Questions tagged [project-calico]

Project Calico aims to simplify, scale, and secure cloud networks.

Filter by
Sorted by
Tagged with
0 votes
0 answers
29 views

Configure service cidr of the cluster with calico policy only

Cluster -> pod cidr - 10.255.0.0/16 service cidr - 10.252.0.0/16 Using - https://github.com/projectcalico/calico/blob/master/manifests/calico-policy-only.yaml I am using flannel as cni plugin ...
  • 1,028
0 votes
0 answers
44 views

how to import a route from external BGP peer in calico BGP network

topology In my lab node1 have leaned an external route which is 88.88.88.88, but it do not pass to master and node 2. How can I debug to know if node1 have transmit the route to others ,and What ...
  • 11
0 votes
0 answers
65 views

Why does minikube cluster goes away from kind cluster gets deleted?

So I first start a minikube cluster (1.25.2) using minikube start. Then I bring up a kind cluster using some kind-Calico-conf.yml file: $ kind create cluster --name=calico --config=./kind-Calico-conf....
  • 1,349
0 votes
0 answers
119 views

Can we use calico network policies and pod security groups in EKS simultaneously?

I am trying to control pod to pod communication in EKS at layer 3/4 of OSI model. I am thinking to choose calico for east-west traffic ( pod to pod communication ) and pod to pod security groups for ...
  • 2,870
0 votes
0 answers
113 views

Kubernetes CALICO globalNetworkpolicy denying authorized traffic

i'm pretty new to CALICO CNI (and more generally in kubernetes) and i'm currently testing the CALICO Open Source solution to evaluate it's network policies filtering features. Installation 'on premise'...
0 votes
0 answers
36 views

blackhole 10.xx.xx.xx/26 proto bird - Calico - K8s

In the K8s cluster, we see that few of the nodes we have "blackhole 10.xx.xx.xx/26 proto bird". Would like to know how this would impact the K8s pod connectivity and can it be removed ...
  • 1
0 votes
0 answers
539 views

kubernetes pod not able to connect to database in same network

I've setup a kubernetes cluster in my network and a postgres database in same network. I am able to connect my java app to my postgres database if I run it over in a container or a VM. But some how ...
  • 51
0 votes
0 answers
126 views

NodePort service is not load balancing by source ip but by (source ip+destnation port of server)

I have migrated IMS (IP Multimedia Service ) as a service on kubernetes with Calico Cni . IMS node has a pcscf server which is running as a NodePort service. For this service, 3 pcscf pods are ...
1 vote
1 answer
386 views

Calico Cloud - Egress domain network policy issue

I am trying to configure egress traffic using domains via Calico Cloud. I am aware that DNS feature is possible with paid Calico Enterprise or Calico Cloud as mentioned here. I am using calico cloud ...
  • 12.3k
0 votes
1 answer
198 views

microk8s configuration location (current vs x1)

I have a microk8s installed on a ubuntu EC2 instance. I have kubernetes 1.21 with calico cni installed. These are installed with snap. I am trying to enable dual stack(ipv4 and ipv6) for the ...
1 vote
2 answers
301 views

Protect Kubernetes hosts

I have a kubernetes cluster with calico. I want to prevent routing through external interfaces to reach the internal clusterIPs of the cluster. I am planning to use this. For which interfaces should ...
0 votes
1 answer
155 views

Calico Global Network Policy and ip table rules

I am trying to understand how do Calico Global Network Policies work "under the hood". Let's say I have lots of (namespaced) network policies. For example, the same policy deployed to lots ...
3 votes
0 answers
291 views

Calico - nf_conntrack_proto_sctp

I noticed this error in the calico log. calico-node [INFO][2355687] felix/int_dataplane.go 1660: attempted to modprobe nf_conntrack_proto_sctp error=exit status 1 output="" It attempts to ...
0 votes
1 answer
171 views

How to access ACR images from calico.yaml

I have a k3s cluster with calico pods calico-node-xxx & calico-kube-controllers-xxx running in kube-system namespace. I am using calico.yaml config in my project. Now, I want these images in ...
  • 155
1 vote
1 answer
161 views

calico network dependency on killall.sh in k3s

I have a k3s cluster that have system pods with calico policy applied: kube-system pod/calico-node-xxxx kube-system pod/calico-kube-controllers-xxxxxx kube-system ...
  • 729
0 votes
1 answer
1k views

Deleting Iptables -S of calico

I am trying to delete all calico related Iptables using calico-script . After running this script most of the calico iptables is removed except these: root@Ubuntu-18-VM:~# iptables -S | grep -oP '(?&...
  • 729
2 votes
1 answer
4k views

"Calico CNI - calico-kube-controllers Failed to initialize Calico data store" error

I am running Calico CNI v3.19.1 on Kubernetes version v1.19.13. using CentOS Steam 8 and RHEL 8 OS for this cluster with 3 master and 3 nodes. when calico-kube-controller starts on the worker node. ...
  • 17.6k
0 votes
1 answer
173 views

Find out GKE Calico policy?

