Configuring Felix

tip

The following tables detail the configuration file and environment variable parameters. For FelixConfiguration resource settings, refer to Felix Configuration Resource.

Configuration for Felix is read from one of four possible locations, in order, as follows.

1. Environment variables.
2. The Felix configuration file.
3. Host-specific FelixConfiguration resources (node.<nodename>).
4. The global FelixConfiguration resource (default).

The value of any configuration parameter is the value read from the first location containing a value. For example, if an environment variable contains a value, it takes top precedence.

If not set in any of these locations, most configuration parameters have defaults, and it should be rare to have to explicitly set them.

The full list of parameters which can be set is as follows.

Spec

Datastore connection

DatastoreType

Configuration file

Attribute	Value
Key	DatastoreType
Description	Controls which datastore driver Felix will use. Typically, this is detected from the environment and it does not need to be set manually. (For example, if KUBECONFIG is set, the kubernetes datastore driver will be used by default).
Schema	One of: etcdv3, kubernetes (case insensitive)
Default	etcdv3

Environment variable

Attribute	Value
Key	FELIX_DATASTORETYPE
Description	Controls which datastore driver Felix will use. Typically, this is detected from the environment and it does not need to be set manually. (For example, if KUBECONFIG is set, the kubernetes datastore driver will be used by default).
Schema	One of: etcdv3, kubernetes (case insensitive)
Default	etcdv3

EtcdAddr

Configuration file

Attribute	Value
Key	EtcdAddr
Description	When using the etcdv3 datastore driver, the etcd server and port to connect to. If EtcdEndpoints is also specified, it takes precedence.
Schema	String matching regex ^[^:/]+:\d+$
Default	127.0.0.1:2379

Environment variable

Attribute	Value
Key	FELIX_ETCDADDR
Description	When using the etcdv3 datastore driver, the etcd server and port to connect to. If EtcdEndpoints is also specified, it takes precedence.
Schema	String matching regex ^[^:/]+:\d+$
Default	127.0.0.1:2379

EtcdCaFile

Configuration file

Attribute	Value
Key	EtcdCaFile
Description	When using the etcdv3 datastore driver, path to TLS CA file to use when connecting to etcd. If the CA file is specified, the other TLS parameters are mandatory.
Schema	Path to file, which must exist
Default	none

Environment variable

Attribute	Value
Key	FELIX_ETCDCAFILE
Description	When using the etcdv3 datastore driver, path to TLS CA file to use when connecting to etcd. If the CA file is specified, the other TLS parameters are mandatory.
Schema	Path to file, which must exist
Default	none

EtcdCertFile

Configuration file

Attribute	Value
Key	EtcdCertFile
Description	When using the etcdv3 datastore driver, path to TLS certificate file to use when connecting to etcd. If the certificate file is specified, the other TLS parameters are mandatory.
Schema	Path to file, which must exist
Default	none

Environment variable

Attribute	Value
Key	FELIX_ETCDCERTFILE
Description	When using the etcdv3 datastore driver, path to TLS certificate file to use when connecting to etcd. If the certificate file is specified, the other TLS parameters are mandatory.
Schema	Path to file, which must exist
Default	none

EtcdEndpoints

Configuration file

Attribute	Value
Key	EtcdEndpoints
Description	When using the etcdv3 datastore driver, comma-delimited list of etcd endpoints to connect to, replaces EtcdAddr and EtcdScheme.
Schema	List of HTTP endpoints: comma-delimited list of http(s)://hostname:port
Default	none

Environment variable

Attribute	Value
Key	FELIX_ETCDENDPOINTS
Description	When using the etcdv3 datastore driver, comma-delimited list of etcd endpoints to connect to, replaces EtcdAddr and EtcdScheme.
Schema	List of HTTP endpoints: comma-delimited list of http(s)://hostname:port
Default	none

EtcdKeyFile

Configuration file

Attribute	Value
Key	EtcdKeyFile
Description	When using the etcdv3 datastore driver, path to TLS private key file to use when connecting to etcd. If the key file is specified, the other TLS parameters are mandatory.
Schema	Path to file, which must exist
Default	none

Environment variable

Attribute	Value
Key	FELIX_ETCDKEYFILE
Description	When using the etcdv3 datastore driver, path to TLS private key file to use when connecting to etcd. If the key file is specified, the other TLS parameters are mandatory.
Schema	Path to file, which must exist
Default	none

EtcdScheme

Configuration file

Attribute	Value
Key	EtcdScheme
Description	EtcdAddr: when using the etcdv3 datastore driver, the URL scheme to use. If EtcdEndpoints is also specified, it takes precedence.
Schema	One of: http, https (case insensitive)
Default	http

Environment variable

Attribute	Value
Key	FELIX_ETCDSCHEME
Description	EtcdAddr: when using the etcdv3 datastore driver, the URL scheme to use. If EtcdEndpoints is also specified, it takes precedence.
Schema	One of: http, https (case insensitive)
Default	http

FelixHostname

Configuration file

Attribute	Value
Key	FelixHostname
Description	The name of this node, used to identify resources in the datastore that belong to this node. Auto-detected from the node's hostname if not provided.
Schema	String matching regex ^[a-zA-Z0-9_.-]+$
Default	none

Environment variable

Attribute	Value
Key	FELIX_FELIXHOSTNAME
Description	The name of this node, used to identify resources in the datastore that belong to this node. Auto-detected from the node's hostname if not provided.
Schema	String matching regex ^[a-zA-Z0-9_.-]+$
Default	none

TyphaAddr

Configuration file

Attribute	Value
Key	TyphaAddr
Description	If set, tells Felix to connect to Typha at the given address and port. Overrides TyphaK8sServiceName.
Schema	String matching regex ^[^:/]+:\d+$
Default	none

Environment variable

Attribute	Value
Key	FELIX_TYPHAADDR
Description	If set, tells Felix to connect to Typha at the given address and port. Overrides TyphaK8sServiceName.
Schema	String matching regex ^[^:/]+:\d+$
Default	none

TyphaCAFile

Configuration file

Attribute	Value
Key	TyphaCAFile
Description	Path to the TLS CA file to use when communicating with Typha. If this parameter is specified, the other TLS parameters must also be specified.
Schema	Path to file, which must exist
Default	none

Environment variable

Attribute	Value
Key	FELIX_TYPHACAFILE
Description	Path to the TLS CA file to use when communicating with Typha. If this parameter is specified, the other TLS parameters must also be specified.
Schema	Path to file, which must exist
Default	none

TyphaCN

Configuration file

Attribute	Value
Key	TyphaCN
Description	Common name to use when authenticating to Typha over TLS. If any TLS parameters are specified then one of TyphaCN and TyphaURISAN must be set.
Schema	String
Default	none

Environment variable

Attribute	Value
Key	FELIX_TYPHACN
Description	Common name to use when authenticating to Typha over TLS. If any TLS parameters are specified then one of TyphaCN and TyphaURISAN must be set.
Schema	String
Default	none

TyphaCertFile

Configuration file

Attribute	Value
Key	TyphaCertFile
Description	Path to the TLS certificate to use when communicating with Typha. If this parameter is specified, the other TLS parameters must also be specified.
Schema	Path to file, which must exist
Default	none

Environment variable

Attribute	Value
Key	FELIX_TYPHACERTFILE
Description	Path to the TLS certificate to use when communicating with Typha. If this parameter is specified, the other TLS parameters must also be specified.
Schema	Path to file, which must exist
Default	none

TyphaK8sNamespace

Configuration file

Attribute	Value
Key	TyphaK8sNamespace
Description	Namespace to look in when looking for Typha's service (see TyphaK8sServiceName).
Schema	String
Default	kube-system

Environment variable

Attribute	Value
Key	FELIX_TYPHAK8SNAMESPACE
Description	Namespace to look in when looking for Typha's service (see TyphaK8sServiceName).
Schema	String
Default	kube-system

TyphaK8sServiceName

Configuration file

Attribute	Value
Key	TyphaK8sServiceName
Description	If set, tells Felix to connect to Typha by looking up the Endpoints of the given Kubernetes Service in namespace specified by TyphaK8sNamespace.
Schema	String
Default	none

Environment variable

Attribute	Value
Key	FELIX_TYPHAK8SSERVICENAME
Description	If set, tells Felix to connect to Typha by looking up the Endpoints of the given Kubernetes Service in namespace specified by TyphaK8sNamespace.
Schema	String
Default	none

TyphaKeyFile

Configuration file

Attribute	Value
Key	TyphaKeyFile
Description	Path to the TLS private key to use when communicating with Typha. If this parameter is specified, the other TLS parameters must also be specified.
Schema	Path to file, which must exist
Default	none

Environment variable

Attribute	Value
Key	FELIX_TYPHAKEYFILE
Description	Path to the TLS private key to use when communicating with Typha. If this parameter is specified, the other TLS parameters must also be specified.
Schema	Path to file, which must exist
Default	none

TyphaReadTimeout

Configuration file

Attribute	Value
Key	TyphaReadTimeout
Description	Read timeout when reading from the Typha connection. If typha sends no data for this long, Felix will exit and restart. (Note that Typha sends regular pings so traffic is always expected.)
Schema	Seconds (floating point)
Default	30

Environment variable

Attribute	Value
Key	FELIX_TYPHAREADTIMEOUT
Description	Read timeout when reading from the Typha connection. If typha sends no data for this long, Felix will exit and restart. (Note that Typha sends regular pings so traffic is always expected.)
Schema	Seconds (floating point)
Default	30

TyphaURISAN

Configuration file

Attribute	Value
Key	TyphaURISAN
Description	URI SAN to use when authenticating to Typha over TLS. If any TLS parameters are specified then one of TyphaCN and TyphaURISAN must be set.
Schema	String
Default	none

Environment variable

Attribute	Value
Key	FELIX_TYPHAURISAN
Description	URI SAN to use when authenticating to Typha over TLS. If any TLS parameters are specified then one of TyphaCN and TyphaURISAN must be set.
Schema	String
Default	none

TyphaWriteTimeout

Configuration file

Attribute	Value
Key	TyphaWriteTimeout
Description	Write timeout when writing data to Typha.
Schema	Seconds (floating point)
Default	10

Environment variable

Attribute	Value
Key	FELIX_TYPHAWRITETIMEOUT
Description	Write timeout when writing data to Typha.
Schema	Seconds (floating point)
Default	10

Process: Feature detection/overrides

FeatureDetectOverride

Configuration file

Attribute	Value
Key	FeatureDetectOverride
Description	Used to override feature detection based on auto-detected platform capabilities. Values are specified in a comma separated list with no spaces, example; "SNATFullyRandom=true,MASQFullyRandom=false,RestoreSupportsLock=". A value of "true" or "false" will force enable/disable feature, empty or omitted values fall back to auto-detection.
Schema	Comma-delimited list of key=value pairs
Default	none

Environment variable

Attribute	Value
Key	FELIX_FEATUREDETECTOVERRIDE
Description	Used to override feature detection based on auto-detected platform capabilities. Values are specified in a comma separated list with no spaces, example; "SNATFullyRandom=true,MASQFullyRandom=false,RestoreSupportsLock=". A value of "true" or "false" will force enable/disable feature, empty or omitted values fall back to auto-detection.
Schema	Comma-delimited list of key=value pairs
Default	none

FeatureGates

Configuration file

Attribute	Value
Key	FeatureGates
Description	Used to enable or disable tech-preview Calico features. Values are specified in a comma separated list with no spaces, example; "BPFConnectTimeLoadBalancingWorkaround=enabled,XyZ=false". This is used to enable features that are not fully production ready.
Schema	Comma-delimited list of key=value pairs
Default	none

Environment variable

Attribute	Value
Key	FELIX_FEATUREGATES
Description	Used to enable or disable tech-preview Calico features. Values are specified in a comma separated list with no spaces, example; "BPFConnectTimeLoadBalancingWorkaround=enabled,XyZ=false". This is used to enable features that are not fully production ready.
Schema	Comma-delimited list of key=value pairs
Default	none

Process: Go runtime

GoGCThreshold

Configuration file

Attribute	Value
Key	GoGCThreshold
Description	Sets the Go runtime's garbage collection threshold. I.e. the percentage that the heap is allowed to grow before garbage collection is triggered. In general, doubling the value halves the CPU time spent doing GC, but it also doubles peak GC memory overhead. A special value of -1 can be used to disable GC entirely; this should only be used in conjunction with the GoMemoryLimitMB setting. This setting is overridden by the GOGC environment variable.
Schema	Integer: [-1,263-1]
Default	40

Environment variable

Attribute	Value
Key	FELIX_GOGCTHRESHOLD
Description	Sets the Go runtime's garbage collection threshold. I.e. the percentage that the heap is allowed to grow before garbage collection is triggered. In general, doubling the value halves the CPU time spent doing GC, but it also doubles peak GC memory overhead. A special value of -1 can be used to disable GC entirely; this should only be used in conjunction with the GoMemoryLimitMB setting. This setting is overridden by the GOGC environment variable.
Schema	Integer: [-1,263-1]
Default	40

GoMaxProcs

Configuration file

Attribute	Value
Key	GoMaxProcs
Description	Sets the maximum number of CPUs that the Go runtime will use concurrently. A value of -1 means "use the system default"; typically the number of real CPUs on the system. this setting is overridden by the GOMAXPROCS environment variable.
Schema	Integer: [-1,263-1]
Default	-1

Environment variable

Attribute	Value
Key	FELIX_GOMAXPROCS
Description	Sets the maximum number of CPUs that the Go runtime will use concurrently. A value of -1 means "use the system default"; typically the number of real CPUs on the system. this setting is overridden by the GOMAXPROCS environment variable.
Schema	Integer: [-1,263-1]
Default	-1

