1"use strict";(self.webpackChunktigera_docs=self.webpackChunktigera_docs||[]).push([["3379"],{3805:function(e,n,i){i.r(n),i.d(n,{default:()=>u,frontMatter:()=>a,metadata:()=>s,assets:()=>d,toc:()=>h,contentTitle:()=>c});var s=JSON.parse('{"id":"reference/component-resources/configuration","title":"Configuring the Calico Enterprise CNI plugins","description":"Details for configuring the Calico Enterprise CNI plugins.","source":"@site/calico-enterprise_versioned_docs/version-3.17/reference/component-resources/configuration.mdx","sourceDirName":"reference/component-resources","slug":"/reference/component-resources/configuration","permalink":"/calico-enterprise/3.17/reference/component-resources/configuration","draft":false,"unlisted":false,"editUrl":"https://github.com/tigera/docs/edit/main/calico-enterprise_versioned_docs/version-3.17/reference/component-resources/configuration.mdx","tags":[],"version":"3.17","frontMatter":{"description":"Details for configuring the Calico Enterprise CNI plugins."},"sidebar":"calicoEnterpriseSidebar","previous":{"title":"Component resources","permalink":"/calico-enterprise/3.17/reference/component-resources/"},"next":{"title":"kube-controllers","permalink":"/calico-enterprise/3.17/reference/component-resources/kube-controllers/"}}'),o=i("85893"),r=i("50065"),t=i("58168"),l=i("97645");let a={description:"Details for configuring the Calico Enterprise CNI plugins."},c="Configuring the Calico Enterprise CNI plugins",d={},h=[{value:"Generic",id:"generic",level:2},{value:"Datastore type",id:"datastore-type",level:3},{value:"Logging",id:"logging",level:3},{value:"IPAM",id:"ipam",level:3},{value:"Container settings",id:"container-settings",level:3},{value:"Readiness Gates",id:"readiness-gates",level:3},{value:"Kubernetes specific",id:"kubernetes-specific",level:2},{value:"Enabling Kubernetes policy",id:"enabling-kubernetes-policy",level:3},{value:"IPAM",id:"ipam-1",level:2},{value:"Using host-local IPAM",id:"using-host-local-ipam",level:3},{value:"Configuring node and typha",id:"configuring-node-and-typha",level:4},{value:"Using Kubernetes annotations",id:"using-kubernetes-annotations",level:3},{value:"Specifying IP pools on a per-namespace or per-pod basis",id:"specifying-ip-pools-on-a-per-namespace-or-per-pod-basis",level:4},{value:"Requesting a specific IP address",id:"requesting-a-specific-ip-address",level:4},{value:"Requesting a floating IP",id:"requesting-a-floating-ip",level:4},{value:"Using IP pools node selectors",id:"using-ip-pools-node-selectors",level:3},{value:"CNI network configuration lists",id:"cni-network-configuration-lists",level:3},{value:"Order of precedence",id:"order-of-precedence",level:3},{value:"Specify num_queues for veth interfaces",id:"specify-num_queues-for-veth-interfaces",level:3}];function p(e){let n={a:"a",admonition:"admonition",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",h4:"h4",header:"header",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,r.a)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(n.header,{children:(0,o.jsx)(n.h1,{id:"configuring-the-calico-enterprise-cni-plugins",children:"Configuring the Calico Enterprise CNI plugins"})}),"\n","\n",(0,o.jsxs)(t.Z,{children:[(0,o.jsx)(l.Z,{label:"Operator",value:"Operator-0",children:(0,o.jsxs)(n.p,{children:["The Calico Enterprise CNI plugins do not need to be configured directly when installed by the operator. For a complete operator\nconfiguration reference, see ",(0,o.jsx)(n.a,{href:"/calico-enterprise/3.17/reference/installation/api",children:"the installation API reference documentation"}),"."]})}),(0,o.jsxs)(l.Z,{label:"Manifest",value:"Manifest-1",children:[(0,o.jsxs)(n.p,{children:["The Calico Enterprise CNI plugin is configured through the standard CNI\n",(0,o.jsx)(n.a,{href:"https://github.com/containernetworking/cni/blob/master/SPEC.md#network-configuration",children:"configuration mechanism"})]}),(0,o.jsx)(n.p,{children:"A minimal configuration file that uses Calico Enterprise for networking\nand IPAM looks like this"}),(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-json",children:'{\n "name": "any_name",\n "cniVersion": "0.1.0",\n "type": "calico",\n "ipam": {\n "type": "calico-ipam"\n }\n}\n'})}),(0,o.jsxs)(n.p,{children:["If the ",(0,o.jsx)(n.code,{children:"cnx-node"})," container on a node registered with a ",(0,o.jsx)(n.code,{children:"NODENAME"})," other than the node hostname, the CNI plugin on this node must be configured with the same ",(0,o.jsx)(n.code,{children:"nodename"}),":"]}),(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-json",children:'{\n "name": "any_name",\n "nodename": "<NODENAME>",\n "type": "calico",\n "ipam": {\n "type": "calico-ipam"\n }\n}\n'})}),(0,o.jsx)(n.p,{children:"Additional configuration can be added as detailed below."