https://archive-os-3-29.netlify.app/assets/js/2ec62296.03856683.js

1"use strict";(self.webpackChunktigera_docs=self.webpackChunktigera_docs||[]).push([["4647"],{71487(e,c,r){r.r(c),r.d(c,{metadata:()=>t,default:()=>j,frontMatter:()=>o,contentTitle:()=>d,toc:()=>h,assets:()=>a});var t=JSON.parse('{"id":"reference/etcd-rbac/calico-etcdv3-paths","title":"Calico key and path prefixes","description":"Prefixes to configure Calico components to access the etcd datastore.","source":"@site/calico_versioned_docs/version-3.29/reference/etcd-rbac/calico-etcdv3-paths.mdx","sourceDirName":"reference/etcd-rbac","slug":"/reference/etcd-rbac/calico-etcdv3-paths","permalink":"/calico/3.29/reference/etcd-rbac/calico-etcdv3-paths","draft":false,"unlisted":false,"editUrl":"https://github.com/tigera/docs/edit/main/calico_versioned_docs/version-3.29/reference/etcd-rbac/calico-etcdv3-paths.mdx","tags":[],"version":"3.29","frontMatter":{"description":"Prefixes to configure Calico components to access the etcd datastore."},"sidebar":"calicoSidebar","previous":{"title":"Segmenting etcd on Kubernetes (advanced)","permalink":"/calico/3.29/reference/etcd-rbac/kubernetes-advanced"},"next":{"title":"Configuring calico/node","permalink":"/calico/3.29/reference/configure-calico-node"}}'),s=r(70689),l=r(3413),i=r(27506),n=r(93460);let o={description:"Prefixes to configure Calico components to access the etcd datastore."},d="Calico key and path prefixes",a={},h=[{value:"calico/node",id:"caliconode",level:2},{value:"Felix as a stand alone process",id:"felix-as-a-stand-alone-process",level:2},{value:"CNI-plugin",id:"cni-plugin",level:2},{value:"calico/kube-controllers",id:"calicokube-controllers",level:2},{value:"OpenStack Calico driver for Neutron",id:"openstack-calico-driver-for-neutron",level:2},{value:"OpenStack Calico DHCP agent",id:"openstack-calico-dhcp-agent",level:2},{value:"calicoctl (read only access)",id:"calicoctl-read-only-access",level:2},{value:"calicoctl (policy editor access)",id:"calicoctl-policy-editor-access",level:2},{value:"calicoctl (full read/write access)",id:"calicoctl-full-readwrite-access",level:2}];function x(e){let c={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",header:"header",p:"p",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,l.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(c.header,{children:(0,s.jsx)(c.h1,{id:"calico-key-and-path-prefixes",children:"Calico key and path prefixes"})}),"\n","\n",(0,s.jsxs)(i.A,{children:[(0,s.jsx)(n.A,{label:"Operator",value:"Operator-0",children:(0,s.jsx)(c.p,{children:"This document does not apply to operator installations of Calico."})}),(0,s.jsxs)(n.A,{label:"Manifest",value:"Manifest-1",children:[(0,s.jsx)(c.p,{children:"The paths listed here are the key or path prefixes that a particular Calico\ncomponent needs access to in etcd to function successfully."}),(0,s.jsx)(c.admonition,{type:"note",children:(0,s.jsx)(c.p,{children:"The path prefixes listed here may change in the future and at that point anything\nreferencing them (like etcd roles) would need to be updated appropriately."})}),(0,s.jsx)(c.h2,{id:"caliconode",children:"calico/node"}),(0,s.jsxs)(c.table,{children:[(0,s.jsx)(c.thead,{children:(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.th,{children:"Path"}),(0,s.jsx)(c.th,{children:"Access"})]})}),(0,s.jsxs)(c.tbody,{children:[(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/felix/v1/*"}),(0,s.jsx)(c.td,{children:"RW"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/felix/v2/*"}),(0,s.jsx)(c.td,{children:"RW"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/ipam/v2/*"}),(0,s.jsx)(c.td,{children:"RW"