GoMemoryLimitMB

Configuration file

Attribute	Value
Key	GoMemoryLimitMB
Description	Sets a (soft) memory limit for the Go runtime in MB. The Go runtime will try to keep its memory usage under the limit by triggering GC as needed. To avoid thrashing, it will exceed the limit if GC starts to take more than 50% of the process's CPU time. A value of -1 disables the memory limit. Note that the memory limit, if used, must be considerably less than any hard resource limit set at the container or pod level. This is because felix is not the only process that must run in the container or pod. This setting is overridden by the GOMEMLIMIT environment variable.
Schema	Integer: [-1,263-1]
Default	-1

Environment variable

Attribute	Value
Key	FELIX_GOMEMORYLIMITMB
Description	Sets a (soft) memory limit for the Go runtime in MB. The Go runtime will try to keep its memory usage under the limit by triggering GC as needed. To avoid thrashing, it will exceed the limit if GC starts to take more than 50% of the process's CPU time. A value of -1 disables the memory limit. Note that the memory limit, if used, must be considerably less than any hard resource limit set at the container or pod level. This is because felix is not the only process that must run in the container or pod. This setting is overridden by the GOMEMLIMIT environment variable.
Schema	Integer: [-1,263-1]
Default	-1

Process: Health port and timeouts

HealthEnabled

Configuration file

Attribute	Value
Key	HealthEnabled
Description	If set to true, enables Felix's health port, which provides readiness and liveness endpoints.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_HEALTHENABLED
Description	If set to true, enables Felix's health port, which provides readiness and liveness endpoints.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

HealthHost

Configuration file

Attribute	Value
Key	HealthHost
Description	The host that the health server should bind to.
Schema	String matching regex ^[a-zA-Z0-9:._+-]{1,64}$
Default	localhost

Environment variable

Attribute	Value
Key	FELIX_HEALTHHOST
Description	The host that the health server should bind to.
Schema	String matching regex ^[a-zA-Z0-9:._+-]{1,64}$
Default	localhost

HealthPort

Configuration file

Attribute	Value
Key	HealthPort
Description	The TCP port that the health server should bind to.
Schema	Integer: [0,65535]
Default	9099

Environment variable

Attribute	Value
Key	FELIX_HEALTHPORT
Description	The TCP port that the health server should bind to.
Schema	Integer: [0,65535]
Default	9099

HealthTimeoutOverrides

Configuration file

Attribute	Value
Key	HealthTimeoutOverrides
Description	Allows the internal watchdog timeouts of individual subcomponents to be overridden. This is useful for working around "false positive" liveness timeouts that can occur in particularly stressful workloads or if CPU is constrained. For a list of active subcomponents, see Felix's logs.
Schema	Comma-delimited list of <key>=<duration> pairs, where durations use Go's standard format (e.g. 1s, 1m, 1h3m2s)
Default	none

Environment variable

Attribute	Value
Key	FELIX_HEALTHTIMEOUTOVERRIDES
Description	Allows the internal watchdog timeouts of individual subcomponents to be overridden. This is useful for working around "false positive" liveness timeouts that can occur in particularly stressful workloads or if CPU is constrained. For a list of active subcomponents, see Felix's logs.
Schema	Comma-delimited list of <key>=<duration> pairs, where durations use Go's standard format (e.g. 1s, 1m, 1h3m2s)
Default	none

Process: Logging

LogDebugFilenameRegex

Configuration file

Attribute	Value
Key	LogDebugFilenameRegex
Description	Controls which source code files have their Debug log output included in the logs. Only logs from files with names that match the given regular expression are included. The filter only applies to Debug level logs.
Schema	Regular expression
Default	none

Environment variable

Attribute	Value
Key	FELIX_LOGDEBUGFILENAMEREGEX
Description	Controls which source code files have their Debug log output included in the logs. Only logs from files with names that match the given regular expression are included. The filter only applies to Debug level logs.
Schema	Regular expression
Default	none

LogFilePath

Configuration file

Attribute	Value
Key	LogFilePath
Description	The full path to the Felix log. Set to none to disable file logging.
Schema	Path to file
Default	/var/log/calico/felix.log

Environment variable

Attribute	Value
Key	FELIX_LOGFILEPATH
Description	The full path to the Felix log. Set to none to disable file logging.
Schema	Path to file
Default	/var/log/calico/felix.log

LogPrefix

Configuration file

Attribute	Value
Key	LogPrefix
Description	The log prefix that Felix uses when rendering LOG rules.
Schema	String
Default	calico-packet

Environment variable

Attribute	Value
Key	FELIX_LOGPREFIX
Description	The log prefix that Felix uses when rendering LOG rules.
Schema	String
Default	calico-packet

LogSeverityFile

Configuration file

Attribute	Value
Key	LogSeverityFile
Description	The log severity above which logs are sent to the log file.
Schema	One of: DEBUG, ERROR, FATAL, INFO, WARNING (case insensitive)
Default	INFO

Environment variable

Attribute	Value
Key	FELIX_LOGSEVERITYFILE
Description	The log severity above which logs are sent to the log file.
Schema	One of: DEBUG, ERROR, FATAL, INFO, WARNING (case insensitive)
Default	INFO

LogSeverityScreen

Configuration file

Attribute	Value
Key	LogSeverityScreen
Description	The log severity above which logs are sent to the stdout.
Schema	One of: DEBUG, ERROR, FATAL, INFO, WARNING (case insensitive)
Default	INFO

Environment variable

Attribute	Value
Key	FELIX_LOGSEVERITYSCREEN
Description	The log severity above which logs are sent to the stdout.
Schema	One of: DEBUG, ERROR, FATAL, INFO, WARNING (case insensitive)
Default	INFO

LogSeveritySys

Configuration file

Attribute	Value
Key	LogSeveritySys
Description	The log severity above which logs are sent to the syslog. Set to None for no logging to syslog.
Schema	One of: DEBUG, ERROR, FATAL, INFO, WARNING (case insensitive)
Default	INFO

Environment variable

Attribute	Value
Key	FELIX_LOGSEVERITYSYS
Description	The log severity above which logs are sent to the syslog. Set to None for no logging to syslog.
Schema	One of: DEBUG, ERROR, FATAL, INFO, WARNING (case insensitive)
Default	INFO

Process: Prometheus metrics

PrometheusGoMetricsEnabled

Configuration file

Attribute	Value
Key	PrometheusGoMetricsEnabled
Description	Disables Go runtime metrics collection, which the Prometheus client does by default, when set to false. This reduces the number of metrics reported, reducing Prometheus load.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

Environment variable

Attribute	Value
Key	FELIX_PROMETHEUSGOMETRICSENABLED
Description	Disables Go runtime metrics collection, which the Prometheus client does by default, when set to false. This reduces the number of metrics reported, reducing Prometheus load.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

PrometheusMetricsEnabled

Configuration file

Attribute	Value
Key	PrometheusMetricsEnabled
Description	Enables the Prometheus metrics server in Felix if set to true.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_PROMETHEUSMETRICSENABLED
Description	Enables the Prometheus metrics server in Felix if set to true.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

PrometheusMetricsHost

Configuration file

Attribute	Value
Key	PrometheusMetricsHost
Description	The host that the Prometheus metrics server should bind to.
Schema	String matching regex ^[a-zA-Z0-9:._+-]{1,64}$
Default	none

Environment variable

Attribute	Value
Key	FELIX_PROMETHEUSMETRICSHOST
Description	The host that the Prometheus metrics server should bind to.
Schema	String matching regex ^[a-zA-Z0-9:._+-]{1,64}$
Default	none

PrometheusMetricsPort

Configuration file

Attribute	Value
Key	PrometheusMetricsPort
Description	The TCP port that the Prometheus metrics server should bind to.
Schema	Integer: [0,65535]
Default	9091

Environment variable

Attribute	Value
Key	FELIX_PROMETHEUSMETRICSPORT
Description	The TCP port that the Prometheus metrics server should bind to.
Schema	Integer: [0,65535]
Default	9091

PrometheusProcessMetricsEnabled

Configuration file

Attribute	Value
Key	PrometheusProcessMetricsEnabled
Description	Disables process metrics collection, which the Prometheus client does by default, when set to false. This reduces the number of metrics reported, reducing Prometheus load.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

Environment variable

Attribute	Value
Key	FELIX_PROMETHEUSPROCESSMETRICSENABLED
Description	Disables process metrics collection, which the Prometheus client does by default, when set to false. This reduces the number of metrics reported, reducing Prometheus load.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

PrometheusWireGuardMetricsEnabled

Configuration file

Attribute	Value
Key	PrometheusWireGuardMetricsEnabled
Description	Disables wireguard metrics collection, which the Prometheus client does by default, when set to false. This reduces the number of metrics reported, reducing Prometheus load.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

Environment variable

Attribute	Value
Key	FELIX_PROMETHEUSWIREGUARDMETRICSENABLED
Description	Disables wireguard metrics collection, which the Prometheus client does by default, when set to false. This reduces the number of metrics reported, reducing Prometheus load.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

Dataplane: Common

AllowIPIPPacketsFromWorkloads

Configuration file

Attribute	Value
Key	AllowIPIPPacketsFromWorkloads
Description	Controls whether Felix will add a rule to drop IPIP encapsulated traffic from workloads.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_ALLOWIPIPPACKETSFROMWORKLOADS
Description	Controls whether Felix will add a rule to drop IPIP encapsulated traffic from workloads.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

AllowVXLANPacketsFromWorkloads

Configuration file

Attribute	Value
Key	AllowVXLANPacketsFromWorkloads
Description	Controls whether Felix will add a rule to drop VXLAN encapsulated traffic from workloads.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_ALLOWVXLANPACKETSFROMWORKLOADS
Description	Controls whether Felix will add a rule to drop VXLAN encapsulated traffic from workloads.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

ChainInsertMode

Configuration file

Attribute	Value
Key	ChainInsertMode
Description	Controls whether Felix hooks the kernel's top-level iptables chains by inserting a rule at the top of the chain or by appending a rule at the bottom. insert is the safe default since it prevents Calico's rules from being bypassed. If you switch to append mode, be sure that the other rules in the chains signal acceptance by falling through to the Calico rules, otherwise the Calico policy will be bypassed.
Schema	One of: append, insert (case insensitive)
Default	insert

Environment variable

Attribute	Value
Key	FELIX_CHAININSERTMODE
Description	Controls whether Felix hooks the kernel's top-level iptables chains by inserting a rule at the top of the chain or by appending a rule at the bottom. insert is the safe default since it prevents Calico's rules from being bypassed. If you switch to append mode, be sure that the other rules in the chains signal acceptance by falling through to the Calico rules, otherwise the Calico policy will be bypassed.
Schema	One of: append, insert (case insensitive)
Default	insert

DataplaneDriver

Configuration file

Attribute	Value
Key	DataplaneDriver
Description	Filename of the external dataplane driver to use. Only used if UseInternalDataplaneDriver is set to false.
Schema	Path to executable, which must exist. If not an absolute path, the directory containing this binary and the system path will be searched.
Default	calico-iptables-plugin

Environment variable

Attribute	Value
Key	FELIX_DATAPLANEDRIVER
Description	Filename of the external dataplane driver to use. Only used if UseInternalDataplaneDriver is set to false.
Schema	Path to executable, which must exist. If not an absolute path, the directory containing this binary and the system path will be searched.
Default	calico-iptables-plugin

DataplaneWatchdogTimeout

Configuration file

Attribute	Value
Key	DataplaneWatchdogTimeout
Description	The readiness/liveness timeout used for Felix's (internal) dataplane driver. Deprecated: replaced by the generic HealthTimeoutOverrides.
Schema	Seconds (floating point)
Default	90 (1m30s)

Environment variable

Attribute	Value
Key	FELIX_DATAPLANEWATCHDOGTIMEOUT
Description	The readiness/liveness timeout used for Felix's (internal) dataplane driver. Deprecated: replaced by the generic HealthTimeoutOverrides.
Schema	Seconds (floating point)
Default	90 (1m30s)

DefaultEndpointToHostAction

Configuration file

Attribute	Value
Key	DefaultEndpointToHostAction
Description	Controls what happens to traffic that goes from a workload endpoint to the host itself (after the endpoint's egress policy is applied). By default, Calico blocks traffic from workload endpoints to the host itself with an iptables "DROP" action. If you want to allow some or all traffic from endpoint to host, set this parameter to RETURN or ACCEPT. Use RETURN if you have your own rules in the iptables "INPUT" chain; Calico will insert its rules at the top of that chain, then "RETURN" packets to the "INPUT" chain once it has completed processing workload endpoint egress policy. Use ACCEPT to unconditionally accept packets from workloads after processing workload endpoint egress policy.
Schema	One of: ACCEPT, DROP, RETURN (case insensitive)
Default	DROP

Environment variable

Attribute	Value
Key	FELIX_DEFAULTENDPOINTTOHOSTACTION
Description	Controls what happens to traffic that goes from a workload endpoint to the host itself (after the endpoint's egress policy is applied). By default, Calico blocks traffic from workload endpoints to the host itself with an iptables "DROP" action. If you want to allow some or all traffic from endpoint to host, set this parameter to RETURN or ACCEPT. Use RETURN if you have your own rules in the iptables "INPUT" chain; Calico will insert its rules at the top of that chain, then "RETURN" packets to the "INPUT" chain once it has completed processing workload endpoint egress policy. Use ACCEPT to unconditionally accept packets from workloads after processing workload endpoint egress policy.
Schema	One of: ACCEPT, DROP, RETURN (case insensitive)
Default	DROP

