataplane: OpenStack support
EndpointReportingDelaySecs
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | EndpointReportingDelaySecs |
Description | The delay before Felix reports endpoint status to the datastore. This is only used by the OpenStack integration. |
Schema | Seconds (floating point) |
Default | 1 (1s) |
Attribute | Value |
---|---|
Key | FELIX_ENDPOINTREPORTINGDELAYSECS |
Description | The delay before Felix reports endpoint status to the datastore. This is only used by the OpenStack integration. |
Schema | Seconds (floating point) |
Default | 1 (1s) |
EndpointReportingEnabled
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | EndpointReportingEnabled |
Description | Controls whether Felix reports endpoint status to the datastore. This is only used by the OpenStack integration. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | false |
Attribute | Value |
---|---|
Key | FELIX_ENDPOINTREPORTINGENABLED |
Description | Controls whether Felix reports endpoint status to the datastore. This is only used by the OpenStack integration. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | false |
MetadataAddr
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | MetadataAddr |
Description | The IP address or domain name of the server that can answer VM queries for cloud-init metadata. In OpenStack, this corresponds to the machine running nova-api (or in Ubuntu, nova-api-metadata). A value of none (case-insensitive) means that Felix should not set up any NAT rule for the metadata path. |
Schema | String matching regex ^[a-zA-Z0-9_.-]+$ |
Default | 127.0.0.1 |
Attribute | Value |
---|---|
Key | FELIX_METADATAADDR |
Description | The IP address or domain name of the server that can answer VM queries for cloud-init metadata. In OpenStack, this corresponds to the machine running nova-api (or in Ubuntu, nova-api-metadata). A value of none (case-insensitive) means that Felix should not set up any NAT rule for the metadata path. |
Schema | String matching regex ^[a-zA-Z0-9_.-]+$ |
Default | 127.0.0.1 |
MetadataPort
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | MetadataPort |
Description | The port of the metadata server. This, combined with global.MetadataAddr (if not 'None'), is used to set up a NAT rule, from 169.254.169.254:80 to MetadataAddr:MetadataPort. In most cases this should not need to be changed . |
Schema | Integer: [0,65535] |
Default | 8775 |
Attribute | Value |
---|---|
Key | FELIX_METADATAPORT |
Description | The port of the metadata server. This, combined with global.MetadataAddr (if not 'None'), is used to set up a NAT rule, from 169.254.169.254:80 to MetadataAddr:MetadataPort. In most cases this should not need to be changed . |
Schema | Integer: [0,65535] |
Default | 8775 |
OpenstackRegion
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | OpenstackRegion |
Description | The name of the region that a particular Felix belongs to. In a multi-region Calico/OpenStack deployment, this must be configured somehow for each Felix (here in the datamodel, or in felix.cfg or the environment on each compute node), and must match the [calico] openstack_region value configured in neutron.conf on each node. |
Schema | OpenStack region name (must be a valid DNS label) |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_OPENSTACKREGION |
Description | The name of the region that a particular Felix belongs to. In a multi-region Calico/OpenStack deployment, this must be configured somehow for each Felix (here in the datamodel, or in felix.cfg or the environment on each compute node), and must match the [calico] openstack_region value configured in neutron.conf on each node. |
Schema | OpenStack region name (must be a valid DNS label) |
Default | none |
ReportingIntervalSecs
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | ReportingIntervalSecs |
Description | The interval at which Felix reports its status into the datastore or 0 to disable. Must be non-zero in OpenStack deployments. |
Schema | Seconds (floating point) |
Default | 30 (30s) |
Attribute | Value |
---|---|
Key | FELIX_REPORTINGINTERVALSECS |
Description | The interval at which Felix reports its status into the datastore or 0 to disable. Must be non-zero in OpenStack deployments. |
Schema | Seconds (floating point) |
Default | 30 (30s) |