}),(0,o.jsx)(n.h2,{id:"generic",children:"Generic"}),(0,o.jsx)(n.h3,{id:"datastore-type",children:"Datastore type"}),(0,o.jsx)(n.p,{children:"The Calico Enterprise CNI plugin supports the following datastore:"}),(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsxs)(n.li,{children:[(0,o.jsx)(n.code,{children:"datastore_type"})," (kubernetes)"]}),"\n"]}),(0,o.jsx)(n.h3,{id:"logging",children:"Logging"}),(0,o.jsxs)(n.p,{children:["Logging is always to ",(0,o.jsx)(n.code,{children:"stderr"}),". Logs are also written to ",(0,o.jsx)(n.code,{children:"/var/log/calico/cni/cni.log"})," on each host by default."]}),(0,o.jsx)(n.p,{children:"Logging can be configured using the following options in the netconf."}),(0,o.jsxs)(n.table,{children:[(0,o.jsx)(n.thead,{children:(0,o.jsxs)(n.tr,{children:[(0,o.jsx)(n.th,{children:"Option name"}),(0,o.jsx)(n.th,{children:"Default"}),(0,o.jsx)(n.th,{children:"Description"})]})}),(0,o.jsxs)(n.tbody,{children:[(0,o.jsxs)(n.tr,{children:[(0,o.jsx)(n.td,{children:(0,o.jsx)(n.code,{children:"log_level"})}),(0,o.jsx)(n.td,{children:"INFO"}),(0,o.jsxs)(n.td,{children:["Logging level. Allowed levels are ",(0,o.jsx)(n.code,{children:"ERROR"}),", ",(0,o.jsx)(n.code,{children:"WARNING"}),", ",(0,o.jsx)(n.code,{children:"INFO"}),", and ",(0,o.jsx)(n.code,{children:"DEBUG"}),"."]})]}),(0,o.jsxs)(n.tr,{children:[(0,o.jsx)(n.td,{children:(0,o.jsx)(n.code,{children:"log_file_path"})}),(0,o.jsx)(n.td,{children:(0,o.jsx)(n.code,{children:"/var/log/calico/cni/cni.log"})}),(0,o.jsx)(n.td,{children:"Location on each host to write CNI log files to. Logging to file can be disabled by removing this option."})]}),(0,o.jsxs)(n.tr,{children:[(0,o.jsx)(n.td,{children:(0,o.jsx)(n.code,{children:"log_file_max_size"})}),(0,o.jsx)(n.td,{children:"100"}),(0,o.jsx)(n.td,{children:"Max file size in MB log files can reach before they are rotated."})]}),(0,o.jsxs)(n.tr,{children:[(0,o.jsx)(n.td,{children:(0,o.jsx)(n.code,{children:"log_file_max_age"})}),(0,o.jsx)(n.td,{children:"30"}),(0,o.jsx)(n.td,{children:"Max age in days that old log files will be kept on the host before they are removed."})]}),(0,o.jsxs)(n.tr,{children:[(0,o.jsx)(n.td,{children:(0,o.jsx)(n.code,{children:"log_file_max_count"})}),(0,o.jsx)(n.td,{children:"10"}),(0,o.jsx)(n.td,{children:"Max number of rotated log files allowed on the host before they are cleaned up."})]})]})]}),(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-json",children:'{\n "name": "any_name",\n "cniVersion": "0.1.0",\n "type": "calico",\n "log_level": "DEBUG",\n "log_file_path": "/var/log/calico/cni/cni.log",\n "ipam": {\n "type": "calico-ipam"\n }\n}\n'})}),(0,o.jsx)(n.h3,{id:"ipam",children:"IPAM"}),(0,o.jsx)(n.p,{children:"When using Calico Enterprise IPAM, the following flags determine what IP addresses should be assigned. NOTE: These flags are strings and not boolean values."}),(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsxs)(n.li,{children:[(0,o.jsx)(n.code,{children:"assign_ipv4"})," (default: ",(0,o.jsx)(n.code,{children:'"true"'}),")"]}),"\n",(0,o.jsxs)(n.li,{children:[(0,o.jsx)(n.code,{children:"assign_ipv6"})," (default: ",(0,o.jsx)(n.code,{children:'"false"'}),")"]}),"\n"]}),(0,o.jsxs)(n.p,{children:["A specific IP address can be chosen by using ",(0,o.jsx)(n.a,{href:"https://github.com/appc/cni/blob/master/SPEC.md#parameters",children:(0,o.jsx)(n.code,{children:"CNI_ARGS"})})," and setting ",(0,o.jsx)(n.code,{children:"IP"})," to the desired value."]}),(0,o.jsx)(n.p,{children:"By default, Calico Enterprise IPAM will assign IP addresses from all the available IP pools."}),(0,o.jsx)(n.p,{children:"Optionally, the list of possible IPv4 and IPv6 pools can also be specified via the following properties:"}),(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsxs)(n.li,{children:[(0,o.jsx)(n.code,{children:"ipv4_pools"}),": An array of CIDR strings or pool names. (e.g., ",(0,o.jsx)(n.code,{children:'"ipv4_pools": ["10.0.0.0/24", "20.0.0.0/16", "default-ipv4-ippo