DeviceRouteProtocol

Configuration file

Attribute	Value
Key	DeviceRouteProtocol
Description	Controls the protocol to set on routes programmed by Felix. The protocol is an 8-bit label used to identify the owner of the route.
Schema	Integer
Default	3

Environment variable

Attribute	Value
Key	FELIX_DEVICEROUTEPROTOCOL
Description	Controls the protocol to set on routes programmed by Felix. The protocol is an 8-bit label used to identify the owner of the route.
Schema	Integer
Default	3

DeviceRouteSourceAddress

Configuration file

Attribute	Value
Key	DeviceRouteSourceAddress
Description	IPv4 address to set as the source hint for routes programmed by Felix. When not set the source address for local traffic from host to workload will be determined by the kernel.
Schema	IPv4 address
Default	none

Environment variable

Attribute	Value
Key	FELIX_DEVICEROUTESOURCEADDRESS
Description	IPv4 address to set as the source hint for routes programmed by Felix. When not set the source address for local traffic from host to workload will be determined by the kernel.
Schema	IPv4 address
Default	none

DeviceRouteSourceAddressIPv6

Configuration file

Attribute	Value
Key	DeviceRouteSourceAddressIPv6
Description	IPv6 address to set as the source hint for routes programmed by Felix. When not set the source address for local traffic from host to workload will be determined by the kernel.
Schema	IPv6 address
Default	none

Environment variable

Attribute	Value
Key	FELIX_DEVICEROUTESOURCEADDRESSIPV6
Description	IPv6 address to set as the source hint for routes programmed by Felix. When not set the source address for local traffic from host to workload will be determined by the kernel.
Schema	IPv6 address
Default	none

DisableConntrackInvalidCheck

Configuration file

Attribute	Value
Key	DisableConntrackInvalidCheck
Description	Disables the check for invalid connections in conntrack. While the conntrack invalid check helps to detect malicious traffic, it can also cause issues with certain multi-NIC scenarios.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_DISABLECONNTRACKINVALIDCHECK
Description	Disables the check for invalid connections in conntrack. While the conntrack invalid check helps to detect malicious traffic, it can also cause issues with certain multi-NIC scenarios.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

EndpointStatusPathPrefix

Configuration file

Attribute	Value
Key	EndpointStatusPathPrefix
Description	The path to the directory where endpoint status will be written. Endpoint status file reporting is disabled if field is left empty. Chosen directory should match the directory used by the CNI plugin for PodStartupDelay.
Schema	Path to file
Default	none

Environment variable

Attribute	Value
Key	FELIX_ENDPOINTSTATUSPATHPREFIX
Description	The path to the directory where endpoint status will be written. Endpoint status file reporting is disabled if field is left empty. Chosen directory should match the directory used by the CNI plugin for PodStartupDelay.
Schema	Path to file
Default	none

ExternalNodesCIDRList

Configuration file

Attribute	Value
Key	ExternalNodesCIDRList
Description	A list of CIDR's of external, non-Calico nodes from which VXLAN/IPIP overlay traffic will be allowed. By default, external tunneled traffic is blocked to reduce attack surface.
Schema	Comma-delimited list of CIDRs
Default	none

Environment variable

Attribute	Value
Key	FELIX_EXTERNALNODESCIDRLIST
Description	A list of CIDR's of external, non-Calico nodes from which VXLAN/IPIP overlay traffic will be allowed. By default, external tunneled traffic is blocked to reduce attack surface.
Schema	Comma-delimited list of CIDRs
Default	none

FailsafeInboundHostPorts

Configuration file

Attribute	Value
Key	FailsafeInboundHostPorts
Description	A list of ProtoPort struct objects including UDP/TCP/SCTP ports and CIDRs that Felix will allow incoming traffic to host endpoints on irrespective of the security policy. This is useful to avoid accidentally cutting off a host with incorrect configuration. For backwards compatibility, if the protocol is not specified, it defaults to "tcp". If a CIDR is not specified, it will allow traffic from all addresses. To disable all inbound host ports, use the value "[]". The default value allows ssh access, DHCP, BGP, etcd and the Kubernetes API.
Schema	Comma-delimited list of numeric ports with optional protocol and CIDR:(tcp|udp):<cidr>:<port>, (tcp|udp):<port> or <port>. IPv6 CIDRs must be enclosed in square brackets.
Default	tcp:22,udp:68,tcp:179,tcp:2379,tcp:2380,tcp:5473,tcp:6443,tcp:6666,tcp:6667

Environment variable

Attribute	Value
Key	FELIX_FAILSAFEINBOUNDHOSTPORTS
Description	A list of ProtoPort struct objects including UDP/TCP/SCTP ports and CIDRs that Felix will allow incoming traffic to host endpoints on irrespective of the security policy. This is useful to avoid accidentally cutting off a host with incorrect configuration. For backwards compatibility, if the protocol is not specified, it defaults to "tcp". If a CIDR is not specified, it will allow traffic from all addresses. To disable all inbound host ports, use the value "[]". The default value allows ssh access, DHCP, BGP, etcd and the Kubernetes API.
Schema	Comma-delimited list of numeric ports with optional protocol and CIDR:(tcp|udp):<cidr>:<port>, (tcp|udp):<port> or <port>. IPv6 CIDRs must be enclosed in square brackets.
Default	tcp:22,udp:68,tcp:179,tcp:2379,tcp:2380,tcp:5473,tcp:6443,tcp:6666,tcp:6667

FailsafeOutboundHostPorts

Configuration file

Attribute	Value
Key	FailsafeOutboundHostPorts
Description	A list of PortProto struct objects including UDP/TCP/SCTP ports and CIDRs that Felix will allow outgoing traffic from host endpoints to irrespective of the security policy. This is useful to avoid accidentally cutting off a host with incorrect configuration. For backwards compatibility, if the protocol is not specified, it defaults to "tcp". If a CIDR is not specified, it will allow traffic from all addresses. To disable all outbound host ports, use the value "[]". The default value opens etcd's standard ports to ensure that Felix does not get cut off from etcd as well as allowing DHCP, DNS, BGP and the Kubernetes API.
Schema	Comma-delimited list of numeric ports with optional protocol and CIDR:(tcp|udp):<cidr>:<port>, (tcp|udp):<port> or <port>. IPv6 CIDRs must be enclosed in square brackets.
Default	udp:53,udp:67,tcp:179,tcp:2379,tcp:2380,tcp:5473,tcp:6443,tcp:6666,tcp:6667

Environment variable

Attribute	Value
Key	FELIX_FAILSAFEOUTBOUNDHOSTPORTS
Description	A list of PortProto struct objects including UDP/TCP/SCTP ports and CIDRs that Felix will allow outgoing traffic from host endpoints to irrespective of the security policy. This is useful to avoid accidentally cutting off a host with incorrect configuration. For backwards compatibility, if the protocol is not specified, it defaults to "tcp". If a CIDR is not specified, it will allow traffic from all addresses. To disable all outbound host ports, use the value "[]". The default value opens etcd's standard ports to ensure that Felix does not get cut off from etcd as well as allowing DHCP, DNS, BGP and the Kubernetes API.
Schema	Comma-delimited list of numeric ports with optional protocol and CIDR:(tcp|udp):<cidr>:<port>, (tcp|udp):<port> or <port>. IPv6 CIDRs must be enclosed in square brackets.
Default	udp:53,udp:67,tcp:179,tcp:2379,tcp:2380,tcp:5473,tcp:6443,tcp:6666,tcp:6667

FloatingIPs

Configuration file

Attribute	Value
Key	FloatingIPs
Description	Configures whether or not Felix will program non-OpenStack floating IP addresses. (OpenStack-derived floating IPs are always programmed, regardless of this setting.)
Schema	One of: Disabled, Enabled (case insensitive)
Default	Disabled

Environment variable

Attribute	Value
Key	FELIX_FLOATINGIPS
Description	Configures whether or not Felix will program non-OpenStack floating IP addresses. (OpenStack-derived floating IPs are always programmed, regardless of this setting.)
Schema	One of: Disabled, Enabled (case insensitive)
Default	Disabled

IPForwarding

Configuration file

Attribute	Value
Key	IPForwarding
Description	Controls whether Felix sets the host sysctls to enable IP forwarding. IP forwarding is required when using Calico for workload networking. This should be disabled only on hosts where Calico is used solely for host protection.
Schema	One of: Disabled, Enabled (case insensitive)
Default	Enabled

Environment variable

Attribute	Value
Key	FELIX_IPFORWARDING
Description	Controls whether Felix sets the host sysctls to enable IP forwarding. IP forwarding is required when using Calico for workload networking. This should be disabled only on hosts where Calico is used solely for host protection.
Schema	One of: Disabled, Enabled (case insensitive)
Default	Enabled

InterfaceExclude

Configuration file

Attribute	Value
Key	InterfaceExclude
Description	A comma-separated list of interface names that should be excluded when Felix is resolving host endpoints. The default value ensures that Felix ignores Kubernetes' internal kube-ipvs0 device. If you want to exclude multiple interface names using a single value, the list supports regular expressions. For regular expressions you must wrap the value with /. For example having values /^kube/,veth1 will exclude all interfaces that begin with kube and also the interface veth1.
Schema	Comma-delimited list of Linux interface names/regex patterns. Regex patterns must start/end with /.
Default	kube-ipvs0

Environment variable

Attribute	Value
Key	FELIX_INTERFACEEXCLUDE
Description	A comma-separated list of interface names that should be excluded when Felix is resolving host endpoints. The default value ensures that Felix ignores Kubernetes' internal kube-ipvs0 device. If you want to exclude multiple interface names using a single value, the list supports regular expressions. For regular expressions you must wrap the value with /. For example having values /^kube/,veth1 will exclude all interfaces that begin with kube and also the interface veth1.
Schema	Comma-delimited list of Linux interface names/regex patterns. Regex patterns must start/end with /.
Default	kube-ipvs0

InterfacePrefix

Configuration file

Attribute	Value
Key	InterfacePrefix
Description	The interface name prefix that identifies workload endpoints and so distinguishes them from host endpoint interfaces. Note: in environments other than bare metal, the orchestrators configure this appropriately. For example our Kubernetes and Docker integrations set the 'cali' value, and our OpenStack integration sets the 'tap' value.
Schema	String matching regex ^[a-zA-Z0-9_-]{1,15}(,[a-zA-Z0-9_-]{1,15})*$
Default	cali

Environment variable

Attribute	Value
Key	FELIX_INTERFACEPREFIX
Description	The interface name prefix that identifies workload endpoints and so distinguishes them from host endpoint interfaces. Note: in environments other than bare metal, the orchestrators configure this appropriately. For example our Kubernetes and Docker integrations set the 'cali' value, and our OpenStack integration sets the 'tap' value.
Schema	String matching regex ^[a-zA-Z0-9_-]{1,15}(,[a-zA-Z0-9_-]{1,15})*$
Default	cali

InterfaceRefreshInterval

Configuration file

Attribute	Value
Key	InterfaceRefreshInterval
Description	The period at which Felix rescans local interfaces to verify their state. The rescan can be disabled by setting the interval to 0.
Schema	Seconds (floating point)
Default	90 (1m30s)

Environment variable

Attribute	Value
Key	FELIX_INTERFACEREFRESHINTERVAL
Description	The period at which Felix rescans local interfaces to verify their state. The rescan can be disabled by setting the interval to 0.
Schema	Seconds (floating point)
Default	90 (1m30s)

Ipv6Support

Configuration file

Attribute	Value
Key	Ipv6Support
Description	Controls whether Felix enables support for IPv6 (if supported by the in-use dataplane).
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

Environment variable

Attribute	Value
Key	FELIX_IPV6SUPPORT
Description	Controls whether Felix enables support for IPv6 (if supported by the in-use dataplane).
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

MTUIfacePattern

Configuration file

Attribute	Value
Key	MTUIfacePattern
Description	A regular expression that controls which interfaces Felix should scan in order to calculate the host's MTU. This should not match workload interfaces (usually named cali...).
Schema	Regular expression
Default	^((en|wl|ww|sl|ib)[Pcopsvx].*|(eth|wlan|wwan).*)

Environment variable

Attribute	Value
Key	FELIX_MTUIFACEPATTERN
Description	A regular expression that controls which interfaces Felix should scan in order to calculate the host's MTU. This should not match workload interfaces (usually named cali...).
Schema	Regular expression
Default	^((en|wl|ww|sl|ib)[Pcopsvx].*|(eth|wlan|wwan).*)

NATOutgoingAddress

Configuration file

Attribute	Value
Key	NATOutgoingAddress
Description	Specifies an address to use when performing source NAT for traffic in a natOutgoing pool that is leaving the network. By default the address used is an address on the interface the traffic is leaving on (i.e. it uses the iptables MASQUERADE target).
Schema	IPv4 address
Default	none

Environment variable

Attribute	Value
Key	FELIX_NATOUTGOINGADDRESS
Description	Specifies an address to use when performing source NAT for traffic in a natOutgoing pool that is leaving the network. By default the address used is an address on the interface the traffic is leaving on (i.e. it uses the iptables MASQUERADE target).
Schema	IPv4 address
Default	none

NATPortRange

Configuration file

Attribute	Value
Key	NATPortRange
Description	Specifies the range of ports that is used for port mapping when doing outgoing NAT. When unset the default behavior of the network stack is used.
Schema	Port range: either a single number in [0,65535] or a range of numbers n:m
Default	none

