From 2f589669e72faf3655d3e3cd38749ad7c8c89f1e Mon Sep 17 00:00:00 2001 From: Christopher Tauchen Date: Wed, 4 Dec 2024 16:36:46 +0000 Subject: [PATCH] DOCS-2387: Adds FelixConfig component to CE --- .../components/FelixConfig/TableConfig.js | 55 + .../components/FelixConfig/TableEnv.js | 55 + .../components/FelixConfig/TableResource.js | 46 + .../components/FelixConfig/file.json | 7926 +++++++++++++++++ .../_includes/components/FelixConfig/index.js | 100 + .../components/FelixConfig/styles.module.css | 12 + .../node/felix/configuration.mdx | 564 +- .../reference/resources/felixconfig.mdx | 394 +- 8 files changed, 8607 insertions(+), 545 deletions(-) create mode 100644 calico-enterprise/_includes/components/FelixConfig/TableConfig.js create mode 100644 calico-enterprise/_includes/components/FelixConfig/TableEnv.js create mode 100644 calico-enterprise/_includes/components/FelixConfig/TableResource.js create mode 100644 calico-enterprise/_includes/components/FelixConfig/file.json create mode 100644 calico-enterprise/_includes/components/FelixConfig/index.js create mode 100644 calico-enterprise/_includes/components/FelixConfig/styles.module.css diff --git a/calico-enterprise/_includes/components/FelixConfig/TableConfig.js b/calico-enterprise/_includes/components/FelixConfig/TableConfig.js new file mode 100644 index 0000000000..cd4e80c552 --- /dev/null +++ b/calico-enterprise/_includes/components/FelixConfig/TableConfig.js @@ -0,0 +1,55 @@ +import React from 'react'; +import DOMPurify from 'isomorphic-dompurify'; +import styles from './styles.module.css'; + +const getSanitizedData = ({ fieldData }) => ({ + sanitizedDescription: { __html: DOMPurify.sanitize(fieldData.DescriptionHTML) }, + sanitizedSchema: { __html: DOMPurify.sanitize(fieldData.StringSchemaHTML) }, +}); + +const TableConfig = ({ fieldData }) => { + const { sanitizedDescription, sanitizedSchema } = getSanitizedData({ fieldData }); + + return ( + + + + + + + + + + + + + + + + + + + + + + + +
AttributeValue
Key + {fieldData.NameConfigFile || 'No Default Value'} +
Description +
Schema +
Default + {fieldData.StringDefault === '' ? ( + 'none' + ) : fieldData.GoType === '*v1.Duration' ? ( + <> + {fieldData.StringDefault} ({fieldData.ParsedDefault}) + + ) : ( + {fieldData.StringDefault} + )} +
+ ); +}; + +export default TableConfig; diff --git a/calico-enterprise/_includes/components/FelixConfig/TableEnv.js b/calico-enterprise/_includes/components/FelixConfig/TableEnv.js new file mode 100644 index 0000000000..6408b0dce0 --- /dev/null +++ b/calico-enterprise/_includes/components/FelixConfig/TableEnv.js @@ -0,0 +1,55 @@ +import React from 'react'; +import DOMPurify from 'isomorphic-dompurify'; +import styles from './styles.module.css'; + +const getSanitizedData = ({ fieldData }) => ({ + sanitizedDescription: { __html: DOMPurify.sanitize(fieldData.DescriptionHTML) }, + sanitizedSchema: { __html: DOMPurify.sanitize(fieldData.StringSchemaHTML) }, +}); + +const TableEnv = ({ fieldData }) => { + const { sanitizedDescription, sanitizedSchema } = getSanitizedData({ fieldData }); + + return ( + + + + + + + + + + + + + + + + + + + + + + + +
AttributeValue
Key + {fieldData.NameEnvVar.toUpperCase() || 'No Default Value'} +
Description +
Schema +
Default + {fieldData.StringDefault === '' ? ( + 'none' + ) : fieldData.GoType === '*v1.Duration' ? ( + <> + {fieldData.StringDefault} ({fieldData.ParsedDefault}) + + ) : ( + {fieldData.StringDefault} + )} +
+ ); +}; + +export default TableEnv; diff --git a/calico-enterprise/_includes/components/FelixConfig/TableResource.js b/calico-enterprise/_includes/components/FelixConfig/TableResource.js new file mode 100644 index 0000000000..4438ab4831 --- /dev/null +++ b/calico-enterprise/_includes/components/FelixConfig/TableResource.js @@ -0,0 +1,46 @@ +import React from 'react'; +import DOMPurify from 'isomorphic-dompurify'; +import styles from './styles.module.css'; + +const getSanitizedData = ({ fieldData }) => ({ + sanitizedNAMEYAML: { __html: DOMPurify.sanitize(fieldData.NameYAML) }, + sanitizedDescription: { __html: DOMPurify.sanitize(fieldData.DescriptionHTML) }, + sanitizedSchema: { __html: DOMPurify.sanitize(fieldData.YAMLSchemaHTML) }, +}); + +const TableResource = ({ fieldData }) => { + const { sanitizedNAMEYAML, sanitizedDescription, sanitizedSchema } = getSanitizedData({ fieldData }); + + return ( + + + + + + + + + + + + + + + + + + + + + + + +
AttributeValue
Key + +
Description +
Schema +
Default{fieldData.YAMLDefault === '' ? 'none' : {fieldData.YAMLDefault}}
+ ); +}; + +export default TableResource; diff --git a/calico-enterprise/_includes/components/FelixConfig/file.json b/calico-enterprise/_includes/components/FelixConfig/file.json new file mode 100644 index 0000000000..056875144f --- /dev/null +++ b/calico-enterprise/_includes/components/FelixConfig/file.json @@ -0,0 +1,7926 @@ +{ + "Comment": "This file generated by calico-felix-docgen, DO NOT EDIT.", + "Groups": [ + { + "Name": "Datastore connection", + "Fields": [ + { + "Group": "Datastore connection", + "GroupWithSortPrefix": "00 Datastore connection", + "NameConfigFile": "DatastoreType", + "NameEnvVar": "FELIX_DatastoreType", + "NameYAML": "", + "NameGoAPI": "", + "StringSchema": "One of: `etcdv3`, `kubernetes` (case insensitive)", + "StringSchemaHTML": "One of: etcdv3, kubernetes (case insensitive)", + "StringDefault": "etcdv3", + "ParsedDefault": "etcdv3", + "ParsedDefaultJSON": "\"etcdv3\"", + "ParsedType": "string", + "YAMLType": "", + "YAMLSchema": "", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "", + "YAMLDefault": "", + "Required": true, + "OnParseFailure": "Exit", + "AllowedConfigSources": "LocalOnly", + "Description": "Controls which datastore driver Felix will use. Typically, this is detected from the environment\nand it does not need to be set manually. (For example, if `KUBECONFIG` is set, the kubernetes datastore driver\nwill be used by default).", + "DescriptionHTML": "

Controls which datastore driver Felix will use. Typically, this is detected from the environment\nand it does not need to be set manually. (For example, if KUBECONFIG is set, the kubernetes datastore driver\nwill be used by default).

", + "UserEditable": true, + "GoType": "", + "OpenSourceOnly": false + }, + { + "Group": "Datastore connection", + "GroupWithSortPrefix": "00 Datastore connection", + "NameConfigFile": "EtcdAddr", + "NameEnvVar": "FELIX_EtcdAddr", + "NameYAML": "", + "NameGoAPI": "", + "StringSchema": "String matching regex `^[^:/]+:\\d+$`", + "StringSchemaHTML": "String matching regex ^[^:/]+:\\d+$", + "StringDefault": "127.0.0.1:2379", + "ParsedDefault": "127.0.0.1:2379", + "ParsedDefaultJSON": "\"127.0.0.1:2379\"", + "ParsedType": "string", + "YAMLType": "", + "YAMLSchema": "", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "LocalOnly", + "Description": "**Open source-only parameter**; `etcdv3` datastore driver is not supported in Calico Enterprise/Cloud.\n\nWhen using the `etcdv3` datastore driver, the etcd server and port to connect to. If EtcdEndpoints\nis also specified, it takes precedence.", + "DescriptionHTML": "

Open source-only parameter; etcdv3 datastore driver is not supported in Calico Enterprise/Cloud.

\n

When using the etcdv3 datastore driver, the etcd server and port to connect to. If EtcdEndpoints\nis also specified, it takes precedence.

", + "UserEditable": true, + "GoType": "", + "OpenSourceOnly": true + }, + { + "Group": "Datastore connection", + "GroupWithSortPrefix": "00 Datastore connection", + "NameConfigFile": "EtcdCaFile", + "NameEnvVar": "FELIX_EtcdCaFile", + "NameYAML": "", + "NameGoAPI": "", + "StringSchema": "Path to file, which must exist", + "StringSchemaHTML": "Path to file, which must exist", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "\"\"", + "ParsedType": "string", + "YAMLType": "", + "YAMLSchema": "", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "LocalOnly", + "Description": "**Open source-only parameter**; `etcdv3` datastore driver is not supported in Calico Enterprise/Cloud.\n\nWhen using the `etcdv3` datastore driver, path to TLS CA file to use when connecting to\netcd. If the CA file is specified, the other TLS parameters are mandatory.", + "DescriptionHTML": "

Open source-only parameter; etcdv3 datastore driver is not supported in Calico Enterprise/Cloud.

\n

When using the etcdv3 datastore driver, path to TLS CA file to use when connecting to\netcd. If the CA file is specified, the other TLS parameters are mandatory.

", + "UserEditable": true, + "GoType": "", + "OpenSourceOnly": true + }, + { + "Group": "Datastore connection", + "GroupWithSortPrefix": "00 Datastore connection", + "NameConfigFile": "EtcdCertFile", + "NameEnvVar": "FELIX_EtcdCertFile", + "NameYAML": "", + "NameGoAPI": "", + "StringSchema": "Path to file, which must exist", + "StringSchemaHTML": "Path to file, which must exist", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "\"\"", + "ParsedType": "string", + "YAMLType": "", + "YAMLSchema": "", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "LocalOnly", + "Description": "**Open source-only parameter**; `etcdv3` datastore driver is not supported in Calico Enterprise/Cloud.\n\nWhen using the `etcdv3` datastore driver, path to TLS certificate file to use when connecting to\netcd. If the certificate file is specified, the other TLS parameters are mandatory.", + "DescriptionHTML": "

Open source-only parameter; etcdv3 datastore driver is not supported in Calico Enterprise/Cloud.

\n

When using the etcdv3 datastore driver, path to TLS certificate file to use when connecting to\netcd. If the certificate file is specified, the other TLS parameters are mandatory.

", + "UserEditable": true, + "GoType": "", + "OpenSourceOnly": true + }, + { + "Group": "Datastore connection", + "GroupWithSortPrefix": "00 Datastore connection", + "NameConfigFile": "EtcdEndpoints", + "NameEnvVar": "FELIX_EtcdEndpoints", + "NameYAML": "", + "NameGoAPI": "", + "StringSchema": "List of HTTP endpoints: comma-delimited list of `http(s)://hostname:port`", + "StringSchemaHTML": "List of HTTP endpoints: comma-delimited list of http(s)://hostname:port", + "StringDefault": "", + "ParsedDefault": "[]", + "ParsedDefaultJSON": "null", + "ParsedType": "[]string", + "YAMLType": "", + "YAMLSchema": "", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "LocalOnly", + "Description": "**Open source-only parameter**; `etcdv3` datastore driver is not supported in Calico Enterprise/Cloud.\n\nWhen using the `etcdv3` datastore driver, comma-delimited list of etcd endpoints to connect to,\nreplaces EtcdAddr and EtcdScheme.", + "DescriptionHTML": "

Open source-only parameter; etcdv3 datastore driver is not supported in Calico Enterprise/Cloud.

\n

When using the etcdv3 datastore driver, comma-delimited list of etcd endpoints to connect to,\nreplaces EtcdAddr and EtcdScheme.

", + "UserEditable": true, + "GoType": "", + "OpenSourceOnly": true + }, + { + "Group": "Datastore connection", + "GroupWithSortPrefix": "00 Datastore connection", + "NameConfigFile": "EtcdKeyFile", + "NameEnvVar": "FELIX_EtcdKeyFile", + "NameYAML": "", + "NameGoAPI": "", + "StringSchema": "Path to file, which must exist", + "StringSchemaHTML": "Path to file, which must exist", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "\"\"", + "ParsedType": "string", + "YAMLType": "", + "YAMLSchema": "", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "LocalOnly", + "Description": "**Open source-only parameter**; `etcdv3` datastore driver is not supported in Calico Enterprise/Cloud.\n\nWhen using the `etcdv3` datastore driver, path to TLS private key file to use when connecting to\netcd. If the key file is specified, the other TLS parameters are mandatory.", + "DescriptionHTML": "

Open source-only parameter; etcdv3 datastore driver is not supported in Calico Enterprise/Cloud.

\n

When using the etcdv3 datastore driver, path to TLS private key file to use when connecting to\netcd. If the key file is specified, the other TLS parameters are mandatory.

", + "UserEditable": true, + "GoType": "", + "OpenSourceOnly": true + }, + { + "Group": "Datastore connection", + "GroupWithSortPrefix": "00 Datastore connection", + "NameConfigFile": "EtcdScheme", + "NameEnvVar": "FELIX_EtcdScheme", + "NameYAML": "", + "NameGoAPI": "", + "StringSchema": "One of: `http`, `https` (case insensitive)", + "StringSchemaHTML": "One of: http, https (case insensitive)", + "StringDefault": "http", + "ParsedDefault": "http", + "ParsedDefaultJSON": "\"http\"", + "ParsedType": "string", + "YAMLType": "", + "YAMLSchema": "", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "LocalOnly", + "Description": "**Open source-only parameter**; `etcdv3` datastore driver is not supported in Calico Enterprise/Cloud.\n\nEtcdAddr: when using the `etcdv3` datastore driver, the URL scheme to use. If EtcdEndpoints\nis also specified, it takes precedence.", + "DescriptionHTML": "

Open source-only parameter; etcdv3 datastore driver is not supported in Calico Enterprise/Cloud.

\n

EtcdAddr: when using the etcdv3 datastore driver, the URL scheme to use. If EtcdEndpoints\nis also specified, it takes precedence.

", + "UserEditable": true, + "GoType": "", + "OpenSourceOnly": true + }, + { + "Group": "Datastore connection", + "GroupWithSortPrefix": "00 Datastore connection", + "NameConfigFile": "FelixHostname", + "NameEnvVar": "FELIX_FelixHostname", + "NameYAML": "", + "NameGoAPI": "", + "StringSchema": "String matching regex `^[a-zA-Z0-9_.-]+$`", + "StringSchemaHTML": "String matching regex ^[a-zA-Z0-9_.-]+$", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "\"\"", + "ParsedType": "string", + "YAMLType": "", + "YAMLSchema": "", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "", + "YAMLDefault": "", + "Required": true, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "LocalOnly", + "Description": "The name of this node, used to identify resources in the datastore that belong to this node.\nAuto-detected from the node's hostname if not provided.", + "DescriptionHTML": "

The name of this node, used to identify resources in the datastore that belong to this node.\nAuto-detected from the node's hostname if not provided.

", + "UserEditable": true, + "GoType": "", + "OpenSourceOnly": false + }, + { + "Group": "Datastore connection", + "GroupWithSortPrefix": "00 Datastore connection", + "NameConfigFile": "TyphaAddr", + "NameEnvVar": "FELIX_TyphaAddr", + "NameYAML": "", + "NameGoAPI": "", + "StringSchema": "String matching regex `^[^:/]+:\\d+$`", + "StringSchemaHTML": "String matching regex ^[^:/]+:\\d+$", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "\"\"", + "ParsedType": "string", + "YAMLType": "", + "YAMLSchema": "", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "LocalOnly", + "Description": "If set, tells Felix to connect to Typha at the given address and port. Overrides TyphaK8sServiceName.", + "DescriptionHTML": "

If set, tells Felix to connect to Typha at the given address and port. Overrides TyphaK8sServiceName.

", + "UserEditable": true, + "GoType": "", + "OpenSourceOnly": false + }, + { + "Group": "Datastore connection", + "GroupWithSortPrefix": "00 Datastore connection", + "NameConfigFile": "TyphaCAFile", + "NameEnvVar": "FELIX_TyphaCAFile", + "NameYAML": "", + "NameGoAPI": "", + "StringSchema": "Path to file, which must exist", + "StringSchemaHTML": "Path to file, which must exist", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "\"\"", + "ParsedType": "string", + "YAMLType": "", + "YAMLSchema": "", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "LocalOnly", + "Description": "Path to the TLS CA file to use when communicating with Typha. If this parameter is specified,\nthe other TLS parameters must also be specified.", + "DescriptionHTML": "

Path to the TLS CA file to use when communicating with Typha. If this parameter is specified,\nthe other TLS parameters must also be specified.

", + "UserEditable": true, + "GoType": "", + "OpenSourceOnly": false + }, + { + "Group": "Datastore connection", + "GroupWithSortPrefix": "00 Datastore connection", + "NameConfigFile": "TyphaCN", + "NameEnvVar": "FELIX_TyphaCN", + "NameYAML": "", + "NameGoAPI": "", + "StringSchema": "String", + "StringSchemaHTML": "String", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "\"\"", + "ParsedType": "string", + "YAMLType": "", + "YAMLSchema": "", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "LocalOnly", + "Description": "Common name to use when authenticating to Typha over TLS. If any TLS parameters are specified then one of\nTyphaCN and TyphaURISAN must be set.", + "DescriptionHTML": "

Common name to use when authenticating to Typha over TLS. If any TLS parameters are specified then one of\nTyphaCN and TyphaURISAN must be set.

", + "UserEditable": true, + "GoType": "", + "OpenSourceOnly": false + }, + { + "Group": "Datastore connection", + "GroupWithSortPrefix": "00 Datastore connection", + "NameConfigFile": "TyphaCertFile", + "NameEnvVar": "FELIX_TyphaCertFile", + "NameYAML": "", + "NameGoAPI": "", + "StringSchema": "Path to file, which must exist", + "StringSchemaHTML": "Path to file, which must exist", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "\"\"", + "ParsedType": "string", + "YAMLType": "", + "YAMLSchema": "", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "LocalOnly", + "Description": "Path to the TLS certificate to use when communicating with Typha. If this parameter is specified,\nthe other TLS parameters must also be specified.", + "DescriptionHTML": "

Path to the TLS certificate to use when communicating with Typha. If this parameter is specified,\nthe other TLS parameters must also be specified.

", + "UserEditable": true, + "GoType": "", + "OpenSourceOnly": false + }, + { + "Group": "Datastore connection", + "GroupWithSortPrefix": "00 Datastore connection", + "NameConfigFile": "TyphaK8sNamespace", + "NameEnvVar": "FELIX_TyphaK8sNamespace", + "NameYAML": "", + "NameGoAPI": "", + "StringSchema": "String", + "StringSchemaHTML": "String", + "StringDefault": "kube-system", + "ParsedDefault": "kube-system", + "ParsedDefaultJSON": "\"kube-system\"", + "ParsedType": "string", + "YAMLType": "", + "YAMLSchema": "", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "", + "YAMLDefault": "", + "Required": true, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "LocalOnly", + "Description": "Namespace to look in when looking for Typha's service (see TyphaK8sServiceName).", + "DescriptionHTML": "

Namespace to look in when looking for Typha's service (see TyphaK8sServiceName).

", + "UserEditable": true, + "GoType": "", + "OpenSourceOnly": false + }, + { + "Group": "Datastore connection", + "GroupWithSortPrefix": "00 Datastore connection", + "NameConfigFile": "TyphaK8sServiceName", + "NameEnvVar": "FELIX_TyphaK8sServiceName", + "NameYAML": "", + "NameGoAPI": "", + "StringSchema": "String", + "StringSchemaHTML": "String", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "\"\"", + "ParsedType": "string", + "YAMLType": "", + "YAMLSchema": "", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "LocalOnly", + "Description": "If set, tells Felix to connect to Typha by looking up the Endpoints of the given Kubernetes\nService in namespace specified by TyphaK8sNamespace.", + "DescriptionHTML": "

If set, tells Felix to connect to Typha by looking up the Endpoints of the given Kubernetes\nService in namespace specified by TyphaK8sNamespace.

", + "UserEditable": true, + "GoType": "", + "OpenSourceOnly": false + }, + { + "Group": "Datastore connection", + "GroupWithSortPrefix": "00 Datastore connection", + "NameConfigFile": "TyphaKeyFile", + "NameEnvVar": "FELIX_TyphaKeyFile", + "NameYAML": "", + "NameGoAPI": "", + "StringSchema": "Path to file, which must exist", + "StringSchemaHTML": "Path to file, which must exist", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "\"\"", + "ParsedType": "string", + "YAMLType": "", + "YAMLSchema": "", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "LocalOnly", + "Description": "Path to the TLS private key to use when communicating with Typha. If this parameter is specified,\nthe other TLS parameters must also be specified.", + "DescriptionHTML": "

Path to the TLS private key to use when communicating with Typha. If this parameter is specified,\nthe other TLS parameters must also be specified.

", + "UserEditable": true, + "GoType": "", + "OpenSourceOnly": false + }, + { + "Group": "Datastore connection", + "GroupWithSortPrefix": "00 Datastore connection", + "NameConfigFile": "TyphaReadTimeout", + "NameEnvVar": "FELIX_TyphaReadTimeout", + "NameYAML": "", + "NameGoAPI": "", + "StringSchema": "Seconds (floating point)", + "StringSchemaHTML": "Seconds (floating point)", + "StringDefault": "30", + "ParsedDefault": "30s", + "ParsedDefaultJSON": "30000000000", + "ParsedType": "time.Duration", + "YAMLType": "", + "YAMLSchema": "", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "LocalOnly", + "Description": "Read timeout when reading from the Typha connection. If typha sends no data for this long,\nFelix will exit and restart. (Note that Typha sends regular pings so traffic is always expected.)", + "DescriptionHTML": "

Read timeout when reading from the Typha connection. If typha sends no data for this long,\nFelix will exit and restart. (Note that Typha sends regular pings so traffic is always expected.)