I have GKE cluster running with Version - 1.19.9-gke.1900 and trying to find out what type of Calcio policy is being used? I read through articles, calico provides different policy and below are the ...
0 votes
2 answers
898 views

How to delete calicoctl and iptables (created by calico installation) from my k3s

I have a K3s setup with calico pods [calico-node- & calico-kube-controllers-] running. On uninstalling K3s, calico pods get deleted but I see that calicoctl and iptables -S commands still running ...
  • 729
1 vote
1 answer
502 views

Kubernetes Egress call restrict with namespace

I have application running in K3s and want to implement network policy based on namespace only. Let's assume that currently I have three namespace A, B and C. I want to allow egress (external call to ...
  • 729
0 votes
1 answer
289 views

DNSSelector support in Kubernetes Network policy

I am trying to implement Kubernetes Network policy in my application on the basis of domain name to control the Egress and Ingress calls to the pod. I found DNSSelector but it seems from there last ...
  • 729
0 votes
2 answers
456 views

Starting with Calico network policy in Kubernetes

I have a application running with kubernetes orchestrator. I want to implement calico network policy on the basis of CIDR so that I can control the pod's traffic (incoming and outgoing). I am looking ...
  • 729
1 vote
1 answer
269 views

EKS Block specific external IP from viewing nginx application

I have an EKS cluster with an nginx deployment on namespace gitlab-managed-apps. Exposing the application to the public from ALB ingress. I'm trying to block a specific Public IP (ex: x.x.x.x/32) from ...
1 vote
1 answer
980 views

Static ip adress for kubernetes pods with calico cni

I'm currently using 10.222.0.0/16 network for my pods on a single node cluster test environment. When I reboot the machine or redeploy pods they get the first ip address which has not been used ...
  • 179
0 votes
1 answer
197 views

Q: Rancher + Calico + Ununtu 20.04 bare metal - no access to service network (10.43.0.10)

Looking for a peice of advice on troubleshooting an issue with Rancher + Calico on a bare metal Ubuntu 20.04. Here is the issue. We have few Rancher (2.5.7) clusters built on top of Ubuntu 20.04 ...
0 votes
1 answer
351 views

Kubernetes Networkpolicy dosen't block traffic

i've a namespace called: test, and containing 3 pods: frontend, backend and database. this is the manifest of pods: kind: Pod apiVersion: v1 metadata: name: frontend namespace: test labels: ...
0 votes
2 answers
2k views

Running calicoctl on Windows results in error: Failed to create Calico API client: invalid configuration: no configuration has been provided

I'm using k3d with calico, and trying to use calicoctl to set a network policy. I am able to get this working on Ubuntu, but on Windows it doesn't. To set it up I did the following: # Download Calico ...
  • 24.2k
0 votes
1 answer
3k views

Why does this pod get a 403 Forbidden when calling the Kubernetes API despite a RoleBinding (same with ClusterRoleBinding)?

I created a pod (an Alpine "BusyBox" to run commands in) which then gets the default service account associated with it. I then created a RoleBinding (and later ClusterRoleBinding when the ...
  • 24.2k
0 votes
1 answer
1k views

Unable to run calico ingress and egress rules

I have been trying to experiment with the calico network rules and I'm finding it tough to get the ingress and the egress rules to work with order in calico after denying all ingress and egress rules. ...
0 votes
1 answer
1k views

error converting YAML to JSON: yaml: line 182: did not find expected '-' indicator in calico yaml [closed]

I am setting up Kubernetes cluster network configuration through calico and while performing 'kubectl apply -f calico.yaml', I get the following error error: error parsing calico.yaml: error ...
1 vote
1 answer
121 views

Why can't I reach a pod in another namespace using the format http://<ip_with_dashes>.<namespace>.pod.cluster.local?

I created a namespace and a pod in it like this: # Create the namespace kubectl create namespace one # Create the pod (NOTE - Without a service) kubectl run rest -n one --image nginx --labels app=...
  • 24.2k
1 vote
1 answer
1k views

Pods can't ping each other in a kubernetes cluster spawned over nodes from two different subnets

I am trying to bring up an on-prem k8 cluster using kubespray with 3 master and 5 worker nodes. The node IPs are from 2 different subnets. Ansible inventory: hosts: saba-k8-vm-m1: ansible_host: 192....
  • 115
3 votes
2 answers
3k views

Project Calico: Priority between "global policy" and "network policy"

I am testing Project Calico on a small Kubernetes cluster and I try to figure out which one between "global policy" and "network policy" will be applied to the data stream first. ...
  • 31
0 votes
0 answers
225 views