Environment variable

Attribute	Value
Key	FELIX_NATPORTRANGE
Description	Specifies the range of ports that is used for port mapping when doing outgoing NAT. When unset the default behavior of the network stack is used.
Schema	Port range: either a single number in [0,65535] or a range of numbers n:m
Default	none

NFTablesMode

Configuration file

Attribute	Value
Key	NFTablesMode
Description	Configures nftables support in Felix.
Schema	One of: Disabled, Enabled (case insensitive)
Default	Disabled

Environment variable

Attribute	Value
Key	FELIX_NFTABLESMODE
Description	Configures nftables support in Felix.
Schema	One of: Disabled, Enabled (case insensitive)
Default	Disabled

NetlinkTimeoutSecs

Configuration file

Attribute	Value
Key	NetlinkTimeoutSecs
Description	The timeout when talking to the kernel over the netlink protocol, used for programming routes, rules, and other kernel objects.
Schema	Seconds (floating point)
Default	10 (10s)

Environment variable

Attribute	Value
Key	FELIX_NETLINKTIMEOUTSECS
Description	The timeout when talking to the kernel over the netlink protocol, used for programming routes, rules, and other kernel objects.
Schema	Seconds (floating point)
Default	10 (10s)

PolicySyncPathPrefix

Configuration file

Attribute	Value
Key	PolicySyncPathPrefix
Description	Used to by Felix to communicate policy changes to external services, like Application layer policy.
Schema	Path to file
Default	none

Environment variable

Attribute	Value
Key	FELIX_POLICYSYNCPATHPREFIX
Description	Used to by Felix to communicate policy changes to external services, like Application layer policy.
Schema	Path to file
Default	none

RemoveExternalRoutes

Configuration file

Attribute	Value
Key	RemoveExternalRoutes
Description	Controls whether Felix will remove unexpected routes to workload interfaces. Felix will always clean up expected routes that use the configured DeviceRouteProtocol. To add your own routes, you must use a distinct protocol (in addition to setting this field to false).
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

Environment variable

Attribute	Value
Key	FELIX_REMOVEEXTERNALROUTES
Description	Controls whether Felix will remove unexpected routes to workload interfaces. Felix will always clean up expected routes that use the configured DeviceRouteProtocol. To add your own routes, you must use a distinct protocol (in addition to setting this field to false).
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

RouteRefreshInterval

Configuration file

Attribute	Value
Key	RouteRefreshInterval
Description	The period at which Felix re-checks the routes in the dataplane to ensure that no other process has accidentally broken Calico's rules. Set to 0 to disable route refresh.
Schema	Seconds (floating point)
Default	90 (1m30s)

Environment variable

Attribute	Value
Key	FELIX_ROUTEREFRESHINTERVAL
Description	The period at which Felix re-checks the routes in the dataplane to ensure that no other process has accidentally broken Calico's rules. Set to 0 to disable route refresh.
Schema	Seconds (floating point)
Default	90 (1m30s)

RouteSource

Configuration file

Attribute	Value
Key	RouteSource
Description	Configures where Felix gets its routing information. - WorkloadIPs: use workload endpoints to construct routes. - CalicoIPAM: the default - use IPAM data to construct routes.
Schema	One of: CalicoIPAM, WorkloadIPs (case insensitive)
Default	CalicoIPAM

Environment variable

Attribute	Value
Key	FELIX_ROUTESOURCE
Description	Configures where Felix gets its routing information. - WorkloadIPs: use workload endpoints to construct routes. - CalicoIPAM: the default - use IPAM data to construct routes.
Schema	One of: CalicoIPAM, WorkloadIPs (case insensitive)
Default	CalicoIPAM

RouteSyncDisabled

Configuration file

Attribute	Value
Key	RouteSyncDisabled
Description	Will disable all operations performed on the route table. Set to true to run in network-policy mode only.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_ROUTESYNCDISABLED
Description	Will disable all operations performed on the route table. Set to true to run in network-policy mode only.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

RouteTableRange

Configuration file

Attribute	Value
Key	RouteTableRange
Description	Deprecated in favor of RouteTableRanges. Calico programs additional Linux route tables for various purposes. RouteTableRange specifies the indices of the route tables that Calico should use.
Schema	Range of route table indices n-m, where n and m are integers in [0,250].
Default	none

Environment variable

Attribute	Value
Key	FELIX_ROUTETABLERANGE
Description	Deprecated in favor of RouteTableRanges. Calico programs additional Linux route tables for various purposes. RouteTableRange specifies the indices of the route tables that Calico should use.
Schema	Range of route table indices n-m, where n and m are integers in [0,250].
Default	none

RouteTableRanges

Configuration file

Attribute	Value
Key	RouteTableRanges
Description	Calico programs additional Linux route tables for various purposes. RouteTableRanges specifies a set of table index ranges that Calico should use. DeprecatesRouteTableRange, overrides RouteTableRange.
Schema	Comma or space-delimited list of route table ranges of the form n-m where n and m are integers in [0,4294967295]. The sum of the sizes of all ranges may not exceed 65535.
Default	none

Environment variable

Attribute	Value
Key	FELIX_ROUTETABLERANGES
Description	Calico programs additional Linux route tables for various purposes. RouteTableRanges specifies a set of table index ranges that Calico should use. DeprecatesRouteTableRange, overrides RouteTableRange.
Schema	Comma or space-delimited list of route table ranges of the form n-m where n and m are integers in [0,4294967295]. The sum of the sizes of all ranges may not exceed 65535.
Default	none

ServiceLoopPrevention

Configuration file

Attribute	Value
Key	ServiceLoopPrevention
Description	When service IP advertisement is enabled, prevent routing loops to service IPs that are not in use, by dropping or rejecting packets that do not get DNAT'd by kube-proxy. Unless set to "Disabled", in which case such routing loops continue to be allowed.
Schema	One of: Disabled, Drop, Reject (case insensitive)
Default	Drop

Environment variable

Attribute	Value
Key	FELIX_SERVICELOOPPREVENTION
Description	When service IP advertisement is enabled, prevent routing loops to service IPs that are not in use, by dropping or rejecting packets that do not get DNAT'd by kube-proxy. Unless set to "Disabled", in which case such routing loops continue to be allowed.
Schema	One of: Disabled, Drop, Reject (case insensitive)
Default	Drop

SidecarAccelerationEnabled

Configuration file

Attribute	Value
Key	SidecarAccelerationEnabled
Description	Enables experimental sidecar acceleration.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_SIDECARACCELERATIONENABLED
Description	Enables experimental sidecar acceleration.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

UseInternalDataplaneDriver

Configuration file

Attribute	Value
Key	UseInternalDataplaneDriver
Description	If true, Felix will use its internal dataplane programming logic. If false, it will launch an external dataplane driver and communicate with it over protobuf.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

Environment variable

Attribute	Value
Key	FELIX_USEINTERNALDATAPLANEDRIVER
Description	If true, Felix will use its internal dataplane programming logic. If false, it will launch an external dataplane driver and communicate with it over protobuf.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

WorkloadSourceSpoofing

Configuration file

Attribute	Value
Key	WorkloadSourceSpoofing
Description	Controls whether pods can use the allowedSourcePrefixes annotation to send traffic with a source IP address that is not theirs. This is disabled by default. When set to "Any", pods can request any prefix.
Schema	One of: Any, Disabled (case insensitive)
Default	Disabled

Environment variable

Attribute	Value
Key	FELIX_WORKLOADSOURCESPOOFING
Description	Controls whether pods can use the allowedSourcePrefixes annotation to send traffic with a source IP address that is not theirs. This is disabled by default. When set to "Any", pods can request any prefix.
Schema	One of: Any, Disabled (case insensitive)
Default	Disabled

Dataplane: iptables

IpsetsRefreshInterval

Configuration file

Attribute	Value
Key	IpsetsRefreshInterval
Description	Controls the period at which Felix re-checks all IP sets to look for discrepancies. Set to 0 to disable the periodic refresh.
Schema	Seconds (floating point)
Default	90 (1m30s)

Environment variable

Attribute	Value
Key	FELIX_IPSETSREFRESHINTERVAL
Description	Controls the period at which Felix re-checks all IP sets to look for discrepancies. Set to 0 to disable the periodic refresh.
Schema	Seconds (floating point)
Default	90 (1m30s)

IptablesBackend

Configuration file

Attribute	Value
Key	IptablesBackend
Description	Controls which backend of iptables will be used. The default is Auto. Warning: changing this on a running system can leave "orphaned" rules in the "other" backend. These should be cleaned up to avoid confusing interactions.
Schema	One of: auto, legacy, nft (case insensitive)
Default	auto

Environment variable

Attribute	Value
Key	FELIX_IPTABLESBACKEND
Description	Controls which backend of iptables will be used. The default is Auto. Warning: changing this on a running system can leave "orphaned" rules in the "other" backend. These should be cleaned up to avoid confusing interactions.
Schema	One of: auto, legacy, nft (case insensitive)
Default	auto

IptablesFilterAllowAction

Configuration file

Attribute	Value
Key	IptablesFilterAllowAction
Description	Controls what happens to traffic that is accepted by a Felix policy chain in the iptables filter table (which is used for "normal" policy). The default will immediately Accept the traffic. Use Return to send the traffic back up to the system chains for further processing.
Schema	One of: ACCEPT, RETURN (case insensitive)
Default	ACCEPT

Environment variable

Attribute	Value
Key	FELIX_IPTABLESFILTERALLOWACTION
Description	Controls what happens to traffic that is accepted by a Felix policy chain in the iptables filter table (which is used for "normal" policy). The default will immediately Accept the traffic. Use Return to send the traffic back up to the system chains for further processing.
Schema	One of: ACCEPT, RETURN (case insensitive)
Default	ACCEPT

IptablesFilterDenyAction

Configuration file

Attribute	Value
Key	IptablesFilterDenyAction
Description	Controls what happens to traffic that is denied by network policy. By default Calico blocks traffic with an iptables "DROP" action. If you want to use "REJECT" action instead you can configure it in here.
Schema	One of: DROP, REJECT (case insensitive)
Default	DROP

Environment variable

Attribute	Value
Key	FELIX_IPTABLESFILTERDENYACTION
Description	Controls what happens to traffic that is denied by network policy. By default Calico blocks traffic with an iptables "DROP" action. If you want to use "REJECT" action instead you can configure it in here.
Schema	One of: DROP, REJECT (case insensitive)
Default	DROP

IptablesLockFilePath

Configuration file

Attribute	Value
Key	IptablesLockFilePath
Description	The location of the iptables lock file. You may need to change this if the lock file is not in its standard location (for example if you have mapped it into Felix's container at a different path).
Schema	Path to file
Default	/run/xtables.lock

Environment variable

Attribute	Value
Key	FELIX_IPTABLESLOCKFILEPATH
Description	The location of the iptables lock file. You may need to change this if the lock file is not in its standard location (for example if you have mapped it into Felix's container at a different path).
Schema	Path to file
Default	/run/xtables.lock

IptablesLockProbeIntervalMillis

Configuration file

Attribute	Value
Key	IptablesLockProbeIntervalMillis
Description	When IptablesLockTimeout is enabled: the time that Felix will wait between attempts to acquire the iptables lock if it is not available. Lower values make Felix more responsive when the lock is contended, but use more CPU.
Schema	Milliseconds (floating point)
Default	50 (50ms)

Environment variable

Attribute	Value
Key	FELIX_IPTABLESLOCKPROBEINTERVALMILLIS
Description	When IptablesLockTimeout is enabled: the time that Felix will wait between attempts to acquire the iptables lock if it is not available. Lower values make Felix more responsive when the lock is contended, but use more CPU.
Schema	Milliseconds (floating point)
Default	50 (50ms)

IptablesLockTimeoutSecs

Configuration file

Attribute	Value
Key	IptablesLockTimeoutSecs
Description	The time that Felix itself will wait for the iptables lock (rather than delegating the lock handling to the iptables command). Deprecated: iptables-restore v1.8+ always takes the lock, so enabling this feature results in deadlock.
Schema	Seconds (floating point)
Default	0 (0s)

Environment variable

Attribute	Value
Key	FELIX_IPTABLESLOCKTIMEOUTSECS
Description	The time that Felix itself will wait for the iptables lock (rather than delegating the lock handling to the iptables command). Deprecated: iptables-restore v1.8+ always takes the lock, so enabling this feature results in deadlock.
Schema	Seconds (floating point)
Default	0 (0s)

IptablesMangleAllowAction

Configuration file

Attribute	Value
Key	IptablesMangleAllowAction
Description	Controls what happens to traffic that is accepted by a Felix policy chain in the iptables mangle table (which is used for "pre-DNAT" policy). The default will immediately Accept the traffic. Use Return to send the traffic back up to the system chains for further processing.
Schema	One of: ACCEPT, RETURN (case insensitive)
Default	ACCEPT

Environment variable

Attribute	Value
Key	FELIX_IPTABLESMANGLEALLOWACTION
Description	Controls what happens to traffic that is accepted by a Felix policy chain in the iptables mangle table (which is used for "pre-DNAT" policy). The default will immediately Accept the traffic. Use Return to send the traffic back up to the system chains for further processing.
Schema	One of: ACCEPT, RETURN (case insensitive)
Default	ACCEPT

IptablesMarkMask

Configuration file

Attribute	Value
Key	IptablesMarkMask
Description	The mask that Felix selects its IPTables Mark bits from. Should be a 32 bit hexadecimal number with at least 8 bits set, none of which clash with any other mark bits in use on the system.
Schema	32-bit bitmask (hex or deccimal allowed) with at least 2 bits set, example: 0xffff0000
Default	0xffff0000

