1"use strict";(self.webpackChunktigera_docs=self.webpackChunktigera_docs||[]).push([["1270"],{88689(e,n,i){i.r(n),i.d(n,{metadata:()=>o,default:()=>h,frontMatter:()=>s,contentTitle:()=>a,toc:()=>l,assets:()=>r});var o=JSON.parse('{"id":"reference/clis/calicoq/overview","title":"calicoq","description":"CLI to verify that your security policies are configured as intended.","source":"@site/calico-enterprise_versioned_docs/version-3.20-2/reference/clis/calicoq/overview.mdx","sourceDirName":"reference/clis/calicoq","slug":"/reference/clis/calicoq/overview","permalink":"/calico-enterprise/3.20/reference/clis/calicoq/overview","draft":false,"unlisted":false,"editUrl":"https://github.com/tigera/docs/edit/main/calico-enterprise_versioned_docs/version-3.20-2/reference/clis/calicoq/overview.mdx","tags":[],"version":"3.20-2","frontMatter":{"description":"CLI to verify that your security policies are configured as intended."},"sidebar":"calicoEnterpriseSidebar","previous":{"title":"calicoq","permalink":"/calico-enterprise/3.20/reference/clis/calicoq/"},"next":{"title":"calicoq and selectors","permalink":"/calico-enterprise/3.20/reference/clis/calicoq/selectors"}}'),c=i(70689),t=i(3413);let s={description:"CLI to verify that your security policies are configured as intended."},a="calicoq",r={},l=[{value:"Datastore configuration",id:"datastore-configuration",level:2},{value:"Commands",id:"commands",level:2},{value:"Overview of usage and options",id:"overview-of-usage-and-options",level:2}];function d(e){let n={a:"a",code:"code",h1:"h1",h2:"h2",header:"header",li:"li",p:"p",pre:"pre",ul:"ul",...(0,t.R)(),...e.components};return(0,c.jsxs)(c.Fragment,{children:[(0,c.jsx)(n.header,{children:(0,c.jsx)(n.h1,{id:"calicoq",children:"calicoq"})}),"\n",(0,c.jsxs)(n.p,{children:[(0,c.jsx)(n.code,{children:"calicoq"})," is the Calico Enterprise policy query utility. It is a command line tool that\nmakes it easy to check your Calico Enterprise security policies.\nSee ",(0,c.jsx)(n.a,{href:"/calico-enterprise/3.20/operations/clis/calicoq/",children:"Installing calicoq"})," for\nhow to download and install ",(0,c.jsx)(n.code,{children:"calicoq"}),"."]}),"\n",(0,c.jsx)(n.h2,{id:"datastore-configuration",children:"Datastore configuration"}),"\n",(0,c.jsxs)(n.p,{children:[(0,c.jsx)(n.code,{children:"calicoq"})," works by querying the Calico Enterprise datastore. For this configuration calicoq uses exactly the same\nsetup as ",(0,c.jsx)(n.code,{children:"calicoctl"}),", which means that:"]}),"\n",(0,c.jsxs)(n.ul,{children:["\n",(0,c.jsxs)(n.li,{children:["\n",(0,c.jsxs)(n.p,{children:["You can create a YAML or JSON config file, and specify that with ",(0,c.jsx)(n.code,{children:"calicoq"}),"'s\n",(0,c.jsx)(n.code,{children:"-c"})," option. This is the best option if you have already created that file\nfor use with ",(0,c.jsx)(n.code,{children:"calicoctl"}),"."]}),"\n"]}),"\n",(0,c.jsxs)(n.li,{children:["\n",(0,c.jsxs)(n.p,{children:["Or you can set environment variables to specify the datastore type and\nlocation: ",(0,c.jsx)(n.code,{children:"DATASTORE_TYPE"})," and so on."]}),"\n"]}),"\n"]}),"\n",(0,c.jsxs)(n.p,{children:["For more detail, see\n",(0,c.jsx)(n.a,{href:"/calico-enterprise/3.20/operations/clis/calicoq/configure/",children:"Configuring calicoq"}),"."]}),"\n",(0,c.jsx)(n.h2,{id:"commands",children:"Commands"}),"\n",(0,c.jsxs)(n.p,{children:["The ",(0,c.jsx)(n.code,{children:"calicoq"})," command line interface provides a number of policy inspection\ncommands to allow you to confirm that your security policies are configured\nas intended."]}),"\n",(0,c.jsxs)(n.ul,{children:["\n",(0,c.jsxs)(n.li,{children:["The ",(0,c.jsx)(n.a,{href:"/calico-enterprise/3.20/reference/clis/calicoq/endpoint",children:"endpoint"}),"\ncommand shows you the Calico Enterprise policies and profiles that relate to specified\nendpoints."]}),"\n",(0,c.jsxs)(n.li,{children:["The ",(0,c.jsx)(n.a,{href:"/calico-enterprise/3.20/reference/clis/calicoq/eval",children:"eval"})," command\ndisplays the endpoints that a selector selects."]