ReportingTTLSecs
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | ReportingTTLSecs |
Description | The time-to-live setting for process-wide status reports. |
Schema | Seconds (floating point) |
Default | 90 (1m30s) |
Attribute | Value |
---|---|
Key | FELIX_REPORTINGTTLSECS |
Description | The time-to-live setting for process-wide status reports. |
Schema | Seconds (floating point) |
Default | 90 (1m30s) |
Dataplane: XDP acceleration for iptables dataplane
GenericXDPEnabled
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | GenericXDPEnabled |
Description | Enables Generic XDP so network cards that don't support XDP offload or driver modes can use XDP. This is not recommended since it doesn't provide better performance than iptables. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | false |
Attribute | Value |
---|---|
Key | FELIX_GENERICXDPENABLED |
Description | Enables Generic XDP so network cards that don't support XDP offload or driver modes can use XDP. This is not recommended since it doesn't provide better performance than iptables. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | false |
XDPEnabled
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | XDPEnabled |
Description | Enables XDP acceleration for suitable untracked incoming deny rules. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | true |
Attribute | Value |
---|---|
Key | FELIX_XDPENABLED |
Description | Enables XDP acceleration for suitable untracked incoming deny rules. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | true |
XDPRefreshInterval
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | XDPRefreshInterval |
Description | The period at which Felix re-checks all XDP state to ensure that no other process has accidentally broken Calico's BPF maps or attached programs. Set to 0 to disable XDP refresh. |
Schema | Seconds (floating point) |
Default | 90 (1m30s) |
Attribute | Value |
---|---|
Key | FELIX_XDPREFRESHINTERVAL |
Description | The period at which Felix re-checks all XDP state to ensure that no other process has accidentally broken Calico's BPF maps or attached programs. Set to 0 to disable XDP refresh. |
Schema | Seconds (floating point) |
Default | 90 (1m30s) |
Overlay: VXLAN overlay
VXLANEnabled
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | VXLANEnabled |
Description | Overrides whether Felix should create the VXLAN tunnel device for IPv4 VXLAN networking. Optional as Felix determines this based on the existing IP pools. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_VXLANENABLED |
Description | Overrides whether Felix should create the VXLAN tunnel device for IPv4 VXLAN networking. Optional as Felix determines this based on the existing IP pools. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | none |
VXLANMTU
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | VXLANMTU |
Description | The MTU to set on the IPv4 VXLAN tunnel device. Optional as Felix auto-detects the MTU based on the MTU of the host's interfaces. |
Schema | Integer |
Default | 0 |
Attribute | Value |
---|---|
Key | FELIX_VXLANMTU |
Description | The MTU to set on the IPv4 VXLAN tunnel device. Optional as Felix auto-detects the MTU based on the MTU of the host's interfaces. |
Schema | Integer |
Default | 0 |
VXLANMTUV6
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | VXLANMTUV6 |
Description | The MTU to set on the IPv6 VXLAN tunnel device. Optional as Felix auto-detects the MTU based on the MTU of the host's interfaces. |
Schema | Integer |
Default | 0 |
Attribute | Value |
---|---|
Key | FELIX_VXLANMTUV6 |
Description | The MTU to set on the IPv6 VXLAN tunnel device. Optional as Felix auto-detects the MTU based on the MTU of the host's interfaces. |
Schema | Integer |
Default | 0 |
VXLANPort
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | VXLANPort |
Description | The UDP port number to use for VXLAN traffic. |
Schema | Integer |
Default | 4789 |
Attribute | Value |
---|---|
Key | FELIX_VXLANPORT |
Description | The UDP port number to use for VXLAN traffic. |
Schema | Integer |
Default | 4789 |
VXLANVNI
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | VXLANVNI |
Description | The VXLAN VNI to use for VXLAN traffic. You may need to change this if the default value is in use on your system. |
Schema | Integer |