1ol"]'}),")"]}),"\n",(0,o.jsxs)(n.li,{children:[(0,o.jsx)(n.code,{children:"ipv6_pools"}),": An array of CIDR strings or pool names. (e.g., ",(0,o.jsx)(n.code,{children:'"ipv6_pools": ["2001:db8::1/120", "namedpool"]'}),")"]}),"\n"]}),(0,o.jsx)(n.p,{children:"Example CNI config:"}),(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-json",children:'{\n "name": "any_name",\n "cniVersion": "0.1.0",\n "type": "calico",\n "ipam": {\n "type": "calico-ipam",\n "assign_ipv4": "true",\n "assign_ipv6": "true",\n "ipv4_pools": ["10.0.0.0/24", "20.0.0.0/16", "default-ipv4-ippool"],\n "ipv6_pools": ["2001:db8::1/120", "default-ipv6-ippool"]\n }\n}\n'})}),(0,o.jsx)(n.admonition,{type:"note",children:(0,o.jsxs)(n.p,{children:[(0,o.jsx)(n.code,{children:"ipv6_pools"})," will be respected only when ",(0,o.jsx)(n.code,{children:"assign_ipv6"})," is set to ",(0,o.jsx)(n.code,{children:'"true"'}),"."]})}),(0,o.jsx)(n.p,{children:"Any IP pools specified in the CNI config must have already been created. It is an error to specify IP pools in the config that do not exist."}),(0,o.jsx)(n.h3,{id:"container-settings",children:"Container settings"}),(0,o.jsx)(n.p,{children:"The following options allow configuration of settings within the container namespace."}),(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsxs)(n.li,{children:["allow_ip_forwarding (default is ",(0,o.jsx)(n.code,{children:"false"}),")"]}),"\n"]}),(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-json",children:'{\n "name": "any_name",\n "cniVersion": "0.1.0",\n "type": "calico",\n "ipam": {\n "type": "calico-ipam"\n },\n "container_settings": {\n "allow_ip_forwarding": true\n }\n}\n'})}),(0,o.jsx)(n.h3,{id:"readiness-gates",children:"Readiness Gates"}),(0,o.jsx)(n.p,{children:"The following option makes CNI plugin wait for specified endpoint(s) to be ready before configuring pod networking."}),(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsx)(n.li,{children:(0,o.jsx)(n.code,{children:"readiness_gates"})}),"\n"]}),(0,o.jsx)(n.p,{children:"This is an optional property that takes an array of URLs. Each URL specified will be polled for readiness and pod networking will continue startup once all readiness_gates are ready."}),(0,o.jsx)(n.p,{children:"Example CNI config:"}),(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-json",children:'{\n "name": "any_name",\n "cniVersion": "0.1.0",\n "type": "calico",\n "ipam": {\n "type": "calico-ipam"\n },\n "readiness_gates": ["http://localhost:9099/readiness", "http://localhost:8888/status"]\n}\n'})}),(0,o.jsx)(n.h2,{id:"kubernetes-specific",children:"Kubernetes specific"}),(0,o.jsxs)(n.p,{children:["When using the Calico Enterprise CNI plugin with Kubernetes, the plugin must be able to access the Kubernetes API server to find the labels assigned to the Kubernetes pods. The recommended way to configure access is through a ",(0,o.jsx)(n.code,{children:"kubeconfig"})," file specified in the ",(0,o.jsx)(n.code,{children:"kubernetes"})," section of the network config. e.g."]}),(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-json",children:'{\n "name": "any_name",\n "cniVersion": "0.1.0",\n "type": "calico",\n "kubernetes": {\n "kubeconfig": "/path/to/kubeconfig"\n },\n "ipam": {\n "type": "calico-ipam"\n }\n}\n'})}),(0,o.jsx)(n.p,{children:"As a convenience, the API location can also be c
1onfigured directly, e.g."}),(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-json",children:'{\n "name": "any_name",\n "cniVersion": "0.1.0",\n "type": "calico",\n "kubernetes": {\n "k8s_api_root": "http://127.0.0.1:8080"\n },\n "ipam": {\n "type": "calico-ipam"\n }\n}\n'})}),(0,o.jsx)(n.h3,{id:"enabling-kubernetes-policy",children:"Enabling Kubernetes policy"}),(0,o.jsxs)(n.p,{children:["If you wish to use the Kubernetes ",(0,o.jsx)(n.code,{children:"NetworkPolicy"})," resource then you must set a policy type in the network config.\nThere is a single supported policy type, ",(0,o.jsx)(n.code,{children:"k8s"}),". When set,\nyou must also run ",(0,o.jsx)(n.code,{children:"tigera/kube-controllers"})," with the policy, profile, and workloadendpoint controllers enabled."]}),(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-json",children:'{\n "name": "any_name",\n "cniVersion": "0.1.0",\n "type": "calico",\n "policy": {\n "type": "k8s"\n },\n "kubernetes": {\n "kubeconfig": "/path/to/kubeconfig"\n },\n "ipam": {\n "type": "calico-ipam"\n }\n}\n'})}),(0,o.jsxs)(n.p,{children:["When using ",(0,o.jsx)(n.code,{children:"type: k8s"}),", the Calico Enterprise CNI plugin requires read-only Kubernetes API access to the ",(0,o.jsx)(n.code,{children:"Pods"})," resource in all namespaces."]})]})]}),"\n",(0,o.jsx)(n.h2,{id:"ipam-1",children:"IPAM"}),"\n",(0,o.jsx)(n.h3,{id:"using-host-local-ipam",children:"Using host-local IPAM"}),"\n",(0,o.jsxs)(n.p,{children:["Calico can be configured to use ",(0,o.jsx)(n.a,{href:"https://www.cni.dev/plugins/current/ipam/host-local/",children:"host-local IPAM"})," instead of the default ",(0,o.jsx)(n.code,{children:"calico-ipam"}),". Host\nlocal IPAM uses a pre-determined CIDR per-host, and stores allocations locally on each node. This is in contrast to Calico IPAM, which dynamically\nallocates blocks of addresses and single addresses alike in response to cluster needs."]