", + "UserEditable": true, + "GoType": "", + "OpenSourceOnly": false + }, + { + "Group": "Datastore connection", + "GroupWithSortPrefix": "00 Datastore connection", + "NameConfigFile": "TyphaURISAN", + "NameEnvVar": "FELIX_TyphaURISAN", + "NameYAML": "", + "NameGoAPI": "", + "StringSchema": "String", + "StringSchemaHTML": "String", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "\"\"", + "ParsedType": "string", + "YAMLType": "", + "YAMLSchema": "", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "LocalOnly", + "Description": "URI SAN to use when authenticating to Typha over TLS. If any TLS parameters are specified then one of\nTyphaCN and TyphaURISAN must be set.", + "DescriptionHTML": "

URI SAN to use when authenticating to Typha over TLS. If any TLS parameters are specified then one of\nTyphaCN and TyphaURISAN must be set.

", + "UserEditable": true, + "GoType": "", + "OpenSourceOnly": false + }, + { + "Group": "Datastore connection", + "GroupWithSortPrefix": "00 Datastore connection", + "NameConfigFile": "TyphaWriteTimeout", + "NameEnvVar": "FELIX_TyphaWriteTimeout", + "NameYAML": "", + "NameGoAPI": "", + "StringSchema": "Seconds (floating point)", + "StringSchemaHTML": "Seconds (floating point)", + "StringDefault": "10", + "ParsedDefault": "10s", + "ParsedDefaultJSON": "10000000000", + "ParsedType": "time.Duration", + "YAMLType": "", + "YAMLSchema": "", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "LocalOnly", + "Description": "Write timeout when writing data to Typha.", + "DescriptionHTML": "

Write timeout when writing data to Typha.

", + "UserEditable": true, + "GoType": "", + "OpenSourceOnly": false + } + ] + }, + { + "Name": "Process: Feature detection/overrides", + "Fields": [ + { + "Group": "Process: Feature detection/overrides", + "GroupWithSortPrefix": "00 Process: Feature detection/overrides", + "NameConfigFile": "FeatureDetectOverride", + "NameEnvVar": "FELIX_FeatureDetectOverride", + "NameYAML": "featureDetectOverride", + "NameGoAPI": "FeatureDetectOverride", + "StringSchema": "Comma-delimited list of key=value pairs", + "StringSchemaHTML": "Comma-delimited list of key=value pairs", + "StringDefault": "", + "ParsedDefault": "map[]", + "ParsedDefaultJSON": "null", + "ParsedType": "map[string]string", + "YAMLType": "string", + "YAMLSchema": "String matching the regular expression `^([a-zA-Z0-9-_]+=(true|false|),)*([a-zA-Z0-9-_]+=(true|false|))?$`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String matching the regular expression ^([a-zA-Z0-9-_]+=(true|false|),)*([a-zA-Z0-9-_]+=(true|false|))?$.", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Used to override feature detection based on auto-detected platform capabilities. Values are specified in a comma separated list with no spaces, example; \"SNATFullyRandom=true,MASQFullyRandom=false,RestoreSupportsLock=\". A value of \"true\" or \"false\" will force enable/disable feature, empty or omitted values fall back to auto-detection.", + "DescriptionHTML": "

Used to override feature detection based on auto-detected platform capabilities. Values are specified in a comma separated list with no spaces, example; \"SNATFullyRandom=true,MASQFullyRandom=false,RestoreSupportsLock=\". A value of \"true\" or \"false\" will force enable/disable feature, empty or omitted values fall back to auto-detection.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Process: Feature detection/overrides", + "GroupWithSortPrefix": "00 Process: Feature detection/overrides", + "NameConfigFile": "FeatureGates", + "NameEnvVar": "FELIX_FeatureGates", + "NameYAML": "featureGates", + "NameGoAPI": "FeatureGates", + "StringSchema": "Comma-delimited list of key=value pairs", + "StringSchemaHTML": "Comma-delimited list of key=value pairs", + "StringDefault": "", + "ParsedDefault": "map[]", + "ParsedDefaultJSON": "null", + "ParsedType": "map[string]string", + "YAMLType": "string", + "YAMLSchema": "String matching the regular expression `^([a-zA-Z0-9-_]+=([^=]+),)*([a-zA-Z0-9-_]+=([^=]+))?$`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String matching the regular expression ^([a-zA-Z0-9-_]+=([^=]+),)*([a-zA-Z0-9-_]+=([^=]+))?$.", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Used to enable or disable tech-preview Calico features. Values are specified in a comma separated list with no spaces, example; \"BPFConnectTimeLoadBalancingWorkaround=enabled,XyZ=false\". This is used to enable features that are not fully production ready.", + "DescriptionHTML": "

Used to enable or disable tech-preview Calico features. Values are specified in a comma separated list with no spaces, example; \"BPFConnectTimeLoadBalancingWorkaround=enabled,XyZ=false\". This is used to enable features that are not fully production ready.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + } + ] + }, + { + "Name": "Process: Go runtime", + "Fields": [ + { + "Group": "Process: Go runtime", + "GroupWithSortPrefix": "00 Process: Go runtime", + "NameConfigFile": "GoGCThreshold", + "NameEnvVar": "FELIX_GoGCThreshold", + "NameYAML": "goGCThreshold", + "NameGoAPI": "GoGCThreshold", + "StringSchema": "Integer: [-1,2^63-1]", + "StringSchemaHTML": "Integer: [-1,263-1]", + "StringDefault": "40", + "ParsedDefault": "40", + "ParsedDefaultJSON": "40", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer: [-1,2^63-1]", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer: [-1,263-1]", + "YAMLDefault": "40", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Sets the Go runtime's garbage collection threshold. I.e. the percentage that the heap is allowed to grow before garbage collection is triggered. In general, doubling the value halves the CPU time spent doing GC, but it also doubles peak GC memory overhead. A special value of -1 can be used to disable GC entirely; this should only be used in conjunction with the GoMemoryLimitMB setting.\n\nThis setting is overridden by the GOGC environment variable.", + "DescriptionHTML": "

Sets the Go runtime's garbage collection threshold. I.e. the percentage that the heap is allowed to grow before garbage collection is triggered. In general, doubling the value halves the CPU time spent doing GC, but it also doubles peak GC memory overhead. A special value of -1 can be used to disable GC entirely; this should only be used in conjunction with the GoMemoryLimitMB setting.

\n

This setting is overridden by the GOGC environment variable.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Process: Go runtime", + "GroupWithSortPrefix": "00 Process: Go runtime", + "NameConfigFile": "GoMaxProcs", + "NameEnvVar": "FELIX_GoMaxProcs", + "NameYAML": "goMaxProcs", + "NameGoAPI": "GoMaxProcs", + "StringSchema": "Integer: [-1,2^63-1]", + "StringSchemaHTML": "Integer: [-1,263-1]", + "StringDefault": "-1", + "ParsedDefault": "-1", + "ParsedDefaultJSON": "-1", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer: [-1,2^63-1]", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer: [-1,263-1]", + "YAMLDefault": "-1", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Sets the maximum number of CPUs that the Go runtime will use concurrently. A value of -1 means \"use the system default\"; typically the number of real CPUs on the system.\n\nthis setting is overridden by the GOMAXPROCS environment variable.", + "DescriptionHTML": "

Sets the maximum number of CPUs that the Go runtime will use concurrently. A value of -1 means \"use the system default\"; typically the number of real CPUs on the system.

\n

this setting is overridden by the GOMAXPROCS environment variable.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Process: Go runtime", + "GroupWithSortPrefix": "00 Process: Go runtime", + "NameConfigFile": "GoMemoryLimitMB", + "NameEnvVar": "FELIX_GoMemoryLimitMB", + "NameYAML": "goMemoryLimitMB", + "NameGoAPI": "GoMemoryLimitMB", + "StringSchema": "Integer: [-1,2^63-1]", + "StringSchemaHTML": "Integer: [-1,263-1]", + "StringDefault": "-1", + "ParsedDefault": "-1", + "ParsedDefaultJSON": "-1", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer: [-1,2^63-1]", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer: [-1,263-1]", + "YAMLDefault": "-1", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Sets a (soft) memory limit for the Go runtime in MB. The Go runtime will try to keep its memory usage under the limit by triggering GC as needed. To avoid thrashing, it will exceed the limit if GC starts to take more than 50% of the process's CPU time. A value of -1 disables the memory limit.\n\nNote that the memory limit, if used, must be considerably less than any hard resource limit set at the container or pod level. This is because felix is not the only process that must run in the container or pod.\n\nThis setting is overridden by the GOMEMLIMIT environment variable.", + "DescriptionHTML": "

Sets a (soft) memory limit for the Go runtime in MB. The Go runtime will try to keep its memory usage under the limit by triggering GC as needed. To avoid thrashing, it will exceed the limit if GC starts to take more than 50% of the process's CPU time. A value of -1 disables the memory limit.

\n

Note that the memory limit, if used, must be considerably less than any hard resource limit set at the container or pod level. This is because felix is not the only process that must run in the container or pod.

\n

This setting is overridden by the GOMEMLIMIT environment variable.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + } + ] + }, + { + "Name": "Process: Health port and timeouts", + "Fields": [ + { + "Group": "Process: Health port and timeouts", + "GroupWithSortPrefix": "00 Process: Health port and timeouts", + "NameConfigFile": "HealthEnabled", + "NameEnvVar": "FELIX_HealthEnabled", + "NameYAML": "healthEnabled", + "NameGoAPI": "HealthEnabled", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "false", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "false", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "If set to true, enables Felix's health port, which provides readiness and liveness endpoints.", + "DescriptionHTML": "

If set to true, enables Felix's health port, which provides readiness and liveness endpoints.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Process: Health port and timeouts", + "GroupWithSortPrefix": "00 Process: Health port and timeouts", + "NameConfigFile": "HealthHost", + "NameEnvVar": "FELIX_HealthHost", + "NameYAML": "healthHost", + "NameGoAPI": "HealthHost", + "StringSchema": "String matching regex `^[a-zA-Z0-9:._+-]{1,64}$`", + "StringSchemaHTML": "String matching regex ^[a-zA-Z0-9:._+-]{1,64}$", + "StringDefault": "localhost", + "ParsedDefault": "localhost", + "ParsedDefaultJSON": "\"localhost\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "localhost", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The host that the health server should bind to.", + "DescriptionHTML": "

The host that the health server should bind to.

", + "UserEditable": true, + "GoType": "*string", + "OpenSourceOnly": false + }, + { + "Group": "Process: Health port and timeouts", + "GroupWithSortPrefix": "00 Process: Health port and timeouts", + "NameConfigFile": "HealthPort", + "NameEnvVar": "FELIX_HealthPort", + "NameYAML": "healthPort", + "NameGoAPI": "HealthPort", + "StringSchema": "Integer: [0,65535]", + "StringSchemaHTML": "Integer: [0,65535]", + "StringDefault": "9099", + "ParsedDefault": "9099", + "ParsedDefaultJSON": "9099", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer: [0,65535]", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer: [0,65535]", + "YAMLDefault": "9099", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The TCP port that the health server should bind to.", + "DescriptionHTML": "

The TCP port that the health server should bind to.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Process: Health port and timeouts", + "GroupWithSortPrefix": "00 Process: Health port and timeouts", + "NameConfigFile": "HealthTimeoutOverrides", + "NameEnvVar": "FELIX_HealthTimeoutOverrides", + "NameYAML": "healthTimeoutOverrides", + "NameGoAPI": "HealthTimeoutOverrides", + "StringSchema": "Comma-delimited list of `=` pairs, where durations use Go's standard format (e.g. 1s, 1m, 1h3m2s)", + "StringSchemaHTML": "Comma-delimited list of <key>=<duration> pairs, where durations use Go's standard format (e.g. 1s, 1m, 1h3m2s)", + "StringDefault": "", + "ParsedDefault": "map[]", + "ParsedDefaultJSON": "null", + "ParsedType": "map[string]time.Duration", + "YAMLType": "array", + "YAMLSchema": "List of health timeout overrides: `[{name: \"\", timeout: \"\"}, ...]` where `` is in the Go duration format, for example `1m30s`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "List of health timeout overrides: [{name: \"<name>\", timeout: \"<duration>\"}, ...] where <duration> is in the Go duration format, for example 1m30s.", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Allows the internal watchdog timeouts of individual subcomponents to be overridden. This is useful for working around \"false positive\" liveness timeouts that can occur in particularly stressful workloads or if CPU is constrained. For a list of active subcomponents, see Felix's logs.", + "DescriptionHTML": "

Allows the internal watchdog timeouts of individual subcomponents to be overridden. This is useful for working around \"false positive\" liveness timeouts that can occur in particularly stressful workloads or if CPU is constrained. For a list of active subcomponents, see Felix's logs.

", + "UserEditable": true, + "GoType": "[]v3.HealthTimeoutOverride", + "OpenSourceOnly": false + } + ] + }, + { + "Name": "Process: Logging", + "Fields": [ + { + "Group": "Process: Logging", + "GroupWithSortPrefix": "00 Process: Logging", + "NameConfigFile": "LogDebugFilenameRegex", + "NameEnvVar": "FELIX_LogDebugFilenameRegex", + "NameYAML": "logDebugFilenameRegex", + "NameGoAPI": "LogDebugFilenameRegex", + "StringSchema": "Regular expression", + "StringSchemaHTML": "Regular expression", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "null", + "ParsedType": "*regexp.Regexp", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls which source code files have their Debug log output included in the logs. Only logs from files with names that match the given regular expression are included. The filter only applies to Debug level logs.", + "DescriptionHTML": "

Controls which source code files have their Debug log output included in the logs. Only logs from files with names that match the given regular expression are included. The filter only applies to Debug level logs.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Process: Logging", + "GroupWithSortPrefix": "00 Process: Logging", + "NameConfigFile": "LogDropActionOverride", + "NameEnvVar": "FELIX_LogDropActionOverride", + "NameYAML": "logDropActionOverride", + "NameGoAPI": "LogDropActionOverride", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "false", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "false", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Specifies whether or not to include the DropActionOverride in the logs when it is triggered.", + "DescriptionHTML": "

Specifies whether or not to include the DropActionOverride in the logs when it is triggered.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Process: Logging", + "GroupWithSortPrefix": "00 Process: Logging", + "NameConfigFile": "LogFilePath", + "NameEnvVar": "FELIX_LogFilePath", + "NameYAML": "logFilePath", + "NameGoAPI": "LogFilePath", + "StringSchema": "Path to file", + "StringSchemaHTML": "Path to file", + "StringDefault": "/var/log/calico/felix.log", + "ParsedDefault": "/var/log/calico/felix.log", + "ParsedDefaultJSON": "\"/var/log/calico/felix.log\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "/var/log/calico/felix.log", + "Required": false, + "OnParseFailure": "Exit", + "AllowedConfigSources": "All", + "Description": "The full path to the Felix log. Set to none to disable file logging.", + "DescriptionHTML": "

The full path to the Felix log. Set to none to disable file logging.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Process: Logging", + "GroupWithSortPrefix": "00 Process: Logging", + "NameConfigFile": "LogPrefix", + "NameEnvVar": "FELIX_LogPrefix", + "NameYAML": "logPrefix", + "NameGoAPI": "LogPrefix", + "StringSchema": "String", + "StringSchemaHTML": "String", + "StringDefault": "calico-packet", + "ParsedDefault": "calico-packet", + "ParsedDefaultJSON": "\"calico-packet\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "calico-packet", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The log prefix that Felix uses when rendering LOG rules.", + "DescriptionHTML": "

The log prefix that Felix uses when rendering LOG rules.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Process: Logging", + "GroupWithSortPrefix": "00 Process: Logging", + "NameConfigFile": "LogSeverityFile", + "NameEnvVar": "FELIX_LogSeverityFile", + "NameYAML": "logSeverityFile", + "NameGoAPI": "LogSeverityFile", + "StringSchema": "One of: `DEBUG`, `ERROR`, `FATAL`, `INFO`, `WARNING` (case insensitive)", + "StringSchemaHTML": "One of: DEBUG, ERROR, FATAL, INFO, WARNING (case insensitive)", + "StringDefault": "INFO", + "ParsedDefault": "INFO", + "ParsedDefaultJSON": "\"INFO\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `Debug`, `Error`, `Fatal`, `Info`, `Warning`.", + "YAMLEnumValues": ["Debug", "Error", "Fatal", "Info", "Warning"], + "YAMLSchemaHTML": "One of: Debug, Error, Fatal, Info, Warning.", + "YAMLDefault": "Info", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The log severity above which logs are sent to the log file.", + "DescriptionHTML": "

The log severity above which logs are sent to the log file.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Process: Logging", + "GroupWithSortPrefix": "00 Process: Logging", + "NameConfigFile": "LogSeverityScreen", + "NameEnvVar": "FELIX_LogSeverityScreen", + "NameYAML": "logSeverityScreen", + "NameGoAPI": "LogSeverityScreen", + "StringSchema": "One of: `DEBUG`, `ERROR`, `FATAL`, `INFO`, `WARNING` (case insensitive)", + "StringSchemaHTML": "One of: DEBUG, ERROR, FATAL, INFO, WARNING (case insensitive)", + "StringDefault": "INFO", + "ParsedDefault": "INFO", + "ParsedDefaultJSON": "\"INFO\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `Debug`, `Error`, `Fatal`, `Info`, `Warning`.", + "YAMLEnumValues": ["Debug", "Error", "Fatal", "Info", "Warning"], + "YAMLSchemaHTML": "One of: Debug, Error, Fatal, Info, Warning.", + "YAMLDefault": "Info", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The log severity above which logs are sent to the stdout.", + "DescriptionHTML": "

The log severity above which logs are sent to the stdout.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Process: Logging", + "GroupWithSortPrefix": "00 Process: Logging", + "NameConfigFile": "LogSeveritySys", + "NameEnvVar": "FELIX_LogSeveritySys", + "NameYAML": "logSeveritySys", + "NameGoAPI": "LogSeveritySys", + "StringSchema": "One of: `DEBUG`, `ERROR`, `FATAL`, `INFO`, `WARNING` (case insensitive)", + "StringSchemaHTML": "One of: DEBUG, ERROR, FATAL, INFO, WARNING (case insensitive)", + "StringDefault": "INFO", + "ParsedDefault": "INFO", + "ParsedDefaultJSON": "\"INFO\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `Debug`, `Error`, `Fatal`, `Info`, `Warning`.", + "YAMLEnumValues": ["Debug", "Error", "Fatal", "Info", "Warning"], + "YAMLSchemaHTML": "One of: Debug, Error, Fatal, Info, Warning.", + "YAMLDefault": "Info", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The log severity above which logs are sent to the syslog. Set to None for no logging to syslog.", + "DescriptionHTML": "

The log severity above which logs are sent to the syslog. Set to None for no logging to syslog.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + } + ] + }, + { + "Name": "Process: Prometheus metrics", + "Fields": [ + { + "Group": "Process: Prometheus metrics", + "GroupWithSortPrefix": "00 Process: Prometheus metrics", + "NameConfigFile": "PrometheusGoMetricsEnabled", + "NameEnvVar": "FELIX_PrometheusGoMetricsEnabled", + "NameYAML": "prometheusGoMetricsEnabled", + "NameGoAPI": "PrometheusGoMetricsEnabled", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "true", + "ParsedDefault": "true", + "ParsedDefaultJSON": "true", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "true", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Disables Go runtime metrics collection, which the Prometheus client does by default, when set to false. This reduces the number of metrics reported, reducing Prometheus load.", + "DescriptionHTML": "

Disables Go runtime metrics collection, which the Prometheus client does by default, when set to false. This reduces the number of metrics reported, reducing Prometheus load.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Process: Prometheus metrics", + "GroupWithSortPrefix": "00 Process: Prometheus metrics", + "NameConfigFile": "PrometheusMetricsCAFile", + "NameEnvVar": "FELIX_PrometheusMetricsCAFile", + "NameYAML": "prometheusMetricsCAFile", + "NameGoAPI": "PrometheusMetricsCAFile", + "StringSchema": "Path to file, which must exist", + "StringSchemaHTML": "Path to file, which must exist", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "\"\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The path to the TLS CA file for the Prometheus metrics server.", + "DescriptionHTML": "

The path to the TLS CA file for the Prometheus metrics server.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Process: Prometheus metrics", + "GroupWithSortPrefix": "00 Process: Prometheus metrics", + "NameConfigFile": "PrometheusMetricsCertFile", + "NameEnvVar": "FELIX_PrometheusMetricsCertFile", + "NameYAML": "prometheusMetricsCertFile", + "NameGoAPI": "PrometheusMetricsCertFile", + "StringSchema": "Path to file, which must exist", + "StringSchemaHTML": "Path to file, which must exist", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "\"\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The path to the TLS certificate file for the Prometheus metrics server.", + "DescriptionHTML": "

The path to the TLS certificate file for the Prometheus metrics server.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Process: Prometheus metrics", + "GroupWithSortPrefix": "00 Process: Prometheus metrics", + "NameConfigFile": "PrometheusMetricsEnabled", + "NameEnvVar": "FELIX_PrometheusMetricsEnabled", + "NameYAML": "prometheusMetricsEnabled", + "NameGoAPI": "PrometheusMetricsEnabled", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "false", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "false", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Enables the Prometheus metrics server in Felix if set to true.", + "DescriptionHTML": "