Default | 4096 |
Attribute | Value |
---|---|
Key | FELIX_VXLANVNI |
Description | The VXLAN VNI to use for VXLAN traffic. You may need to change this if the default value is in use on your system. |
Schema | Integer |
Default | 4096 |
Overlay: IP-in-IP
IpInIpEnabled
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | IpInIpEnabled |
Description | Overrides whether Felix should configure an IPIP interface on the host. Optional as Felix determines this based on the existing IP pools. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_IPINIPENABLED |
Description | Overrides whether Felix should configure an IPIP interface on the host. Optional as Felix determines this based on the existing IP pools. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | none |
IpInIpMtu
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | IpInIpMtu |
Description | Controls the MTU to set on the IPIP tunnel device. Optional as Felix auto-detects the MTU based on the MTU of the host's interfaces. |
Schema | Integer |
Default | 0 |
Attribute | Value |
---|---|
Key | FELIX_IPINIPMTU |
Description | Controls the MTU to set on the IPIP tunnel device. Optional as Felix auto-detects the MTU based on the MTU of the host's interfaces. |
Schema | Integer |
Default | 0 |
Overlay: Wireguard
WireguardEnabled
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | WireguardEnabled |
Description | Controls whether Wireguard is enabled for IPv4 (encapsulating IPv4 traffic over an IPv4 underlay network). |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | false |
Attribute | Value |
---|---|
Key | FELIX_WIREGUARDENABLED |
Description | Controls whether Wireguard is enabled for IPv4 (encapsulating IPv4 traffic over an IPv4 underlay network). |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | false |
WireguardEnabledV6
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | WireguardEnabledV6 |
Description | Controls whether Wireguard is enabled for IPv6 (encapsulating IPv6 traffic over an IPv6 underlay network). |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | false |
Attribute | Value |
---|---|
Key | FELIX_WIREGUARDENABLEDV6 |
Description | Controls whether Wireguard is enabled for IPv6 (encapsulating IPv6 traffic over an IPv6 underlay network). |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | false |
WireguardHostEncryptionEnabled
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | WireguardHostEncryptionEnabled |
Description | Controls whether Wireguard host-to-host encryption is enabled. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | false |
Attribute | Value |
---|---|
Key | FELIX_WIREGUARDHOSTENCRYPTIONENABLED |
Description | Controls whether Wireguard host-to-host encryption is enabled. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | false |
WireguardInterfaceName
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | WireguardInterfaceName |
Description | Specifies the name to use for the IPv4 Wireguard interface. |
Schema | String matching regex ^[a-zA-Z0-9:._+-]{1,15}$ |
Default | wireguard.cali |
Attribute | Value |
---|---|
Key | FELIX_WIREGUARDINTERFACENAME |
Description | Specifies the name to use for the IPv4 Wireguard interface. |
Schema | String matching regex ^[a-zA-Z0-9:._+-]{1,15}$ |
Default | wireguard.cali |
WireguardInterfaceNameV6
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | WireguardInterfaceNameV6 |
Description | Specifies the name to use for the IPv6 Wireguard interface. |
Schema | String matching regex ^[a-zA-Z0-9:._+-]{1,15}$ |
Default | wg-v6.cali |
Attribute | Value |
---|---|
Key | FELIX_WIREGUARDINTERFACENAMEV6 |
Description | Specifies the name to use for the IPv6 Wireguard interface. |
Schema | String matching regex ^[a-zA-Z0-9:._+-]{1,15}$ |
Default | wg-v6.cali |
WireguardListeningPort
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | WireguardListeningPort |
Description | Controls the listening port used by IPv4 Wireguard. |
Schema | Integer |
Default | 51820 |
Attribute | Value |
---|---|
Key | FELIX_WIREGUARDLISTENINGPORT |
Description | Controls the listening port used by IPv4 Wireguard. |
Schema | Integer |
Default | 51820 |
WireguardListeningPortV6
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | WireguardListeningPortV6 |
Description | Controls the listening port used by IPv6 Wireguard. |