}),"\n",(0,o.jsxs)(n.p,{children:["Host local IPAM is generally only used on clusters where integration with the Kubernetes ",(0,o.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/architecture/cloud-controller/#route-controller",children:"route controller"})," is necessary.\nNote that some Calico features - such as the ability to request a specific address or pool for a pod - require Calico IPAM to function, and will not work with host-local IPAM enabled."]}),"\n",(0,o.jsxs)(t.Z,{children:[(0,o.jsxs)(l.Z,{label:"Operator",value:"Operator-2",children:[(0,o.jsxs)(n.p,{children:["The ",(0,o.jsx)(n.code,{children:"host-local"})," IPAM plugin can be configured by setting the ",(0,o.jsx)(n.code,{children:"Spec.CNI.IPAM.Plugin"})," field to ",(0,o.jsx)(n.code,{children:"HostLocal"})," on the ",(0,o.jsx)(n.a,{href:"/calico-enterprise/3.17/reference/installation/api#operator.tigera.io/v1.Installation",children:"operator.tigera.io/Installation"})," API."]}),(0,o.jsxs)(n.p,{children:["Calico will use the ",(0,o.jsx)(n.code,{children:"host-local"})," IPAM plugin to allocate IPv4 addresses from the node's IPv4 pod CIDR if there is an IPv4 pool configured in ",(0,o.jsx)(n.code,{children:"Spec.IPPools"}),", and an IPv6 address from the node's IPv6 pod CIDR if\nthere is an IPv6 pool configured in ",(0,o.jsx)(n.code,{children:"Spec.IPPools"}),"."]}),(0,o.jsx)(n.p,{children:"The following example configures Calico to assign dual-stack IPs to pods using the host-local IPAM plugin."}),(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-yaml",children:"kind: Installation\napiVersion: operator.tigera.io/v1\nmetadata:\n name: default\nspec:\n calicoNetwork:\n ipPools:\n - cidr: 192.168.0.0/16\n - cidr: 2001:db8::/64\n cni:\n type: Calico\n ipam:\n type: HostLocal\n"})})]}),(0,o.jsxs)(l.Z,{label:"Manifest",value:"Manifest-3",children:[(0,o.jsxs)(n.p,{children:["When using the CNI ",(0,o.jsx)(n.code,{children:"host-local"})," IPAM plugin, two special values - ",(0,o.jsx)(n.code,{children:"usePodCidr"})," and ",(0,o.jsx)(n.code,{children:"usePodCidrIPv6"}),' - are allowed for the subnet field (either at the top-level, or in a "range"). This tells the plugin to determine the subnet to use from the Kubernetes API based on the Node.podCIDR field. Calico Enterprise does not use the ',(0,o.jsx)(n.code,{children:"gateway"})," field of a range so that field is not required and it will be ignored if present."]}),(0,o.jsx)(n.admonition,{type:"note",children:(0,o.jsxs)(n.p,{children:[(0,o.jsx)(n.code,{children:"usePodCidr"})," and ",(0,o.jsx)(n.code,{children:"usePodCidrIPv6"})," can only be used as the value of the ",(0,o.jsx)(n.code,{children:"subnet"})," field, it cannot be used in\n",(0,o.jsx)(n.code,{children:"rangeStart"})," or ",(0,o.jsx)(n.code,{children:"rangeEnd"})," so those values are not useful if ",(0,o.jsx)(n.code,{children:"subnet"})," is set to ",(0,o.jsx)(n.code,{children:"usePodCidr"}),"."]})}),(0,o.jsxs)(n.p,{children:["Calico Enterprise supports the host-local IPAM plugin's ",(0,o.jsx)(n.code,{children:"routes"})," field as follows:"]}),(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsxs)(n.li,{children:["\n",(0,o.jsxs)(n.p,{children:["If there is no ",(0,o.jsx)(n.code,{children:"routes"})," field, Calico Enterprise will install a default ",(0,o.jsx)(n.code,{children:"0.0.0.0/0"}),", and/or ",(0,o.jsx)(n.code,{children:"::/0"})," route into the pod (depending on whether the pod has an IPv4 and/or IPv6 address)."]}),"\n"]}),"\n",(0,o.jsxs)(n.li,{children:["\n",(0,o.jsxs)(n.p,{children:["If there is a ",(0,o.jsx)(n.code,{children:"routes"})," field then Calico Enterprise will program ",(0,o.jsx)(n.em,{children:"only"})," the routes in the routes field into the pod. Since Calico Enterprise implements a point-to-point link into the pod, the ",(0,o.jsx)(n.code,{children:"gw"})," field is not required and it will be ignored if present. All routes that Calico Enterprise installs will have
1Calico Enterprise's link-local IP as the next hop."]}),"\n"]}),"\n"]}),(0,o.jsx)(n.p,{children:"Calico Enterprise CNI plugin configuration:"}),(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsxs)(n.li,{children:[(0,o.jsx)(n.code,{children:"node_name"}),"\n",(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsx)(n.li,{children:"The node name to use when looking up the CIDR value (defaults to current hostname)"}),"\n"]}),"\n"]}),"\n"]}),(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-json",children:'{\n "name": "any_name",\n "cniVersion": "0.1.0",\n "type": "calico",\n "kubernetes": {\n "kubeconfig": "/path/to/kubeconfig",\n "node_name": "node-name-in-k8s"\n },\n "ipam": {\n "type": "host-local",\n "ranges": [[{ "subnet": "usePodCidr" }], [{ "subnet": "usePodCidrIPv6" }]],\n "routes": [{ "dst": "0.0.0.0/0" }, { "dst": "2001:db8::/96" }]\n }\n}\n'})}),(0,o.jsxs)(n.p,{children:["When making use of the ",(0,o.jsx)(n.code,{children:"usePodCidr"})," or ",(0,o.jsx)(n.code,{children:"usePodCidrIPv6"})," options, the Calico Enterprise CNI plugin requires read-only Kubernetes API access to the ",(0,o.jsx)(n.code,{children:"Nodes"})," resource."]