Questions tagged [project-calico]
Project Calico aims to simplify, scale, and secure cloud networks.
171
questions
0
votes
0
answers
29
views
Configure service cidr of the cluster with calico policy only
Cluster ->
pod cidr - 10.255.0.0/16
service cidr - 10.252.0.0/16
Using - https://github.com/projectcalico/calico/blob/master/manifests/calico-policy-only.yaml
I am using flannel as cni plugin ...
0
votes
0
answers
44
views
how to import a route from external BGP peer in calico BGP network
topology
In my lab node1 have leaned an external route which is 88.88.88.88, but it do not pass to master and node 2.
How can I debug to know if node1 have transmit the route to others ,and What ...
0
votes
0
answers
65
views
Why does minikube cluster goes away from kind cluster gets deleted?
So I first start a minikube cluster (1.25.2) using minikube start. Then I bring up a kind cluster using some kind-Calico-conf.yml file:
$ kind create cluster --name=calico --config=./kind-Calico-conf....
0
votes
0
answers
119
views
Can we use calico network policies and pod security groups in EKS simultaneously?
I am trying to control pod to pod communication in EKS at layer 3/4 of OSI model. I am thinking to choose calico for east-west traffic ( pod to pod communication ) and pod to pod security groups for ...
0
votes
0
answers
113
views
Kubernetes CALICO globalNetworkpolicy denying authorized traffic
i'm pretty new to CALICO CNI (and more generally in kubernetes) and i'm currently testing the CALICO Open Source solution to evaluate it's network policies filtering features.
Installation 'on premise'...
0
votes
0
answers
36
views
blackhole 10.xx.xx.xx/26 proto bird - Calico - K8s
In the K8s cluster, we see that few of the nodes we have "blackhole 10.xx.xx.xx/26 proto bird". Would like to know how this would impact the K8s pod connectivity and can it be removed ...
0
votes
0
answers
539
views
kubernetes pod not able to connect to database in same network
I've setup a kubernetes cluster in my network and a postgres database in same network. I am able to connect my java app to my postgres database if I run it over in a container or a VM. But some how ...
0
votes
0
answers
126
views
NodePort service is not load balancing by source ip but by (source ip+destnation port of server)
I have migrated IMS (IP Multimedia Service ) as a service on kubernetes with Calico Cni . IMS node has a pcscf server which is running as a NodePort service. For this service, 3 pcscf pods are ...
1
vote
1
answer
386
views
Calico Cloud - Egress domain network policy issue
I am trying to configure egress traffic using domains via Calico Cloud.
I am aware that DNS feature is possible with paid Calico Enterprise or Calico Cloud as mentioned here. I am using calico cloud ...
0
votes
1
answer
198
views
microk8s configuration location (current vs x1)
I have a microk8s installed on a ubuntu EC2 instance. I have kubernetes 1.21 with calico cni installed. These are installed with snap.
I am trying to enable dual stack(ipv4 and ipv6) for the ...
1
vote
2
answers
301
views
Protect Kubernetes hosts
I have a kubernetes cluster with calico. I want to prevent routing through external interfaces to reach the internal clusterIPs of the cluster. I am planning to use this.
For which interfaces should ...
0
votes
1
answer
155
views
Calico Global Network Policy and ip table rules
I am trying to understand how do Calico Global Network Policies work "under the hood". Let's say I have lots of (namespaced) network policies. For example, the same policy deployed to lots ...
3
votes
0
answers
291
views
Calico - nf_conntrack_proto_sctp
I noticed this error in the calico log.
calico-node [INFO][2355687] felix/int_dataplane.go 1660: attempted to modprobe nf_conntrack_proto_sctp error=exit status 1 output=""
It attempts to ...
0
votes
1
answer
171
views
How to access ACR images from calico.yaml
I have a k3s cluster with calico pods calico-node-xxx & calico-kube-controllers-xxx running in kube-system namespace. I am using calico.yaml config in my project.
Now, I want these images in ...
1
vote
1
answer
161
views
calico network dependency on killall.sh in k3s
I have a k3s cluster that have system pods with calico policy applied:
kube-system pod/calico-node-xxxx
kube-system pod/calico-kube-controllers-xxxxxx
kube-system ...
0
votes
1
answer
1k
views
Deleting Iptables -S of calico
I am trying to delete all calico related Iptables using calico-script . After running this script most of the calico iptables is removed except these:
root@Ubuntu-18-VM:~# iptables -S | grep -oP '(?&...
2
votes
1
answer
4k
views
"Calico CNI - calico-kube-controllers Failed to initialize Calico data store" error
I am running Calico CNI v3.19.1 on Kubernetes version v1.19.13. using CentOS Steam 8 and RHEL 8 OS for this cluster with 3 master and 3 nodes.
when calico-kube-controller starts on the worker node. ...