Schema | Integer |
Default | 51821 |
Attribute | Value |
---|---|
Key | FELIX_WIREGUARDLISTENINGPORTV6 |
Description | Controls the listening port used by IPv6 Wireguard. |
Schema | Integer |
Default | 51821 |
WireguardMTU
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | WireguardMTU |
Description | Controls the MTU on the IPv4 Wireguard interface. See Configuring MTU. |
Schema | Integer |
Default | 0 |
Attribute | Value |
---|---|
Key | FELIX_WIREGUARDMTU |
Description | Controls the MTU on the IPv4 Wireguard interface. See Configuring MTU. |
Schema | Integer |
Default | 0 |
WireguardMTUV6
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | WireguardMTUV6 |
Description | Controls the MTU on the IPv6 Wireguard interface. See Configuring MTU. |
Schema | Integer |
Default | 0 |
Attribute | Value |
---|---|
Key | FELIX_WIREGUARDMTUV6 |
Description | Controls the MTU on the IPv6 Wireguard interface. See Configuring MTU. |
Schema | Integer |
Default | 0 |
WireguardPersistentKeepAlive
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | WireguardPersistentKeepAlive |
Description | Controls Wireguard PersistentKeepalive option. Set 0 to disable. |
Schema | Seconds (floating point) |
Default | 0 (0s) |
Attribute | Value |
---|---|
Key | FELIX_WIREGUARDPERSISTENTKEEPALIVE |
Description | Controls Wireguard PersistentKeepalive option. Set 0 to disable. |
Schema | Seconds (floating point) |
Default | 0 (0s) |
WireguardRoutingRulePriority
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | WireguardRoutingRulePriority |
Description | Controls the priority value to use for the Wireguard routing rule. |
Schema | Integer |
Default | 99 |
Attribute | Value |
---|---|
Key | FELIX_WIREGUARDROUTINGRULEPRIORITY |
Description | Controls the priority value to use for the Wireguard routing rule. |
Schema | Integer |
Default | 99 |
AWS integration
AWSSrcDstCheck
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | AWSSrcDstCheck |
Description | Controls whether Felix will try to change the "source/dest check" setting on the EC2 instance on which it is running. A value of "Disable" will try to disable the source/dest check. Disabling the check allows for sending workload traffic without encapsulation within the same AWS subnet. |
Schema | One of: Disable , DoNothing , Enable (case insensitive) |
Default | DoNothing |
Attribute | Value |
---|---|
Key | FELIX_AWSSRCDSTCHECK |
Description | Controls whether Felix will try to change the "source/dest check" setting on the EC2 instance on which it is running. A value of "Disable" will try to disable the source/dest check. Disabling the check allows for sending workload traffic without encapsulation within the same AWS subnet. |
Schema | One of: Disable , DoNothing , Enable (case insensitive) |
Default | DoNothing |
Debug/test-only (generally unsupported)
DebugBPFCgroupV2
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | DebugBPFCgroupV2 |
Description | Controls the cgroup v2 path that we apply the connect-time load balancer to. Most distros are configured for cgroup v1, which prevents all but the root cgroup v2 from working so this is only useful for development right now. |
Schema | String |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_DEBUGBPFCGROUPV2 |
Description | Controls the cgroup v2 path that we apply the connect-time load balancer to. Most distros are configured for cgroup v1, which prevents all but the root cgroup v2 from working so this is only useful for development right now. |
Schema | String |
Default | none |
DebugBPFMapRepinEnabled
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | DebugBPFMapRepinEnabled |
Description | Can be used to prevent Felix from repinning its BPF maps at startup. This is useful for testing with multiple Felix instances running on one host. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | false |
Attribute | Value |
---|---|
Key | FELIX_DEBUGBPFMAPREPINENABLED |
Description | Can be used to prevent Felix from repinning its BPF maps at startup. This is useful for testing with multiple Felix instances running on one host. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | false |
DebugCPUProfilePath
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | DebugCPUProfilePath |