}),(0,o.jsx)(n.h4,{id:"configuring-node-and-typha",children:"Configuring node and typha"}),(0,o.jsxs)(n.p,{children:["When using ",(0,o.jsx)(n.code,{children:"host-local"})," IPAM with the Kubernetes API datastore, you must configure both cnx-node and the Typha deployment to use the ",(0,o.jsx)(n.code,{children:"Node.podCIDR"})," field by setting the environment variable ",(0,o.jsx)(n.code,{children:"USE_POD_CIDR=true"})," in each."]})]})]}),"\n",(0,o.jsx)(n.h3,{id:"using-kubernetes-annotations",children:"Using Kubernetes annotations"}),"\n",(0,o.jsx)(n.h4,{id:"specifying-ip-pools-on-a-per-namespace-or-per-pod-basis",children:"Specifying IP pools on a per-namespace or per-pod basis"}),"\n",(0,o.jsxs)(n.p,{children:["In addition to specifying IP pools in the CNI config as discussed above, Calico Enterprise IPAM supports specifying IP pools per-namespace or per-pod using the following ",(0,o.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/",children:"Kubernetes annotations"}),"."]}),"\n",(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsxs)(n.li,{children:["\n",(0,o.jsxs)(n.p,{children:[(0,o.jsx)(n.code,{children:"cni.projectcalico.org/ipv4pools"}),": A list of configured IPv4 Pools from which to choose an address for the pod."]}),"\n",(0,o.jsx)(n.p,{children:"Example:"}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-yaml",children:"annotations:\n 'cni.projectcalico.org/ipv4pools': '[\"default-ipv4-ippool\"]'\n"})}),"\n"]}),"\n",(0,o.jsxs)(n.li,{children:["\n",(0,o.jsxs)(n.p,{children:[(0,o.jsx)(n.code,{children:"cni.projectcalico.org/ipv6pools"}),": A list of configured IPv6 Pools from which to choose an address for the pod."]}),"\n",(0,o.jsx)(n.p,{children:"Example:"}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-yaml",children:"annotations:\n 'cni.projectcalico.org/ipv6pools': '[\"2001:db8::1/120\"]'\n"})}),"\n"]}),"\n"]}),"\n",(0,o.jsx)(n.p,{children:"If provided, these IP pools will override any IP pools specified in the CNI config."}),"\n",(0,o.jsx)(n.admonition,{type:"note",children:(0,o.jsxs)(n.p,{children:["This requires the IP pools to exist before ",(0,o.jsx)(n.code,{children:"ipv4pools"})," or\n",(0,o.jsx)(n.code,{children:"ipv6pools"})," annotations are used. Requesting a subset of an IP pool\nis not supported. IP pools requested in the annotations must exactly\nmatch a configured ",(0,o.jsx)(n.a,{href:"/calico-enterprise/3.17/reference/resources/ippool",children:"IPPool"})," resource."]})}),"\n",(0,o.jsx)(n.admonition,{type:"note",children:(0,o.jsx)(n.p,{children:"The Calico Enterprise CNI plugin supports specifying an annotation per namespace.\nIf both the namespace and the pod have this annotation, the pod information will be used.\nOtherwise, if only the namespace has the annotation the annotation of the namespace will\nbe used for each pod in it."})}),"\n",(0,o.jsx)(n.h4,{id:"requesting-a-specific-ip-address",children:"Requesting a specific IP address"}),"\n",(0,o.jsxs)(n.p,{children:["You can also request a specific IP address through ",(0,o.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/
1overview/working-with-objects/annotations/",children:"Kubernetes annotations"})," with Calico Enterprise IPAM.\nThere are two annotations to request a specific IP address:"]}),"\n",(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsxs)(n.li,{children:["\n",(0,o.jsxs)(n.p,{children:[(0,o.jsx)(n.code,{children:"cni.projectcalico.org/ipAddrs"}),": A list of IPv4 and/or IPv6 addresses to assign to the Pod. The requested IP addresses will be assigned from Calico Enterprise IPAM and must exist within a configured IP pool."]}),"\n",(0,o.jsx)(n.p,{children:"Example:"}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-yaml",children:"annotations:\n 'cni.projectcalico.org/ipAddrs': '[\"192.168.0.1\"]'\n"})}),"\n"]}),"\n",(0,o.jsxs)(n.li,{children:["\n",(0,o.jsxs)(n.p,{children:[(0,o.jsx)(n.code,{children:"cni.projectcalico.org/ipAddrsNoIpam"}),": A list of IPv4 and/or IPv6 addresses to assign to the Pod, bypassing IPAM. Any IP conflicts and routing have to be taken care of manually or by some other system.