Enables the Prometheus metrics server in Felix if set to true.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Process: Prometheus metrics", + "GroupWithSortPrefix": "00 Process: Prometheus metrics", + "NameConfigFile": "PrometheusMetricsHost", + "NameEnvVar": "FELIX_PrometheusMetricsHost", + "NameYAML": "prometheusMetricsHost", + "NameGoAPI": "PrometheusMetricsHost", + "StringSchema": "String matching regex `^[a-zA-Z0-9:._+-]{1,64}$`", + "StringSchemaHTML": "String matching regex ^[a-zA-Z0-9:._+-]{1,64}$", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "\"\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The host that the Prometheus metrics server should bind to.", + "DescriptionHTML": "

The host that the Prometheus metrics server should bind to.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Process: Prometheus metrics", + "GroupWithSortPrefix": "00 Process: Prometheus metrics", + "NameConfigFile": "PrometheusMetricsKeyFile", + "NameEnvVar": "FELIX_PrometheusMetricsKeyFile", + "NameYAML": "prometheusMetricsKeyFile", + "NameGoAPI": "PrometheusMetricsKeyFile", + "StringSchema": "Path to file, which must exist", + "StringSchemaHTML": "Path to file, which must exist", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "\"\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The path to the TLS private key file for the Prometheus metrics server.", + "DescriptionHTML": "

The path to the TLS private key file for the Prometheus metrics server.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Process: Prometheus metrics", + "GroupWithSortPrefix": "00 Process: Prometheus metrics", + "NameConfigFile": "PrometheusMetricsPort", + "NameEnvVar": "FELIX_PrometheusMetricsPort", + "NameYAML": "prometheusMetricsPort", + "NameGoAPI": "PrometheusMetricsPort", + "StringSchema": "Integer: [0,65535]", + "StringSchemaHTML": "Integer: [0,65535]", + "StringDefault": "9091", + "ParsedDefault": "9091", + "ParsedDefaultJSON": "9091", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer: [0,65535]", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer: [0,65535]", + "YAMLDefault": "9091", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The TCP port that the Prometheus metrics server should bind to.", + "DescriptionHTML": "

The TCP port that the Prometheus metrics server should bind to.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Process: Prometheus metrics", + "GroupWithSortPrefix": "00 Process: Prometheus metrics", + "NameConfigFile": "PrometheusProcessMetricsEnabled", + "NameEnvVar": "FELIX_PrometheusProcessMetricsEnabled", + "NameYAML": "prometheusProcessMetricsEnabled", + "NameGoAPI": "PrometheusProcessMetricsEnabled", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "true", + "ParsedDefault": "true", + "ParsedDefaultJSON": "true", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "true", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Disables process metrics collection, which the Prometheus client does by default, when set to false. This reduces the number of metrics reported, reducing Prometheus load.", + "DescriptionHTML": "

Disables process metrics collection, which the Prometheus client does by default, when set to false. This reduces the number of metrics reported, reducing Prometheus load.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Process: Prometheus metrics", + "GroupWithSortPrefix": "00 Process: Prometheus metrics", + "NameConfigFile": "PrometheusWireGuardMetricsEnabled", + "NameEnvVar": "FELIX_PrometheusWireGuardMetricsEnabled", + "NameYAML": "prometheusWireGuardMetricsEnabled", + "NameGoAPI": "PrometheusWireGuardMetricsEnabled", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "true", + "ParsedDefault": "true", + "ParsedDefaultJSON": "true", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "true", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Disables wireguard metrics collection, which the Prometheus client does by default, when set to false. This reduces the number of metrics reported, reducing Prometheus load.", + "DescriptionHTML": "

Disables wireguard metrics collection, which the Prometheus client does by default, when set to false. This reduces the number of metrics reported, reducing Prometheus load.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + } + ] + }, + { + "Name": "Dataplane: Common", + "Fields": [ + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "AllowIPIPPacketsFromWorkloads", + "NameEnvVar": "FELIX_AllowIPIPPacketsFromWorkloads", + "NameYAML": "allowIPIPPacketsFromWorkloads", + "NameGoAPI": "AllowIPIPPacketsFromWorkloads", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "false", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "false", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls whether Felix will add a rule to drop IPIP encapsulated traffic from workloads.", + "DescriptionHTML": "

Controls whether Felix will add a rule to drop IPIP encapsulated traffic from workloads.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "AllowVXLANPacketsFromWorkloads", + "NameEnvVar": "FELIX_AllowVXLANPacketsFromWorkloads", + "NameYAML": "allowVXLANPacketsFromWorkloads", + "NameGoAPI": "AllowVXLANPacketsFromWorkloads", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "false", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "false", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls whether Felix will add a rule to drop VXLAN encapsulated traffic from workloads.", + "DescriptionHTML": "

Controls whether Felix will add a rule to drop VXLAN encapsulated traffic from workloads.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "ChainInsertMode", + "NameEnvVar": "FELIX_ChainInsertMode", + "NameYAML": "chainInsertMode", + "NameGoAPI": "ChainInsertMode", + "StringSchema": "One of: `append`, `insert` (case insensitive)", + "StringSchemaHTML": "One of: append, insert (case insensitive)", + "StringDefault": "insert", + "ParsedDefault": "insert", + "ParsedDefaultJSON": "\"insert\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `Append`, `Insert`.", + "YAMLEnumValues": ["Append", "Insert"], + "YAMLSchemaHTML": "One of: Append, Insert.", + "YAMLDefault": "Insert", + "Required": true, + "OnParseFailure": "Exit", + "AllowedConfigSources": "All", + "Description": "Controls whether Felix hooks the kernel's top-level iptables chains by inserting a rule at the top of the chain or by appending a rule at the bottom. insert is the safe default since it prevents Calico's rules from being bypassed. If you switch to append mode, be sure that the other rules in the chains signal acceptance by falling through to the Calico rules, otherwise the Calico policy will be bypassed.", + "DescriptionHTML": "

Controls whether Felix hooks the kernel's top-level iptables chains by inserting a rule at the top of the chain or by appending a rule at the bottom. insert is the safe default since it prevents Calico's rules from being bypassed. If you switch to append mode, be sure that the other rules in the chains signal acceptance by falling through to the Calico rules, otherwise the Calico policy will be bypassed.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "DataplaneDriver", + "NameEnvVar": "FELIX_DataplaneDriver", + "NameYAML": "dataplaneDriver", + "NameGoAPI": "DataplaneDriver", + "StringSchema": "Path to executable, which must exist. If not an absolute path, the directory containing this binary and the system path will be searched.", + "StringSchemaHTML": "Path to executable, which must exist. If not an absolute path, the directory containing this binary and the system path will be searched.", + "StringDefault": "calico-iptables-plugin", + "ParsedDefault": "calico-iptables-plugin", + "ParsedDefaultJSON": "\"calico-iptables-plugin\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "calico-iptables-plugin", + "Required": true, + "OnParseFailure": "Exit", + "AllowedConfigSources": "All", + "Description": "Filename of the external dataplane driver to use. Only used if UseInternalDataplaneDriver is set to false.", + "DescriptionHTML": "

Filename of the external dataplane driver to use. Only used if UseInternalDataplaneDriver is set to false.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "DataplaneWatchdogTimeout", + "NameEnvVar": "FELIX_DataplaneWatchdogTimeout", + "NameYAML": "dataplaneWatchdogTimeout", + "NameGoAPI": "DataplaneWatchdogTimeout", + "StringSchema": "Seconds (floating point)", + "StringSchemaHTML": "Seconds (floating point)", + "StringDefault": "90", + "ParsedDefault": "1m30s", + "ParsedDefaultJSON": "90000000000", + "ParsedType": "time.Duration", + "YAMLType": "string", + "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", + "YAMLDefault": "1m30s", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The readiness/liveness timeout used for Felix's (internal) dataplane driver. Deprecated: replaced by the generic HealthTimeoutOverrides.", + "DescriptionHTML": "

The readiness/liveness timeout used for Felix's (internal) dataplane driver. Deprecated: replaced by the generic HealthTimeoutOverrides.

", + "UserEditable": true, + "GoType": "*v1.Duration", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "DefaultEndpointToHostAction", + "NameEnvVar": "FELIX_DefaultEndpointToHostAction", + "NameYAML": "defaultEndpointToHostAction", + "NameGoAPI": "DefaultEndpointToHostAction", + "StringSchema": "One of: `ACCEPT`, `DROP`, `RETURN` (case insensitive)", + "StringSchemaHTML": "One of: ACCEPT, DROP, RETURN (case insensitive)", + "StringDefault": "DROP", + "ParsedDefault": "DROP", + "ParsedDefaultJSON": "\"DROP\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `Accept`, `Drop`, `Return`.", + "YAMLEnumValues": ["Accept", "Drop", "Return"], + "YAMLSchemaHTML": "One of: Accept, Drop, Return.", + "YAMLDefault": "Drop", + "Required": true, + "OnParseFailure": "Exit", + "AllowedConfigSources": "All", + "Description": "Controls what happens to traffic that goes from a workload endpoint to the host itself (after the endpoint's egress policy is applied). By default, Calico blocks traffic from workload endpoints to the host itself with an iptables \"DROP\" action. If you want to allow some or all traffic from endpoint to host, set this parameter to RETURN or ACCEPT. Use RETURN if you have your own rules in the iptables \"INPUT\" chain; Calico will insert its rules at the top of that chain, then \"RETURN\" packets to the \"INPUT\" chain once it has completed processing workload endpoint egress policy. Use ACCEPT to unconditionally accept packets from workloads after processing workload endpoint egress policy.", + "DescriptionHTML": "

Controls what happens to traffic that goes from a workload endpoint to the host itself (after the endpoint's egress policy is applied). By default, Calico blocks traffic from workload endpoints to the host itself with an iptables \"DROP\" action. If you want to allow some or all traffic from endpoint to host, set this parameter to RETURN or ACCEPT. Use RETURN if you have your own rules in the iptables \"INPUT\" chain; Calico will insert its rules at the top of that chain, then \"RETURN\" packets to the \"INPUT\" chain once it has completed processing workload endpoint egress policy. Use ACCEPT to unconditionally accept packets from workloads after processing workload endpoint egress policy.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "DeviceRouteProtocol", + "NameEnvVar": "FELIX_DeviceRouteProtocol", + "NameYAML": "deviceRouteProtocol", + "NameGoAPI": "DeviceRouteProtocol", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "3", + "ParsedDefault": "3", + "ParsedDefaultJSON": "3", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "3", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls the protocol to set on routes programmed by Felix. The protocol is an 8-bit label used to identify the owner of the route.", + "DescriptionHTML": "

Controls the protocol to set on routes programmed by Felix. The protocol is an 8-bit label used to identify the owner of the route.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "DeviceRouteSourceAddress", + "NameEnvVar": "FELIX_DeviceRouteSourceAddress", + "NameYAML": "deviceRouteSourceAddress", + "NameGoAPI": "DeviceRouteSourceAddress", + "StringSchema": "IPv4 address", + "StringSchemaHTML": "IPv4 address", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "\"\"", + "ParsedType": "net.IP", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "IPv4 address to set as the source hint for routes programmed by Felix. When not set the source address for local traffic from host to workload will be determined by the kernel.", + "DescriptionHTML": "

IPv4 address to set as the source hint for routes programmed by Felix. When not set the source address for local traffic from host to workload will be determined by the kernel.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "DeviceRouteSourceAddressIPv6", + "NameEnvVar": "FELIX_DeviceRouteSourceAddressIPv6", + "NameYAML": "deviceRouteSourceAddressIPv6", + "NameGoAPI": "DeviceRouteSourceAddressIPv6", + "StringSchema": "IPv6 address", + "StringSchemaHTML": "IPv6 address", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "\"\"", + "ParsedType": "net.IP", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "IPv6 address to set as the source hint for routes programmed by Felix. When not set the source address for local traffic from host to workload will be determined by the kernel.", + "DescriptionHTML": "

IPv6 address to set as the source hint for routes programmed by Felix. When not set the source address for local traffic from host to workload will be determined by the kernel.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "DisableConntrackInvalidCheck", + "NameEnvVar": "FELIX_DisableConntrackInvalidCheck", + "NameYAML": "disableConntrackInvalidCheck", + "NameGoAPI": "DisableConntrackInvalidCheck", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "false", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "false", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Disables the check for invalid connections in conntrack. While the conntrack invalid check helps to detect malicious traffic, it can also cause issues with certain multi-NIC scenarios.", + "DescriptionHTML": "

Disables the check for invalid connections in conntrack. While the conntrack invalid check helps to detect malicious traffic, it can also cause issues with certain multi-NIC scenarios.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "DropActionOverride", + "NameEnvVar": "FELIX_DropActionOverride", + "NameYAML": "dropActionOverride", + "NameGoAPI": "DropActionOverride", + "StringSchema": "One of: `ACCEPT`, `DROP`, `LOGandACCEPT`, `LOGandDROP` (case insensitive)", + "StringSchemaHTML": "One of: ACCEPT, DROP, LOGandACCEPT, LOGandDROP (case insensitive)", + "StringDefault": "DROP", + "ParsedDefault": "DROP", + "ParsedDefaultJSON": "\"DROP\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `Accept`, `Drop`, `LogAndAccept`, `LogAndDrop`.", + "YAMLEnumValues": ["Accept", "Drop", "LogAndAccept", "LogAndDrop"], + "YAMLSchemaHTML": "One of: Accept, Drop, LogAndAccept, LogAndDrop.", + "YAMLDefault": "Drop", + "Required": true, + "OnParseFailure": "Exit", + "AllowedConfigSources": "All", + "Description": "Overrides the Drop action in Felix, optionally changing the behavior to Accept, and optionally adding Log. Possible values are Drop, LogAndDrop, Accept, LogAndAccept.", + "DescriptionHTML": "

Overrides the Drop action in Felix, optionally changing the behavior to Accept, and optionally adding Log. Possible values are Drop, LogAndDrop, Accept, LogAndAccept.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "EndpointStatusPathPrefix", + "NameEnvVar": "FELIX_EndpointStatusPathPrefix", + "NameYAML": "endpointStatusPathPrefix", + "NameGoAPI": "EndpointStatusPathPrefix", + "StringSchema": "Path to file", + "StringSchemaHTML": "Path to file", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "\"\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The path to the directory where endpoint status will be written. Endpoint status file reporting is disabled if field is left empty.\n\nChosen directory should match the directory used by the CNI plugin for PodStartupDelay.", + "DescriptionHTML": "

The path to the directory where endpoint status will be written. Endpoint status file reporting is disabled if field is left empty.

\n

Chosen directory should match the directory used by the CNI plugin for PodStartupDelay.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "ExternalNodesCIDRList", + "NameEnvVar": "FELIX_ExternalNodesCIDRList", + "NameYAML": "externalNodesList", + "NameGoAPI": "ExternalNodesCIDRList", + "StringSchema": "Comma-delimited list of CIDRs", + "StringSchemaHTML": "Comma-delimited list of CIDRs", + "StringDefault": "", + "ParsedDefault": "[]", + "ParsedDefaultJSON": "null", + "ParsedType": "[]string", + "YAMLType": "array", + "YAMLSchema": "List of strings: `[\"\", ...]`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "List of strings: [\"<string>\", ...].", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "Exit", + "AllowedConfigSources": "All", + "Description": "A list of CIDR's of external, non-Calico nodes from which VXLAN/IPIP overlay traffic will be allowed. By default, external tunneled traffic is blocked to reduce attack surface.", + "DescriptionHTML": "

A list of CIDR's of external, non-Calico nodes from which VXLAN/IPIP overlay traffic will be allowed. By default, external tunneled traffic is blocked to reduce attack surface.

", + "UserEditable": true, + "GoType": "*[]string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "FailsafeInboundHostPorts", + "NameEnvVar": "FELIX_FailsafeInboundHostPorts", + "NameYAML": "failsafeInboundHostPorts", + "NameGoAPI": "FailsafeInboundHostPorts", + "StringSchema": "Comma-delimited list of numeric ports with optional protocol and CIDR:`(tcp|udp)::`, `(tcp|udp):` or ``. IPv6 CIDRs must be enclosed in square brackets.", + "StringSchemaHTML": "Comma-delimited list of numeric ports with optional protocol and CIDR:(tcp|udp):<cidr>:<port>, (tcp|udp):<port> or <port>. IPv6 CIDRs must be enclosed in square brackets.", + "StringDefault": "tcp:22,udp:68,tcp:179,tcp:2379,tcp:2380,tcp:5473,tcp:6443,tcp:6666,tcp:6667", + "ParsedDefault": "[{tcp 22 } {udp 68 } {tcp 179 } {tcp 2379 } {tcp 2380 } {tcp 5473 } {tcp 6443 } {tcp 6666 } {tcp 6667 }]", + "ParsedDefaultJSON": "[{\"protocol\":\"tcp\",\"port\":22},{\"protocol\":\"udp\",\"port\":68},{\"protocol\":\"tcp\",\"port\":179},{\"protocol\":\"tcp\",\"port\":2379},{\"protocol\":\"tcp\",\"port\":2380},{\"protocol\":\"tcp\",\"port\":5473},{\"protocol\":\"tcp\",\"port\":6443},{\"protocol\":\"tcp\",\"port\":6666},{\"protocol\":\"tcp\",\"port\":6667}]", + "ParsedType": "[]v3.ProtoPort", + "YAMLType": "array", + "YAMLSchema": "List of protocol/port objects with optional CIDR match: `[{protocol: \"TCP|UDP\", port: , net: \"\"}, ...]`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "List of protocol/port objects with optional CIDR match: [{protocol: \"TCP|UDP\", port: <port>, net: \"<cidr>\"}, ...].", + "YAMLDefault": "[{\"protocol\":\"tcp\",\"port\":22},{\"protocol\":\"udp\",\"port\":68},{\"protocol\":\"tcp\",\"port\":179},{\"protocol\":\"tcp\",\"port\":2379},{\"protocol\":\"tcp\",\"port\":2380},{\"protocol\":\"tcp\",\"port\":5473},{\"protocol\":\"tcp\",\"port\":6443},{\"protocol\":\"tcp\",\"port\":6666},{\"protocol\":\"tcp\",\"port\":6667}]", + "Required": false, + "OnParseFailure": "Exit", + "AllowedConfigSources": "All", + "Description": "A list of ProtoPort struct objects including UDP/TCP/SCTP ports and CIDRs that Felix will allow incoming traffic to host endpoints on irrespective of the security policy. This is useful to avoid accidentally cutting off a host with incorrect configuration. For backwards compatibility, if the protocol is not specified, it defaults to \"tcp\". If a CIDR is not specified, it will allow traffic from all addresses. To disable all inbound host ports, use the value \"[]\". The default value allows ssh access, DHCP, BGP, etcd and the Kubernetes API.", + "DescriptionHTML": "

A list of ProtoPort struct objects including UDP/TCP/SCTP ports and CIDRs that Felix will allow incoming traffic to host endpoints on irrespective of the security policy. This is useful to avoid accidentally cutting off a host with incorrect configuration. For backwards compatibility, if the protocol is not specified, it defaults to \"tcp\". If a CIDR is not specified, it will allow traffic from all addresses. To disable all inbound host ports, use the value \"[]\". The default value allows ssh access, DHCP, BGP, etcd and the Kubernetes API.

", + "UserEditable": true, + "GoType": "*[]v3.ProtoPort", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "FailsafeOutboundHostPorts", + "NameEnvVar": "FELIX_FailsafeOutboundHostPorts", + "NameYAML": "failsafeOutboundHostPorts", + "NameGoAPI": "FailsafeOutboundHostPorts", + "StringSchema": "Comma-delimited list of numeric ports with optional protocol and CIDR:`(tcp|udp)::`, `(tcp|udp):` or ``. IPv6 CIDRs must be enclosed in square brackets.", + "StringSchemaHTML": "Comma-delimited list of numeric ports with optional protocol and CIDR:(tcp|udp):<cidr>:<port>, (tcp|udp):<port> or <port>. IPv6 CIDRs must be enclosed in square brackets.", + "StringDefault": "udp:53,udp:67,tcp:179,tcp:2379,tcp:2380,tcp:5473,tcp:6443,tcp:6666,tcp:6667", + "ParsedDefault": "[{udp 53 } {udp 67 } {tcp 179 } {tcp 2379 } {tcp 2380 } {tcp 5473 } {tcp 6443 } {tcp 6666 } {tcp 6667 }]", + "ParsedDefaultJSON": "[{\"protocol\":\"udp\",\"port\":53},{\"protocol\":\"udp\",\"port\":67},{\"protocol\":\"tcp\",\"port\":179},{\"protocol\":\"tcp\",\"port\":2379},{\"protocol\":\"tcp\",\"port\":2380},{\"protocol\":\"tcp\",\"port\":5473},{\"protocol\":\"tcp\",\"port\":6443},{\"protocol\":\"tcp\",\"port\":6666},{\"protocol\":\"tcp\",\"port\":6667}]", + "ParsedType": "[]v3.ProtoPort", + "YAMLType": "array", + "YAMLSchema": "List of protocol/port objects with optional CIDR match: `[{protocol: \"TCP|UDP\", port: , net: \"\"}, ...]`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "List of protocol/port objects with optional CIDR match: [{protocol: \"TCP|UDP\", port: <port>, net: \"<cidr>\"}, ...].", + "YAMLDefault": "[{\"protocol\":\"udp\",\"port\":53},{\"protocol\":\"udp\",\"port\":67},{\"protocol\":\"tcp\",\"port\":179},{\"protocol\":\"tcp\",\"port\":2379},{\"protocol\":\"tcp\",\"port\":2380},{\"protocol\":\"tcp\",\"port\":5473},{\"protocol\":\"tcp\",\"port\":6443},{\"protocol\":\"tcp\",\"port\":6666},{\"protocol\":\"tcp\",\"port\":6667}]", + "Required": false, + "OnParseFailure": "Exit", + "AllowedConfigSources": "All", + "Description": "A list of PortProto struct objects including UDP/TCP/SCTP ports and CIDRs that Felix will allow outgoing traffic from host endpoints to irrespective of the security policy. This is useful to avoid accidentally cutting off a host with incorrect configuration. For backwards compatibility, if the protocol is not specified, it defaults to \"tcp\". If a CIDR is not specified, it will allow traffic from all addresses. To disable all outbound host ports, use the value \"[]\". The default value opens etcd's standard ports to ensure that Felix does not get cut off from etcd as well as allowing DHCP, DNS, BGP and the Kubernetes API.", + "DescriptionHTML": "

A list of PortProto struct objects including UDP/TCP/SCTP ports and CIDRs that Felix will allow outgoing traffic from host endpoints to irrespective of the security policy. This is useful to avoid accidentally cutting off a host with incorrect configuration. For backwards compatibility, if the protocol is not specified, it defaults to \"tcp\". If a CIDR is not specified, it will allow traffic from all addresses. To disable all outbound host ports, use the value \"[]\". The default value opens etcd's standard ports to ensure that Felix does not get cut off from etcd as well as allowing DHCP, DNS, BGP and the Kubernetes API.

