1"use strict";(self.webpackChunktigera_docs=self.webpackChunktigera_docs||[]).push([["3368"],{7716:function(e,n,t){t.r(n),t.d(n,{frontMatter:()=>r,toc:()=>d,default:()=>h,metadata:()=>o,assets:()=>c,contentTitle:()=>a});var o=JSON.parse('{"id":"reference/host-endpoints/objects","title":"Creating host endpoint objects","description":"To protect a host interface, start by creating a host endpoint object in etcd.","source":"@site/calico-enterprise_versioned_docs/version-3.19-2/reference/host-endpoints/objects.mdx","sourceDirName":"reference/host-endpoints","slug":"/reference/host-endpoints/objects","permalink":"/calico-enterprise/3.19/reference/host-endpoints/objects","draft":false,"unlisted":false,"editUrl":"https://github.com/tigera/docs/edit/main/calico-enterprise_versioned_docs/version-3.19-2/reference/host-endpoints/objects.mdx","tags":[],"version":"3.19-2","frontMatter":{"description":"To protect a host interface, start by creating a host endpoint object in etcd."},"sidebar":"calicoEnterpriseSidebar","previous":{"title":"Creating policy for basic connectivity","permalink":"/calico-enterprise/3.19/reference/host-endpoints/connectivity"},"next":{"title":"Selector-based policies","permalink":"/calico-enterprise/3.19/reference/host-endpoints/selector"}}'),i=t(70689),s=t(17869);let r={description:"To protect a host interface, start by creating a host endpoint object in etcd."},a="Creating host endpoint objects",c={},d=[];function l(e){let n={admonition:"admonition",code:"code",h1:"h1",header:"header",p:"p",pre:"pre",...(0,s.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.header,{children:(0,i.jsx)(n.h1,{id:"creating-host-endpoint-objects",children:"Creating host endpoint objects"})}),"\n",(0,i.jsxs)(n.p,{children:["For each host endpoint that you want Calico Enterprise to secure, you'll need to\ncreate a host endpoint object in etcd. Use the ",(0,i.jsx)(n.code,{children:"calicoctl create"})," command\nto create a host endpoint resource (",(0,i.jsx)(n.code,{children:"HostEndpoint"}),")."]}),"\n",(0,i.jsx)(n.p,{children:"There are two ways to specify the interface that a host endpoint should\nrefer to. You can either specify the name of the interface or its\nexpected IP address. In either case, you'll also need to know the name given to\nthe Calico Enterprise node running on the host that owns the interface; in most cases this\nwill be the same as the hostname of the host."}),"\n",(0,i.jsxs)(n.p,{children:["For example, to secure the interface named ",(0,i.jsx)(n.code,{children:"eth0"})," with IP 10.0.0.1 on\nhost ",(0,i.jsx)(n.code,{children:"my-host"}),", run the command below. The name of the endpoint is an\narbitrary name required for endpoint identification."]}),"\n",(0,i.jsx)(n.p,{children:"When running this command, replace the placeholders in angle brackets with\nappropriate values for your deployment."}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:'calicoctl create -f - <<EOF\n- apiVersion: projectcalico.org/v3\n kind: HostEndpoint\n metadata:\n name: <name of endpoint>\n labels:\n role: webserver\n environment: production\n spec:\n interfaceName: eth0\n node: <node name or hostname>\n profiles: [<list of profile IDs>]\n expectedIPs: ["10.0.0.1"]\nEOF\n'})}),"\n",(0,i.jsx)(n.admonition,{type:"note",children:(0,i.jsxs)(n.p,{children:["Felix tries to detect the correct hostname for a system. It logs\nout the value it has determined at start-of-day in the following\nformat:\n",(0,i.jsx)(n.code,{children:"2015-10-20 17:42:09,813 \\[INFO\\]\\[30149/5\\] calico.felix.config 285: Parameter FelixHostname (Felix compute host hostname) has value 'my-hostname' read from None"}),"\nThe value (in this case ",(0,i.jsx)(n.code,{children:"'my-hostname'"}),") needs to match the hostname\nused in etcd. Ideally, the host's system hostname should be set\ncorrectly but if that's not possible, the Felix value can be\noverridden with the FelixHostname configuration setting. See\nconfiguration for more details."]