\nCalico Enterprise will only distribute routes to a Pod if its IP address falls within a Calico Enterprise IP pool using BGP mode. Calico will not distribute ipAddrsNoIpam routes when operating in VXLAN mode. If you assign an IP address that is not in a Calico Enterprise IP pool or if its IP address falls within a Calico Enterprise IP pool that uses VXLAN encapsulation, you must ensure that routing to that IP address is taken care of through another mechanism."]}),"\n",(0,o.jsx)(n.p,{children:"Example:"}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-yaml",children:"annotations:\n 'cni.projectcalico.org/ipAddrsNoIpam': '[\"10.0.0.1\"]'\n"})}),"\n",(0,o.jsx)(n.p,{children:"The ipAddrsNoIpam feature is disabled by default. It can be enabled in the feature_control section of the CNI network config:"}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-json",children:'{\n "name": "any_name",\n "cniVersion": "0.1.0",\n "type": "calico",\n "ipam": {\n "type": "calico-ipam"\n },\n "feature_control": {\n "ip_addrs_no_ipam": true\n }\n}\n'})}),"\n",(0,o.jsx)(n.admonition,{type:"caution",children:(0,o.jsx)(n.p,{children:"This feature allows for the bypassing of network policy via IP spoofing.\nUsers should make sure the proper admission control is in place to prevent users from selecting arbitrary IP addresses."})}),"\n"]}),"\n"]}),"\n",(0,o.jsx)(n.admonition,{type:"note",children:(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsxs)(n.li,{children:["The ",(0,o.jsx)(n.code,{children:"ipAddrs"})," and ",(0,o.jsx)(n.code,{children:"ipAddrsNoIpam"})," annotations can't be used together."]}),"\n",(0,o.jsx)(n.li,{children:"You can only specify one IPv4/IPv6 or one IPv4 and one IPv6 address with these annotations."}),"\n",(0,o.jsxs)(n.li,{children:["When ",(0,o.jsx)(n.code,{children:"ipAddrs"})," or ",(0,o.jsx)(n.code,{children:"ipAddrsNoIpam"})," is used with ",(0,o.jsx)(n.code,{children:"ipv4pools"})," or ",(0,o.jsx)(n.code,{children:"ipv6pools"}),", ",(0,o.jsx)(n.code,{children:"ipAddrs"})," / ",(0,o.jsx)(n.code,{children:"ipAddrsNoIpam"})," take priority."]}),"\n"]})}),"\n",(0,o.jsx)(n.h4,{id:"requesting-a-floating-ip",children:"Requesting a floating IP"}),"\n",(0,o.jsxs)(n.p,{children:["You can request a floating IP address for a pod through ",(0,o.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/",children:"Kubernetes annotations"})," with Calico Enterprise."]}),"\n",(0,o.jsx)(n.admonition,{type:"note",children:(0,o.jsx)(n.p,{children:"The specified address must belong to an IP Pool for advertisement to work properly."})}),"\n",(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsxs)(n.li,{children:["\n",(0,o.jsxs)(n.p,{children:[(0,o.jsx)(n.code,{children:"cni.projectcalico.org/floatingIPs"}),": A list of floating IPs which will be assigned to the pod's workload endpoint."]}),"\n",(0,o.jsx)(n.p,{children:"Example:"}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-yaml",children:"annotations:\n 'cni.projectcalico.org/floatingIPs': '[\"10.0.0.1\"]'\n"})}),"\n",(0,o.jsx)(n.p,{children:"The floatingIPs feature is disabled by default. It can be enabled in the feature_control section of the CNI network config:"}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-json",children:'{\n "name": "any_name",\n "cniVersion": "0.1.0",\n "type": "calico",\n "ipam": {\n "type": "calico-ipam"\n },\n "feature_control": {\n "floating_ips": true\n }\n}\n'})}),"\n",(0,o.jsx)(n.admonition,{type:"caution",children:(0,o.jsx)(n.p,{children:"This feature can allow pods to receive traffic which may not have been intended for that pod.\nUsers should make sure the proper admission control is in place to prevent users from selecting arbitrary floating IP addresses."})}),"\n"]}),"\n"]}),"\n",(0,o.jsx)(n.h3,{id:"using-ip-pools-node-selectors",children:"Using IP pools node selectors"}),"\n",(0,o.jsxs)(n.p,{children:["Nodes will only assign workload addresses from IP pools which select them. By\ndefault, IP pools select all nodes, but this can be configured using the\n",(0,o.jsx)(n.code,{children:"nodeSelector"})," field. Check out the ",(0,o.jsx)(n.a,{href:"/calico-enterprise/3.17/reference/resources/ippool",children:"IP pool resource document"}),"\nfor more details."]}),"\n",(0,o.jsx)(n.p,{children:"Example:"}),"\n",(0,o.jsxs)(n.ol,{children:["\n",(0,o.jsxs)(n.li,{children:["\n",(0,o.jsxs)(n.p,{children:["Create (or update) an IP pool that only allocates IPs for nodes where it\ncontains a label ",(0,o.jsx)(n.code,{children:"rack=0"}),"."]}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-bash",children:'kubectl create -f -<<EOF\napiVersion: projectcalico.org/v3\nkind: IPPool\nmetadata:\n name: rack-0-ippool\nspec:\n cidr: 192.168.0.0/24\n ipipMode: Always\n natOutgoing: true\n nodeSelector: rack == "0"\nEOF\n'})}),"\n"]}),"\n",(0,o.jsxs)(n.li,{children:["\n",(0,o.jsxs)(n.p,{children:["Label a node with ",(0,o.jsx)(n.code,{children:"rack=0"}),"."]