", + "UserEditable": true, + "GoType": "*[]v3.ProtoPort", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "FloatingIPs", + "NameEnvVar": "FELIX_FloatingIPs", + "NameYAML": "floatingIPs", + "NameGoAPI": "FloatingIPs", + "StringSchema": "One of: `Disabled`, `Enabled` (case insensitive)", + "StringSchemaHTML": "One of: Disabled, Enabled (case insensitive)", + "StringDefault": "Disabled", + "ParsedDefault": "Disabled", + "ParsedDefaultJSON": "\"Disabled\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `\"Disabled\"`, `\"Enabled\"`.", + "YAMLEnumValues": ["Disabled", "Enabled"], + "YAMLSchemaHTML": "One of: \"Disabled\", \"Enabled\".", + "YAMLDefault": "Disabled", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Configures whether or not Felix will program non-OpenStack floating IP addresses. (OpenStack-derived floating IPs are always programmed, regardless of this setting.)", + "DescriptionHTML": "

Configures whether or not Felix will program non-OpenStack floating IP addresses. (OpenStack-derived floating IPs are always programmed, regardless of this setting.)

", + "UserEditable": true, + "GoType": "*v3.FloatingIPType", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "IPForwarding", + "NameEnvVar": "FELIX_IPForwarding", + "NameYAML": "ipForwarding", + "NameGoAPI": "IPForwarding", + "StringSchema": "One of: `Disabled`, `Enabled` (case insensitive)", + "StringSchemaHTML": "One of: Disabled, Enabled (case insensitive)", + "StringDefault": "Enabled", + "ParsedDefault": "Enabled", + "ParsedDefaultJSON": "\"Enabled\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `\"Disabled\"`, `\"Enabled\"`.", + "YAMLEnumValues": ["Disabled", "Enabled"], + "YAMLSchemaHTML": "One of: \"Disabled\", \"Enabled\".", + "YAMLDefault": "Enabled", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls whether Felix sets the host sysctls to enable IP forwarding. IP forwarding is required when using Calico for workload networking. This should be disabled only on hosts where Calico is used solely for host protection. In BPF mode, due to a kernel interaction, either IPForwarding must be enabled or BPFEnforceRPF must be disabled.", + "DescriptionHTML": "

Controls whether Felix sets the host sysctls to enable IP forwarding. IP forwarding is required when using Calico for workload networking. This should be disabled only on hosts where Calico is used solely for host protection. In BPF mode, due to a kernel interaction, either IPForwarding must be enabled or BPFEnforceRPF must be disabled.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "InterfaceExclude", + "NameEnvVar": "FELIX_InterfaceExclude", + "NameYAML": "interfaceExclude", + "NameGoAPI": "InterfaceExclude", + "StringSchema": "Comma-delimited list of Linux interface names/regex patterns. Regex patterns must start/end with `/`.", + "StringSchemaHTML": "Comma-delimited list of Linux interface names/regex patterns. Regex patterns must start/end with /.", + "StringDefault": "kube-ipvs0", + "ParsedDefault": "[^kube-ipvs0$]", + "ParsedDefaultJSON": "[\"^kube-ipvs0$\"]", + "ParsedType": "[]*regexp.Regexp", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "kube-ipvs0", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "A comma-separated list of interface names that should be excluded when Felix is resolving host endpoints. The default value ensures that Felix ignores Kubernetes' internal `kube-ipvs0` device. If you want to exclude multiple interface names using a single value, the list supports regular expressions. For regular expressions you must wrap the value with `/`. For example having values `/^kube/,veth1` will exclude all interfaces that begin with `kube` and also the interface `veth1`.", + "DescriptionHTML": "

A comma-separated list of interface names that should be excluded when Felix is resolving host endpoints. The default value ensures that Felix ignores Kubernetes' internal kube-ipvs0 device. If you want to exclude multiple interface names using a single value, the list supports regular expressions. For regular expressions you must wrap the value with /. For example having values /^kube/,veth1 will exclude all interfaces that begin with kube and also the interface veth1.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "InterfacePrefix", + "NameEnvVar": "FELIX_InterfacePrefix", + "NameYAML": "interfacePrefix", + "NameGoAPI": "InterfacePrefix", + "StringSchema": "String matching regex `^[a-zA-Z0-9_-]{1,15}(,[a-zA-Z0-9_-]{1,15})*$`", + "StringSchemaHTML": "String matching regex ^[a-zA-Z0-9_-]{1,15}(,[a-zA-Z0-9_-]{1,15})*$", + "StringDefault": "cali", + "ParsedDefault": "cali", + "ParsedDefaultJSON": "\"cali\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "cali", + "Required": true, + "OnParseFailure": "Exit", + "AllowedConfigSources": "All", + "Description": "The interface name prefix that identifies workload endpoints and so distinguishes them from host endpoint interfaces. Note: in environments other than bare metal, the orchestrators configure this appropriately. For example our Kubernetes and Docker integrations set the 'cali' value, and our OpenStack integration sets the 'tap' value.", + "DescriptionHTML": "

The interface name prefix that identifies workload endpoints and so distinguishes them from host endpoint interfaces. Note: in environments other than bare metal, the orchestrators configure this appropriately. For example our Kubernetes and Docker integrations set the 'cali' value, and our OpenStack integration sets the 'tap' value.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "InterfaceRefreshInterval", + "NameEnvVar": "FELIX_InterfaceRefreshInterval", + "NameYAML": "interfaceRefreshInterval", + "NameGoAPI": "InterfaceRefreshInterval", + "StringSchema": "Seconds (floating point)", + "StringSchemaHTML": "Seconds (floating point)", + "StringDefault": "90", + "ParsedDefault": "1m30s", + "ParsedDefaultJSON": "90000000000", + "ParsedType": "time.Duration", + "YAMLType": "string", + "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", + "YAMLDefault": "1m30s", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The period at which Felix rescans local interfaces to verify their state. The rescan can be disabled by setting the interval to 0.", + "DescriptionHTML": "

The period at which Felix rescans local interfaces to verify their state. The rescan can be disabled by setting the interval to 0.

", + "UserEditable": true, + "GoType": "*v1.Duration", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "Ipv6Support", + "NameEnvVar": "FELIX_Ipv6Support", + "NameYAML": "ipv6Support", + "NameGoAPI": "IPv6Support", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "true", + "ParsedDefault": "true", + "ParsedDefaultJSON": "true", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "true", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls whether Felix enables support for IPv6 (if supported by the in-use dataplane).", + "DescriptionHTML": "

Controls whether Felix enables support for IPv6 (if supported by the in-use dataplane).

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "KubeMasqueradeBit", + "NameEnvVar": "FELIX_KubeMasqueradeBit", + "NameYAML": "kubeMasqueradeBit", + "NameGoAPI": "KubeMasqueradeBit", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "14", + "ParsedDefault": "14", + "ParsedDefaultJSON": "14", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "14", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Should be set to the same value as --iptables-masquerade-bit of kube-proxy when TPROXY is used. The default is the same as kube-proxy default thus only needs a change if kube-proxy is using a non-standard setting. Must be within the range of 0-31.", + "DescriptionHTML": "

Should be set to the same value as --iptables-masquerade-bit of kube-proxy when TPROXY is used. The default is the same as kube-proxy default thus only needs a change if kube-proxy is using a non-standard setting. Must be within the range of 0-31.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "MTUIfacePattern", + "NameEnvVar": "FELIX_MTUIfacePattern", + "NameYAML": "mtuIfacePattern", + "NameGoAPI": "MTUIfacePattern", + "StringSchema": "Regular expression", + "StringSchemaHTML": "Regular expression", + "StringDefault": "^((en|wl|ww|sl|ib)[Pcopsvx].*|(eth|wlan|wwan).*)", + "ParsedDefault": "^((en|wl|ww|sl|ib)[Pcopsvx].*|(eth|wlan|wwan).*)", + "ParsedDefaultJSON": "\"^((en|wl|ww|sl|ib)[Pcopsvx].*|(eth|wlan|wwan).*)\"", + "ParsedType": "*regexp.Regexp", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "^((en|wl|ww|sl|ib)[Pcopsvx].*|(eth|wlan|wwan).*)", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "A regular expression that controls which interfaces Felix should scan in order to calculate the host's MTU. This should not match workload interfaces (usually named cali...).", + "DescriptionHTML": "

A regular expression that controls which interfaces Felix should scan in order to calculate the host's MTU. This should not match workload interfaces (usually named cali...).

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "NATOutgoingAddress", + "NameEnvVar": "FELIX_NATOutgoingAddress", + "NameYAML": "natOutgoingAddress", + "NameGoAPI": "NATOutgoingAddress", + "StringSchema": "IPv4 address", + "StringSchemaHTML": "IPv4 address", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "\"\"", + "ParsedType": "net.IP", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Specifies an address to use when performing source NAT for traffic in a natOutgoing pool that is leaving the network. By default the address used is an address on the interface the traffic is leaving on (i.e. it uses the iptables MASQUERADE target).", + "DescriptionHTML": "

Specifies an address to use when performing source NAT for traffic in a natOutgoing pool that is leaving the network. By default the address used is an address on the interface the traffic is leaving on (i.e. it uses the iptables MASQUERADE target).

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "NATPortRange", + "NameEnvVar": "FELIX_NATPortRange", + "NameYAML": "natPortRange", + "NameGoAPI": "NATPortRange", + "StringSchema": "Port range: either a single number in [0,65535] or a range of numbers `n:m`", + "StringSchemaHTML": "Port range: either a single number in [0,65535] or a range of numbers n:m", + "StringDefault": "", + "ParsedDefault": "0", + "ParsedDefaultJSON": "0", + "ParsedType": "numorstring.Port", + "YAMLType": "integer or string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "0", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Specifies the range of ports that is used for port mapping when doing outgoing NAT. When unset the default behavior of the network stack is used.", + "DescriptionHTML": "

Specifies the range of ports that is used for port mapping when doing outgoing NAT. When unset the default behavior of the network stack is used.

", + "UserEditable": true, + "GoType": "*numorstring.Port", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "NFTablesMode", + "NameEnvVar": "FELIX_NFTablesMode", + "NameYAML": "nftablesMode", + "NameGoAPI": "NFTablesMode", + "StringSchema": "One of: `Disabled`, `Enabled` (case insensitive)", + "StringSchemaHTML": "One of: Disabled, Enabled (case insensitive)", + "StringDefault": "Disabled", + "ParsedDefault": "Disabled", + "ParsedDefaultJSON": "\"Disabled\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `\"Auto\"`, `\"Disabled\"`, `\"Enabled\"`.", + "YAMLEnumValues": ["Auto", "Disabled", "Enabled"], + "YAMLSchemaHTML": "One of: \"Auto\", \"Disabled\", \"Enabled\".", + "YAMLDefault": "Disabled", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Configures nftables support in Felix.", + "DescriptionHTML": "

Configures nftables support in Felix.

", + "UserEditable": true, + "GoType": "*v3.NFTablesMode", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "NetlinkTimeoutSecs", + "NameEnvVar": "FELIX_NetlinkTimeoutSecs", + "NameYAML": "netlinkTimeout", + "NameGoAPI": "NetlinkTimeout", + "StringSchema": "Seconds (floating point)", + "StringSchemaHTML": "Seconds (floating point)", + "StringDefault": "10", + "ParsedDefault": "10s", + "ParsedDefaultJSON": "10000000000", + "ParsedType": "time.Duration", + "YAMLType": "string", + "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", + "YAMLDefault": "10s", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The timeout when talking to the kernel over the netlink protocol, used for programming routes, rules, and other kernel objects.", + "DescriptionHTML": "

The timeout when talking to the kernel over the netlink protocol, used for programming routes, rules, and other kernel objects.

", + "UserEditable": true, + "GoType": "*v1.Duration", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "NfNetlinkBufSize", + "NameEnvVar": "FELIX_NfNetlinkBufSize", + "NameYAML": "nfNetlinkBufSize", + "NameGoAPI": "NfNetlinkBufSize", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "65536", + "ParsedDefault": "65536", + "ParsedDefaultJSON": "65536", + "ParsedType": "int", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "65536", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls the size of NFLOG messages that the kernel will try to send to Felix. NFLOG messages are used to report flow verdicts from the kernel. Warning: currently increasing the value may cause errors due to a bug in the netlink library.", + "DescriptionHTML": "

Controls the size of NFLOG messages that the kernel will try to send to Felix. NFLOG messages are used to report flow verdicts from the kernel. Warning: currently increasing the value may cause errors due to a bug in the netlink library.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "PolicySyncPathPrefix", + "NameEnvVar": "FELIX_PolicySyncPathPrefix", + "NameYAML": "policySyncPathPrefix", + "NameGoAPI": "PolicySyncPathPrefix", + "StringSchema": "Path to file", + "StringSchemaHTML": "Path to file", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "\"\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Used to by Felix to communicate policy changes to external services, like Application layer policy.", + "DescriptionHTML": "

Used to by Felix to communicate policy changes to external services, like Application layer policy.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "RemoveExternalRoutes", + "NameEnvVar": "FELIX_RemoveExternalRoutes", + "NameYAML": "removeExternalRoutes", + "NameGoAPI": "RemoveExternalRoutes", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "true", + "ParsedDefault": "true", + "ParsedDefaultJSON": "true", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "true", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls whether Felix will remove unexpected routes to workload interfaces. Felix will always clean up expected routes that use the configured DeviceRouteProtocol. To add your own routes, you must use a distinct protocol (in addition to setting this field to false).", + "DescriptionHTML": "

Controls whether Felix will remove unexpected routes to workload interfaces. Felix will always clean up expected routes that use the configured DeviceRouteProtocol. To add your own routes, you must use a distinct protocol (in addition to setting this field to false).

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "RouteRefreshInterval", + "NameEnvVar": "FELIX_RouteRefreshInterval", + "NameYAML": "routeRefreshInterval", + "NameGoAPI": "RouteRefreshInterval", + "StringSchema": "Seconds (floating point)", + "StringSchemaHTML": "Seconds (floating point)", + "StringDefault": "90", + "ParsedDefault": "1m30s", + "ParsedDefaultJSON": "90000000000", + "ParsedType": "time.Duration", + "YAMLType": "string", + "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", + "YAMLDefault": "1m30s", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The period at which Felix re-checks the routes in the dataplane to ensure that no other process has accidentally broken Calico's rules. Set to 0 to disable route refresh.", + "DescriptionHTML": "

The period at which Felix re-checks the routes in the dataplane to ensure that no other process has accidentally broken Calico's rules. Set to 0 to disable route refresh.

", + "UserEditable": true, + "GoType": "*v1.Duration", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "RouteSource", + "NameEnvVar": "FELIX_RouteSource", + "NameYAML": "routeSource", + "NameGoAPI": "RouteSource", + "StringSchema": "One of: `CalicoIPAM`, `WorkloadIPs` (case insensitive)", + "StringSchemaHTML": "One of: CalicoIPAM, WorkloadIPs (case insensitive)", + "StringDefault": "CalicoIPAM", + "ParsedDefault": "CalicoIPAM", + "ParsedDefaultJSON": "\"CalicoIPAM\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `CalicoIPAM`, `WorkloadIPs`.", + "YAMLEnumValues": ["CalicoIPAM", "WorkloadIPs"], + "YAMLSchemaHTML": "One of: CalicoIPAM, WorkloadIPs.", + "YAMLDefault": "CalicoIPAM", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Configures where Felix gets its routing information. - WorkloadIPs: use workload endpoints to construct routes. - CalicoIPAM: the default - use IPAM data to construct routes.", + "DescriptionHTML": "

Configures where Felix gets its routing information. - WorkloadIPs: use workload endpoints to construct routes. - CalicoIPAM: the default - use IPAM data to construct routes.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "RouteSyncDisabled", + "NameEnvVar": "FELIX_RouteSyncDisabled", + "NameYAML": "routeSyncDisabled", + "NameGoAPI": "RouteSyncDisabled", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "false", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "false", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Will disable all operations performed on the route table. Set to true to run in network-policy mode only.", + "DescriptionHTML": "

Will disable all operations performed on the route table. Set to true to run in network-policy mode only.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "RouteTableRange", + "NameEnvVar": "FELIX_RouteTableRange", + "NameYAML": "routeTableRange", + "NameGoAPI": "RouteTableRange", + "StringSchema": "Range of route table indices `n-m`, where `n` and `m` are integers in [0,250].", + "StringSchemaHTML": "Range of route table indices n-m, where n and m are integers in [0,250].", + "StringDefault": "", + "ParsedDefault": "{0 0}", + "ParsedDefaultJSON": "{\"Min\":0,\"Max\":0}", + "ParsedType": "idalloc.IndexRange", + "YAMLType": "object", + "YAMLSchema": "Route table range: `{min:, max}`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Route table range: {min:<n>, max<m>}.", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "Exit", + "AllowedConfigSources": "All", + "Description": "Deprecated in favor of RouteTableRanges. Calico programs additional Linux route tables for various purposes. RouteTableRange specifies the indices of the route tables that Calico should use.", + "DescriptionHTML": "

Deprecated in favor of RouteTableRanges. Calico programs additional Linux route tables for various purposes. RouteTableRange specifies the indices of the route tables that Calico should use.

", + "UserEditable": true, + "GoType": "*v3.RouteTableRange", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "RouteTableRanges", + "NameEnvVar": "FELIX_RouteTableRanges", + "NameYAML": "routeTableRanges", + "NameGoAPI": "RouteTableRanges", + "StringSchema": "Comma or space-delimited list of route table ranges of the form `n-m` where `n` and `m` are integers in [0,4294967295]. The sum of the sizes of all ranges may not exceed 65535.", + "StringSchemaHTML": "Comma or space-delimited list of route table ranges of the form n-m where n and m are integers in [0,4294967295]. The sum of the sizes of all ranges may not exceed 65535.", + "StringDefault": "", + "ParsedDefault": "[]", + "ParsedDefaultJSON": "null", + "ParsedType": "[]idalloc.IndexRange", + "YAMLType": "array", + "YAMLSchema": "List of route table ranges: `[{min:, max}, ...]`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "List of route table ranges: [{min:<n>, max<m>}, ...].", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "Exit", + "AllowedConfigSources": "All", + "Description": "Calico programs additional Linux route tables for various purposes. RouteTableRanges specifies a set of table index ranges that Calico should use. Deprecates`RouteTableRange`, overrides `RouteTableRange`.", + "DescriptionHTML": "

Calico programs additional Linux route tables for various purposes. RouteTableRanges specifies a set of table index ranges that Calico should use. DeprecatesRouteTableRange, overrides RouteTableRange.

", + "UserEditable": true, + "GoType": "*v3.RouteTableRanges", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "ServiceLoopPrevention", + "NameEnvVar": "FELIX_ServiceLoopPrevention", + "NameYAML": "serviceLoopPrevention", + "NameGoAPI": "ServiceLoopPrevention", + "StringSchema": "One of: `Disabled`, `Drop`, `Reject` (case insensitive)", + "StringSchemaHTML": "One of: Disabled, Drop, Reject (case insensitive)", + "StringDefault": "Drop", + "ParsedDefault": "Drop", + "ParsedDefaultJSON": "\"Drop\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `Disabled`, `Drop`, `Reject`.", + "YAMLEnumValues": ["Disabled", "Drop", "Reject"], + "YAMLSchemaHTML": "One of: Disabled, Drop, Reject.", + "YAMLDefault": "Drop", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "When service IP advertisement is enabled, prevent routing loops to service IPs that are not in use, by dropping or rejecting packets that do not get DNAT'd by kube-proxy. Unless set to \"Disabled\", in which case such routing loops continue to be allowed.", + "DescriptionHTML": "

When service IP advertisement is enabled, prevent routing loops to service IPs that are not in use, by dropping or rejecting packets that do not get DNAT'd by kube-proxy. Unless set to \"Disabled\", in which case such routing loops continue to be allowed.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "SidecarAccelerationEnabled", + "NameEnvVar": "FELIX_SidecarAccelerationEnabled", + "NameYAML": "sidecarAccelerationEnabled", + "NameGoAPI": "SidecarAccelerationEnabled", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "false", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "false", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Enables experimental sidecar acceleration.", + "DescriptionHTML": "

Enables experimental sidecar acceleration.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "UseInternalDataplaneDriver", + "NameEnvVar": "FELIX_UseInternalDataplaneDriver", + "NameYAML": "useInternalDataplaneDriver", + "NameGoAPI": "UseInternalDataplaneDriver", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "true", + "ParsedDefault": "true", + "ParsedDefaultJSON": "true", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "true", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "If true, Felix will use its internal dataplane programming logic. If false, it will launch an external dataplane driver and communicate with it over protobuf.", + "DescriptionHTML": "

If true, Felix will use its internal dataplane programming logic. If false, it will launch an external dataplane driver and communicate with it over protobuf.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Common", + "GroupWithSortPrefix": "10 Dataplane: Common", + "NameConfigFile": "WorkloadSourceSpoofing", + "NameEnvVar": "FELIX_WorkloadSourceSpoofing", + "NameYAML": "workloadSourceSpoofing", + "NameGoAPI": "WorkloadSourceSpoofing", + "StringSchema": "One of: `Any`, `Disabled` (case insensitive)", + "StringSchemaHTML": "One of: Any, Disabled (case insensitive)", + "StringDefault": "Disabled", + "ParsedDefault": "Disabled", + "ParsedDefaultJSON": "\"Disabled\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `Any`, `Disabled`.", + "YAMLEnumValues": ["Any", "Disabled"], + "YAMLSchemaHTML": "One of: Any, Disabled.", + "YAMLDefault": "Disabled", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls whether pods can use the allowedSourcePrefixes annotation to send traffic with a source IP address that is not theirs. This is disabled by default. When set to \"Any\", pods can request any prefix.", + "DescriptionHTML": "

Controls whether pods can use the allowedSourcePrefixes annotation to send traffic with a source IP address that is not theirs. This is disabled by default. When set to \"Any\", pods can request any prefix.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + } + ] + }, + { + "Name": "Dataplane: iptables", + "Fields": [ + { + "Group": "Dataplane: iptables", + "GroupWithSortPrefix": "20 Dataplane: iptables", + "NameConfigFile": "IpsetsRefreshInterval", + "NameEnvVar": "FELIX_IpsetsRefreshInterval", + "NameYAML": "ipsetsRefreshInterval", + "NameGoAPI": "IpsetsRefreshInterval", + "StringSchema": "Seconds (floating point)", + "StringSchemaHTML": "Seconds (floating point)", + "StringDefault": "90", + "ParsedDefault": "1m30s", + "ParsedDefaultJSON": "90000000000", + "ParsedType": "time.Duration", + "YAMLType": "string", + "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", + "YAMLDefault": "1m30s", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls the period at which Felix re-checks all IP sets to look for discrepancies. Set to 0 to disable the periodic refresh.", + "DescriptionHTML": "

Controls the period at which Felix re-checks all IP sets to look for discrepancies. Set to 0 to disable the periodic refresh.