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/resources/v3/projectcalico.org/felixconfigurations/*"}),(0,s.jsx)(c.td,{children:"RW"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/resources/v3/projectcalico.org/nodes/*"}),(0,s.jsx)(c.td,{children:"RW"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/resources/v3/projectcalico.org/workloadendpoints/*"}),(0,s.jsx)(c.td,{children:"RW"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/resources/v3/projectcalico.org/clusterinformations/*"}),(0,s.jsx)(c.td,{children:"RW"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/resources/v3/projectcalico.org/ippools/*"}),(0,s.jsx)(c.td,{children:"RW"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/resources/v3/projectcalico.org/*"}),(0,s.jsx)(c.td,{children:"R"})]})]})]}),(0,s.jsx)(c.h2,{id:"felix-as-a-stand-alone-process",children:"Felix as a 

1stand alone process"}),(0,s.jsxs)(c.table,{children:[(0,s.jsx)(c.thead,{children:(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.th,{children:"Path"}),(0,s.jsx)(c.th,{children:"Access"})]})}),(0,s.jsxs)(c.tbody,{children:[(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/felix/v1/*"}),(0,s.jsx)(c.td,{children:"RW"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/felix/v2/*"}),(0,s.jsx)(c.td,{children:"RW"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/resources/v3/projectcalico.org/*"}),(0,s.jsx)(c.td,{children:"R"})]})]})]}),(0,s.jsx)(c.h2,{id:"cni-plugin",children:"CNI-plugin"}),(0,s.jsxs)(c.table,{children:[(0,s.jsx)(c.thead,{children:(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.th,{children:"Path"}),(0,s.jsx)(c.th,{children:"Access"})]})}),(0,s.jsxs)(c.tbody,{children:[(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/ipam/v2/*"}),(0,s.jsx)(c.td,{children:"RW"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/resources/v3/projectcalico.org/workloadendpoints/*"}),(0,s.jsx)(c.td,{children:"RW"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/resources/v3/projectcalico.org/ippools/*"}),(0,s.jsx)(c.td,{children:"R"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/resources/v3/projectcalico.org/clusterinformations/*"}),(0,s.jsx)(c.td,{children:"R"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/resources/v3/projectcalico.org/nodes/*"}),(0,s.jsx)(c.td,{children:"R"})]})]})]}),(0,s.jsx)(c.h2,{id:"calicokube-controllers",children:"calico/kube-controllers"}),(0,s.jsxs)(c.table,{children:[(0,s.jsx)(c.thead,{children:(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.th,{children:"Path"}),(0,s.jsx)(c.th,{children:"Access"})]})}),(0,s.jsxs)(c.tbody,{children:[(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/ipam/v2/*"}),(0,s.jsx)(c.td,{children:"RW"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/resources/v3/projectcalico.org/profiles/*"}),(0,s.jsx)(c.td,{children:"RW"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/resources/v3/projectcalico.org/networkpolicies/*"}),(0,s.jsx)(c.td,{children:"RW"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/resources/v3/projectcalico.org/nodes/*"}),(0,s.jsx)(c.td,{children:"RW"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/resources/v3/projectcalico.org/clusterinformations/*"}),(0,s.jsx)(c.td,{children:"RW"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/resources/v3/projectcalico.org/hostendpoints/*"}),(0,s.jsx)(c.td,{children:"RW"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/resources/v3/projectcalico.org/kubecontrollersconfigurations/*"}),(0,s.jsx)(c.td,{children:"RW"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/resources/v3/projectcalico.org/*"}),(0,s.jsx)(c.td,{children:"R"})]})]})]}),(0,s.jsx)(c.admonition,{type:"note",children:(0,s.jsxs)(c.p,{children:["By