DNS lookup still getting blocked even when authorized

My rule allowing DNS with Calico's Network Policy isn't working. Using CURL with a DNS is still blocked ! My use case : I want all external networking to be dropped except communication to an S3 ...
  • 6,607
0 votes
1 answer
487 views

Unable to "get" my calico node using calicoctl

I am trying to examine my node to potentially fix my nodes, but the command "get" is failing. the error is Failed to create Calico API client... error parsing document: fields in document ...
4 votes
1 answer
421 views

Kubernetes NetworkPolicy limit egress traffic to service

Is it possible to allow egress traffic only to the specific service? This is my naive try to do that: kind: NetworkPolicy metadata: name: default-deny-all-egress namespace: default spec: ...
  • 4,571
3 votes
1 answer
974 views

Unable to setup Calico on Kubernetes

Trying to set up Calico on-premises Kubernetes cluster. Initializing cluster kubeadm init --pod-network-cidr=192.168.0.0/16 Using https://docs.projectcalico.org/manifests/calico.yaml manifest. ~# ...
  • 4,571
0 votes
2 answers
1k views

Kubernetes: Calio not working on remote worker, local ok

I setup a Kubernetes cluster with calico. The setup is "simple" 1x master (local network, ok) 1x node (local network, ok) 1x node (cloud server, not ok) All debian buster with docker 19.03 ...
0 votes
0 answers
522 views

Kubernetes: can't join on different subnet - TLS Bootstrap timeout

I have two Ubuntu 18.04 Server machines on AWS (the network conf its okay, I'm able even to connect through SSH between them but they are on different subnets of the same LAN). Ubuntu firewall also ...
1 vote
2 answers
2k views

Kubernetes - calico IP_AUTODETECTION_METHOD impossible to set

I want to force the interface, setting the IP_AUTODETECTION_METHOD: $ kubectl set env daemonset/calico-node -n calico-system IP_AUTODETECTION_METHOD=interface=ens192 daemonset.apps/calico-node env ...
  • 11
2 votes
0 answers
361 views

Unable to reach the mutating webhooks in aws eks

I am using amamzon eks cluster with calico cni plugin installed. I deployed flink operator which will register mutating webhooks for the purpose of flink cluster handling to the cluster. I am ...
1 vote
0 answers
570 views

K8s DNS resolutions not working for all pods

I currently have a k8s cluster setup on my Ubuntu machine using kubeadm. For the CNI, I am using calico. I am debugging the following DNS issue (I've seen numerous posts for this): [ERROR] plugin/...
1 vote
2 answers
1k views

route missed in kubernetes with calico

I am installing k8s with calico on centos8, everything looks well but I couldn't ping each other between pods. I am using k8s as DATASTORE of calico, the deployment file is in calico.yaml I don't know ...
  • 21
1 vote
1 answer
525 views

Kubernets PODs running on different host, not able to establish TCP connection

I have Kubernets 1.20.1 cluster with single master and single worker configured with ipvs mode. Using calico CNI calico/cni:v3.16.1. Cluster running on OS RHEL 8 kernel 4.18.0-240.10 with firewalld ...
  • 17.6k
1 vote
2 answers
3k views

Calico prints "Hit error connecting to datastore: connection refused"

I created a cluster on an Ubuntu server using this command: > kubeadm init --cri-socket /var/run/dockershim.sock --control-plane-endpoint servername.local --apiserver-cert-extra-sans servername....
  • 224
1 vote
0 answers
2k views

How to troubleshot: Kubernetes pods not creating or terminating

I am new at K8s so I am having troubles getting to the button of the issue. Last week I installed a cluster with 1 master 2 nodes in centos with kubeadm: kubectl get nodes NAME STATUS ...
2 votes
2 answers
2k views

How to find out what podcidr is assigned to each node by calico CNI in kubernetes

Is there any direct command to fetch the podcidr assigned to each node when using calico CNI. I am looking for exact network and netmask assigned to each node. I am not able to fetch it from kubectl ...
0 votes
1 answer
870 views

Global Policy to default allow traffic within namespaces

We are setting up a strict default deny policy with calico to disable any traffic except the failsafe rules. Now we have multiple namespaces that are increasing since every application is scoped with ...
  • 301
1 vote
1 answer
857 views

Calico GlobalNetworkPolicy exclusion not working

Recently started with Calico network policies on a AKS cluster. The plan is to block all traffic for new namespaces with the exception of traffic destined for the coredeDNS pod labeled "kube-dns&...
3 votes
1 answer
1k views

calico network connectivity failing between pods and services and pods in different hosts

I have implemented a multi master HA kubernetes cluster and wanted to implement the Calico the hardway as described in here. I was able complete all the steps and my connectivity is not there between ...