", + "UserEditable": true, + "GoType": "*v1.Duration", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: iptables", + "GroupWithSortPrefix": "20 Dataplane: iptables", + "NameConfigFile": "IptablesBackend", + "NameEnvVar": "FELIX_IptablesBackend", + "NameYAML": "iptablesBackend", + "NameGoAPI": "IptablesBackend", + "StringSchema": "One of: `auto`, `legacy`, `nft` (case insensitive)", + "StringSchemaHTML": "One of: auto, legacy, nft (case insensitive)", + "StringDefault": "auto", + "ParsedDefault": "auto", + "ParsedDefaultJSON": "\"auto\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `Auto`, `Legacy`, `NFT`.", + "YAMLEnumValues": ["Auto", "Legacy", "NFT"], + "YAMLSchemaHTML": "One of: Auto, Legacy, NFT.", + "YAMLDefault": "Auto", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls which backend of iptables will be used. The default is `Auto`.\n\nWarning: changing this on a running system can leave \"orphaned\" rules in the \"other\" backend. These should be cleaned up to avoid confusing interactions.", + "DescriptionHTML": "

Controls which backend of iptables will be used. The default is Auto.

\n

Warning: changing this on a running system can leave \"orphaned\" rules in the \"other\" backend. These should be cleaned up to avoid confusing interactions.

", + "UserEditable": true, + "GoType": "*v3.IptablesBackend", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: iptables", + "GroupWithSortPrefix": "20 Dataplane: iptables", + "NameConfigFile": "IptablesFilterAllowAction", + "NameEnvVar": "FELIX_IptablesFilterAllowAction", + "NameYAML": "iptablesFilterAllowAction", + "NameGoAPI": "IptablesFilterAllowAction", + "StringSchema": "One of: `ACCEPT`, `RETURN` (case insensitive)", + "StringSchemaHTML": "One of: ACCEPT, RETURN (case insensitive)", + "StringDefault": "ACCEPT", + "ParsedDefault": "ACCEPT", + "ParsedDefaultJSON": "\"ACCEPT\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `Accept`, `Return`.", + "YAMLEnumValues": ["Accept", "Return"], + "YAMLSchemaHTML": "One of: Accept, Return.", + "YAMLDefault": "Accept", + "Required": true, + "OnParseFailure": "Exit", + "AllowedConfigSources": "All", + "Description": "Controls what happens to traffic that is accepted by a Felix policy chain in the iptables filter table (which is used for \"normal\" policy). The default will immediately `Accept` the traffic. Use `Return` to send the traffic back up to the system chains for further processing.", + "DescriptionHTML": "

Controls what happens to traffic that is accepted by a Felix policy chain in the iptables filter table (which is used for \"normal\" policy). The default will immediately Accept the traffic. Use Return to send the traffic back up to the system chains for further processing.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: iptables", + "GroupWithSortPrefix": "20 Dataplane: iptables", + "NameConfigFile": "IptablesFilterDenyAction", + "NameEnvVar": "FELIX_IptablesFilterDenyAction", + "NameYAML": "iptablesFilterDenyAction", + "NameGoAPI": "IptablesFilterDenyAction", + "StringSchema": "One of: `DROP`, `REJECT` (case insensitive)", + "StringSchemaHTML": "One of: DROP, REJECT (case insensitive)", + "StringDefault": "DROP", + "ParsedDefault": "DROP", + "ParsedDefaultJSON": "\"DROP\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `Drop`, `Reject`.", + "YAMLEnumValues": ["Drop", "Reject"], + "YAMLSchemaHTML": "One of: Drop, Reject.", + "YAMLDefault": "Drop", + "Required": true, + "OnParseFailure": "Exit", + "AllowedConfigSources": "All", + "Description": "Controls what happens to traffic that is denied by network policy. By default Calico blocks traffic with an iptables \"DROP\" action. If you want to use \"REJECT\" action instead you can configure it in here.", + "DescriptionHTML": "

Controls what happens to traffic that is denied by network policy. By default Calico blocks traffic with an iptables \"DROP\" action. If you want to use \"REJECT\" action instead you can configure it in here.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: iptables", + "GroupWithSortPrefix": "20 Dataplane: iptables", + "NameConfigFile": "IptablesLockFilePath", + "NameEnvVar": "FELIX_IptablesLockFilePath", + "NameYAML": "iptablesLockFilePath", + "NameGoAPI": "IptablesLockFilePath", + "StringSchema": "Path to file", + "StringSchemaHTML": "Path to file", + "StringDefault": "/run/xtables.lock", + "ParsedDefault": "/run/xtables.lock", + "ParsedDefaultJSON": "\"/run/xtables.lock\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "/run/xtables.lock", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The location of the iptables lock file. You may need to change this if the lock file is not in its standard location (for example if you have mapped it into Felix's container at a different path).", + "DescriptionHTML": "

The location of the iptables lock file. You may need to change this if the lock file is not in its standard location (for example if you have mapped it into Felix's container at a different path).

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: iptables", + "GroupWithSortPrefix": "20 Dataplane: iptables", + "NameConfigFile": "IptablesLockProbeIntervalMillis", + "NameEnvVar": "FELIX_IptablesLockProbeIntervalMillis", + "NameYAML": "iptablesLockProbeInterval", + "NameGoAPI": "IptablesLockProbeInterval", + "StringSchema": "Milliseconds (floating point)", + "StringSchemaHTML": "Milliseconds (floating point)", + "StringDefault": "50", + "ParsedDefault": "50ms", + "ParsedDefaultJSON": "50000000", + "ParsedType": "time.Duration", + "YAMLType": "string", + "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", + "YAMLDefault": "50ms", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "When IptablesLockTimeout is enabled: the time that Felix will wait between attempts to acquire the iptables lock if it is not available. Lower values make Felix more responsive when the lock is contended, but use more CPU.", + "DescriptionHTML": "

When IptablesLockTimeout is enabled: the time that Felix will wait between attempts to acquire the iptables lock if it is not available. Lower values make Felix more responsive when the lock is contended, but use more CPU.

", + "UserEditable": true, + "GoType": "*v1.Duration", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: iptables", + "GroupWithSortPrefix": "20 Dataplane: iptables", + "NameConfigFile": "IptablesLockTimeoutSecs", + "NameEnvVar": "FELIX_IptablesLockTimeoutSecs", + "NameYAML": "iptablesLockTimeout", + "NameGoAPI": "IptablesLockTimeout", + "StringSchema": "Seconds (floating point)", + "StringSchemaHTML": "Seconds (floating point)", + "StringDefault": "0", + "ParsedDefault": "0s", + "ParsedDefaultJSON": "0", + "ParsedType": "time.Duration", + "YAMLType": "string", + "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", + "YAMLDefault": "0s", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The time that Felix itself will wait for the iptables lock (rather than delegating the lock handling to the `iptables` command).\n\nDeprecated: `iptables-restore` v1.8+ always takes the lock, so enabling this feature results in deadlock.", + "DescriptionHTML": "

The time that Felix itself will wait for the iptables lock (rather than delegating the lock handling to the iptables command).

\n

Deprecated: iptables-restore v1.8+ always takes the lock, so enabling this feature results in deadlock.

", + "UserEditable": true, + "GoType": "*v1.Duration", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: iptables", + "GroupWithSortPrefix": "20 Dataplane: iptables", + "NameConfigFile": "IptablesMangleAllowAction", + "NameEnvVar": "FELIX_IptablesMangleAllowAction", + "NameYAML": "iptablesMangleAllowAction", + "NameGoAPI": "IptablesMangleAllowAction", + "StringSchema": "One of: `ACCEPT`, `RETURN` (case insensitive)", + "StringSchemaHTML": "One of: ACCEPT, RETURN (case insensitive)", + "StringDefault": "ACCEPT", + "ParsedDefault": "ACCEPT", + "ParsedDefaultJSON": "\"ACCEPT\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `Accept`, `Return`.", + "YAMLEnumValues": ["Accept", "Return"], + "YAMLSchemaHTML": "One of: Accept, Return.", + "YAMLDefault": "Accept", + "Required": true, + "OnParseFailure": "Exit", + "AllowedConfigSources": "All", + "Description": "Controls what happens to traffic that is accepted by a Felix policy chain in the iptables mangle table (which is used for \"pre-DNAT\" policy). The default will immediately `Accept` the traffic. Use `Return` to send the traffic back up to the system chains for further processing.", + "DescriptionHTML": "

Controls what happens to traffic that is accepted by a Felix policy chain in the iptables mangle table (which is used for \"pre-DNAT\" policy). The default will immediately Accept the traffic. Use Return to send the traffic back up to the system chains for further processing.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: iptables", + "GroupWithSortPrefix": "20 Dataplane: iptables", + "NameConfigFile": "IptablesMarkMask", + "NameEnvVar": "FELIX_IptablesMarkMask", + "NameYAML": "iptablesMarkMask", + "NameGoAPI": "IptablesMarkMask", + "StringSchema": "32-bit bitmask (hex or deccimal allowed) with at least 2 bits set, example: `0xffff0000`", + "StringSchemaHTML": "32-bit bitmask (hex or deccimal allowed) with at least 2 bits set, example: 0xffff0000", + "StringDefault": "0xffff0000", + "ParsedDefault": "4294901760", + "ParsedDefaultJSON": "4294901760", + "ParsedType": "uint32", + "YAMLType": "integer", + "YAMLSchema": "Unsigned 32-bit integer.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Unsigned 32-bit integer.", + "YAMLDefault": "0xffff0000", + "Required": true, + "OnParseFailure": "Exit", + "AllowedConfigSources": "All", + "Description": "The mask that Felix selects its IPTables Mark bits from. Should be a 32 bit hexadecimal number with at least 8 bits set, none of which clash with any other mark bits in use on the system.", + "DescriptionHTML": "

The mask that Felix selects its IPTables Mark bits from. Should be a 32 bit hexadecimal number with at least 8 bits set, none of which clash with any other mark bits in use on the system.

", + "UserEditable": true, + "GoType": "*uint32", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: iptables", + "GroupWithSortPrefix": "20 Dataplane: iptables", + "NameConfigFile": "IptablesNATOutgoingInterfaceFilter", + "NameEnvVar": "FELIX_IptablesNATOutgoingInterfaceFilter", + "NameYAML": "iptablesNATOutgoingInterfaceFilter", + "NameGoAPI": "IptablesNATOutgoingInterfaceFilter", + "StringSchema": "String matching regex `^[a-zA-Z0-9:._+-]{1,15}$`", + "StringSchemaHTML": "String matching regex ^[a-zA-Z0-9:._+-]{1,15}$", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "\"\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "This parameter can be used to limit the host interfaces on which Calico will apply SNAT to traffic leaving a Calico IPAM pool with \"NAT outgoing\" enabled. This can be useful if you have a main data interface, where traffic should be SNATted and a secondary device (such as the docker bridge) which is local to the host and doesn't require SNAT. This parameter uses the iptables interface matching syntax, which allows + as a wildcard. Most users will not need to set this. Example: if your data interfaces are eth0 and eth1 and you want to exclude the docker bridge, you could set this to eth+.", + "DescriptionHTML": "

This parameter can be used to limit the host interfaces on which Calico will apply SNAT to traffic leaving a Calico IPAM pool with \"NAT outgoing\" enabled. This can be useful if you have a main data interface, where traffic should be SNATted and a secondary device (such as the docker bridge) which is local to the host and doesn't require SNAT. This parameter uses the iptables interface matching syntax, which allows + as a wildcard. Most users will not need to set this. Example: if your data interfaces are eth0 and eth1 and you want to exclude the docker bridge, you could set this to eth+.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: iptables", + "GroupWithSortPrefix": "20 Dataplane: iptables", + "NameConfigFile": "IptablesPostWriteCheckIntervalSecs", + "NameEnvVar": "FELIX_IptablesPostWriteCheckIntervalSecs", + "NameYAML": "iptablesPostWriteCheckInterval", + "NameGoAPI": "IptablesPostWriteCheckInterval", + "StringSchema": "Seconds (floating point)", + "StringSchemaHTML": "Seconds (floating point)", + "StringDefault": "5", + "ParsedDefault": "5s", + "ParsedDefaultJSON": "5000000000", + "ParsedType": "time.Duration", + "YAMLType": "string", + "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", + "YAMLDefault": "5s", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The period after Felix has done a write to the dataplane that it schedules an extra read back in order to check the write was not clobbered by another process. This should only occur if another application on the system doesn't respect the iptables lock.", + "DescriptionHTML": "

The period after Felix has done a write to the dataplane that it schedules an extra read back in order to check the write was not clobbered by another process. This should only occur if another application on the system doesn't respect the iptables lock.

", + "UserEditable": true, + "GoType": "*v1.Duration", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: iptables", + "GroupWithSortPrefix": "20 Dataplane: iptables", + "NameConfigFile": "IptablesRefreshInterval", + "NameEnvVar": "FELIX_IptablesRefreshInterval", + "NameYAML": "iptablesRefreshInterval", + "NameGoAPI": "IptablesRefreshInterval", + "StringSchema": "Seconds (floating point)", + "StringSchemaHTML": "Seconds (floating point)", + "StringDefault": "180", + "ParsedDefault": "3m0s", + "ParsedDefaultJSON": "180000000000", + "ParsedType": "time.Duration", + "YAMLType": "string", + "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", + "YAMLDefault": "3m0s", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The period at which Felix re-checks the IP sets in the dataplane to ensure that no other process has accidentally broken Calico's rules. Set to 0 to disable IP sets refresh. Note: the default for this value is lower than the other refresh intervals as a workaround for a Linux kernel bug that was fixed in kernel version 4.11. If you are using v4.11 or greater you may want to set this to, a higher value to reduce Felix CPU usage.", + "DescriptionHTML": "

The period at which Felix re-checks the IP sets in the dataplane to ensure that no other process has accidentally broken Calico's rules. Set to 0 to disable IP sets refresh. Note: the default for this value is lower than the other refresh intervals as a workaround for a Linux kernel bug that was fixed in kernel version 4.11. If you are using v4.11 or greater you may want to set this to, a higher value to reduce Felix CPU usage.

", + "UserEditable": true, + "GoType": "*v1.Duration", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: iptables", + "GroupWithSortPrefix": "20 Dataplane: iptables", + "NameConfigFile": "KubeNodePortRanges", + "NameEnvVar": "FELIX_KubeNodePortRanges", + "NameYAML": "kubeNodePortRanges", + "NameGoAPI": "KubeNodePortRanges", + "StringSchema": "List of port ranges: comma-delimited list of either single numbers in range [0,65535] or a ranges of numbers `n:m`", + "StringSchemaHTML": "List of port ranges: comma-delimited list of either single numbers in range [0,65535] or a ranges of numbers n:m", + "StringDefault": "30000:32767", + "ParsedDefault": "[30000:32767]", + "ParsedDefaultJSON": "[\"30000:32767\"]", + "ParsedType": "[]numorstring.Port", + "YAMLType": "array", + "YAMLSchema": "List of ports: `[, ...]` where `` is a port number (integer) or range (string), for example `80`, `8080:8089`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "List of ports: [<port>, ...] where <port> is a port number (integer) or range (string), for example 80, 8080:8089.", + "YAMLDefault": "[\"30000:32767\"]", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Holds list of port ranges used for service node ports. Only used if felix detects kube-proxy running in ipvs mode. Felix uses these ranges to separate host and workload traffic. .", + "DescriptionHTML": "

Holds list of port ranges used for service node ports. Only used if felix detects kube-proxy running in ipvs mode. Felix uses these ranges to separate host and workload traffic. .

", + "UserEditable": true, + "GoType": "*[]numorstring.Port", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: iptables", + "GroupWithSortPrefix": "20 Dataplane: iptables", + "NameConfigFile": "MaxIpsetSize", + "NameEnvVar": "FELIX_MaxIpsetSize", + "NameYAML": "maxIpsetSize", + "NameGoAPI": "MaxIpsetSize", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "1048576", + "ParsedDefault": "1048576", + "ParsedDefaultJSON": "1048576", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "1048576", + "Required": true, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The maximum number of IP addresses that can be stored in an IP set. Not applicable if using the nftables backend.", + "DescriptionHTML": "

The maximum number of IP addresses that can be stored in an IP set. Not applicable if using the nftables backend.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + } + ] + }, + { + "Name": "Dataplane: nftables", + "Fields": [ + { + "Group": "Dataplane: nftables", + "GroupWithSortPrefix": "21 Dataplane: nftables", + "NameConfigFile": "NftablesFilterAllowAction", + "NameEnvVar": "FELIX_NftablesFilterAllowAction", + "NameYAML": "nftablesFilterAllowAction", + "NameGoAPI": "NftablesFilterAllowAction", + "StringSchema": "One of: `ACCEPT`, `RETURN` (case insensitive)", + "StringSchemaHTML": "One of: ACCEPT, RETURN (case insensitive)", + "StringDefault": "ACCEPT", + "ParsedDefault": "ACCEPT", + "ParsedDefaultJSON": "\"ACCEPT\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `Accept`, `Return`.", + "YAMLEnumValues": ["Accept", "Return"], + "YAMLSchemaHTML": "One of: Accept, Return.", + "YAMLDefault": "Accept", + "Required": true, + "OnParseFailure": "Exit", + "AllowedConfigSources": "All", + "Description": "Controls the nftables action that Felix uses to represent the \"allow\" policy verdict in the filter table. The default is to `ACCEPT` the traffic, which is a terminal action. Alternatively, `RETURN` can be used to return the traffic back to the top-level chain for further processing by your rules.", + "DescriptionHTML": "

Controls the nftables action that Felix uses to represent the \"allow\" policy verdict in the filter table. The default is to ACCEPT the traffic, which is a terminal action. Alternatively, RETURN can be used to return the traffic back to the top-level chain for further processing by your rules.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: nftables", + "GroupWithSortPrefix": "21 Dataplane: nftables", + "NameConfigFile": "NftablesFilterDenyAction", + "NameEnvVar": "FELIX_NftablesFilterDenyAction", + "NameYAML": "nftablesFilterDenyAction", + "NameGoAPI": "NftablesFilterDenyAction", + "StringSchema": "One of: `DROP`, `REJECT` (case insensitive)", + "StringSchemaHTML": "One of: DROP, REJECT (case insensitive)", + "StringDefault": "DROP", + "ParsedDefault": "DROP", + "ParsedDefaultJSON": "\"DROP\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `Drop`, `Reject`.", + "YAMLEnumValues": ["Drop", "Reject"], + "YAMLSchemaHTML": "One of: Drop, Reject.", + "YAMLDefault": "Drop", + "Required": true, + "OnParseFailure": "Exit", + "AllowedConfigSources": "All", + "Description": "Controls what happens to traffic that is denied by network policy. By default, Calico blocks traffic with a \"drop\" action. If you want to use a \"reject\" action instead you can configure it here.", + "DescriptionHTML": "

Controls what happens to traffic that is denied by network policy. By default, Calico blocks traffic with a \"drop\" action. If you want to use a \"reject\" action instead you can configure it here.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: nftables", + "GroupWithSortPrefix": "21 Dataplane: nftables", + "NameConfigFile": "NftablesMangleAllowAction", + "NameEnvVar": "FELIX_NftablesMangleAllowAction", + "NameYAML": "nftablesMangleAllowAction", + "NameGoAPI": "NftablesMangleAllowAction", + "StringSchema": "One of: `ACCEPT`, `RETURN` (case insensitive)", + "StringSchemaHTML": "One of: ACCEPT, RETURN (case insensitive)", + "StringDefault": "ACCEPT", + "ParsedDefault": "ACCEPT", + "ParsedDefaultJSON": "\"ACCEPT\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `Accept`, `Return`.", + "YAMLEnumValues": ["Accept", "Return"], + "YAMLSchemaHTML": "One of: Accept, Return.", + "YAMLDefault": "Accept", + "Required": true, + "OnParseFailure": "Exit", + "AllowedConfigSources": "All", + "Description": "Controls the nftables action that Felix uses to represent the \"allow\" policy verdict in the mangle table. The default is to `ACCEPT` the traffic, which is a terminal action. Alternatively, `RETURN` can be used to return the traffic back to the top-level chain for further processing by your rules.", + "DescriptionHTML": "

Controls the nftables action that Felix uses to represent the \"allow\" policy verdict in the mangle table. The default is to ACCEPT the traffic, which is a terminal action. Alternatively, RETURN can be used to return the traffic back to the top-level chain for further processing by your rules.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: nftables", + "GroupWithSortPrefix": "21 Dataplane: nftables", + "NameConfigFile": "NftablesMarkMask", + "NameEnvVar": "FELIX_NftablesMarkMask", + "NameYAML": "nftablesMarkMask", + "NameGoAPI": "NftablesMarkMask", + "StringSchema": "32-bit bitmask (hex or deccimal allowed) with at least 2 bits set, example: `0xffff0000`", + "StringSchemaHTML": "32-bit bitmask (hex or deccimal allowed) with at least 2 bits set, example: 0xffff0000", + "StringDefault": "0xffff0000", + "ParsedDefault": "4294901760", + "ParsedDefaultJSON": "4294901760", + "ParsedType": "uint32", + "YAMLType": "integer", + "YAMLSchema": "Unsigned 32-bit integer.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Unsigned 32-bit integer.", + "YAMLDefault": "0xffff0000", + "Required": true, + "OnParseFailure": "Exit", + "AllowedConfigSources": "All", + "Description": "The mask that Felix selects its nftables Mark bits from. Should be a 32 bit hexadecimal number with at least 8 bits set, none of which clash with any other mark bits in use on the system.", + "DescriptionHTML": "

The mask that Felix selects its nftables Mark bits from. Should be a 32 bit hexadecimal number with at least 8 bits set, none of which clash with any other mark bits in use on the system.