Description | Unsupported diagnostic setting, used when testing Felix. Not exposed in |
Schema | Path to file |
Default | /tmp/felix-cpu-<timestamp>.pprof |
Attribute | Value |
---|---|
Key | FELIX_DEBUGCPUPROFILEPATH |
Description | Unsupported diagnostic setting, used when testing Felix. Not exposed in |
Schema | Path to file |
Default | /tmp/felix-cpu-<timestamp>.pprof |
DebugDisableLogDropping
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | DebugDisableLogDropping |
Description | Disables the dropping of log messages when the log buffer is full. This can significantly impact performance if log write-out is a bottleneck. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | false |
Attribute | Value |
---|---|
Key | FELIX_DEBUGDISABLELOGDROPPING |
Description | Disables the dropping of log messages when the log buffer is full. This can significantly impact performance if log write-out is a bottleneck. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | false |
DebugHost
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | DebugHost |
Description | The host IP or hostname to bind the debug port to. Only used if DebugPort is set. |
Schema | String matching regex ^[a-zA-Z0-9:._+-]{1,64}$ |
Default | localhost |
Attribute | Value |
---|---|
Key | FELIX_DEBUGHOST |
Description | The host IP or hostname to bind the debug port to. Only used if DebugPort is set. |
Schema | String matching regex ^[a-zA-Z0-9:._+-]{1,64}$ |
Default | localhost |
DebugMemoryProfilePath
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | DebugMemoryProfilePath |
Description | The path to write the memory profile to when triggered by signal. |
Schema | Path to file |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_DEBUGMEMORYPROFILEPATH |
Description | The path to write the memory profile to when triggered by signal. |
Schema | Path to file |
Default | none |
DebugPanicAfter
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | DebugPanicAfter |
Description | Unsupported diagnostic setting, used when testing Felix. Not exposed in |
Schema | Seconds (floating point) |
Default | 0 |
Attribute | Value |
---|---|
Key | FELIX_DEBUGPANICAFTER |
Description | Unsupported diagnostic setting, used when testing Felix. Not exposed in |
Schema | Seconds (floating point) |
Default | 0 |
DebugPort
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | DebugPort |
Description | If set, enables Felix's debug HTTP port, which allows memory and CPU profiles to be retrieved. The debug port is not secure, it should not be exposed to the internet. |
Schema | Integer: [0,65535] |
Default | none |
Attribute | Value |
---|---|
Key | FELIX_DEBUGPORT |
Description | If set, enables Felix's debug HTTP port, which allows memory and CPU profiles to be retrieved. The debug port is not secure, it should not be exposed to the internet. |
Schema | Integer: [0,65535] |
Default | none |
DebugSimulateCalcGraphHangAfter
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | DebugSimulateCalcGraphHangAfter |
Description | Used to simulate a hang in the calculation graph after the specified duration. This is useful in tests of the watchdog system only! |
Schema | Seconds (floating point) |
Default | 0 (0s) |
Attribute | Value |
---|---|
Key | FELIX_DEBUGSIMULATECALCGRAPHHANGAFTER |
Description | Used to simulate a hang in the calculation graph after the specified duration. This is useful in tests of the watchdog system only! |
Schema | Seconds (floating point) |
Default | 0 (0s) |
DebugSimulateDataRace
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | DebugSimulateDataRace |
Description | Unsupported diagnostic setting, used when testing Felix. Not exposed in |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | false |
Attribute | Value |
---|---|
Key | FELIX_DEBUGSIMULATEDATARACE |
Description | Unsupported diagnostic setting, used when testing Felix. Not exposed in |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | false |
DebugSimulateDataplaneApplyDelay
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | DebugSimulateDataplaneApplyDelay |
Description | Adds an artificial delay to every dataplane operation. This is useful for simulating a heavily loaded system for test purposes only. |
Schema | Seconds (floating point) |
Default | 0 (0s) |
Attribute | Value |
---|---|