default, ",(0,s.jsx)(c.code,{children:"calico/kube-controllers"})," performs periodic\ncompaction of the etcd data store. If you limit it to just these\npaths it will be unauthorized to perform this compaction, as that\noperation requires root privileges on the etcd cluster. You should\n",(0,s.jsx)(c.a,{href:"https://etcd.io/docs/v3.3.12/op-guide/maintenance/",children:"configure auto-compaction"}),"\non your etcd cluster and\n",(0,s.jsxs)(c.a,{href:"/calico/3.29/reference/kube-controllers/configuration",children:["disable ",(0,s.jsx)(c.code,{children:"calico/kube-controllers"})," periodic compaction"]}),"."]})}),(0,s.jsx)(c.h2,{id:"openstack-calico-driver-for-neutron",children:"OpenStack Calico driver for Neutron"}),(0,s.jsxs)(c.table,{children:[(0,s.jsx)(c.thead,{children:(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.th,{children:"Path"}),(0,s.jsx)(c.th,{children:"Access"})]})}),(0,s.jsxs)(c.tbody,{children:[(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/resources/v3/projectcalico.org/*"}),(0,s.jsx)(c.td,{children:"RW"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/dhcp/v1/*"}),(0,s.jsx)(c.td,{children:"RW"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/dhcp/v2/*"}),(0,s.jsx)(c.td,{children:"RW"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/compaction/v1/*"}),(0,s.jsx)(c.td,{children:"RW"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/openstack/v1/*"}),(0,s.jsx)(c.td,{children:"RW"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/openstack/v2/*"}),(0,s.jsx)(c.td,{children:"RW"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/felix/v1/*"}),(0,s.jsx)(c.td,{children:"R"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/felix/v2/*"}),(0,s.jsx)(c.td,{children:"R"})]})]})]}),(0,s.jsx)(c.h2,{id:"openstack-calico-dhcp-agent",children:"OpenStack Calico DHCP agent"}),(0,s.jsxs)(c.table,{children:[(0,s.jsx)(c.thead,{children:(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.th,{children:"Path"}),(0,s.jsx)(c.th,{children:"Access"})]})}),(0,s.jsxs)(c.tbody,{children:[(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/resources/v3/projectcalico.org/*"}),(0,s.jsx)(c.td,{children:"R"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/dhcp/v1/*"}),(0,s.jsx)(c.td,{children:"R"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/dhcp/v2/*"}),(0,s.jsx)(c.td,{children:"R"})]})]})]}),(0,s.jsx)(c.h2,{id:"calicoctl-read-only-access",children:"calicoctl (read only access)"}),(0,s.jsxs)(c.table,{children:[(0,s.jsx)(c.thead,{children:(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.th,{children:"Path"}),(0,s.jsx)(c.th,{children:"Access"})]})}),(0,s.jsxs)(c.tbody,{children:[(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/ipam/v2/*"}),(0,s.jsx)(c.td,{children:"R"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/resources/v3/projectcalico.org/*"}),(0,s.jsx)(c.td,{children:"R"})]})]})]}),(0,s.jsx)(c.h2,{id:"calicoctl-policy-editor-access",children:"calicoctl (policy editor access)"}),(0,s.jsxs)(c.table,{children:[(0,s.jsx)(c.thead,{children:(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.th,{children:"Path"}),(0,s.jsx)(c.th,{children:"Access"})]})}),(0,s.jsxs)(c.tbody,{children:[(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/ipam/v2/*"}),(0,s.jsx)(c.td,{children:"R"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/resources/v3/projectcalico.org/*"}),(0,s.jsx)(c.td,{children:"R"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/resources/v3/projectcalico.org/globalnetworkpolicies/*"}),(0,s.jsx)(c.td,{children:"RW"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/resources/v3/projectcalico.org/globalnetworksets/*"}),(0,s.jsx)(c.td,{children:"RW"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/resources/v3/projectcalico.org/networkpolicies/*"}),(0,s.jsx)(c.td,{children:"RW"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/resources/v3/projectcalico.org/networksets/*"}),(0,s.jsx)(c.td,{children:"RW"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/resources/v3/projectcalico.org/profiles/*"}),(0,s.jsx)(c.td,{children:"RW"})]})]})]}),(0,s.jsx)(c.h2,{id:"calicoctl-full-readwrite-access",children:"calicoctl (full read/write access)"}),(0,s.jsxs)(c.table,{children:[(0,s.jsx)(c.thead,{children:(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.th,{children:"Path"}),(0,s.jsx)(c.th,{children:"Access"})]})}),(0,s.jsxs)(c.tbody,{children:[(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/ipam/v2/*"}),(0,s.jsx)(c.td,{children:"RW"})]}),(0,s.jsxs)(c.tr,{children:[(0,s.jsx)(c.td,{children:"/calico/resources/v3/projectcalico.org/*"}),(0,s.jsx)(c.td,{children:"RW"})]})]})]})]})]})]})}function j(e={}){let{wrapper:c}={...(0,l.R)(),...e.components};return c?(0,s.jsx)(c,{...e,children:(0,s.jsx)(x,{...e})}):x(e)}},93460(e,c,r){r.d(c,{A:()=>n});var t=r(70689);r(16645);var s=r(74998),l=r(24236);function i({children:e,className:c,hidden:r}){return(0,t.jsx)("div",{role:"tabpanel",className:(0,s.A)("tabItem_i_uI",c),hidden:r,children:e})}function n({children:e,className:c,value:r}){let{selectedValue:s,lazy:o}=(0,l.uc)(),d=r===s;return!d&&o?null:(0,t.jsx)(i,{className:c,hidden:!d,children:e})}},27506(e,c,r){r.d(c,{A:()=>x});var t=r(70689);r(16645);var s=r(74998),l=r(44336),i=r(24236),n=r(58319),o=r(97947);function d({className:e}){let{selectedValue:c,selectValue:r,tabValues:l,block:o}=(0,i.uc)(),a=[],{blockElementScrollPositionUntilNextRender:h}=(0,n.a_)(),x=e=>{let t=e.currentTarget,s=l[a.indexOf(t)].value;s!==c&&(h(t),r(s))},j=e=>{let c=null;switch(e.key){case"Enter":x(e);break;case"ArrowRight":{let r=a.indexOf(e.currentTarget)+1;c=a[r]??a[0];break}case"ArrowLeft":{let r=a.indexOf(e.currentTarget)-1;c=a[r]??a[a.length-1]}}c?.focus()};return(0,t.jsx)("ul",{role:"tablist","aria-orientation":"horizontal",className:(0,s.A)("tabs",{"tabs--block":o},e),children:l.map(({value:e,label:r,attributes:l})=>(0,t.jsx)("li",{role:"tab",tabIndex:c===e?0:-1,"aria-selected":c===e,ref:e=>{a.push(e)},onKeyDown:j,onClick:x,...l,className:(0,s.A)("tabs__item","tabItem_NNQm",l?.className,{"tabs__item--active":c===e}),children:r??e},e))})}function a({children:e}){return(0,t.jsx)("div",{className:"margin-top--md",children:e})}function h({className:e,children:c}){return(0,t.jsxs)("div",{className:(0,s.A)(l.G.tabs.container,"tabs-container","tabList_C8yV"),children:[(0,t.jsx)(d,{className:e}),(0,t.jsx)(a,{children:c})]})}function x(e){let c=(0,o.A)(),r=(0,i.OC)(e);return(0,t.jsx)(i.O_,{value:r,children:(0,t.jsx)(h,{className:e.className,children:(0,i.vT)(e.children)})},String(c))}},24236(e,c,r){r.d(c,{OC:()=>x,O_:()=>p,uc:()=>u,vT:()=>a});var t=r(70689),s=r(16645),l=r(64097),i=r(50297),n=r(74832),o=r(2721),d=r(95219);function a(e){return s.Children.toArray(e).filter(e=>"\n"!==e)}function h({value:e,tabValues:c}){return c.some(c=>c.value===e)}function x(e){let c,{defaultValue:r,queryString:t=!1,groupId:a}=e,x=function(e){let{values:c,children:r}=e;return(0,s.useMemo)(()=>{let e=c??s.Children.toArray(r).flatMap(e=>{if(!e)return[];if((0,s.isValidElement)(e)&&function(e){let{props:c}=e;return!!c&&"object"==typeof c&&"value"in c}(e))return[e];

1let c="string"==typeof e.type?e.type:e.type.name;throw Error(`Docusaurus error: Bad <Tabs> child <${c}>: all children of the <Tabs> component should be <TabItem>, and every <TabItem> should have a unique "value" prop.