", + "UserEditable": true, + "GoType": "*uint32", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: nftables", + "GroupWithSortPrefix": "21 Dataplane: nftables", + "NameConfigFile": "NftablesRefreshInterval", + "NameEnvVar": "FELIX_NftablesRefreshInterval", + "NameYAML": "nftablesRefreshInterval", + "NameGoAPI": "NftablesRefreshInterval", + "StringSchema": "Seconds (floating point)", + "StringSchemaHTML": "Seconds (floating point)", + "StringDefault": "180", + "ParsedDefault": "3m0s", + "ParsedDefaultJSON": "180000000000", + "ParsedType": "time.Duration", + "YAMLType": "string", + "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", + "YAMLDefault": "3m0s", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls the interval at which Felix periodically refreshes the nftables rules.", + "DescriptionHTML": "

Controls the interval at which Felix periodically refreshes the nftables rules.

", + "UserEditable": true, + "GoType": "*v1.Duration", + "OpenSourceOnly": false + } + ] + }, + { + "Name": "Dataplane: eBPF", + "Fields": [ + { + "Group": "Dataplane: eBPF", + "GroupWithSortPrefix": "22 Dataplane: eBPF", + "NameConfigFile": "BPFCTLBLogFilter", + "NameEnvVar": "FELIX_BPFCTLBLogFilter", + "NameYAML": "bpfCTLBLogFilter", + "NameGoAPI": "BPFCTLBLogFilter", + "StringSchema": "One of: `all` (case insensitive)", + "StringSchemaHTML": "One of: all (case insensitive)", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "\"\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Specifies, what is logged by connect time load balancer when BPFLogLevel is debug. Currently has to be specified as 'all' when BPFLogFilters is set to see CTLB logs.", + "DescriptionHTML": "

Specifies, what is logged by connect time load balancer when BPFLogLevel is debug. Currently has to be specified as 'all' when BPFLogFilters is set to see CTLB logs.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: eBPF", + "GroupWithSortPrefix": "22 Dataplane: eBPF", + "NameConfigFile": "BPFConnectTimeLoadBalancing", + "NameEnvVar": "FELIX_BPFConnectTimeLoadBalancing", + "NameYAML": "bpfConnectTimeLoadBalancing", + "NameGoAPI": "BPFConnectTimeLoadBalancing", + "StringSchema": "One of: `Disabled`, `Enabled`, `TCP` (case insensitive)", + "StringSchemaHTML": "One of: Disabled, Enabled, TCP (case insensitive)", + "StringDefault": "TCP", + "ParsedDefault": "TCP", + "ParsedDefaultJSON": "\"TCP\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `\"Disabled\"`, `\"Enabled\"`, `\"TCP\"`.", + "YAMLEnumValues": ["Disabled", "Enabled", "TCP"], + "YAMLSchemaHTML": "One of: \"Disabled\", \"Enabled\", \"TCP\".", + "YAMLDefault": "TCP", + "Required": true, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "When in BPF mode, controls whether Felix installs the connect-time load balancer. The connect-time load balancer is required for the host to be able to reach Kubernetes services and it improves the performance of pod-to-service connections.When set to TCP, connect time load balancing is available only for services with TCP ports.", + "DescriptionHTML": "

When in BPF mode, controls whether Felix installs the connect-time load balancer. The connect-time load balancer is required for the host to be able to reach Kubernetes services and it improves the performance of pod-to-service connections.When set to TCP, connect time load balancing is available only for services with TCP ports.

", + "UserEditable": true, + "GoType": "*v3.BPFConnectTimeLBType", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: eBPF", + "GroupWithSortPrefix": "22 Dataplane: eBPF", + "NameConfigFile": "BPFConnectTimeLoadBalancingEnabled", + "NameEnvVar": "FELIX_BPFConnectTimeLoadBalancingEnabled", + "NameYAML": "bpfConnectTimeLoadBalancingEnabled", + "NameGoAPI": "BPFConnectTimeLoadBalancingEnabled", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "When in BPF mode, controls whether Felix installs the connection-time load balancer. The connect-time load balancer is required for the host to be able to reach Kubernetes services and it improves the performance of pod-to-service connections. The only reason to disable it is for debugging purposes.\n\nDeprecated: Use BPFConnectTimeLoadBalancing.", + "DescriptionHTML": "

When in BPF mode, controls whether Felix installs the connection-time load balancer. The connect-time load balancer is required for the host to be able to reach Kubernetes services and it improves the performance of pod-to-service connections. The only reason to disable it is for debugging purposes.

\n

Deprecated: Use BPFConnectTimeLoadBalancing.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: eBPF", + "GroupWithSortPrefix": "22 Dataplane: eBPF", + "NameConfigFile": "BPFDNSPolicyMode", + "NameEnvVar": "FELIX_BPFDNSPolicyMode", + "NameYAML": "bpfDNSPolicyMode", + "NameGoAPI": "BPFDNSPolicyMode", + "StringSchema": "One of: `Inline`, `NoDelay` (case insensitive)", + "StringSchemaHTML": "One of: Inline, NoDelay (case insensitive)", + "StringDefault": "Inline", + "ParsedDefault": "Inline", + "ParsedDefaultJSON": "\"Inline\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "", + "YAMLDefault": "Inline", + "Required": true, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Specifies how DNS policy programming will be handled. Inline - BPF parses DNS response inline with DNS response packet processing. This guarantees the DNS rules reflect any change immediately. NoDelay - Felix does not introduce any delay to the packets. DNS rules may not have been programmed by the time the first packet traverses the policy rules. Client applications need to handle reconnection attempts if initial connection attempts fail. This may be problematic for some applications or for very low DNS TTLs.", + "DescriptionHTML": "

Specifies how DNS policy programming will be handled. Inline - BPF parses DNS response inline with DNS response packet processing. This guarantees the DNS rules reflect any change immediately. NoDelay - Felix does not introduce any delay to the packets. DNS rules may not have been programmed by the time the first packet traverses the policy rules. Client applications need to handle reconnection attempts if initial connection attempts fail. This may be problematic for some applications or for very low DNS TTLs.

", + "UserEditable": true, + "GoType": "*v3.BPFDNSPolicyMode", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: eBPF", + "GroupWithSortPrefix": "22 Dataplane: eBPF", + "NameConfigFile": "BPFDSROptoutCIDRs", + "NameEnvVar": "FELIX_BPFDSROptoutCIDRs", + "NameYAML": "bpfDSROptoutCIDRs", + "NameGoAPI": "BPFDSROptoutCIDRs", + "StringSchema": "Comma-delimited list of CIDRs", + "StringSchemaHTML": "Comma-delimited list of CIDRs", + "StringDefault": "", + "ParsedDefault": "[]", + "ParsedDefaultJSON": "null", + "ParsedType": "[]string", + "YAMLType": "array", + "YAMLSchema": "List of CIDRs: `[\"\", ...]`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "List of CIDRs: [\"<cidr>\", ...].", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "A list of CIDRs which are excluded from DSR. That is, clients in those CIDRs will access service node ports as if BPFExternalServiceMode was set to Tunnel.", + "DescriptionHTML": "

A list of CIDRs which are excluded from DSR. That is, clients in those CIDRs will access service node ports as if BPFExternalServiceMode was set to Tunnel.

", + "UserEditable": true, + "GoType": "*[]string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: eBPF", + "GroupWithSortPrefix": "22 Dataplane: eBPF", + "NameConfigFile": "BPFDataIfacePattern", + "NameEnvVar": "FELIX_BPFDataIfacePattern", + "NameYAML": "bpfDataIfacePattern", + "NameGoAPI": "BPFDataIfacePattern", + "StringSchema": "Regular expression", + "StringSchemaHTML": "Regular expression", + "StringDefault": "^((en|wl|ww|sl|ib)[Popsx].*|(eth|wlan|wwan|bond).*|tunl0$|vxlan.calico$|vxlan-v6.calico$|wireguard.cali$|wg-v6.cali$|egress.calico$)", + "ParsedDefault": "^((en|wl|ww|sl|ib)[Popsx].*|(eth|wlan|wwan|bond).*|tunl0$|vxlan.calico$|vxlan-v6.calico$|wireguard.cali$|wg-v6.cali$|egress.calico$)", + "ParsedDefaultJSON": "\"^((en|wl|ww|sl|ib)[Popsx].*|(eth|wlan|wwan|bond).*|tunl0$|vxlan.calico$|vxlan-v6.calico$|wireguard.cali$|wg-v6.cali$|egress.calico$)\"", + "ParsedType": "*regexp.Regexp", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "^((en|wl|ww|sl|ib)[Popsx].*|(eth|wlan|wwan|bond).*|tunl0$|vxlan.calico$|vxlan-v6.calico$|wireguard.cali$|wg-v6.cali$|egress.calico$)", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "A regular expression that controls which interfaces Felix should attach BPF programs to in order to catch traffic to/from the network. This needs to match the interfaces that Calico workload traffic flows over as well as any interfaces that handle incoming traffic to nodeports and services from outside the cluster. It should not match the workload interfaces (usually named cali...).", + "DescriptionHTML": "

A regular expression that controls which interfaces Felix should attach BPF programs to in order to catch traffic to/from the network. This needs to match the interfaces that Calico workload traffic flows over as well as any interfaces that handle incoming traffic to nodeports and services from outside the cluster. It should not match the workload interfaces (usually named cali...).

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: eBPF", + "GroupWithSortPrefix": "22 Dataplane: eBPF", + "NameConfigFile": "BPFDisableGROForIfaces", + "NameEnvVar": "FELIX_BPFDisableGROForIfaces", + "NameYAML": "bpfDisableGROForIfaces", + "NameGoAPI": "BPFDisableGROForIfaces", + "StringSchema": "Regular expression", + "StringSchemaHTML": "Regular expression", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "null", + "ParsedType": "*regexp.Regexp", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "A regular expression that controls which interfaces Felix should disable the Generic Receive Offload [GRO] option. It should not match the workload interfaces (usually named cali...).", + "DescriptionHTML": "

A regular expression that controls which interfaces Felix should disable the Generic Receive Offload [GRO] option. It should not match the workload interfaces (usually named cali...).

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: eBPF", + "GroupWithSortPrefix": "22 Dataplane: eBPF", + "NameConfigFile": "BPFDisableUnprivileged", + "NameEnvVar": "FELIX_BPFDisableUnprivileged", + "NameYAML": "bpfDisableUnprivileged", + "NameGoAPI": "BPFDisableUnprivileged", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "true", + "ParsedDefault": "true", + "ParsedDefaultJSON": "true", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "true", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "If enabled, Felix sets the kernel.unprivileged_bpf_disabled sysctl to disable unprivileged use of BPF. This ensures that unprivileged users cannot access Calico's BPF maps and cannot insert their own BPF programs to interfere with Calico's.", + "DescriptionHTML": "

If enabled, Felix sets the kernel.unprivileged_bpf_disabled sysctl to disable unprivileged use of BPF. This ensures that unprivileged users cannot access Calico's BPF maps and cannot insert their own BPF programs to interfere with Calico's.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: eBPF", + "GroupWithSortPrefix": "22 Dataplane: eBPF", + "NameConfigFile": "BPFEnabled", + "NameEnvVar": "FELIX_BPFEnabled", + "NameYAML": "bpfEnabled", + "NameGoAPI": "BPFEnabled", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "false", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "false", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "If enabled Felix will use the BPF dataplane.", + "DescriptionHTML": "

If enabled Felix will use the BPF dataplane.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: eBPF", + "GroupWithSortPrefix": "22 Dataplane: eBPF", + "NameConfigFile": "BPFEnforceRPF", + "NameEnvVar": "FELIX_BPFEnforceRPF", + "NameYAML": "bpfEnforceRPF", + "NameGoAPI": "BPFEnforceRPF", + "StringSchema": "One of: `Disabled`, `Loose`, `Strict` (case insensitive)", + "StringSchemaHTML": "One of: Disabled, Loose, Strict (case insensitive)", + "StringDefault": "Loose", + "ParsedDefault": "Loose", + "ParsedDefaultJSON": "\"Loose\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `Disabled`, `Loose`, `Strict`.", + "YAMLEnumValues": ["Disabled", "Loose", "Strict"], + "YAMLSchemaHTML": "One of: Disabled, Loose, Strict.", + "YAMLDefault": "Loose", + "Required": true, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Enforce strict RPF on all host interfaces with BPF programs regardless of what is the per-interfaces or global setting. Possible values are Disabled, Strict or Loose.", + "DescriptionHTML": "

Enforce strict RPF on all host interfaces with BPF programs regardless of what is the per-interfaces or global setting. Possible values are Disabled, Strict or Loose.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: eBPF", + "GroupWithSortPrefix": "22 Dataplane: eBPF", + "NameConfigFile": "BPFExcludeCIDRsFromNAT", + "NameEnvVar": "FELIX_BPFExcludeCIDRsFromNAT", + "NameYAML": "bpfExcludeCIDRsFromNAT", + "NameGoAPI": "BPFExcludeCIDRsFromNAT", + "StringSchema": "Comma-delimited list of CIDRs", + "StringSchemaHTML": "Comma-delimited list of CIDRs", + "StringDefault": "", + "ParsedDefault": "[]", + "ParsedDefaultJSON": "null", + "ParsedType": "[]string", + "YAMLType": "array", + "YAMLSchema": "List of CIDRs: `[\"\", ...]`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "List of CIDRs: [\"<cidr>\", ...].", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "A list of CIDRs that are to be excluded from NAT resolution so that host can handle them. A typical usecase is node local DNS cache.", + "DescriptionHTML": "

A list of CIDRs that are to be excluded from NAT resolution so that host can handle them. A typical usecase is node local DNS cache.

", + "UserEditable": true, + "GoType": "*[]string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: eBPF", + "GroupWithSortPrefix": "22 Dataplane: eBPF", + "NameConfigFile": "BPFExportBufferSizeMB", + "NameEnvVar": "FELIX_BPFExportBufferSizeMB", + "NameYAML": "bpfExportBufferSizeMB", + "NameGoAPI": "BPFExportBufferSizeMB", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "1", + "ParsedDefault": "1", + "ParsedDefaultJSON": "1", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "1", + "Required": true, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "In BPF mode, controls the buffer size used for sending BPF events to felix.", + "DescriptionHTML": "

In BPF mode, controls the buffer size used for sending BPF events to felix.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: eBPF", + "GroupWithSortPrefix": "22 Dataplane: eBPF", + "NameConfigFile": "BPFExtToServiceConnmark", + "NameEnvVar": "FELIX_BPFExtToServiceConnmark", + "NameYAML": "bpfExtToServiceConnmark", + "NameGoAPI": "BPFExtToServiceConnmark", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "0", + "ParsedDefault": "0", + "ParsedDefaultJSON": "0", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "0", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "In BPF mode, controls a 32bit mark that is set on connections from an external client to a local service. This mark allows us to control how packets of that connection are routed within the host and how is routing interpreted by RPF check.", + "DescriptionHTML": "

In BPF mode, controls a 32bit mark that is set on connections from an external client to a local service. This mark allows us to control how packets of that connection are routed within the host and how is routing interpreted by RPF check.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: eBPF", + "GroupWithSortPrefix": "22 Dataplane: eBPF", + "NameConfigFile": "BPFExternalServiceMode", + "NameEnvVar": "FELIX_BPFExternalServiceMode", + "NameYAML": "bpfExternalServiceMode", + "NameGoAPI": "BPFExternalServiceMode", + "StringSchema": "One of: `dsr`, `tunnel` (case insensitive)", + "StringSchemaHTML": "One of: dsr, tunnel (case insensitive)", + "StringDefault": "tunnel", + "ParsedDefault": "tunnel", + "ParsedDefaultJSON": "\"tunnel\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `DSR`, `Tunnel`.", + "YAMLEnumValues": ["DSR", "Tunnel"], + "YAMLSchemaHTML": "One of: DSR, Tunnel.", + "YAMLDefault": "Tunnel", + "Required": true, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "In BPF mode, controls how connections from outside the cluster to services (node ports and cluster IPs) are forwarded to remote workloads. If set to \"Tunnel\" then both request and response traffic is tunneled to the remote node. If set to \"DSR\", the request traffic is tunneled but the response traffic is sent directly from the remote node. In \"DSR\" mode, the remote node appears to use the IP of the ingress node; this requires a permissive L2 network.", + "DescriptionHTML": "

In BPF mode, controls how connections from outside the cluster to services (node ports and cluster IPs) are forwarded to remote workloads. If set to \"Tunnel\" then both request and response traffic is tunneled to the remote node. If set to \"DSR\", the request traffic is tunneled but the response traffic is sent directly from the remote node. In \"DSR\" mode, the remote node appears to use the IP of the ingress node; this requires a permissive L2 network.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: eBPF", + "GroupWithSortPrefix": "22 Dataplane: eBPF", + "NameConfigFile": "BPFForceTrackPacketsFromIfaces", + "NameEnvVar": "FELIX_BPFForceTrackPacketsFromIfaces", + "NameYAML": "bpfForceTrackPacketsFromIfaces", + "NameGoAPI": "BPFForceTrackPacketsFromIfaces", + "StringSchema": "Comma-delimited list of strings, each matching the regex `^[a-zA-Z0-9:._+-]{1,15}$`", + "StringSchemaHTML": "Comma-delimited list of strings, each matching the regex ^[a-zA-Z0-9:._+-]{1,15}$", + "StringDefault": "docker+", + "ParsedDefault": "[docker+]", + "ParsedDefaultJSON": "[\"docker+\"]", + "ParsedType": "[]string", + "YAMLType": "array", + "YAMLSchema": "List of interface names (may use `+` as a wildcard: `[\"\", ...]`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "List of interface names (may use + as a wildcard: [\"<name>\", ...].", + "YAMLDefault": "[\"docker+\"]", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "In BPF mode, forces traffic from these interfaces to skip Calico's iptables NOTRACK rule, allowing traffic from those interfaces to be tracked by Linux conntrack. Should only be used for interfaces that are not used for the Calico fabric. For example, a docker bridge device for non-Calico-networked containers.", + "DescriptionHTML": "

In BPF mode, forces traffic from these interfaces to skip Calico's iptables NOTRACK rule, allowing traffic from those interfaces to be tracked by Linux conntrack. Should only be used for interfaces that are not used for the Calico fabric. For example, a docker bridge device for non-Calico-networked containers.

", + "UserEditable": true, + "GoType": "*[]string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: eBPF", + "GroupWithSortPrefix": "22 Dataplane: eBPF", + "NameConfigFile": "BPFHostConntrackBypass", + "NameEnvVar": "FELIX_BPFHostConntrackBypass", + "NameYAML": "bpfHostConntrackBypass", + "NameGoAPI": "BPFHostConntrackBypass", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "false", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "false", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls whether to bypass Linux conntrack in BPF mode for workloads and services.", + "DescriptionHTML": "

Controls whether to bypass Linux conntrack in BPF mode for workloads and services.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: eBPF", + "GroupWithSortPrefix": "22 Dataplane: eBPF", + "NameConfigFile": "BPFHostNetworkedNATWithoutCTLB", + "NameEnvVar": "FELIX_BPFHostNetworkedNATWithoutCTLB", + "NameYAML": "bpfHostNetworkedNATWithoutCTLB", + "NameGoAPI": "BPFHostNetworkedNATWithoutCTLB", + "StringSchema": "One of: `Disabled`, `Enabled` (case insensitive)", + "StringSchemaHTML": "One of: Disabled, Enabled (case insensitive)", + "StringDefault": "Enabled", + "ParsedDefault": "Enabled", + "ParsedDefaultJSON": "\"Enabled\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "", + "YAMLDefault": "Enabled", + "Required": true, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "When in BPF mode, controls whether Felix does a NAT without CTLB. This along with BPFConnectTimeLoadBalancing determines the CTLB behavior.", + "DescriptionHTML": "

When in BPF mode, controls whether Felix does a NAT without CTLB. This along with BPFConnectTimeLoadBalancing determines the CTLB behavior.