})}),"\n",(0,i.jsxs)(n.p,{children:["Where ",(0,i.jsx)(n.code,{children:"<list of profile IDs>"})," is an optional list of security profiles\nto apply to the endpoint and labels contains a set of arbitrary\nkey/value pairs that can be used in selector expressions."]}),"\n","\n",(0,i.jsxs)(n.admonition,{type:"note",children:[(0,i.jsxs)(n.p,{children:["When rendering security rules on other hosts, Calico Enterprise uses the\n",(0,i.jsx)(n.code,{children:"expectedIPs"})," field to resolve label selectors\nto IP addresses. If the ",(0,i.jsx)(n.code,{children:"expectedIPs"})," field is omitted\nthen security rules that use labels will fail to match\nthis endpoint.\nOr, if you knew that the IP address should be 10.0.0.1, but not the name\nof the interface:"]}),(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:'calicoctl create -f - <<EOF\n- apiVersion: projectcalico.org/v3\n kind: HostEndpoint\n metadata:\n name: <name of endpoint>\n labels:\n role: webserver\n environment: production\n spec:\n node: <node name or hostname>\n profiles: [<list of profile IDs>]\n expectedIPs: ["10.0.0.1"]\nEOF\n'})})]}),"\n",(0,i.jsx)(n.p,{children:"After you create host endpoint objects, Felix will start policing\ntraffic to/from that interface. If you have no policy or profiles in\nplace, then you should see traffic being dropped on the interface."}),"\n",(0,i.jsx)(n.admonition,{type:"note",children:(0,i.jsx)(n.p,{children:"By default, Calico Enterprise has a failsafe in place that allows certain\ntraffic such as ssh. See below for more details on\ndisabling/configuring the failsafe rules."})}),"\n",(0,i.jsxs)(n.p,{children:["If you don't see traffic being dropped, check the hostname, IP address\nand (if used) the interface name in the configuration. If there was\nsomething wrong with the endpoint data, Felix will log a validation\nerror at ",(0,i.jsx)(n.code,{children:"WARNING"})," level and it will ignore the endpoint:"]}),"\n",(0,i.jsxs)(n.p,{children:["A ",(0,i.jsx)(n.code,{children:"grep"}),' through the Felix logs for the string "Validation failed" should allow\nyou to locate the error.']}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:'grep "Validation failed" /var/log/calico/felix.log\n'})}),"\n",(0,i.jsx)(n.p,{children:"An example error follows."}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{children:'2016-05-31 12:16:21,651 [WARNING][8657/3] calico.felix.fetcd 1017:\n Validation failed for host endpoint HostEndpointId<eth0>, treating as\n missing: \'name\' or \'expected_ipvX_addrs\' must be present.;\n \'{ "labels": {"foo": "bar"}, "profile_ids": ["prof1"]}\'\n'})}),"\n",(0,i.jsxs)(n.p,{children:["The error can be quite long but it should log the precise cause of the\nrejection; in this case ",(0,i.jsx)(n.code,{children:"'name' or 'expected\\_ipvX\\_addrs' must be present"})," tells us that either the interface's name or its expected IP\naddress must be specified."]})]})}function h(e={}){let{wrapper:n}={...(0,s.R)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(l,{...e})}):l(e)}},17869:function(e,n,t){t.d(n,{R:()=>r,x:()=>a});var o=t(16645);let i={},s=o.createContext(i);function r(e){let n=o.useContext(s);return o.useMemo(function(){return"function"==typeof e?e(n):{...n,...e}},[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:r(e.components),o.createElement(s.Provider,{value:n},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.