Environment variable

Attribute	Value
Key	FELIX_IPTABLESMARKMASK
Description	The mask that Felix selects its IPTables Mark bits from. Should be a 32 bit hexadecimal number with at least 8 bits set, none of which clash with any other mark bits in use on the system.
Schema	32-bit bitmask (hex or deccimal allowed) with at least 2 bits set, example: 0xffff0000
Default	0xffff0000

IptablesNATOutgoingInterfaceFilter

Configuration file

Attribute	Value
Key	IptablesNATOutgoingInterfaceFilter
Description	This parameter can be used to limit the host interfaces on which Calico will apply SNAT to traffic leaving a Calico IPAM pool with "NAT outgoing" enabled. This can be useful if you have a main data interface, where traffic should be SNATted and a secondary device (such as the docker bridge) which is local to the host and doesn't require SNAT. This parameter uses the iptables interface matching syntax, which allows + as a wildcard. Most users will not need to set this. Example: if your data interfaces are eth0 and eth1 and you want to exclude the docker bridge, you could set this to eth+.
Schema	String matching regex ^[a-zA-Z0-9:._+-]{1,15}$
Default	none

Environment variable

Attribute	Value
Key	FELIX_IPTABLESNATOUTGOINGINTERFACEFILTER
Description	This parameter can be used to limit the host interfaces on which Calico will apply SNAT to traffic leaving a Calico IPAM pool with "NAT outgoing" enabled. This can be useful if you have a main data interface, where traffic should be SNATted and a secondary device (such as the docker bridge) which is local to the host and doesn't require SNAT. This parameter uses the iptables interface matching syntax, which allows + as a wildcard. Most users will not need to set this. Example: if your data interfaces are eth0 and eth1 and you want to exclude the docker bridge, you could set this to eth+.
Schema	String matching regex ^[a-zA-Z0-9:._+-]{1,15}$
Default	none

IptablesPostWriteCheckIntervalSecs

Configuration file

Attribute	Value
Key	IptablesPostWriteCheckIntervalSecs
Description	The period after Felix has done a write to the dataplane that it schedules an extra read back in order to check the write was not clobbered by another process. This should only occur if another application on the system doesn't respect the iptables lock.
Schema	Seconds (floating point)
Default	5 (5s)

Environment variable

Attribute	Value
Key	FELIX_IPTABLESPOSTWRITECHECKINTERVALSECS
Description	The period after Felix has done a write to the dataplane that it schedules an extra read back in order to check the write was not clobbered by another process. This should only occur if another application on the system doesn't respect the iptables lock.
Schema	Seconds (floating point)
Default	5 (5s)

IptablesRefreshInterval

Configuration file

Attribute	Value
Key	IptablesRefreshInterval
Description	The period at which Felix re-checks the IP sets in the dataplane to ensure that no other process has accidentally broken Calico's rules. Set to 0 to disable IP sets refresh. Note: the default for this value is lower than the other refresh intervals as a workaround for a Linux kernel bug that was fixed in kernel version 4.11. If you are using v4.11 or greater you may want to set this to, a higher value to reduce Felix CPU usage.
Schema	Seconds (floating point)
Default	180 (3m0s)

Environment variable

Attribute	Value
Key	FELIX_IPTABLESREFRESHINTERVAL
Description	The period at which Felix re-checks the IP sets in the dataplane to ensure that no other process has accidentally broken Calico's rules. Set to 0 to disable IP sets refresh. Note: the default for this value is lower than the other refresh intervals as a workaround for a Linux kernel bug that was fixed in kernel version 4.11. If you are using v4.11 or greater you may want to set this to, a higher value to reduce Felix CPU usage.
Schema	Seconds (floating point)
Default	180 (3m0s)

KubeNodePortRanges

Configuration file

Attribute	Value
Key	KubeNodePortRanges
Description	Holds list of port ranges used for service node ports. Only used if felix detects kube-proxy running in ipvs mode. Felix uses these ranges to separate host and workload traffic. .
Schema	List of port ranges: comma-delimited list of either single numbers in range [0,65535] or a ranges of numbers n:m
Default	30000:32767

Environment variable

Attribute	Value
Key	FELIX_KUBENODEPORTRANGES
Description	Holds list of port ranges used for service node ports. Only used if felix detects kube-proxy running in ipvs mode. Felix uses these ranges to separate host and workload traffic. .
Schema	List of port ranges: comma-delimited list of either single numbers in range [0,65535] or a ranges of numbers n:m
Default	30000:32767

MaxIpsetSize

Configuration file

Attribute	Value
Key	MaxIpsetSize
Description	The maximum number of IP addresses that can be stored in an IP set. Not applicable if using the nftables backend.
Schema	Integer
Default	1048576

Environment variable

Attribute	Value
Key	FELIX_MAXIPSETSIZE
Description	The maximum number of IP addresses that can be stored in an IP set. Not applicable if using the nftables backend.
Schema	Integer
Default	1048576

Dataplane: nftables

NftablesFilterAllowAction

Configuration file

Attribute	Value
Key	NftablesFilterAllowAction
Description	Controls the nftables action that Felix uses to represent the "allow" policy verdict in the filter table. The default is to ACCEPT the traffic, which is a terminal action. Alternatively, RETURN can be used to return the traffic back to the top-level chain for further processing by your rules.
Schema	One of: ACCEPT, RETURN (case insensitive)
Default	ACCEPT

Environment variable

Attribute	Value
Key	FELIX_NFTABLESFILTERALLOWACTION
Description	Controls the nftables action that Felix uses to represent the "allow" policy verdict in the filter table. The default is to ACCEPT the traffic, which is a terminal action. Alternatively, RETURN can be used to return the traffic back to the top-level chain for further processing by your rules.
Schema	One of: ACCEPT, RETURN (case insensitive)
Default	ACCEPT

NftablesFilterDenyAction

Configuration file

Attribute	Value
Key	NftablesFilterDenyAction
Description	Controls what happens to traffic that is denied by network policy. By default, Calico blocks traffic with a "drop" action. If you want to use a "reject" action instead you can configure it here.
Schema	One of: DROP, REJECT (case insensitive)
Default	DROP

Environment variable

Attribute	Value
Key	FELIX_NFTABLESFILTERDENYACTION
Description	Controls what happens to traffic that is denied by network policy. By default, Calico blocks traffic with a "drop" action. If you want to use a "reject" action instead you can configure it here.
Schema	One of: DROP, REJECT (case insensitive)
Default	DROP

NftablesMangleAllowAction

Configuration file

Attribute	Value
Key	NftablesMangleAllowAction
Description	Controls the nftables action that Felix uses to represent the "allow" policy verdict in the mangle table. The default is to ACCEPT the traffic, which is a terminal action. Alternatively, RETURN can be used to return the traffic back to the top-level chain for further processing by your rules.
Schema	One of: ACCEPT, RETURN (case insensitive)
Default	ACCEPT

Environment variable

Attribute	Value
Key	FELIX_NFTABLESMANGLEALLOWACTION
Description	Controls the nftables action that Felix uses to represent the "allow" policy verdict in the mangle table. The default is to ACCEPT the traffic, which is a terminal action. Alternatively, RETURN can be used to return the traffic back to the top-level chain for further processing by your rules.
Schema	One of: ACCEPT, RETURN (case insensitive)
Default	ACCEPT

NftablesMarkMask

Configuration file

Attribute	Value
Key	NftablesMarkMask
Description	The mask that Felix selects its nftables Mark bits from. Should be a 32 bit hexadecimal number with at least 8 bits set, none of which clash with any other mark bits in use on the system.
Schema	32-bit bitmask (hex or deccimal allowed) with at least 2 bits set, example: 0xffff0000
Default	0xffff0000

Environment variable

Attribute	Value
Key	FELIX_NFTABLESMARKMASK
Description	The mask that Felix selects its nftables Mark bits from. Should be a 32 bit hexadecimal number with at least 8 bits set, none of which clash with any other mark bits in use on the system.
Schema	32-bit bitmask (hex or deccimal allowed) with at least 2 bits set, example: 0xffff0000
Default	0xffff0000

NftablesRefreshInterval

Configuration file

Attribute	Value
Key	NftablesRefreshInterval
Description	Controls the interval at which Felix periodically refreshes the nftables rules.
Schema	Seconds (floating point)
Default	180 (3m0s)

Environment variable

Attribute	Value
Key	FELIX_NFTABLESREFRESHINTERVAL
Description	Controls the interval at which Felix periodically refreshes the nftables rules.
Schema	Seconds (floating point)
Default	180 (3m0s)

Dataplane: eBPF

BPFCTLBLogFilter

Configuration file

Attribute	Value
Key	BPFCTLBLogFilter
Description	Specifies, what is logged by connect time load balancer when BPFLogLevel is debug. Currently has to be specified as 'all' when BPFLogFilters is set to see CTLB logs.
Schema	One of: all (case insensitive)
Default	none

Environment variable

Attribute	Value
Key	FELIX_BPFCTLBLOGFILTER
Description	Specifies, what is logged by connect time load balancer when BPFLogLevel is debug. Currently has to be specified as 'all' when BPFLogFilters is set to see CTLB logs.
Schema	One of: all (case insensitive)
Default	none

BPFConnectTimeLoadBalancing

Configuration file

Attribute	Value
Key	BPFConnectTimeLoadBalancing
Description	When in BPF mode, controls whether Felix installs the connect-time load balancer. The connect-time load balancer is required for the host to be able to reach Kubernetes services and it improves the performance of pod-to-service connections.When set to TCP, connect time load balancing is available only for services with TCP ports.
Schema	One of: Disabled, Enabled, TCP (case insensitive)
Default	TCP

Environment variable

Attribute	Value
Key	FELIX_BPFCONNECTTIMELOADBALANCING
Description	When in BPF mode, controls whether Felix installs the connect-time load balancer. The connect-time load balancer is required for the host to be able to reach Kubernetes services and it improves the performance of pod-to-service connections.When set to TCP, connect time load balancing is available only for services with TCP ports.
Schema	One of: Disabled, Enabled, TCP (case insensitive)
Default	TCP

BPFConnectTimeLoadBalancingEnabled

Configuration file

Attribute	Value
Key	BPFConnectTimeLoadBalancingEnabled
Description	When in BPF mode, controls whether Felix installs the connection-time load balancer. The connect-time load balancer is required for the host to be able to reach Kubernetes services and it improves the performance of pod-to-service connections. The only reason to disable it is for debugging purposes. Deprecated: Use BPFConnectTimeLoadBalancing.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	none

Environment variable

Attribute	Value
Key	FELIX_BPFCONNECTTIMELOADBALANCINGENABLED
Description	When in BPF mode, controls whether Felix installs the connection-time load balancer. The connect-time load balancer is required for the host to be able to reach Kubernetes services and it improves the performance of pod-to-service connections. The only reason to disable it is for debugging purposes. Deprecated: Use BPFConnectTimeLoadBalancing.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	none

BPFDSROptoutCIDRs

Configuration file

Attribute	Value
Key	BPFDSROptoutCIDRs
Description	A list of CIDRs which are excluded from DSR. That is, clients in those CIDRs will access service node ports as if BPFExternalServiceMode was set to Tunnel.
Schema	Comma-delimited list of CIDRs
Default	none

Environment variable

Attribute	Value
Key	FELIX_BPFDSROPTOUTCIDRS
Description	A list of CIDRs which are excluded from DSR. That is, clients in those CIDRs will access service node ports as if BPFExternalServiceMode was set to Tunnel.
Schema	Comma-delimited list of CIDRs
Default	none

BPFDataIfacePattern

Configuration file

Attribute	Value
Key	BPFDataIfacePattern
Description	A regular expression that controls which interfaces Felix should attach BPF programs to in order to catch traffic to/from the network. This needs to match the interfaces that Calico workload traffic flows over as well as any interfaces that handle incoming traffic to nodeports and services from outside the cluster. It should not match the workload interfaces (usually named cali...).
Schema	Regular expression
Default	^((en|wl|ww|sl|ib)[Popsx].*|(eth|wlan|wwan|bond).*|tunl0$|vxlan.calico$|vxlan-v6.calico$|wireguard.cali$|wg-v6.cali$|egress.calico$)

Environment variable

Attribute	Value
Key	FELIX_BPFDATAIFACEPATTERN
Description	A regular expression that controls which interfaces Felix should attach BPF programs to in order to catch traffic to/from the network. This needs to match the interfaces that Calico workload traffic flows over as well as any interfaces that handle incoming traffic to nodeports and services from outside the cluster. It should not match the workload interfaces (usually named cali...).
Schema	Regular expression
Default	^((en|wl|ww|sl|ib)[Popsx].*|(eth|wlan|wwan|bond).*|tunl0$|vxlan.calico$|vxlan-v6.calico$|wireguard.cali$|wg-v6.cali$|egress.calico$)

BPFDisableGROForIfaces

Configuration file

Attribute	Value
Key	BPFDisableGROForIfaces
Description	A regular expression that controls which interfaces Felix should disable the Generic Receive Offload [GRO] option. It should not match the workload interfaces (usually named cali...).
Schema	Regular expression
Default	none

Environment variable

Attribute	Value
Key	FELIX_BPFDISABLEGROFORIFACES
Description	A regular expression that controls which interfaces Felix should disable the Generic Receive Offload [GRO] option. It should not match the workload interfaces (usually named cali...).
Schema	Regular expression
Default	none