", + "UserEditable": true, + "GoType": "*v3.BPFHostNetworkedNATType", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: eBPF", + "GroupWithSortPrefix": "22 Dataplane: eBPF", + "NameConfigFile": "BPFKubeProxyEndpointSlicesEnabled", + "NameEnvVar": "FELIX_BPFKubeProxyEndpointSlicesEnabled", + "NameYAML": "bpfKubeProxyEndpointSlicesEnabled", + "NameGoAPI": "BPFKubeProxyEndpointSlicesEnabled", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "true", + "ParsedDefault": "true", + "ParsedDefaultJSON": "true", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "true", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Deprecated and has no effect. BPF kube-proxy always accepts endpoint slices. This option will be removed in the next release.", + "DescriptionHTML": "

Deprecated and has no effect. BPF kube-proxy always accepts endpoint slices. This option will be removed in the next release.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: eBPF", + "GroupWithSortPrefix": "22 Dataplane: eBPF", + "NameConfigFile": "BPFKubeProxyIptablesCleanupEnabled", + "NameEnvVar": "FELIX_BPFKubeProxyIptablesCleanupEnabled", + "NameYAML": "bpfKubeProxyIptablesCleanupEnabled", + "NameGoAPI": "BPFKubeProxyIptablesCleanupEnabled", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "true", + "ParsedDefault": "true", + "ParsedDefaultJSON": "true", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "true", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "If enabled in BPF mode, Felix will proactively clean up the upstream Kubernetes kube-proxy's iptables chains. Should only be enabled if kube-proxy is not running.", + "DescriptionHTML": "

If enabled in BPF mode, Felix will proactively clean up the upstream Kubernetes kube-proxy's iptables chains. Should only be enabled if kube-proxy is not running.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: eBPF", + "GroupWithSortPrefix": "22 Dataplane: eBPF", + "NameConfigFile": "BPFKubeProxyMinSyncPeriod", + "NameEnvVar": "FELIX_BPFKubeProxyMinSyncPeriod", + "NameYAML": "bpfKubeProxyMinSyncPeriod", + "NameGoAPI": "BPFKubeProxyMinSyncPeriod", + "StringSchema": "Seconds (floating point)", + "StringSchemaHTML": "Seconds (floating point)", + "StringDefault": "1", + "ParsedDefault": "1s", + "ParsedDefaultJSON": "1000000000", + "ParsedType": "time.Duration", + "YAMLType": "string", + "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", + "YAMLDefault": "1s", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "In BPF mode, controls the minimum time between updates to the dataplane for Felix's embedded kube-proxy. Lower values give reduced set-up latency. Higher values reduce Felix CPU usage by batching up more work.", + "DescriptionHTML": "

In BPF mode, controls the minimum time between updates to the dataplane for Felix's embedded kube-proxy. Lower values give reduced set-up latency. Higher values reduce Felix CPU usage by batching up more work.

", + "UserEditable": true, + "GoType": "*v1.Duration", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: eBPF", + "GroupWithSortPrefix": "22 Dataplane: eBPF", + "NameConfigFile": "BPFL3IfacePattern", + "NameEnvVar": "FELIX_BPFL3IfacePattern", + "NameYAML": "bpfL3IfacePattern", + "NameGoAPI": "BPFL3IfacePattern", + "StringSchema": "Regular expression", + "StringSchemaHTML": "Regular expression", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "null", + "ParsedType": "*regexp.Regexp", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "A regular expression that allows to list tunnel devices like wireguard or vxlan (i.e., L3 devices) in addition to BPFDataIfacePattern. That is, tunnel interfaces not created by Calico, that Calico workload traffic flows over as well as any interfaces that handle incoming traffic to nodeports and services from outside the cluster.", + "DescriptionHTML": "

A regular expression that allows to list tunnel devices like wireguard or vxlan (i.e., L3 devices) in addition to BPFDataIfacePattern. That is, tunnel interfaces not created by Calico, that Calico workload traffic flows over as well as any interfaces that handle incoming traffic to nodeports and services from outside the cluster.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: eBPF", + "GroupWithSortPrefix": "22 Dataplane: eBPF", + "NameConfigFile": "BPFLogFilters", + "NameEnvVar": "FELIX_BPFLogFilters", + "NameYAML": "bpfLogFilters", + "NameGoAPI": "BPFLogFilters", + "StringSchema": "Comma-delimited list of key=value pairs", + "StringSchemaHTML": "Comma-delimited list of key=value pairs", + "StringDefault": "", + "ParsedDefault": "map[]", + "ParsedDefaultJSON": "null", + "ParsedType": "map[string]string", + "YAMLType": "object", + "YAMLSchema": "", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "A map of key=values where the value is a pcap filter expression and the key is an interface name with 'all' denoting all interfaces, 'weps' all workload endpoints and 'heps' all host endpoints.\n\nWhen specified as an env var, it accepts a comma-separated list of key=values.", + "DescriptionHTML": "

A map of key=values where the value is a pcap filter expression and the key is an interface name with 'all' denoting all interfaces, 'weps' all workload endpoints and 'heps' all host endpoints.

\n

When specified as an env var, it accepts a comma-separated list of key=values.

", + "UserEditable": true, + "GoType": "*map[string]string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: eBPF", + "GroupWithSortPrefix": "22 Dataplane: eBPF", + "NameConfigFile": "BPFLogLevel", + "NameEnvVar": "FELIX_BPFLogLevel", + "NameYAML": "bpfLogLevel", + "NameGoAPI": "BPFLogLevel", + "StringSchema": "One of: `debug`, `info`, `off` (case insensitive)", + "StringSchemaHTML": "One of: debug, info, off (case insensitive)", + "StringDefault": "off", + "ParsedDefault": "off", + "ParsedDefaultJSON": "\"off\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `Debug`, `Info`, `Off`.", + "YAMLEnumValues": ["Debug", "Info", "Off"], + "YAMLSchemaHTML": "One of: Debug, Info, Off.", + "YAMLDefault": "Off", + "Required": true, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls the log level of the BPF programs when in BPF dataplane mode. One of \"Off\", \"Info\", or \"Debug\". The logs are emitted to the BPF trace pipe, accessible with the command `tc exec bpf debug`. .", + "DescriptionHTML": "

Controls the log level of the BPF programs when in BPF dataplane mode. One of \"Off\", \"Info\", or \"Debug\". The logs are emitted to the BPF trace pipe, accessible with the command tc exec bpf debug. .

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: eBPF", + "GroupWithSortPrefix": "22 Dataplane: eBPF", + "NameConfigFile": "BPFMapSizeConntrack", + "NameEnvVar": "FELIX_BPFMapSizeConntrack", + "NameYAML": "bpfMapSizeConntrack", + "NameGoAPI": "BPFMapSizeConntrack", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "512000", + "ParsedDefault": "512000", + "ParsedDefaultJSON": "512000", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "512000", + "Required": true, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Sets the size for the conntrack map. This map must be large enough to hold an entry for each active connection. Warning: changing the size of the conntrack map can cause disruption.", + "DescriptionHTML": "

Sets the size for the conntrack map. This map must be large enough to hold an entry for each active connection. Warning: changing the size of the conntrack map can cause disruption.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: eBPF", + "GroupWithSortPrefix": "22 Dataplane: eBPF", + "NameConfigFile": "BPFMapSizeIPSets", + "NameEnvVar": "FELIX_BPFMapSizeIPSets", + "NameYAML": "bpfMapSizeIPSets", + "NameGoAPI": "BPFMapSizeIPSets", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "1048576", + "ParsedDefault": "1048576", + "ParsedDefaultJSON": "1048576", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "1048576", + "Required": true, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Sets the size for ipsets map. The IP sets map must be large enough to hold an entry for each endpoint matched by every selector in the source/destination matches in network policy. Selectors such as \"all()\" can result in large numbers of entries (one entry per endpoint in that case).", + "DescriptionHTML": "

Sets the size for ipsets map. The IP sets map must be large enough to hold an entry for each endpoint matched by every selector in the source/destination matches in network policy. Selectors such as \"all()\" can result in large numbers of entries (one entry per endpoint in that case).

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: eBPF", + "GroupWithSortPrefix": "22 Dataplane: eBPF", + "NameConfigFile": "BPFMapSizeIfState", + "NameEnvVar": "FELIX_BPFMapSizeIfState", + "NameYAML": "bpfMapSizeIfState", + "NameGoAPI": "BPFMapSizeIfState", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "1000", + "ParsedDefault": "1000", + "ParsedDefaultJSON": "1000", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "1000", + "Required": true, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Sets the size for ifstate map. The ifstate map must be large enough to hold an entry for each device (host + workloads) on a host.", + "DescriptionHTML": "

Sets the size for ifstate map. The ifstate map must be large enough to hold an entry for each device (host + workloads) on a host.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: eBPF", + "GroupWithSortPrefix": "22 Dataplane: eBPF", + "NameConfigFile": "BPFMapSizeNATAffinity", + "NameEnvVar": "FELIX_BPFMapSizeNATAffinity", + "NameYAML": "bpfMapSizeNATAffinity", + "NameGoAPI": "BPFMapSizeNATAffinity", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "65536", + "ParsedDefault": "65536", + "ParsedDefaultJSON": "65536", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "65536", + "Required": true, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Sets the size of the BPF map that stores the affinity of a connection (for services that enable that feature.", + "DescriptionHTML": "

Sets the size of the BPF map that stores the affinity of a connection (for services that enable that feature.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: eBPF", + "GroupWithSortPrefix": "22 Dataplane: eBPF", + "NameConfigFile": "BPFMapSizeNATBackend", + "NameEnvVar": "FELIX_BPFMapSizeNATBackend", + "NameYAML": "bpfMapSizeNATBackend", + "NameGoAPI": "BPFMapSizeNATBackend", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "262144", + "ParsedDefault": "262144", + "ParsedDefaultJSON": "262144", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "262144", + "Required": true, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Sets the size for NAT back end map. This is the total number of endpoints. This is mostly more than the size of the number of services.", + "DescriptionHTML": "

Sets the size for NAT back end map. This is the total number of endpoints. This is mostly more than the size of the number of services.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: eBPF", + "GroupWithSortPrefix": "22 Dataplane: eBPF", + "NameConfigFile": "BPFMapSizeNATFrontend", + "NameEnvVar": "FELIX_BPFMapSizeNATFrontend", + "NameYAML": "bpfMapSizeNATFrontend", + "NameGoAPI": "BPFMapSizeNATFrontend", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "65536", + "ParsedDefault": "65536", + "ParsedDefaultJSON": "65536", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "65536", + "Required": true, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Sets the size for NAT front end map. FrontendMap should be large enough to hold an entry for each nodeport, external IP and each port in each service.", + "DescriptionHTML": "

Sets the size for NAT front end map. FrontendMap should be large enough to hold an entry for each nodeport, external IP and each port in each service.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: eBPF", + "GroupWithSortPrefix": "22 Dataplane: eBPF", + "NameConfigFile": "BPFMapSizeRoute", + "NameEnvVar": "FELIX_BPFMapSizeRoute", + "NameYAML": "bpfMapSizeRoute", + "NameGoAPI": "BPFMapSizeRoute", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "262144", + "ParsedDefault": "262144", + "ParsedDefaultJSON": "262144", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "262144", + "Required": true, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Sets the size for the routes map. The routes map should be large enough to hold one entry per workload and a handful of entries per host (enough to cover its own IPs and tunnel IPs).", + "DescriptionHTML": "

Sets the size for the routes map. The routes map should be large enough to hold one entry per workload and a handful of entries per host (enough to cover its own IPs and tunnel IPs).

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: eBPF", + "GroupWithSortPrefix": "22 Dataplane: eBPF", + "NameConfigFile": "BPFPSNATPorts", + "NameEnvVar": "FELIX_BPFPSNATPorts", + "NameYAML": "bpfPSNATPorts", + "NameGoAPI": "BPFPSNATPorts", + "StringSchema": "Port range: either a single number in [0,65535] or a range of numbers `n:m`", + "StringSchemaHTML": "Port range: either a single number in [0,65535] or a range of numbers n:m", + "StringDefault": "20000:29999", + "ParsedDefault": "20000:29999", + "ParsedDefaultJSON": "\"20000:29999\"", + "ParsedType": "numorstring.Port", + "YAMLType": "integer or string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "20000:29999", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Sets the range from which we randomly pick a port if there is a source port collision. This should be within the ephemeral range as defined by RFC 6056 (1024–65535) and preferably outside the ephemeral ranges used by common operating systems. Linux uses 32768–60999, while others mostly use the IANA defined range 49152–65535. It is not necessarily a problem if this range overlaps with the operating systems. Both ends of the range are inclusive.", + "DescriptionHTML": "

Sets the range from which we randomly pick a port if there is a source port collision. This should be within the ephemeral range as defined by RFC 6056 (1024–65535) and preferably outside the ephemeral ranges used by common operating systems. Linux uses 32768–60999, while others mostly use the IANA defined range 49152–65535. It is not necessarily a problem if this range overlaps with the operating systems. Both ends of the range are inclusive.

", + "UserEditable": true, + "GoType": "*numorstring.Port", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: eBPF", + "GroupWithSortPrefix": "22 Dataplane: eBPF", + "NameConfigFile": "BPFPolicyDebugEnabled", + "NameEnvVar": "FELIX_BPFPolicyDebugEnabled", + "NameYAML": "bpfPolicyDebugEnabled", + "NameGoAPI": "BPFPolicyDebugEnabled", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "true", + "ParsedDefault": "true", + "ParsedDefaultJSON": "true", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "true", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "When true, Felix records detailed information about the BPF policy programs, which can be examined with the calico-bpf command-line tool.", + "DescriptionHTML": "

When true, Felix records detailed information about the BPF policy programs, which can be examined with the calico-bpf command-line tool.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: eBPF", + "GroupWithSortPrefix": "22 Dataplane: eBPF", + "NameConfigFile": "BPFRedirectToPeer", + "NameEnvVar": "FELIX_BPFRedirectToPeer", + "NameYAML": "bpfRedirectToPeer", + "NameGoAPI": "BPFRedirectToPeer", + "StringSchema": "One of: `Disabled`, `Enabled`, `L2Only` (case insensitive)", + "StringSchemaHTML": "One of: Disabled, Enabled, L2Only (case insensitive)", + "StringDefault": "Disabled", + "ParsedDefault": "Disabled", + "ParsedDefaultJSON": "\"Disabled\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `\"Disabled\"`, `\"Enabled\"`, `\"L2Only\"`.", + "YAMLEnumValues": ["Disabled", "Enabled", "L2Only"], + "YAMLSchemaHTML": "One of: \"Disabled\", \"Enabled\", \"L2Only\".", + "YAMLDefault": "Disabled", + "Required": true, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls which whether it is allowed to forward straight to the peer side of the workload devices. It is allowed for any host L2 devices by default (L2Only), but it breaks TCP dump on the host side of workload device as it bypasses it on ingress. Value of Enabled also allows redirection from L3 host devices like IPIP tunnel or Wireguard directly to the peer side of the workload's device. This makes redirection faster, however, it breaks tools like tcpdump on the peer side. Use Enabled with caution.", + "DescriptionHTML": "

Controls which whether it is allowed to forward straight to the peer side of the workload devices. It is allowed for any host L2 devices by default (L2Only), but it breaks TCP dump on the host side of workload device as it bypasses it on ingress. Value of Enabled also allows redirection from L3 host devices like IPIP tunnel or Wireguard directly to the peer side of the workload's device. This makes redirection faster, however, it breaks tools like tcpdump on the peer side. Use Enabled with caution.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + } + ] + }, + { + "Name": "Dataplane: Windows", + "Fields": [ + { + "Group": "Dataplane: Windows", + "GroupWithSortPrefix": "23 Dataplane: Windows", + "NameConfigFile": "WindowsDNSCacheFile", + "NameEnvVar": "FELIX_WindowsDNSCacheFile", + "NameYAML": "windowsDnsCacheFile", + "NameGoAPI": "WindowsDNSCacheFile", + "StringSchema": "Path to file", + "StringSchemaHTML": "Path to file", + "StringDefault": "c:\\TigeraCalico\\felix-dns-cache.txt", + "ParsedDefault": "c:\\TigeraCalico\\felix-dns-cache.txt", + "ParsedDefaultJSON": "\"c:\\\\TigeraCalico\\\\felix-dns-cache.txt\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "c:\\TigeraCalico\\felix-dns-cache.txt", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The name of the file that Felix uses to preserve learnt DNS information when restarting. .", + "DescriptionHTML": "

The name of the file that Felix uses to preserve learnt DNS information when restarting. .

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Windows", + "GroupWithSortPrefix": "23 Dataplane: Windows", + "NameConfigFile": "WindowsDNSExtraTTL", + "NameEnvVar": "FELIX_WindowsDNSExtraTTL", + "NameYAML": "windowsDnsExtraTTL", + "NameGoAPI": "WindowsDNSExtraTTL", + "StringSchema": "Seconds (floating point)", + "StringSchemaHTML": "Seconds (floating point)", + "StringDefault": "120", + "ParsedDefault": "2m0s", + "ParsedDefaultJSON": "120000000000", + "ParsedType": "time.Duration", + "YAMLType": "string", + "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", + "YAMLDefault": "2m0s", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Extra time to keep IPs and alias names that are learnt from DNS, in addition to each name or IP's advertised TTL. The default value is 120s which is same as the default value of ServicePointManager.DnsRefreshTimeout on .net framework. .", + "DescriptionHTML": "

Extra time to keep IPs and alias names that are learnt from DNS, in addition to each name or IP's advertised TTL. The default value is 120s which is same as the default value of ServicePointManager.DnsRefreshTimeout on .net framework. .

", + "UserEditable": true, + "GoType": "*v1.Duration", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Windows", + "GroupWithSortPrefix": "23 Dataplane: Windows", + "NameConfigFile": "WindowsFlowLogsFileDirectory", + "NameEnvVar": "FELIX_WindowsFlowLogsFileDirectory", + "NameYAML": "windowsFlowLogsFileDirectory", + "NameGoAPI": "WindowsFlowLogsFileDirectory", + "StringSchema": "String", + "StringSchemaHTML": "String", + "StringDefault": "c:\\TigeraCalico\\flowlogs", + "ParsedDefault": "c:\\TigeraCalico\\flowlogs", + "ParsedDefaultJSON": "\"c:\\\\TigeraCalico\\\\flowlogs\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "c:\\TigeraCalico\\flowlogs", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Sets the directory where flow logs files are stored on Windows nodes. .", + "DescriptionHTML": "

Sets the directory where flow logs files are stored on Windows nodes. .

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Windows", + "GroupWithSortPrefix": "23 Dataplane: Windows", + "NameConfigFile": "WindowsFlowLogsPositionFilePath", + "NameEnvVar": "FELIX_WindowsFlowLogsPositionFilePath", + "NameYAML": "windowsFlowLogsPositionFilePath", + "NameGoAPI": "WindowsFlowLogsPositionFilePath", + "StringSchema": "String", + "StringSchemaHTML": "String", + "StringDefault": "c:\\TigeraCalico\\flowlogs\\flows.log.pos", + "ParsedDefault": "c:\\TigeraCalico\\flowlogs\\flows.log.pos", + "ParsedDefaultJSON": "\"c:\\\\TigeraCalico\\\\flowlogs\\\\flows.log.pos\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "c:\\TigeraCalico\\flowlogs\\flows.log.pos", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Used to specify the position of the external pipeline that reads flow logs on Windows nodes. . This parameter only takes effect when FlowLogsDynamicAggregationEnabled is set to true.", + "DescriptionHTML": "

Used to specify the position of the external pipeline that reads flow logs on Windows nodes. . This parameter only takes effect when FlowLogsDynamicAggregationEnabled is set to true.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Windows", + "GroupWithSortPrefix": "23 Dataplane: Windows", + "NameConfigFile": "WindowsManageFirewallRules", + "NameEnvVar": "FELIX_WindowsManageFirewallRules", + "NameYAML": "windowsManageFirewallRules", + "NameGoAPI": "WindowsManageFirewallRules", + "StringSchema": "One of: `Disabled`, `Enabled` (case insensitive)", + "StringSchemaHTML": "One of: Disabled, Enabled (case insensitive)", + "StringDefault": "Disabled", + "ParsedDefault": "Disabled", + "ParsedDefaultJSON": "\"Disabled\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `\"Disabled\"`, `\"Enabled\"`.", + "YAMLEnumValues": ["Disabled", "Enabled"], + "YAMLSchemaHTML": "One of: \"Disabled\", \"Enabled\".", + "YAMLDefault": "Disabled", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Configures whether or not Felix will program Windows Firewall rules (to allow inbound access to its own metrics ports).", + "DescriptionHTML": "

Configures whether or not Felix will program Windows Firewall rules (to allow inbound access to its own metrics ports).

", + "UserEditable": true, + "GoType": "*v3.WindowsManageFirewallRulesMode", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Windows", + "GroupWithSortPrefix": "23 Dataplane: Windows", + "NameConfigFile": "WindowsNetworkName", + "NameEnvVar": "FELIX_WindowsNetworkName", + "NameYAML": "windowsNetworkName", + "NameGoAPI": "WindowsNetworkName", + "StringSchema": "Regular expression", + "StringSchemaHTML": "Regular expression", + "StringDefault": "(?i)calico.*", + "ParsedDefault": "(?i)calico.*", + "ParsedDefaultJSON": "\"(?i)calico.*\"", + "ParsedType": "*regexp.Regexp", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "(?i)calico.*", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Specifies which Windows HNS networks Felix should operate on. The default is to match networks that start with \"calico\". Supports regular expression syntax.", + "DescriptionHTML": "

Specifies which Windows HNS networks Felix should operate on. The default is to match networks that start with \"calico\". Supports regular expression syntax.