}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-bash",children:"kubectl label nodes kube-node-0 rack=0\n"})}),"\n"]}),"\n"]}),"\n",(0,o.jsxs)(n.p,{children:["Check out the usage guide on ",(0,o.jsx)(n.a,{href:"/calico-enterprise/3.17/networking/ipam/assign-ip-addresses-topology",children:"assign IP addresses based on topology"})]}),"\n",(0,o.jsx)(n.p,{children:"for a full example."}),"\n",(0,o.jsx)(n.h3,{id:"cni-network-configuration-lists",children:"CNI network configuration lists"}),"\n",(0,o.jsxs)(n.p,{children:["The CNI 0.3.0 ",(0,o.jsx)(n.a,{href:"https://github.com/containernetworking/cni/blob/spec-v0.3.0/SPEC.md#network-configuration-lists",children:"spec"}),' supports "chaining" multiple CNI plugins together. Calico Enterprise supports the following Kubernetes CNI plugins, which are enabled by default. Although chaining other CNI plugins may work, we support only the following tested CNI plugins.']}),"\n",(0,o.jsx)(n.p,{children:(0,o.jsx)(n.strong,{children:"Port mapping plugin"})}),"\n",(0,o.jsx)(n.p,{children:"Calico Enterprise is required to implement Kubernetes host port functionality and is enabled by default."}),"\n",(0,o.jsx)(n.admonition,{type:"note",children:(0,o.jsxs)(n.p,{children:["Be aware of the following ",(0,o.jsx)(n.a,{href:"https://github.com/containernetworking/cni/issues/605",children:"portmap plugin CNI issue"})," where draining nodes\nmay take a long time with a cluster of 100+ nodes and 4000+ services."]})}),"\n",(0,o.jsx)(n.p,{children:"To disable it, remove the portmap section from the CNI network configuration in the Calico Enterprise manifests."}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-json",children:'{\n "type": "portmap",\n "snat": true,\n "capabilities": { "portMappings": true }\n}\n'})}),"\n",(0,o.jsx)(n.p,{children:(0,o.jsx)(n.strong,{children:"Traffic shaping plugin"})}),"\n",(0,o.jsxs)(n.p,{children:["The ",(0,o.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/",children:"traffic shaping Kubernetes CNI plugin"})," supports pod ingress and egress traffic shaping. This bandwidth management te
1chnique delays the flow of certain types of network packets to ensure network performance for higher priority applications. It is enabled by default."]}),"\n",(0,o.jsxs)(n.p,{children:["You can add the ",(0,o.jsx)(n.code,{children:"kubernetes.io/ingress-bandwidth"})," and ",(0,o.jsx)(n.code,{children:"kubernetes.io/egress-bandwidth"})," annotations to your pod. For example, the following sets a 1 megabit-per-second connection for ingress and egress traffic."]}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-bash",children:"apiVersion: v1\nkind: Pod\nmetadata:\n annotations:\n kubernetes.io/ingress-bandwidth: 1M\n kubernetes.io/egress-bandwidth: 1M\n...\n"})}),"\n",(0,o.jsx)(n.p,{children:"To disable it, remove the bandwidth section from the CNI network configuration in the Calico Enterprise manifests."}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-json",children:'{\n "type": "bandwidth",\n "capabilities": { "bandwidth": true }\n}\n'})}),"\n",(0,o.jsx)(n.h3,{id:"order-of-precedence",children:"Order of precedence"}),"\n",(0,o.jsx)(n.p,{children:"If more than one of these methods are used for IP address assignment, they will\ntake on the following precedence, 1 being the highest:"}),"\n",(0,o.jsxs)(n.ol,{children:["\n",(0,o.jsx)(n.li,{children:"Kubernetes annotations"}),"\n",(0,o.jsx)(n.li,{children:"CNI configuration"}),"\n",(0,o.jsx)(n.li,{children:"IP pool node selectors"}),"\n"]}),"\n",(0,o.jsx)(n.admonition,{type:"note",children:(0,o.jsx)(n.p,{children:"Calico Enterprise IPAM will not reassign IP addresses to workloads\nthat are already running. To update running workloads with IP addresses from\na newly configured IP pool, they must be recreated. We recommend doing this\nbefore going into production or during a maintenance window."})}),"\n",(0,o.jsx)(n.h3,{id:"specify-num_queues-for-veth-interfaces",children:"Specify num_queues for veth interfaces"}),"\n",(0,o.jsxs)(n.p,{children:[(0,o.jsx)(n.code,{children:"num_rx_queues"})," and ",(0,o.jsx)(n.code,{children:"num_tx_queues"})," can be set using the ",(0,o.jsx)(n.code,{children:"num_queues"})," option in the CNI configuration. Default: 1"]}),"\n",(0,o.jsx)(n.p,{children:"For example:"}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-json",children:'{\n "num_queues": 3\n}\n'})})]})}function u(e={}){let{wrapper:n}={...(0,r.a)(),...e.components};return n?(0,o.jsx)(n,{...e,children:(0,o.jsx)(p,{...e})}):p(e)}},97645:function(e,n,i){i.d(n,{Z:()=>r});var s=i("85893");i("67294");var o=i("67026");function r(e){let{children:n,hidden:i,className:r}=e;return(0,s.jsx)("div",{role:"tabpanel",className:(0,o.Z)("tabItem_Ymn6",r),hidden:i,children:n})}},58168:function(e,n,i){i.d(n,{Z:()=>m});var s=i("85893"),o=i("67294"),r=i("67026"),t=i("34718"),l=i("16550"),a=i("8714"),c=i("89207"),d=i("69413"),h=i("54510");function p(e){return o.Children.toArray(e).filter(e=>"\n"!