BPFDisableUnprivileged

Configuration file

Attribute	Value
Key	BPFDisableUnprivileged
Description	If enabled, Felix sets the kernel.unprivileged_bpf_disabled sysctl to disable unprivileged use of BPF. This ensures that unprivileged users cannot access Calico's BPF maps and cannot insert their own BPF programs to interfere with Calico's.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

Environment variable

Attribute	Value
Key	FELIX_BPFDISABLEUNPRIVILEGED
Description	If enabled, Felix sets the kernel.unprivileged_bpf_disabled sysctl to disable unprivileged use of BPF. This ensures that unprivileged users cannot access Calico's BPF maps and cannot insert their own BPF programs to interfere with Calico's.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

BPFEnabled

Configuration file

Attribute	Value
Key	BPFEnabled
Description	If enabled Felix will use the BPF dataplane.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_BPFENABLED
Description	If enabled Felix will use the BPF dataplane.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

BPFEnforceRPF

Configuration file

Attribute	Value
Key	BPFEnforceRPF
Description	Enforce strict RPF on all host interfaces with BPF programs regardless of what is the per-interfaces or global setting. Possible values are Disabled, Strict or Loose.
Schema	One of: Disabled, Loose, Strict (case insensitive)
Default	Loose

Environment variable

Attribute	Value
Key	FELIX_BPFENFORCERPF
Description	Enforce strict RPF on all host interfaces with BPF programs regardless of what is the per-interfaces or global setting. Possible values are Disabled, Strict or Loose.
Schema	One of: Disabled, Loose, Strict (case insensitive)
Default	Loose

BPFExcludeCIDRsFromNAT

Configuration file

Attribute	Value
Key	BPFExcludeCIDRsFromNAT
Description	A list of CIDRs that are to be excluded from NAT resolution so that host can handle them. A typical usecase is node local DNS cache.
Schema	Comma-delimited list of CIDRs
Default	none

Environment variable

Attribute	Value
Key	FELIX_BPFEXCLUDECIDRSFROMNAT
Description	A list of CIDRs that are to be excluded from NAT resolution so that host can handle them. A typical usecase is node local DNS cache.
Schema	Comma-delimited list of CIDRs
Default	none

BPFExtToServiceConnmark

Configuration file

Attribute	Value
Key	BPFExtToServiceConnmark
Description	In BPF mode, controls a 32bit mark that is set on connections from an external client to a local service. This mark allows us to control how packets of that connection are routed within the host and how is routing interpreted by RPF check.
Schema	Integer
Default	0

Environment variable

Attribute	Value
Key	FELIX_BPFEXTTOSERVICECONNMARK
Description	In BPF mode, controls a 32bit mark that is set on connections from an external client to a local service. This mark allows us to control how packets of that connection are routed within the host and how is routing interpreted by RPF check.
Schema	Integer
Default	0

BPFExternalServiceMode

Configuration file

Attribute	Value
Key	BPFExternalServiceMode
Description	In BPF mode, controls how connections from outside the cluster to services (node ports and cluster IPs) are forwarded to remote workloads. If set to "Tunnel" then both request and response traffic is tunneled to the remote node. If set to "DSR", the request traffic is tunneled but the response traffic is sent directly from the remote node. In "DSR" mode, the remote node appears to use the IP of the ingress node; this requires a permissive L2 network.
Schema	One of: dsr, tunnel (case insensitive)
Default	tunnel

Environment variable

Attribute	Value
Key	FELIX_BPFEXTERNALSERVICEMODE
Description	In BPF mode, controls how connections from outside the cluster to services (node ports and cluster IPs) are forwarded to remote workloads. If set to "Tunnel" then both request and response traffic is tunneled to the remote node. If set to "DSR", the request traffic is tunneled but the response traffic is sent directly from the remote node. In "DSR" mode, the remote node appears to use the IP of the ingress node; this requires a permissive L2 network.
Schema	One of: dsr, tunnel (case insensitive)
Default	tunnel

BPFForceTrackPacketsFromIfaces

Configuration file

Attribute	Value
Key	BPFForceTrackPacketsFromIfaces
Description	In BPF mode, forces traffic from these interfaces to skip Calico's iptables NOTRACK rule, allowing traffic from those interfaces to be tracked by Linux conntrack. Should only be used for interfaces that are not used for the Calico fabric. For example, a docker bridge device for non-Calico-networked containers.
Schema	Comma-delimited list of strings, each matching the regex ^[a-zA-Z0-9:._+-]{1,15}$
Default	docker+

Environment variable

Attribute	Value
Key	FELIX_BPFFORCETRACKPACKETSFROMIFACES
Description	In BPF mode, forces traffic from these interfaces to skip Calico's iptables NOTRACK rule, allowing traffic from those interfaces to be tracked by Linux conntrack. Should only be used for interfaces that are not used for the Calico fabric. For example, a docker bridge device for non-Calico-networked containers.
Schema	Comma-delimited list of strings, each matching the regex ^[a-zA-Z0-9:._+-]{1,15}$
Default	docker+

BPFHostConntrackBypass

Configuration file

Attribute	Value
Key	BPFHostConntrackBypass
Description	Controls whether to bypass Linux conntrack in BPF mode for workloads and services.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

Environment variable

Attribute	Value
Key	FELIX_BPFHOSTCONNTRACKBYPASS
Description	Controls whether to bypass Linux conntrack in BPF mode for workloads and services.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

BPFHostNetworkedNATWithoutCTLB

Configuration file

Attribute	Value
Key	BPFHostNetworkedNATWithoutCTLB
Description	When in BPF mode, controls whether Felix does a NAT without CTLB. This along with BPFConnectTimeLoadBalancing determines the CTLB behavior.
Schema	One of: Disabled, Enabled (case insensitive)
Default	Enabled

Environment variable

Attribute	Value
Key	FELIX_BPFHOSTNETWORKEDNATWITHOUTCTLB
Description	When in BPF mode, controls whether Felix does a NAT without CTLB. This along with BPFConnectTimeLoadBalancing determines the CTLB behavior.
Schema	One of: Disabled, Enabled (case insensitive)
Default	Enabled

BPFKubeProxyEndpointSlicesEnabled

Configuration file

Attribute	Value
Key	BPFKubeProxyEndpointSlicesEnabled
Description	Deprecated and has no effect. BPF kube-proxy always accepts endpoint slices. This option will be removed in the next release.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

Environment variable

Attribute	Value
Key	FELIX_BPFKUBEPROXYENDPOINTSLICESENABLED
Description	Deprecated and has no effect. BPF kube-proxy always accepts endpoint slices. This option will be removed in the next release.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

BPFKubeProxyIptablesCleanupEnabled

Configuration file

Attribute	Value
Key	BPFKubeProxyIptablesCleanupEnabled
Description	If enabled in BPF mode, Felix will proactively clean up the upstream Kubernetes kube-proxy's iptables chains. Should only be enabled if kube-proxy is not running.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

Environment variable

Attribute	Value
Key	FELIX_BPFKUBEPROXYIPTABLESCLEANUPENABLED
Description	If enabled in BPF mode, Felix will proactively clean up the upstream Kubernetes kube-proxy's iptables chains. Should only be enabled if kube-proxy is not running.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

BPFKubeProxyMinSyncPeriod

Configuration file

Attribute	Value
Key	BPFKubeProxyMinSyncPeriod
Description	In BPF mode, controls the minimum time between updates to the dataplane for Felix's embedded kube-proxy. Lower values give reduced set-up latency. Higher values reduce Felix CPU usage by batching up more work.
Schema	Seconds (floating point)
Default	1 (1s)

Environment variable

Attribute	Value
Key	FELIX_BPFKUBEPROXYMINSYNCPERIOD
Description	In BPF mode, controls the minimum time between updates to the dataplane for Felix's embedded kube-proxy. Lower values give reduced set-up latency. Higher values reduce Felix CPU usage by batching up more work.
Schema	Seconds (floating point)
Default	1 (1s)

BPFL3IfacePattern

Configuration file

Attribute	Value
Key	BPFL3IfacePattern
Description	A regular expression that allows to list tunnel devices like wireguard or vxlan (i.e., L3 devices) in addition to BPFDataIfacePattern. That is, tunnel interfaces not created by Calico, that Calico workload traffic flows over as well as any interfaces that handle incoming traffic to nodeports and services from outside the cluster.
Schema	Regular expression
Default	none

Environment variable

Attribute	Value
Key	FELIX_BPFL3IFACEPATTERN
Description	A regular expression that allows to list tunnel devices like wireguard or vxlan (i.e., L3 devices) in addition to BPFDataIfacePattern. That is, tunnel interfaces not created by Calico, that Calico workload traffic flows over as well as any interfaces that handle incoming traffic to nodeports and services from outside the cluster.
Schema	Regular expression
Default	none

BPFLogFilters

Configuration file

Attribute	Value
Key	BPFLogFilters
Description	A map of key=values where the value is a pcap filter expression and the key is an interface name with 'all' denoting all interfaces, 'weps' all workload endpoints and 'heps' all host endpoints. When specified as an env var, it accepts a comma-separated list of key=values.
Schema	Comma-delimited list of key=value pairs
Default	none

Environment variable

Attribute	Value
Key	FELIX_BPFLOGFILTERS
Description	A map of key=values where the value is a pcap filter expression and the key is an interface name with 'all' denoting all interfaces, 'weps' all workload endpoints and 'heps' all host endpoints. When specified as an env var, it accepts a comma-separated list of key=values.
Schema	Comma-delimited list of key=value pairs
Default	none

BPFLogLevel

Configuration file

Attribute	Value
Key	BPFLogLevel
Description	Controls the log level of the BPF programs when in BPF dataplane mode. One of "Off", "Info", or "Debug". The logs are emitted to the BPF trace pipe, accessible with the command tc exec bpf debug. .
Schema	One of: debug, info, off (case insensitive)
Default	off

Environment variable

Attribute	Value
Key	FELIX_BPFLOGLEVEL
Description	Controls the log level of the BPF programs when in BPF dataplane mode. One of "Off", "Info", or "Debug". The logs are emitted to the BPF trace pipe, accessible with the command tc exec bpf debug. .
Schema	One of: debug, info, off (case insensitive)
Default	off

BPFMapSizeConntrack

Configuration file

Attribute	Value
Key	BPFMapSizeConntrack
Description	Sets the size for the conntrack map. This map must be large enough to hold an entry for each active connection. Warning: changing the size of the conntrack map can cause disruption.
Schema	Integer
Default	512000

Environment variable

Attribute	Value
Key	FELIX_BPFMAPSIZECONNTRACK
Description	Sets the size for the conntrack map. This map must be large enough to hold an entry for each active connection. Warning: changing the size of the conntrack map can cause disruption.
Schema	Integer
Default	512000

BPFMapSizeIPSets

Configuration file

Attribute	Value
Key	BPFMapSizeIPSets
Description	Sets the size for ipsets map. The IP sets map must be large enough to hold an entry for each endpoint matched by every selector in the source/destination matches in network policy. Selectors such as "all()" can result in large numbers of entries (one entry per endpoint in that case).
Schema	Integer
Default	1048576

Environment variable

Attribute	Value
Key	FELIX_BPFMAPSIZEIPSETS
Description	Sets the size for ipsets map. The IP sets map must be large enough to hold an entry for each endpoint matched by every selector in the source/destination matches in network policy. Selectors such as "all()" can result in large numbers of entries (one entry per endpoint in that case).
Schema	Integer
Default	1048576

BPFMapSizeIfState

Configuration file

Attribute	Value
Key	BPFMapSizeIfState
Description	Sets the size for ifstate map. The ifstate map must be large enough to hold an entry for each device (host + workloads) on a host.
Schema	Integer
Default	1000

Environment variable

Attribute	Value
Key	FELIX_BPFMAPSIZEIFSTATE
Description	Sets the size for ifstate map. The ifstate map must be large enough to hold an entry for each device (host + workloads) on a host.
Schema	Integer
Default	1000

BPFMapSizeNATAffinity

Configuration file

Attribute	Value
Key	BPFMapSizeNATAffinity
Description	Sets the size of the BPF map that stores the affinity of a connection (for services that enable that feature.
Schema	Integer
Default	65536

Environment variable

Attribute	Value
Key	FELIX_BPFMAPSIZENATAFFINITY
Description	Sets the size of the BPF map that stores the affinity of a connection (for services that enable that feature.
Schema	Integer
Default	65536

BPFMapSizeNATBackend

Configuration file

Attribute	Value
Key	BPFMapSizeNATBackend
Description	Sets the size for NAT back end map. This is the total number of endpoints. This is mostly more than the size of the number of services.
Schema	Integer
Default	262144

Environment variable

Attribute	Value
Key	FELIX_BPFMAPSIZENATBACKEND
Description	Sets the size for NAT back end map. This is the total number of endpoints. This is mostly more than the size of the number of services.
Schema	Integer
Default	262144

BPFMapSizeNATFrontend

Configuration file

Attribute	Value
Key	BPFMapSizeNATFrontend
Description	Sets the size for NAT front end map. FrontendMap should be large enough to hold an entry for each nodeport, external IP and each port in each service.
Schema	Integer
Default	65536

Environment variable

Attribute	Value
Key	FELIX_BPFMAPSIZENATFRONTEND
Description	Sets the size for NAT front end map. FrontendMap should be large enough to hold an entry for each nodeport, external IP and each port in each service.
Schema	Integer
Default	65536

BPFMapSizeRoute

Configuration file

Attribute	Value
Key	BPFMapSizeRoute
Description	Sets the size for the routes map. The routes map should be large enough to hold one entry per workload and a handful of entries per host (enough to cover its own IPs and tunnel IPs).
Schema	Integer
Default	262144