Key | FELIX_DEBUGSIMULATEDATAPLANEAPPLYDELAY |
Description | Adds an artificial delay to every dataplane operation. This is useful for simulating a heavily loaded system for test purposes only. |
Schema | Seconds (floating point) |
Default | 0 (0s) |
DebugSimulateDataplaneHangAfter
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | DebugSimulateDataplaneHangAfter |
Description | Used to simulate a hang in the dataplane after the specified duration. This is useful in tests of the watchdog system only! |
Schema | Seconds (floating point) |
Default | 0 (0s) |
Attribute | Value |
---|---|
Key | FELIX_DEBUGSIMULATEDATAPLANEHANGAFTER |
Description | Used to simulate a hang in the dataplane after the specified duration. This is useful in tests of the watchdog system only! |
Schema | Seconds (floating point) |
Default | 0 (0s) |
Usage reporting
UsageReportingEnabled
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | UsageReportingEnabled |
Description | Reports anonymous Calico version number and cluster size to projectcalico.org. Logs warnings returned by the usage server. For example, if a significant security vulnerability has been discovered in the version of Calico being used. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | true |
Attribute | Value |
---|---|
Key | FELIX_USAGEREPORTINGENABLED |
Description | Reports anonymous Calico version number and cluster size to projectcalico.org. Logs warnings returned by the usage server. For example, if a significant security vulnerability has been discovered in the version of Calico being used. |
Schema | Boolean: true , 1 , yes , y , t accepted as True; false , 0 , no , n , f accepted (case insensitively) as False. |
Default | true |
UsageReportingInitialDelaySecs
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | UsageReportingInitialDelaySecs |
Description | Controls the minimum delay before Felix makes a report. |
Schema | Seconds (floating point) |
Default | 300 (5m0s) |
Attribute | Value |
---|---|
Key | FELIX_USAGEREPORTINGINITIALDELAYSECS |
Description | Controls the minimum delay before Felix makes a report. |
Schema | Seconds (floating point) |
Default | 300 (5m0s) |
UsageReportingIntervalSecs
- Configuration file
- Environment variable
Attribute | Value |
---|---|
Key | UsageReportingIntervalSecs |
Description | Controls the interval at which Felix makes reports. |
Schema | Seconds (floating point) |
Default | 86400 (24h0m0s) |
Attribute | Value |
---|---|
Key | FELIX_USAGEREPORTINGINTERVALSECS |
Description | Controls the interval at which Felix makes reports. |
Schema | Seconds (floating point) |
Default | 86400 (24h0m0s) |
Environment variables
The highest priority of configuration is that read from environment
variables. To set a configuration parameter via an environment variable,
set the environment variable formed by taking FELIX_
and appending the
uppercase form of the variable name. For example, to set the etcd
address, set the environment variable FELIX_ETCDADDR
. Other examples
include FELIX_ETCDSCHEME
, FELIX_ETCDKEYFILE
, FELIX_ETCDCERTFILE
,
FELIX_ETCDCAFILE
, FELIX_FELIXHOSTNAME
, FELIX_LOGFILEPATH
and
FELIX_METADATAADDR
.
Configuration file
On startup, Felix reads an ini-style configuration file. The path to
this file defaults to /etc/calico/felix.cfg
but can be overridden
using the -c
or --config-file
options on the command line. If the
file exists, then it is read (ignoring section names) and all parameters
are set from it.
In OpenStack, we recommend putting all configuration into configuration files, since the etcd database is transient (and may be recreated by the OpenStack plugin in certain error cases). However, in a Docker environment the use of environment variables or etcd is often more convenient.
Datastore
Felix also reads configuration parameters from the datastore. It supports a global setting and a per-host override.
-
Get the current felixconfig settings.
calicoctl get felixconfig default -o yaml --export > felix.yaml
-
Modify logFilePath to your intended path, e.g. "/tmp/felix.log"
vim felix.yaml
tipFor a global change set name to "default". For a node-specific change: set name to
node.<nodename>
, e.g. "node.Calico-node-1" -
Replace the current felixconfig settings
calicoctl replace -f felix.yaml
For more information, see Felix Configuration Resource.