2If you do not want to pass on a "value" prop to the direct children of <Tabs>, you can also pass an explicit <Tabs values={...}> prop.`)}).map(({props:{value:e,label:c,attributes:r,default:t}})=>({value:e,label:c,attributes:r,default:t})),t=(0,o.XI)(e,(e,c)=>e.value===c.value);if(t.length>0)throw Error(`Docusaurus error: Duplicate values "${t.map(e=>`'${e.value}'`).join(", ")}" found in <Tabs>. Every value needs to be unique.`);return e},[c,r])}(e),[j,u]=(0,s.useState)(()=>(function({defaultValue:e,tabValues:c}){if(0===c.length)throw Error("Docusaurus error: the <Tabs> component requires at least one <TabItem> children component");if(e){if(!h({value:e,tabValues:c}))throw Error(`Docusaurus error: The <Tabs> has a defaultValue "${e}" but none of its children has the corresponding value. Available values are: ${c.map(e=>e.value).join(", ")}. If you intend to show no default tab, use defaultValue={null} instead.`);return e}let r=c.find(e=>e.default)??c[0];if(!r)throw Error("Unexpected error: 0 tabValues");return r.value})({defaultValue:r,tabValues:x})),[p,f]=function({queryString:e=!1,groupId:c}){let r=(0,l.W6)(),t=function({queryString:e=!1,groupId:c}){if("string"==typeof e)return e;if(!1===e)return null;if(!0===e&&!c)throw Error('Docusaurus error: The <Tabs> component groupId prop is required if queryString=true, because this value is used as the search param name. You can also provide an explicit value such as queryString="my-search-param".');return c??null}({queryString:e,groupId:c});return[(0,n.aZ)(t),(0,s.useCallback)(e=>{if(!t)return;let c=new URLSearchParams(r.location.search);c.set(t,e),r.replace({...r.location,search:c.toString()})},[t,r])]}({queryString:t,groupId:a}),[v,b]=function({groupId:e}){let c=e?`docusaurus.tab.${e}`:null,[r,t]=(0,d.Dv)(c);return[r,(0,s.useCallback)(e=>{c&&t.set(e)},[c,t])]}({groupId:a}),m=h({value:c=p??v,tabValues:x})?c:null;return(0,i.A)(()=>{m&&u(m)},[m]),{selectedValue:j,selectValue:(0,s.useCallback)(e=>{if(!h({value:e,tabValues:x}))throw Error(`Can't select invalid tab value=${e}`);u(e),f(e),b(e)},[f,b,x]),tabValues:x,lazy:e.lazy??!1,block:e.block??!1}}let j=(0,s.createContext)(null);function u(){let e=s.useContext(j);if(!e)throw Error("useTabsContext() must be used within a Tabs component");return e}function p(e){return(0,t.jsx)(j.Provider,{value:e.value,children:e.children})}},3413(e,c,r){r.d(c,{R:()=>i,x:()=>n});var t=r(16645);let s={},l=t.createContext(s);function i(e){let c=t.useContext(l);return t.useMemo(function(){return"function"==typeof e?e(c):{...c,...e}},[c,e])}function n(e){let c;return c=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:i(e.components),t.createElement(l.Provider,{value:c},e.children)}}}]);