0
votes
1
answer
173
views
Find out GKE Calico policy?
I have GKE cluster running with Version - 1.19.9-gke.1900 and trying to find out what type of Calcio policy is being used? I read through articles, calico provides different policy and below are the ...
0
votes
2
answers
898
views
How to delete calicoctl and iptables (created by calico installation) from my k3s
I have a K3s setup with calico pods [calico-node- & calico-kube-controllers-] running. On uninstalling K3s, calico pods get deleted but I see that calicoctl and iptables -S commands still running ...
1
vote
1
answer
502
views
Kubernetes Egress call restrict with namespace
I have application running in K3s and want to implement network policy based on namespace only.
Let's assume that currently I have three namespace A, B and C. I want to allow egress (external call to ...
0
votes
1
answer
289
views
DNSSelector support in Kubernetes Network policy
I am trying to implement Kubernetes Network policy in my application on the basis of domain name to control the Egress and Ingress calls to the pod. I found DNSSelector but it seems from there last ...
0
votes
2
answers
456
views
Starting with Calico network policy in Kubernetes
I have a application running with kubernetes orchestrator. I want to implement calico network policy on the basis of CIDR so that I can control the pod's traffic (incoming and outgoing). I am looking ...
1
vote
1
answer
269
views
EKS Block specific external IP from viewing nginx application
I have an EKS cluster with an nginx deployment on namespace gitlab-managed-apps. Exposing the application to the public from ALB ingress. I'm trying to block a specific Public IP (ex: x.x.x.x/32) from ...
1
vote
1
answer
980
views
Static ip adress for kubernetes pods with calico cni
I'm currently using 10.222.0.0/16 network for my pods on a single node cluster test environment.
When I reboot the machine or redeploy pods they get the first ip address which has not been used ...
0
votes
1
answer
197
views
Q: Rancher + Calico + Ununtu 20.04 bare metal - no access to service network (10.43.0.10)
Looking for a peice of advice on troubleshooting an issue with Rancher + Calico on a bare metal Ubuntu 20.04.
Here is the issue.
We have few Rancher (2.5.7) clusters built on top of Ubuntu 20.04 ...
0
votes
1
answer
351
views
Kubernetes Networkpolicy dosen't block traffic
i've a namespace called: test, and containing 3 pods: frontend, backend and database.
this is the manifest of pods:
kind: Pod
apiVersion: v1
metadata:
name: frontend
namespace: test
labels:
...
0
votes
2
answers
2k
views
Running calicoctl on Windows results in error: Failed to create Calico API client: invalid configuration: no configuration has been provided
I'm using k3d with calico, and trying to use calicoctl to set a network policy. I am able to get this working on Ubuntu, but on Windows it doesn't. To set it up I did the following:
# Download Calico ...
0
votes
1
answer
3k
views
Why does this pod get a 403 Forbidden when calling the Kubernetes API despite a RoleBinding (same with ClusterRoleBinding)?
I created a pod (an Alpine "BusyBox" to run commands in) which then gets the default service account associated with it. I then created a RoleBinding (and later ClusterRoleBinding when the ...
0
votes
1
answer
1k
views
Unable to run calico ingress and egress rules
I have been trying to experiment with the calico network rules and I'm finding it tough to get the ingress and the egress rules to work with order in calico after denying all ingress and egress rules.
...
0
votes
1
answer
1k
views
error converting YAML to JSON: yaml: line 182: did not find expected '-' indicator in calico yaml [closed]
I am setting up Kubernetes cluster network configuration through calico and while performing
'kubectl apply -f calico.yaml', I get the following error
error: error parsing calico.yaml: error ...
1
vote
1
answer
121
views
Why can't I reach a pod in another namespace using the format http://<ip_with_dashes>.<namespace>.pod.cluster.local?
I created a namespace and a pod in it like this:
# Create the namespace
kubectl create namespace one
# Create the pod (NOTE - Without a service)
kubectl run rest -n one --image nginx --labels app=...
1
vote
1
answer
1k
views
Pods can't ping each other in a kubernetes cluster spawned over nodes from two different subnets
I am trying to bring up an on-prem k8 cluster using kubespray with 3 master and 5 worker nodes. The node IPs are from 2 different subnets.
Ansible inventory:
hosts:
saba-k8-vm-m1:
ansible_host: 192....
3
votes
2
answers
3k
views
Project Calico: Priority between "global policy" and "network policy"
I am testing Project Calico on a small Kubernetes cluster and I try to figure out which one between "global policy" and "network policy" will be applied to the data stream first.
...