==e).map(e=>{if(!e||o.isValidElement(e)&&function(e){let{props:n}=e;return!!n&&"object"==typeof n&&"value"in n}(e))return e;throw Error(`Docusaurus error: Bad <Tabs> child <${"string"==typeof e.type?e.type:e.type.name}>: all children of the <Tabs> component should be <TabItem>, and every <TabItem> should have a unique "value" prop.`)})?.filter(Boolean)??[]}function u(e){let{value:n,tabValues:i}=e;return i.some(e=>e.value===n)}var g=i("6735");function f(e){let{className:n,block:i,selectedValue:o,selectValue:l,tabValues:a}=e,c=[],{blockElementScrollPositionUntilNextRender:d}=(0,t.o5)(),h=e=>{let n=e.currentTarget,i=a[c.indexOf(n)].value;i!==o&&(d(n),l(i))},p=e=>{let n=null;switch(e.key){case"Enter":h(e);break;case"ArrowRight":{let i=c.indexOf(e.currentTarget)+1;n=c[i]??c[0];break}case"ArrowLeft":{let i=c.indexOf(e.currentTarget)-1;n=c[i]??c[c.length-1]}}n?.focus()};return(0,s.jsx)("ul",{role:"tablist","aria-orientation":"horizontal",className:(0,r.Z)("tabs",{"tabs--block":i},n),children:a.map(e=>{let{value:n,label:i,attributes:t}=e;return(0,s.jsx)("li",{role:"tab",tabIndex:o===n?0:-1,"aria-selected":o===n,ref:e=>{c.push(e)},onKeyDown:p,onClick:h,...t,className:(0,r.Z)("tabs__item","tabItem_LNqP",t?.className,{"tabs__item--active":o===n}),children:i??n},n)})})}function x(e){let{lazy:n,children:i,selectedValue:t}
1=e,l=(Array.isArray(i)?i:[i]).filter(Boolean);if(n){let e=l.find(e=>e.props.value===t);return e?(0,o.cloneElement)(e,{className:(0,r.Z)("margin-top--md",e.props.className)}):null}return(0,s.jsx)("div",{className:"margin-top--md",children:l.map((e,n)=>(0,o.cloneElement)(e,{key:n,hidden:e.props.value!==t}))})}function j(e){let n=function(e){let{defaultValue:n,queryString:i=!1,groupId:s}=e,r=function(e){let{values:n,children:i}=e;return(0,o.useMemo)(()=>{let e=n??p(i).map(e=>{let{props:{value:n,label:i,attributes:s,default:o}}=e;return{value:n,label:i,attributes:s,default:o}});return!function(e){let n=(0,d.lx)(e,(e,n)=>e.value===n.value);if(n.length>0)throw Error(`Docusaurus error: Duplicate values "${n.map(e=>e.value).join(", ")}" found in <Tabs>. Every value needs to be unique.`)}(e),e},[n,i])}(e),[t,g]=(0,o.useState)(()=>(function(e){let{defaultValue:n,tabValues:i}=e;if(0===i.length)throw Error("Docusaurus error: the <Tabs> component requires at least one <TabItem> children component");if(n){if(!u({value:n,tabValues:i}))throw Error(`Docusaurus error: The <Tabs> has a defaultValue "${n}" but none of its children has the corresponding value. Available values are: ${i.map(e=>e.value).join(", ")}. If you intend to show no default tab, use defaultValue={null} instead.`);return n}let s=i.find(e=>e.default)??i[0];if(!s)throw Error("Unexpected error: 0 tabValues");return s.value})({defaultValue:n,tabValues:r})),[f,x]=function(e){let{queryString:n=!1,groupId:i}=e,s=(0,l.k6)(),r=function(e){let{queryString:n=!1,groupId:i}=e;if("string"==typeof n)return n;if(!1===n)return null;if(!0===n&&!i)throw Error('Docusaurus error: The <Tabs> component groupId prop is required if queryString=true, because this value is used as the search param name. You can also provide an explicit value such as queryString="my-search-param".');return i??null}({queryString:n,groupId:i});return[(0,c._X)(r),(0,o.useCallback)(e=>{if(!r)return;let n=new URLSearchParams(s.location.search);n.set(r,e),s.replace({...s.location,search:n.toString()})},[r,s])]}({queryString:i,groupId:s}),[j,m]=function(e){let{groupId:n}=e,i=n?`docusaurus.tab.${n}`:null,[s,r]=(0,h.Nk)(i);return[s,(0,o.useCallback)(e=>{i&&r.set(e)},[i,r])]}({groupId:s}),b=(()=>{let e=f??j;return u({value:e,tabValues:r})?e:null})();return(0,a.Z)(()=>{b&&g(b)},[b]),{selectedValue:t,selectValue:(0,o.useCallback)(e=>{if(!u({value:e,tabValues:r}))throw Error(`Can't select invalid tab value=${e}`);g(e),x(e),m(e)},[x,m,r]),tabValues:r}}(e);return(0,s.jsxs)("div",{className:(0,r.Z)("tabs-container","tabList__CuJ"),children:[(0,s.jsx)(f,{...n,...e}),(0,s.jsx)(x,{...n,...e})]})}function m(e){let n=(0,g.Z)();return(0,s.jsx)(j,{...e,children:p(e.children)},String(n))}},50065:function(e,n,i){i.d(n,{Z:function(){return l},a:function(){return t}});var s=i(67294);let o={},r=s.createContext(o);function t(e){let n=s.useContext(r);return s.useMemo(function(){return"function"==typeof e?e(n):{...n,...e}},[n,e])}function l(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:t(e.components),s.createElement(r.Provider,{value:n},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.