Environment variable

Attribute	Value
Key	FELIX_BPFMAPSIZEROUTE
Description	Sets the size for the routes map. The routes map should be large enough to hold one entry per workload and a handful of entries per host (enough to cover its own IPs and tunnel IPs).
Schema	Integer
Default	262144

BPFPSNATPorts

Configuration file

Attribute	Value
Key	BPFPSNATPorts
Description	Sets the range from which we randomly pick a port if there is a source port collision. This should be within the ephemeral range as defined by RFC 6056 (1024–65535) and preferably outside the ephemeral ranges used by common operating systems. Linux uses 32768–60999, while others mostly use the IANA defined range 49152–65535. It is not necessarily a problem if this range overlaps with the operating systems. Both ends of the range are inclusive.
Schema	Port range: either a single number in [0,65535] or a range of numbers n:m
Default	20000:29999

Environment variable

Attribute	Value
Key	FELIX_BPFPSNATPORTS
Description	Sets the range from which we randomly pick a port if there is a source port collision. This should be within the ephemeral range as defined by RFC 6056 (1024–65535) and preferably outside the ephemeral ranges used by common operating systems. Linux uses 32768–60999, while others mostly use the IANA defined range 49152–65535. It is not necessarily a problem if this range overlaps with the operating systems. Both ends of the range are inclusive.
Schema	Port range: either a single number in [0,65535] or a range of numbers n:m
Default	20000:29999

BPFPolicyDebugEnabled

Configuration file

Attribute	Value
Key	BPFPolicyDebugEnabled
Description	When true, Felix records detailed information about the BPF policy programs, which can be examined with the calico-bpf command-line tool.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

Environment variable

Attribute	Value
Key	FELIX_BPFPOLICYDEBUGENABLED
Description	When true, Felix records detailed information about the BPF policy programs, which can be examined with the calico-bpf command-line tool.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

BPFRedirectToPeer

Configuration file

Attribute	Value
Key	BPFRedirectToPeer
Description	Controls which whether it is allowed to forward straight to the peer side of the workload devices. It is allowed for any host L2 devices by default (L2Only), but it breaks TCP dump on the host side of workload device as it bypasses it on ingress. Value of Enabled also allows redirection from L3 host devices like IPIP tunnel or Wireguard directly to the peer side of the workload's device. This makes redirection faster, however, it breaks tools like tcpdump on the peer side. Use Enabled with caution.
Schema	One of: Disabled, Enabled, L2Only (case insensitive)
Default	L2Only

Environment variable

Attribute	Value
Key	FELIX_BPFREDIRECTTOPEER
Description	Controls which whether it is allowed to forward straight to the peer side of the workload devices. It is allowed for any host L2 devices by default (L2Only), but it breaks TCP dump on the host side of workload device as it bypasses it on ingress. Value of Enabled also allows redirection from L3 host devices like IPIP tunnel or Wireguard directly to the peer side of the workload's device. This makes redirection faster, however, it breaks tools like tcpdump on the peer side. Use Enabled with caution.
Schema	One of: Disabled, Enabled, L2Only (case insensitive)
Default	L2Only

Dataplane: Windows

WindowsManageFirewallRules

Configuration file

Attribute	Value
Key	WindowsManageFirewallRules
Description	Configures whether or not Felix will program Windows Firewall rules (to allow inbound access to its own metrics ports).
Schema	One of: Disabled, Enabled (case insensitive)
Default	Disabled

Environment variable

Attribute	Value
Key	FELIX_WINDOWSMANAGEFIREWALLRULES
Description	Configures whether or not Felix will program Windows Firewall rules (to allow inbound access to its own metrics ports).
Schema	One of: Disabled, Enabled (case insensitive)
Default	Disabled

Dataplane: OpenStack support

EndpointReportingDelaySecs

Configuration file

Attribute	Value
Key	EndpointReportingDelaySecs
Description	The delay before Felix reports endpoint status to the datastore. This is only used by the OpenStack integration.
Schema	Seconds (floating point)
Default	1 (1s)

Environment variable

Attribute	Value
Key	FELIX_ENDPOINTREPORTINGDELAYSECS
Description	The delay before Felix reports endpoint status to the datastore. This is only used by the OpenStack integration.
Schema	Seconds (floating point)
Default	1 (1s)

EndpointReportingEnabled

Configuration file

Attribute	Value
Key	EndpointReportingEnabled
Description	Controls whether Felix reports endpoint status to the datastore. This is only used by the OpenStack integration.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_ENDPOINTREPORTINGENABLED
Description	Controls whether Felix reports endpoint status to the datastore. This is only used by the OpenStack integration.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

MetadataAddr

Configuration file

Attribute	Value
Key	MetadataAddr
Description	The IP address or domain name of the server that can answer VM queries for cloud-init metadata. In OpenStack, this corresponds to the machine running nova-api (or in Ubuntu, nova-api-metadata). A value of none (case-insensitive) means that Felix should not set up any NAT rule for the metadata path.
Schema	String matching regex ^[a-zA-Z0-9_.-]+$
Default	127.0.0.1

Environment variable

Attribute	Value
Key	FELIX_METADATAADDR
Description	The IP address or domain name of the server that can answer VM queries for cloud-init metadata. In OpenStack, this corresponds to the machine running nova-api (or in Ubuntu, nova-api-metadata). A value of none (case-insensitive) means that Felix should not set up any NAT rule for the metadata path.
Schema	String matching regex ^[a-zA-Z0-9_.-]+$
Default	127.0.0.1

MetadataPort

Configuration file

Attribute	Value
Key	MetadataPort
Description	The port of the metadata server. This, combined with global.MetadataAddr (if not 'None'), is used to set up a NAT rule, from 169.254.169.254:80 to MetadataAddr:MetadataPort. In most cases this should not need to be changed .
Schema	Integer: [0,65535]
Default	8775

Environment variable

Attribute	Value
Key	FELIX_METADATAPORT
Description	The port of the metadata server. This, combined with global.MetadataAddr (if not 'None'), is used to set up a NAT rule, from 169.254.169.254:80 to MetadataAddr:MetadataPort. In most cases this should not need to be changed .
Schema	Integer: [0,65535]
Default	8775

OpenstackRegion

Configuration file

Attribute	Value
Key	OpenstackRegion
Description	The name of the region that a particular Felix belongs to. In a multi-region Calico/OpenStack deployment, this must be configured somehow for each Felix (here in the datamodel, or in felix.cfg or the environment on each compute node), and must match the [calico] openstack_region value configured in neutron.conf on each node.
Schema	OpenStack region name (must be a valid DNS label)
Default	none

Environment variable

Attribute	Value
Key	FELIX_OPENSTACKREGION
Description	The name of the region that a particular Felix belongs to. In a multi-region Calico/OpenStack deployment, this must be configured somehow for each Felix (here in the datamodel, or in felix.cfg or the environment on each compute node), and must match the [calico] openstack_region value configured in neutron.conf on each node.
Schema	OpenStack region name (must be a valid DNS label)
Default	none

ReportingIntervalSecs

Configuration file

Attribute	Value
Key	ReportingIntervalSecs
Description	The interval at which Felix reports its status into the datastore or 0 to disable. Must be non-zero in OpenStack deployments.
Schema	Seconds (floating point)
Default	30 (30s)

Environment variable

Attribute	Value
Key	FELIX_REPORTINGINTERVALSECS
Description	The interval at which Felix reports its status into the datastore or 0 to disable. Must be non-zero in OpenStack deployments.
Schema	Seconds (floating point)
Default	30 (30s)

ReportingTTLSecs

Configuration file

Attribute	Value
Key	ReportingTTLSecs
Description	The time-to-live setting for process-wide status reports.
Schema	Seconds (floating point)
Default	90 (1m30s)

Environment variable

Attribute	Value
Key	FELIX_REPORTINGTTLSECS
Description	The time-to-live setting for process-wide status reports.
Schema	Seconds (floating point)
Default	90 (1m30s)

Dataplane: XDP acceleration for iptables dataplane

GenericXDPEnabled

Configuration file

Attribute	Value
Key	GenericXDPEnabled
Description	Enables Generic XDP so network cards that don't support XDP offload or driver modes can use XDP. This is not recommended since it doesn't provide better performance than iptables.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_GENERICXDPENABLED
Description	Enables Generic XDP so network cards that don't support XDP offload or driver modes can use XDP. This is not recommended since it doesn't provide better performance than iptables.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

XDPEnabled

Configuration file

Attribute	Value
Key	XDPEnabled
Description	Enables XDP acceleration for suitable untracked incoming deny rules.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

Environment variable

Attribute	Value
Key	FELIX_XDPENABLED
Description	Enables XDP acceleration for suitable untracked incoming deny rules.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

XDPRefreshInterval

Configuration file

Attribute	Value
Key	XDPRefreshInterval
Description	The period at which Felix re-checks all XDP state to ensure that no other process has accidentally broken Calico's BPF maps or attached programs. Set to 0 to disable XDP refresh.
Schema	Seconds (floating point)
Default	90 (1m30s)

Environment variable

Attribute	Value
Key	FELIX_XDPREFRESHINTERVAL
Description	The period at which Felix re-checks all XDP state to ensure that no other process has accidentally broken Calico's BPF maps or attached programs. Set to 0 to disable XDP refresh.
Schema	Seconds (floating point)
Default	90 (1m30s)

Overlay: VXLAN overlay

VXLANEnabled

Configuration file

Attribute	Value
Key	VXLANEnabled
Description	Overrides whether Felix should create the VXLAN tunnel device for IPv4 VXLAN networking. Optional as Felix determines this based on the existing IP pools.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	none

Environment variable

Attribute	Value
Key	FELIX_VXLANENABLED
Description	Overrides whether Felix should create the VXLAN tunnel device for IPv4 VXLAN networking. Optional as Felix determines this based on the existing IP pools.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	none

VXLANMTU

Configuration file

Attribute	Value
Key	VXLANMTU
Description	The MTU to set on the IPv4 VXLAN tunnel device. Optional as Felix auto-detects the MTU based on the MTU of the host's interfaces.
Schema	Integer
Default	0

Environment variable

Attribute	Value
Key	FELIX_VXLANMTU
Description	The MTU to set on the IPv4 VXLAN tunnel device. Optional as Felix auto-detects the MTU based on the MTU of the host's interfaces.
Schema	Integer
Default	0

VXLANMTUV6

Configuration file

Attribute	Value
Key	VXLANMTUV6
Description	The MTU to set on the IPv6 VXLAN tunnel device. Optional as Felix auto-detects the MTU based on the MTU of the host's interfaces.
Schema	Integer
Default	0

Environment variable

Attribute	Value
Key	FELIX_VXLANMTUV6
Description	The MTU to set on the IPv6 VXLAN tunnel device. Optional as Felix auto-detects the MTU based on the MTU of the host's interfaces.
Schema	Integer
Default	0

VXLANPort

Configuration file

Attribute	Value
Key	VXLANPort
Description	The UDP port number to use for VXLAN traffic.
Schema	Integer
Default	4789

Environment variable

Attribute	Value
Key	FELIX_VXLANPORT
Description	The UDP port number to use for VXLAN traffic.
Schema	Integer
Default	4789

VXLANVNI

Configuration file

Attribute	Value
Key	VXLANVNI
Description	The VXLAN VNI to use for VXLAN traffic. You may need to change this if the default value is in use on your system.
Schema	Integer
Default	4096

Environment variable

Attribute	Value
Key	FELIX_VXLANVNI
Description	The VXLAN VNI to use for VXLAN traffic. You may need to change this if the default value is in use on your system.
Schema	Integer
Default	4096

Overlay: IP-in-IP

IpInIpEnabled

Configuration file

Attribute	Value
Key	IpInIpEnabled
Description	Overrides whether Felix should configure an IPIP interface on the host. Optional as Felix determines this based on the existing IP pools.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	none

Environment variable

Attribute	Value
Key	FELIX_IPINIPENABLED
Description	Overrides whether Felix should configure an IPIP interface on the host. Optional as Felix determines this based on the existing IP pools.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	none

IpInIpMtu

Configuration file

Attribute	Value
Key	IpInIpMtu
Description	Controls the MTU to set on the IPIP tunnel device. Optional as Felix auto-detects the MTU based on the MTU of the host's interfaces.
Schema	Integer
Default	0

Environment variable

Attribute	Value
Key	FELIX_IPINIPMTU
Description	Controls the MTU to set on the IPIP tunnel device. Optional as Felix auto-detects the MTU based on the MTU of the host's interfaces.
Schema	Integer
Default	0

Overlay: Wireguard

WireguardEnabled

Configuration file

Attribute	Value
Key	WireguardEnabled
Description	Controls whether Wireguard is enabled for IPv4 (encapsulating IPv4 traffic over an IPv4 underlay network).
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_WIREGUARDENABLED
Description	Controls whether Wireguard is enabled for IPv4 (encapsulating IPv4 traffic over an IPv4 underlay network).
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

WireguardEnabledV6

Configuration file

Attribute	Value
Key	WireguardEnabledV6
Description	Controls whether Wireguard is enabled for IPv6 (encapsulating IPv6 traffic over an IPv6 underlay network).
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_WIREGUARDENABLEDV6
Description	Controls whether Wireguard is enabled for IPv6 (encapsulating IPv6 traffic over an IPv6 underlay network).
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

WireguardHostEncryptionEnabled

Configuration file

Attribute	Value
Key	WireguardHostEncryptionEnabled
Description	Controls whether Wireguard host-to-host encryption is enabled.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_WIREGUARDHOSTENCRYPTIONENABLED
Description	Controls whether Wireguard host-to-host encryption is enabled.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