0
votes
0
answers
225
views
DNS lookup still getting blocked even when authorized
My rule allowing DNS with Calico's Network Policy isn't working. Using CURL with a DNS is still blocked !
My use case : I want all external networking to be dropped except communication to an S3 ...
0
votes
1
answer
487
views
Unable to "get" my calico node using calicoctl
I am trying to examine my node to potentially fix my nodes, but the command "get" is failing.
the error is
Failed to create Calico API client... error parsing document: fields in document ...
4
votes
1
answer
421
views
Kubernetes NetworkPolicy limit egress traffic to service
Is it possible to allow egress traffic only to the specific service?
This is my naive try to do that:
kind: NetworkPolicy
metadata:
name: default-deny-all-egress
namespace: default
spec:
...
3
votes
1
answer
974
views
Unable to setup Calico on Kubernetes
Trying to set up Calico on-premises Kubernetes cluster.
Initializing cluster kubeadm init --pod-network-cidr=192.168.0.0/16
Using https://docs.projectcalico.org/manifests/calico.yaml manifest.
~# ...
0
votes
2
answers
1k
views
Kubernetes: Calio not working on remote worker, local ok
I setup a Kubernetes cluster with calico.
The setup is "simple"
1x master (local network, ok)
1x node (local network, ok)
1x node (cloud server, not ok)
All debian buster with docker 19.03
...
0
votes
0
answers
522
views
Kubernetes: can't join on different subnet - TLS Bootstrap timeout
I have two Ubuntu 18.04 Server machines on AWS (the network conf its okay, I'm able even to connect through SSH between them but they are on different subnets of the same LAN). Ubuntu firewall also ...
1
vote
2
answers
2k
views
Kubernetes - calico IP_AUTODETECTION_METHOD impossible to set
I want to force the interface, setting the IP_AUTODETECTION_METHOD:
$ kubectl set env daemonset/calico-node -n calico-system IP_AUTODETECTION_METHOD=interface=ens192
daemonset.apps/calico-node env ...
2
votes
0
answers
361
views
Unable to reach the mutating webhooks in aws eks
I am using amamzon eks cluster with calico cni plugin installed. I deployed flink operator which will register mutating webhooks for the purpose of flink cluster handling to the cluster. I am ...
1
vote
0
answers
570
views
K8s DNS resolutions not working for all pods
I currently have a k8s cluster setup on my Ubuntu machine using kubeadm. For the CNI, I am using calico. I am debugging the following DNS issue (I've seen numerous posts for this):
[ERROR] plugin/...
1
vote
2
answers
1k
views
route missed in kubernetes with calico
I am installing k8s with calico on centos8, everything looks well but I couldn't ping each other between pods.
I am using k8s as DATASTORE of calico, the deployment file is in calico.yaml
I don't know ...
1
vote
1
answer
525
views
Kubernets PODs running on different host, not able to establish TCP connection
I have Kubernets 1.20.1 cluster with single master and single worker configured with ipvs mode. Using calico CNI calico/cni:v3.16.1. Cluster running on OS RHEL 8 kernel 4.18.0-240.10 with firewalld ...
1
vote
2
answers
3k
views
Calico prints "Hit error connecting to datastore: connection refused"
I created a cluster on an Ubuntu server using this command:
> kubeadm init --cri-socket /var/run/dockershim.sock --control-plane-endpoint servername.local --apiserver-cert-extra-sans servername....
1
vote
0
answers
2k
views
How to troubleshot: Kubernetes pods not creating or terminating
I am new at K8s so I am having troubles getting to the button of the issue.
Last week I installed a cluster with 1 master 2 nodes in centos with kubeadm:
kubectl get nodes
NAME STATUS ...
2
votes
2
answers
2k
views
How to find out what podcidr is assigned to each node by calico CNI in kubernetes
Is there any direct command to fetch the podcidr assigned to each node when using calico CNI.
I am looking for exact network and netmask assigned to each node. I am not able to fetch it from kubectl ...
0
votes
1
answer
870
views
Global Policy to default allow traffic within namespaces
We are setting up a strict default deny policy with calico to disable any traffic except the failsafe rules. Now we have multiple namespaces that are increasing since every application is scoped with ...
1
vote
1
answer
857
views
Calico GlobalNetworkPolicy exclusion not working
Recently started with Calico network policies on a AKS cluster. The plan is to block all traffic for new namespaces with the exception of traffic destined for the coredeDNS pod labeled "kube-dns&...
3
votes
1
answer
1k
views
calico network connectivity failing between pods and services and pods in different hosts
I have implemented a multi master HA kubernetes cluster and wanted to implement the Calico the hardway as described in here. I was able complete all the steps and my connectivity is not there between ...