}),"\n",(0,c.jsxs)(n.li,{children:["The ",(0,c.jsx)(n.a,{href:"/calico-enterprise/3.20/reference/clis/calicoq/host",children:"host"})," command\ndisplays the policies and profiles that are relevant to all endpoints on a\ngiven host."]}),"\n",(0,c.jsxs)(n.li,{children:["The ",(0,c.jsx)(n.a,{href:"/calico-enterprise/3.20/reference/clis/calicoq/policy",children:"policy"}),"\ncommand shows the endpoints that are relevant to a given policy."]}),"\n",(0,c.jsxs)(n.li,{children:["The ",(0,c.jsx)(n.a,{href:"/calico-enterprise/3.20/reference/clis/calicoq/version",children:"version"}),"\ncommand displays the version of the tool."]}),"\n"]}),"\n",(0,c.jsx)(n.h2,{id:"overview-of-usage-and-options",children:"Overview of usage and options"}),"\n",(0,c.jsx)(n.p,{children:"To access the help:"}),"\n",(0,c.jsx)(n.pre,{children:(0,c.jsx)(n.code,{children:"calicoq -h\n"})}),"\n",(0,c.jsx)(n.p,{children:"The help output follows."}),"\n",(0,c.jsx)(n.pre,{children:(0,c.jsx)(n.code,{children:'Calico query tool.\n\nUsage:\n calicoq [--debug] [--config=<config>] eval <selector>\n calicoq [--debug] [--config=<config>] policy <policy-name> [--hide-selectors|-s] [--hide-rule-matches|-r]\n calicoq [--debug] [--config=<config>] endpoint <substring> [--hide-selectors|-s] [--hide-rule-matches|-r]\n calicoq [--debug] [--config=<config>] host <hostname> [--hide-selectors|-s] [--hide-rule-matches|-r]\n calicoq [--debug] ver
1sion\n\nDescription:\n The calicoq command line tool is used to check Calico security policies.\n\n calicoq eval <selector> is used to display the endpoints that are matched by <selector>.\n\n calicoq policy <policy-name> shows the endpoints that are relevant to the named policy,\n comprising:\n - the endpoints that the policy applies to (for which ingress or egress traffic is policed\n according to the rules in that policy)\n - the endpoints that match the policy\'s rule selectors (that are allowed or disallowed as data\n sources or destinations).\n\n calicoq endpoint <substring> shows you the Calico policies and profiles that relate to endpoints\n whose full ID includes <substring>.\n\n calicoq host <hostname> shows you the endpoints that are hosted on <hostname> and all the Calico\n policies and profiles that relate to those endpoints.\n\nNotes:\n When specifying a namespaced NetworkPolicy name, the namespace should also be included by\n specifying the <policy-name> in the format "<namespace>/<policy-name>". If the namespace is\n omitted it is assumed the name refers to a GlobalNetworkPolicy.\n\n When a Calico policy is mapped from a Kubernetes resource, the name will be prefixed with\n "knp.default". For example to query the Kubernetes NetworkPolicy "test-policy" in the Namespace\n "demo-ns" use the following command:\n calicoq policy demo-ns/knp.default.test-policy\n\n For an endpoint, the full Calico ID is "<host>/<orchestrator>/<workload-name>/<endpoint-name>".\n In the Kubernetes case "<orchestrator>" is always "k8s", "<workload-name>" is "<pod\n namespace>.<pod name>", and "<endpoint-name>" is always "eth0".\n\nOptions:\n -c <config> --config=<config> Path to the file containing connection\n configuration in YAML or JSON format.\n [default: /etc/calico/calicoctl.cfg]\n\n -r --hide-rule-matches Don\'t show the list of policies and profiles whose\n rule selectors match the specified endpoint (or an\n endpoint on the specified host) as an allowed or\n disallowed source/destination.\n\n -s --hide-selectors Don\'t show the detailed selector expressions involved\n (that cause each displayed policy or profile to apply to or match\n various endpoints).\n\n -d --debug Log debugging information to stderr.\n\n -o <output> --output=<output> Output format. Either yaml, json, or ps.\n [default: ps]\n'})})]})}function h(e={}){let{wrapper:n}={...(0,t.R)(),...e.components};return n?(0,c.jsx)(n,{...e,children:(0,c.jsx)(d,{...e})}):d(e)}},3413(e,n,i){i.d(n,{R:()=>s,x:()=>a});var o=i(16645);let c={},t=o.createContext(c);function s(e){let n=o.useContext(t);return o.useMemo(function(){return"function"==typeof e?e(n):{...n,...e}},[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(c):e.components||c:s(e.components),o.createElement(t.Provider,{value:n},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.