WireguardInterfaceName

Configuration file

Attribute	Value
Key	WireguardInterfaceName
Description	Specifies the name to use for the IPv4 Wireguard interface.
Schema	String matching regex ^[a-zA-Z0-9:._+-]{1,15}$
Default	wireguard.cali

Environment variable

Attribute	Value
Key	FELIX_WIREGUARDINTERFACENAME
Description	Specifies the name to use for the IPv4 Wireguard interface.
Schema	String matching regex ^[a-zA-Z0-9:._+-]{1,15}$
Default	wireguard.cali

WireguardInterfaceNameV6

Configuration file

Attribute	Value
Key	WireguardInterfaceNameV6
Description	Specifies the name to use for the IPv6 Wireguard interface.
Schema	String matching regex ^[a-zA-Z0-9:._+-]{1,15}$
Default	wg-v6.cali

Environment variable

Attribute	Value
Key	FELIX_WIREGUARDINTERFACENAMEV6
Description	Specifies the name to use for the IPv6 Wireguard interface.
Schema	String matching regex ^[a-zA-Z0-9:._+-]{1,15}$
Default	wg-v6.cali

WireguardListeningPort

Configuration file

Attribute	Value
Key	WireguardListeningPort
Description	Controls the listening port used by IPv4 Wireguard.
Schema	Integer
Default	51820

Environment variable

Attribute	Value
Key	FELIX_WIREGUARDLISTENINGPORT
Description	Controls the listening port used by IPv4 Wireguard.
Schema	Integer
Default	51820

WireguardListeningPortV6

Configuration file

Attribute	Value
Key	WireguardListeningPortV6
Description	Controls the listening port used by IPv6 Wireguard.
Schema	Integer
Default	51821

Environment variable

Attribute	Value
Key	FELIX_WIREGUARDLISTENINGPORTV6
Description	Controls the listening port used by IPv6 Wireguard.
Schema	Integer
Default	51821

WireguardMTU

Configuration file

Attribute	Value
Key	WireguardMTU
Description	Controls the MTU on the IPv4 Wireguard interface. See Configuring MTU.
Schema	Integer
Default	0

Environment variable

Attribute	Value
Key	FELIX_WIREGUARDMTU
Description	Controls the MTU on the IPv4 Wireguard interface. See Configuring MTU.
Schema	Integer
Default	0

WireguardMTUV6

Configuration file

Attribute	Value
Key	WireguardMTUV6
Description	Controls the MTU on the IPv6 Wireguard interface. See Configuring MTU.
Schema	Integer
Default	0

Environment variable

Attribute	Value
Key	FELIX_WIREGUARDMTUV6
Description	Controls the MTU on the IPv6 Wireguard interface. See Configuring MTU.
Schema	Integer
Default	0

WireguardPersistentKeepAlive

Configuration file

Attribute	Value
Key	WireguardPersistentKeepAlive
Description	Controls Wireguard PersistentKeepalive option. Set 0 to disable.
Schema	Seconds (floating point)
Default	0 (0s)

Environment variable

Attribute	Value
Key	FELIX_WIREGUARDPERSISTENTKEEPALIVE
Description	Controls Wireguard PersistentKeepalive option. Set 0 to disable.
Schema	Seconds (floating point)
Default	0 (0s)

WireguardRoutingRulePriority

Configuration file

Attribute	Value
Key	WireguardRoutingRulePriority
Description	Controls the priority value to use for the Wireguard routing rule.
Schema	Integer
Default	99

Environment variable

Attribute	Value
Key	FELIX_WIREGUARDROUTINGRULEPRIORITY
Description	Controls the priority value to use for the Wireguard routing rule.
Schema	Integer
Default	99

AWS integration

AWSSrcDstCheck

Configuration file

Attribute	Value
Key	AWSSrcDstCheck
Description	Controls whether Felix will try to change the "source/dest check" setting on the EC2 instance on which it is running. A value of "Disable" will try to disable the source/dest check. Disabling the check allows for sending workload traffic without encapsulation within the same AWS subnet.
Schema	One of: Disable, DoNothing, Enable (case insensitive)
Default	DoNothing

Environment variable

Attribute	Value
Key	FELIX_AWSSRCDSTCHECK
Description	Controls whether Felix will try to change the "source/dest check" setting on the EC2 instance on which it is running. A value of "Disable" will try to disable the source/dest check. Disabling the check allows for sending workload traffic without encapsulation within the same AWS subnet.
Schema	One of: Disable, DoNothing, Enable (case insensitive)
Default	DoNothing

Debug/test-only (generally unsupported)

DebugBPFCgroupV2

Configuration file

Attribute	Value
Key	DebugBPFCgroupV2
Description	Controls the cgroup v2 path that we apply the connect-time load balancer to. Most distros are configured for cgroup v1, which prevents all but the root cgroup v2 from working so this is only useful for development right now.
Schema	String
Default	none

Environment variable

Attribute	Value
Key	FELIX_DEBUGBPFCGROUPV2
Description	Controls the cgroup v2 path that we apply the connect-time load balancer to. Most distros are configured for cgroup v1, which prevents all but the root cgroup v2 from working so this is only useful for development right now.
Schema	String
Default	none

DebugBPFMapRepinEnabled

Configuration file

Attribute	Value
Key	DebugBPFMapRepinEnabled
Description	Can be used to prevent Felix from repinning its BPF maps at startup. This is useful for testing with multiple Felix instances running on one host.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_DEBUGBPFMAPREPINENABLED
Description	Can be used to prevent Felix from repinning its BPF maps at startup. This is useful for testing with multiple Felix instances running on one host.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

DebugCPUProfilePath

Configuration file

Attribute	Value
Key	DebugCPUProfilePath
Description	Unsupported diagnostic setting, used when testing Felix. Not exposed in FelixConfiguration.
Schema	Path to file
Default	/tmp/felix-cpu-<timestamp>.pprof

Environment variable

Attribute	Value
Key	FELIX_DEBUGCPUPROFILEPATH
Description	Unsupported diagnostic setting, used when testing Felix. Not exposed in FelixConfiguration.
Schema	Path to file
Default	/tmp/felix-cpu-<timestamp>.pprof

DebugDisableLogDropping

Configuration file

Attribute	Value
Key	DebugDisableLogDropping
Description	Disables the dropping of log messages when the log buffer is full. This can significantly impact performance if log write-out is a bottleneck.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_DEBUGDISABLELOGDROPPING
Description	Disables the dropping of log messages when the log buffer is full. This can significantly impact performance if log write-out is a bottleneck.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

DebugHost

Configuration file

Attribute	Value
Key	DebugHost
Description	The host IP or hostname to bind the debug port to. Only used if DebugPort is set.
Schema	String matching regex ^[a-zA-Z0-9:._+-]{1,64}$
Default	localhost

Environment variable

Attribute	Value
Key	FELIX_DEBUGHOST
Description	The host IP or hostname to bind the debug port to. Only used if DebugPort is set.
Schema	String matching regex ^[a-zA-Z0-9:._+-]{1,64}$
Default	localhost

DebugMemoryProfilePath

Configuration file

Attribute	Value
Key	DebugMemoryProfilePath
Description	The path to write the memory profile to when triggered by signal.
Schema	Path to file
Default	none

Environment variable

Attribute	Value
Key	FELIX_DEBUGMEMORYPROFILEPATH
Description	The path to write the memory profile to when triggered by signal.
Schema	Path to file
Default	none

DebugPanicAfter

Configuration file

Attribute	Value
Key	DebugPanicAfter
Description	Unsupported diagnostic setting, used when testing Felix. Not exposed in FelixConfiguration.
Schema	Seconds (floating point)
Default	0

Environment variable

Attribute	Value
Key	FELIX_DEBUGPANICAFTER
Description	Unsupported diagnostic setting, used when testing Felix. Not exposed in FelixConfiguration.
Schema	Seconds (floating point)
Default	0

DebugPort

Configuration file

Attribute	Value
Key	DebugPort
Description	If set, enables Felix's debug HTTP port, which allows memory and CPU profiles to be retrieved. The debug port is not secure, it should not be exposed to the internet.
Schema	Integer: [0,65535]
Default	none

Environment variable

Attribute	Value
Key	FELIX_DEBUGPORT
Description	If set, enables Felix's debug HTTP port, which allows memory and CPU profiles to be retrieved. The debug port is not secure, it should not be exposed to the internet.
Schema	Integer: [0,65535]
Default	none

DebugSimulateCalcGraphHangAfter

Configuration file

Attribute	Value
Key	DebugSimulateCalcGraphHangAfter
Description	Used to simulate a hang in the calculation graph after the specified duration. This is useful in tests of the watchdog system only!
Schema	Seconds (floating point)
Default	0 (0s)

Environment variable

Attribute	Value
Key	FELIX_DEBUGSIMULATECALCGRAPHHANGAFTER
Description	Used to simulate a hang in the calculation graph after the specified duration. This is useful in tests of the watchdog system only!
Schema	Seconds (floating point)
Default	0 (0s)

DebugSimulateDataRace

Configuration file

Attribute	Value
Key	DebugSimulateDataRace
Description	Unsupported diagnostic setting, used when testing Felix. Not exposed in FelixConfiguration.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_DEBUGSIMULATEDATARACE
Description	Unsupported diagnostic setting, used when testing Felix. Not exposed in FelixConfiguration.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

DebugSimulateDataplaneApplyDelay

Configuration file

Attribute	Value
Key	DebugSimulateDataplaneApplyDelay
Description	Adds an artificial delay to every dataplane operation. This is useful for simulating a heavily loaded system for test purposes only.
Schema	Seconds (floating point)
Default	0 (0s)

Environment variable

Attribute	Value
Key	FELIX_DEBUGSIMULATEDATAPLANEAPPLYDELAY
Description	Adds an artificial delay to every dataplane operation. This is useful for simulating a heavily loaded system for test purposes only.
Schema	Seconds (floating point)
Default	0 (0s)

DebugSimulateDataplaneHangAfter

Configuration file

Attribute	Value
Key	DebugSimulateDataplaneHangAfter
Description	Used to simulate a hang in the dataplane after the specified duration. This is useful in tests of the watchdog system only!
Schema	Seconds (floating point)
Default	0 (0s)

Environment variable

Attribute	Value
Key	FELIX_DEBUGSIMULATEDATAPLANEHANGAFTER
Description	Used to simulate a hang in the dataplane after the specified duration. This is useful in tests of the watchdog system only!
Schema	Seconds (floating point)
Default	0 (0s)

Usage reporting

UsageReportingEnabled

Configuration file

Attribute	Value
Key	UsageReportingEnabled
Description	Reports anonymous Calico version number and cluster size to projectcalico.org. Logs warnings returned by the usage server. For example, if a significant security vulnerability has been discovered in the version of Calico being used.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

Environment variable

Attribute	Value
Key	FELIX_USAGEREPORTINGENABLED
Description	Reports anonymous Calico version number and cluster size to projectcalico.org. Logs warnings returned by the usage server. For example, if a significant security vulnerability has been discovered in the version of Calico being used.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

UsageReportingInitialDelaySecs

Configuration file

Attribute	Value
Key	UsageReportingInitialDelaySecs
Description	Controls the minimum delay before Felix makes a report.
Schema	Seconds (floating point)
Default	300 (5m0s)

Environment variable

Attribute	Value
Key	FELIX_USAGEREPORTINGINITIALDELAYSECS
Description	Controls the minimum delay before Felix makes a report.
Schema	Seconds (floating point)
Default	300 (5m0s)

UsageReportingIntervalSecs

Configuration file

Attribute	Value
Key	UsageReportingIntervalSecs
Description	Controls the interval at which Felix makes reports.
Schema	Seconds (floating point)
Default	86400 (24h0m0s)

Environment variable

Attribute	Value
Key	FELIX_USAGEREPORTINGINTERVALSECS
Description	Controls the interval at which Felix makes reports.
Schema	Seconds (floating point)
Default	86400 (24h0m0s)

Environment variables

The highest priority of configuration is that read from environment variables. To set a configuration parameter via an environment variable, set the environment variable formed by taking FELIX_ and appending the uppercase form of the variable name. For example, to set the etcd address, set the environment variable FELIX_ETCDADDR. Other examples include FELIX_ETCDSCHEME, FELIX_ETCDKEYFILE, FELIX_ETCDCERTFILE, FELIX_ETCDCAFILE, FELIX_FELIXHOSTNAME, FELIX_LOGFILEPATH and FELIX_METADATAADDR.

Configuration file

On startup, Felix reads an ini-style configuration file. The path to this file defaults to /etc/calico/felix.cfg but can be overridden using the -c or --config-file options on the command line. If the file exists, then it is read (ignoring section names) and all parameters are set from it.

In OpenStack, we recommend putting all configuration into configuration files, since the etcd database is transient (and may be recreated by the OpenStack plugin in certain error cases). However, in a Docker environment the use of environment variables or etcd is often more convenient.

Datastore

Felix also reads configuration parameters from the datastore. It supports a global setting and a per-host override.

1. Get the current felixconfig settings.

   calicoctl get felixconfig default -o yaml --export > felix.yaml

2. Modify logFilePath to your intended path, e.g. "/tmp/felix.log"

   vim felix.yaml
   tip

   For a global change set name to "default". For a node-specific change: set name to node.<nodename>, e.g. "node.Calico-node-1"

3. Replace the current felixconfig settings

   calicoctl replace -f felix.yaml

For more information, see Felix Configuration Resource.