", + "UserEditable": true, + "GoType": "*string", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: Windows", + "GroupWithSortPrefix": "23 Dataplane: Windows", + "NameConfigFile": "WindowsStatsDumpFilePath", + "NameEnvVar": "FELIX_WindowsStatsDumpFilePath", + "NameYAML": "windowsStatsDumpFilePath", + "NameGoAPI": "WindowsStatsDumpFilePath", + "StringSchema": "Path to file", + "StringSchemaHTML": "Path to file", + "StringDefault": "c:\\TigeraCalico\\stats\\dump", + "ParsedDefault": "c:\\TigeraCalico\\stats\\dump", + "ParsedDefaultJSON": "\"c:\\\\TigeraCalico\\\\stats\\\\dump\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "c:\\TigeraCalico\\stats\\dump", + "Required": false, + "OnParseFailure": "Exit", + "AllowedConfigSources": "All", + "Description": "Used to specify the path of the stats dump file on Windows nodes.", + "DescriptionHTML": "

Used to specify the path of the stats dump file on Windows nodes.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + } + ] + }, + { + "Name": "Dataplane: OpenStack support", + "Fields": [ + { + "Group": "Dataplane: OpenStack support", + "GroupWithSortPrefix": "25 Dataplane: OpenStack support", + "NameConfigFile": "EndpointReportingDelaySecs", + "NameEnvVar": "FELIX_EndpointReportingDelaySecs", + "NameYAML": "endpointReportingDelay", + "NameGoAPI": "EndpointReportingDelay", + "StringSchema": "Seconds (floating point)", + "StringSchemaHTML": "Seconds (floating point)", + "StringDefault": "1", + "ParsedDefault": "1s", + "ParsedDefaultJSON": "1000000000", + "ParsedType": "time.Duration", + "YAMLType": "string", + "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", + "YAMLDefault": "1s", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "**Open source-only parameter**; OpenStack is not supported in Calico Enterprise/Cloud.\n\nThe delay before Felix reports endpoint status to the datastore. This is only used by the OpenStack integration.", + "DescriptionHTML": "

Open source-only parameter; OpenStack is not supported in Calico Enterprise/Cloud.

\n

The delay before Felix reports endpoint status to the datastore. This is only used by the OpenStack integration.

", + "UserEditable": true, + "GoType": "*v1.Duration", + "OpenSourceOnly": true + }, + { + "Group": "Dataplane: OpenStack support", + "GroupWithSortPrefix": "25 Dataplane: OpenStack support", + "NameConfigFile": "EndpointReportingEnabled", + "NameEnvVar": "FELIX_EndpointReportingEnabled", + "NameYAML": "endpointReportingEnabled", + "NameGoAPI": "EndpointReportingEnabled", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "false", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "false", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "**Open source-only parameter**; OpenStack is not supported in Calico Enterprise/Cloud.\n\nControls whether Felix reports endpoint status to the datastore. This is only used by the OpenStack integration.", + "DescriptionHTML": "

Open source-only parameter; OpenStack is not supported in Calico Enterprise/Cloud.

\n

Controls whether Felix reports endpoint status to the datastore. This is only used by the OpenStack integration.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": true + }, + { + "Group": "Dataplane: OpenStack support", + "GroupWithSortPrefix": "25 Dataplane: OpenStack support", + "NameConfigFile": "MetadataAddr", + "NameEnvVar": "FELIX_MetadataAddr", + "NameYAML": "metadataAddr", + "NameGoAPI": "MetadataAddr", + "StringSchema": "String matching regex `^[a-zA-Z0-9_.-]+$`", + "StringSchemaHTML": "String matching regex ^[a-zA-Z0-9_.-]+$", + "StringDefault": "127.0.0.1", + "ParsedDefault": "127.0.0.1", + "ParsedDefaultJSON": "\"127.0.0.1\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "127.0.0.1", + "Required": false, + "OnParseFailure": "Exit", + "AllowedConfigSources": "All", + "Description": "**Open source-only parameter**; OpenStack is not supported in Calico Enterprise/Cloud.\n\nThe IP address or domain name of the server that can answer VM queries for cloud-init metadata. In OpenStack, this corresponds to the machine running nova-api (or in Ubuntu, nova-api-metadata). A value of none (case-insensitive) means that Felix should not set up any NAT rule for the metadata path.", + "DescriptionHTML": "

Open source-only parameter; OpenStack is not supported in Calico Enterprise/Cloud.

\n

The IP address or domain name of the server that can answer VM queries for cloud-init metadata. In OpenStack, this corresponds to the machine running nova-api (or in Ubuntu, nova-api-metadata). A value of none (case-insensitive) means that Felix should not set up any NAT rule for the metadata path.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": true + }, + { + "Group": "Dataplane: OpenStack support", + "GroupWithSortPrefix": "25 Dataplane: OpenStack support", + "NameConfigFile": "MetadataPort", + "NameEnvVar": "FELIX_MetadataPort", + "NameYAML": "metadataPort", + "NameGoAPI": "MetadataPort", + "StringSchema": "Integer: [0,65535]", + "StringSchemaHTML": "Integer: [0,65535]", + "StringDefault": "8775", + "ParsedDefault": "8775", + "ParsedDefaultJSON": "8775", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer: [0,65535]", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer: [0,65535]", + "YAMLDefault": "8775", + "Required": false, + "OnParseFailure": "Exit", + "AllowedConfigSources": "All", + "Description": "**Open source-only parameter**; OpenStack is not supported in Calico Enterprise/Cloud.\n\nThe port of the metadata server. This, combined with global.MetadataAddr (if not 'None'), is used to set up a NAT rule, from 169.254.169.254:80 to MetadataAddr:MetadataPort. In most cases this should not need to be changed .", + "DescriptionHTML": "

Open source-only parameter; OpenStack is not supported in Calico Enterprise/Cloud.

\n

The port of the metadata server. This, combined with global.MetadataAddr (if not 'None'), is used to set up a NAT rule, from 169.254.169.254:80 to MetadataAddr:MetadataPort. In most cases this should not need to be changed .

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": true + }, + { + "Group": "Dataplane: OpenStack support", + "GroupWithSortPrefix": "25 Dataplane: OpenStack support", + "NameConfigFile": "OpenstackRegion", + "NameEnvVar": "FELIX_OpenstackRegion", + "NameYAML": "openstackRegion", + "NameGoAPI": "OpenstackRegion", + "StringSchema": "OpenStack region name (must be a valid DNS label)", + "StringSchemaHTML": "OpenStack region name (must be a valid DNS label)", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "\"\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "Exit", + "AllowedConfigSources": "All", + "Description": "**Open source-only parameter**; OpenStack is not supported in Calico Enterprise/Cloud.\n\nThe name of the region that a particular Felix belongs to. In a multi-region Calico/OpenStack deployment, this must be configured somehow for each Felix (here in the datamodel, or in felix.cfg or the environment on each compute node), and must match the [calico] openstack_region value configured in neutron.conf on each node.", + "DescriptionHTML": "

Open source-only parameter; OpenStack is not supported in Calico Enterprise/Cloud.

\n

The name of the region that a particular Felix belongs to. In a multi-region Calico/OpenStack deployment, this must be configured somehow for each Felix (here in the datamodel, or in felix.cfg or the environment on each compute node), and must match the [calico] openstack_region value configured in neutron.conf on each node.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": true + }, + { + "Group": "Dataplane: OpenStack support", + "GroupWithSortPrefix": "25 Dataplane: OpenStack support", + "NameConfigFile": "ReportingIntervalSecs", + "NameEnvVar": "FELIX_ReportingIntervalSecs", + "NameYAML": "reportingInterval", + "NameGoAPI": "ReportingInterval", + "StringSchema": "Seconds (floating point)", + "StringSchemaHTML": "Seconds (floating point)", + "StringDefault": "30", + "ParsedDefault": "30s", + "ParsedDefaultJSON": "30000000000", + "ParsedType": "time.Duration", + "YAMLType": "string", + "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", + "YAMLDefault": "30s", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "**Open source-only parameter**; OpenStack is not supported in Calico Enterprise/Cloud.\n\nThe interval at which Felix reports its status into the datastore or 0 to disable. Must be non-zero in OpenStack deployments.", + "DescriptionHTML": "

Open source-only parameter; OpenStack is not supported in Calico Enterprise/Cloud.

\n

The interval at which Felix reports its status into the datastore or 0 to disable. Must be non-zero in OpenStack deployments.

", + "UserEditable": true, + "GoType": "*v1.Duration", + "OpenSourceOnly": true + }, + { + "Group": "Dataplane: OpenStack support", + "GroupWithSortPrefix": "25 Dataplane: OpenStack support", + "NameConfigFile": "ReportingTTLSecs", + "NameEnvVar": "FELIX_ReportingTTLSecs", + "NameYAML": "reportingTTL", + "NameGoAPI": "ReportingTTL", + "StringSchema": "Seconds (floating point)", + "StringSchemaHTML": "Seconds (floating point)", + "StringDefault": "90", + "ParsedDefault": "1m30s", + "ParsedDefaultJSON": "90000000000", + "ParsedType": "time.Duration", + "YAMLType": "string", + "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", + "YAMLDefault": "1m30s", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "**Open source-only parameter**; OpenStack is not supported in Calico Enterprise/Cloud.\n\nThe time-to-live setting for process-wide status reports.", + "DescriptionHTML": "

Open source-only parameter; OpenStack is not supported in Calico Enterprise/Cloud.

\n

The time-to-live setting for process-wide status reports.

", + "UserEditable": true, + "GoType": "*v1.Duration", + "OpenSourceOnly": true + } + ] + }, + { + "Name": "Dataplane: XDP acceleration for iptables dataplane", + "Fields": [ + { + "Group": "Dataplane: XDP acceleration for iptables dataplane", + "GroupWithSortPrefix": "25 Dataplane: XDP acceleration for iptables dataplane", + "NameConfigFile": "GenericXDPEnabled", + "NameEnvVar": "FELIX_GenericXDPEnabled", + "NameYAML": "genericXDPEnabled", + "NameGoAPI": "GenericXDPEnabled", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "false", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "false", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Enables Generic XDP so network cards that don't support XDP offload or driver modes can use XDP. This is not recommended since it doesn't provide better performance than iptables.", + "DescriptionHTML": "

Enables Generic XDP so network cards that don't support XDP offload or driver modes can use XDP. This is not recommended since it doesn't provide better performance than iptables.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: XDP acceleration for iptables dataplane", + "GroupWithSortPrefix": "25 Dataplane: XDP acceleration for iptables dataplane", + "NameConfigFile": "XDPEnabled", + "NameEnvVar": "FELIX_XDPEnabled", + "NameYAML": "xdpEnabled", + "NameGoAPI": "XDPEnabled", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "false", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "false", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Enables XDP acceleration for suitable untracked incoming deny rules.", + "DescriptionHTML": "

Enables XDP acceleration for suitable untracked incoming deny rules.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Dataplane: XDP acceleration for iptables dataplane", + "GroupWithSortPrefix": "25 Dataplane: XDP acceleration for iptables dataplane", + "NameConfigFile": "XDPRefreshInterval", + "NameEnvVar": "FELIX_XDPRefreshInterval", + "NameYAML": "xdpRefreshInterval", + "NameGoAPI": "XDPRefreshInterval", + "StringSchema": "Seconds (floating point)", + "StringSchemaHTML": "Seconds (floating point)", + "StringDefault": "90", + "ParsedDefault": "1m30s", + "ParsedDefaultJSON": "90000000000", + "ParsedType": "time.Duration", + "YAMLType": "string", + "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", + "YAMLDefault": "1m30s", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The period at which Felix re-checks all XDP state to ensure that no other process has accidentally broken Calico's BPF maps or attached programs. Set to 0 to disable XDP refresh.", + "DescriptionHTML": "

The period at which Felix re-checks all XDP state to ensure that no other process has accidentally broken Calico's BPF maps or attached programs. Set to 0 to disable XDP refresh.

", + "UserEditable": true, + "GoType": "*v1.Duration", + "OpenSourceOnly": false + } + ] + }, + { + "Name": "Overlay: VXLAN overlay", + "Fields": [ + { + "Group": "Overlay: VXLAN overlay", + "GroupWithSortPrefix": "31 Overlay: VXLAN overlay", + "NameConfigFile": "VXLANEnabled", + "NameEnvVar": "FELIX_VXLANEnabled", + "NameYAML": "vxlanEnabled", + "NameGoAPI": "VXLANEnabled", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "null", + "ParsedType": "*bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Overrides whether Felix should create the VXLAN tunnel device for IPv4 VXLAN networking. Optional as Felix determines this based on the existing IP pools.", + "DescriptionHTML": "

Overrides whether Felix should create the VXLAN tunnel device for IPv4 VXLAN networking. Optional as Felix determines this based on the existing IP pools.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Overlay: VXLAN overlay", + "GroupWithSortPrefix": "31 Overlay: VXLAN overlay", + "NameConfigFile": "VXLANMTU", + "NameEnvVar": "FELIX_VXLANMTU", + "NameYAML": "vxlanMTU", + "NameGoAPI": "VXLANMTU", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "0", + "ParsedDefault": "0", + "ParsedDefaultJSON": "0", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "0", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The MTU to set on the IPv4 VXLAN tunnel device. Optional as Felix auto-detects the MTU based on the MTU of the host's interfaces.", + "DescriptionHTML": "

The MTU to set on the IPv4 VXLAN tunnel device. Optional as Felix auto-detects the MTU based on the MTU of the host's interfaces.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Overlay: VXLAN overlay", + "GroupWithSortPrefix": "31 Overlay: VXLAN overlay", + "NameConfigFile": "VXLANMTUV6", + "NameEnvVar": "FELIX_VXLANMTUV6", + "NameYAML": "vxlanMTUV6", + "NameGoAPI": "VXLANMTUV6", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "0", + "ParsedDefault": "0", + "ParsedDefaultJSON": "0", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "0", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The MTU to set on the IPv6 VXLAN tunnel device. Optional as Felix auto-detects the MTU based on the MTU of the host's interfaces.", + "DescriptionHTML": "

The MTU to set on the IPv6 VXLAN tunnel device. Optional as Felix auto-detects the MTU based on the MTU of the host's interfaces.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Overlay: VXLAN overlay", + "GroupWithSortPrefix": "31 Overlay: VXLAN overlay", + "NameConfigFile": "VXLANPort", + "NameEnvVar": "FELIX_VXLANPort", + "NameYAML": "vxlanPort", + "NameGoAPI": "VXLANPort", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "4789", + "ParsedDefault": "4789", + "ParsedDefaultJSON": "4789", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "4789", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The UDP port number to use for VXLAN traffic.", + "DescriptionHTML": "

The UDP port number to use for VXLAN traffic.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Overlay: VXLAN overlay", + "GroupWithSortPrefix": "31 Overlay: VXLAN overlay", + "NameConfigFile": "VXLANVNI", + "NameEnvVar": "FELIX_VXLANVNI", + "NameYAML": "vxlanVNI", + "NameGoAPI": "VXLANVNI", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "4096", + "ParsedDefault": "4096", + "ParsedDefaultJSON": "4096", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "4096", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The VXLAN VNI to use for VXLAN traffic. You may need to change this if the default value is in use on your system.", + "DescriptionHTML": "

The VXLAN VNI to use for VXLAN traffic. You may need to change this if the default value is in use on your system.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + } + ] + }, + { + "Name": "Overlay: IP-in-IP", + "Fields": [ + { + "Group": "Overlay: IP-in-IP", + "GroupWithSortPrefix": "32 Overlay: IP-in-IP", + "NameConfigFile": "IpInIpEnabled", + "NameEnvVar": "FELIX_IpInIpEnabled", + "NameYAML": "ipipEnabled", + "NameGoAPI": "IPIPEnabled", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "null", + "ParsedType": "*bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Overrides whether Felix should configure an IPIP interface on the host. Optional as Felix determines this based on the existing IP pools.", + "DescriptionHTML": "

Overrides whether Felix should configure an IPIP interface on the host. Optional as Felix determines this based on the existing IP pools.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Overlay: IP-in-IP", + "GroupWithSortPrefix": "32 Overlay: IP-in-IP", + "NameConfigFile": "IpInIpMtu", + "NameEnvVar": "FELIX_IpInIpMtu", + "NameYAML": "ipipMTU", + "NameGoAPI": "IPIPMTU", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "0", + "ParsedDefault": "0", + "ParsedDefaultJSON": "0", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "0", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls the MTU to set on the IPIP tunnel device. Optional as Felix auto-detects the MTU based on the MTU of the host's interfaces.", + "DescriptionHTML": "

Controls the MTU to set on the IPIP tunnel device. Optional as Felix auto-detects the MTU based on the MTU of the host's interfaces.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + } + ] + }, + { + "Name": "Overlay: Wireguard", + "Fields": [ + { + "Group": "Overlay: Wireguard", + "GroupWithSortPrefix": "33 Overlay: Wireguard", + "NameConfigFile": "WireguardEnabled", + "NameEnvVar": "FELIX_WireguardEnabled", + "NameYAML": "wireguardEnabled", + "NameGoAPI": "WireguardEnabled", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "false", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "false", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls whether Wireguard is enabled for IPv4 (encapsulating IPv4 traffic over an IPv4 underlay network).", + "DescriptionHTML": "

Controls whether Wireguard is enabled for IPv4 (encapsulating IPv4 traffic over an IPv4 underlay network).

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Overlay: Wireguard", + "GroupWithSortPrefix": "33 Overlay: Wireguard", + "NameConfigFile": "WireguardEnabledV6", + "NameEnvVar": "FELIX_WireguardEnabledV6", + "NameYAML": "wireguardEnabledV6", + "NameGoAPI": "WireguardEnabledV6", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "false", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "false", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls whether Wireguard is enabled for IPv6 (encapsulating IPv6 traffic over an IPv6 underlay network).", + "DescriptionHTML": "

Controls whether Wireguard is enabled for IPv6 (encapsulating IPv6 traffic over an IPv6 underlay network).

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Overlay: Wireguard", + "GroupWithSortPrefix": "33 Overlay: Wireguard", + "NameConfigFile": "WireguardHostEncryptionEnabled", + "NameEnvVar": "FELIX_WireguardHostEncryptionEnabled", + "NameYAML": "wireguardHostEncryptionEnabled", + "NameGoAPI": "WireguardHostEncryptionEnabled", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "false", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "false", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls whether Wireguard host-to-host encryption is enabled.", + "DescriptionHTML": "

Controls whether Wireguard host-to-host encryption is enabled.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Overlay: Wireguard", + "GroupWithSortPrefix": "33 Overlay: Wireguard", + "NameConfigFile": "WireguardInterfaceName", + "NameEnvVar": "FELIX_WireguardInterfaceName", + "NameYAML": "wireguardInterfaceName", + "NameGoAPI": "WireguardInterfaceName", + "StringSchema": "String matching regex `^[a-zA-Z0-9:._+-]{1,15}$`", + "StringSchemaHTML": "String matching regex ^[a-zA-Z0-9:._+-]{1,15}$", + "StringDefault": "wireguard.cali", + "ParsedDefault": "wireguard.cali", + "ParsedDefaultJSON": "\"wireguard.cali\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "wireguard.cali", + "Required": true, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Specifies the name to use for the IPv4 Wireguard interface.", + "DescriptionHTML": "

Specifies the name to use for the IPv4 Wireguard interface.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Overlay: Wireguard", + "GroupWithSortPrefix": "33 Overlay: Wireguard", + "NameConfigFile": "WireguardInterfaceNameV6", + "NameEnvVar": "FELIX_WireguardInterfaceNameV6", + "NameYAML": "wireguardInterfaceNameV6", + "NameGoAPI": "WireguardInterfaceNameV6", + "StringSchema": "String matching regex `^[a-zA-Z0-9:._+-]{1,15}$`", + "StringSchemaHTML": "String matching regex ^[a-zA-Z0-9:._+-]{1,15}$", + "StringDefault": "wg-v6.cali", + "ParsedDefault": "wg-v6.cali", + "ParsedDefaultJSON": "\"wg-v6.cali\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "wg-v6.cali", + "Required": true, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Specifies the name to use for the IPv6 Wireguard interface.", + "DescriptionHTML": "

Specifies the name to use for the IPv6 Wireguard interface.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Overlay: Wireguard", + "GroupWithSortPrefix": "33 Overlay: Wireguard", + "NameConfigFile": "WireguardListeningPort", + "NameEnvVar": "FELIX_WireguardListeningPort", + "NameYAML": "wireguardListeningPort", + "NameGoAPI": "WireguardListeningPort", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "51820", + "ParsedDefault": "51820", + "ParsedDefaultJSON": "51820", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "51820", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls the listening port used by IPv4 Wireguard.", + "DescriptionHTML": "

Controls the listening port used by IPv4 Wireguard.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Overlay: Wireguard", + "GroupWithSortPrefix": "33 Overlay: Wireguard", + "NameConfigFile": "WireguardListeningPortV6", + "NameEnvVar": "FELIX_WireguardListeningPortV6", + "NameYAML": "wireguardListeningPortV6", + "NameGoAPI": "WireguardListeningPortV6", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "51821", + "ParsedDefault": "51821", + "ParsedDefaultJSON": "51821", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "51821", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls the listening port used by IPv6 Wireguard.", + "DescriptionHTML": "

Controls the listening port used by IPv6 Wireguard.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Overlay: Wireguard", + "GroupWithSortPrefix": "33 Overlay: Wireguard", + "NameConfigFile": "WireguardMTU", + "NameEnvVar": "FELIX_WireguardMTU", + "NameYAML": "wireguardMTU", + "NameGoAPI": "WireguardMTU", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "0", + "ParsedDefault": "0", + "ParsedDefaultJSON": "0", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "0", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls the MTU on the IPv4 Wireguard interface. See Configuring MTU.", + "DescriptionHTML": "

Controls the MTU on the IPv4 Wireguard interface. See Configuring MTU.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Overlay: Wireguard", + "GroupWithSortPrefix": "33 Overlay: Wireguard", + "NameConfigFile": "WireguardMTUV6", + "NameEnvVar": "FELIX_WireguardMTUV6", + "NameYAML": "wireguardMTUV6", + "NameGoAPI": "WireguardMTUV6", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "0", + "ParsedDefault": "0", + "ParsedDefaultJSON": "0", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "0", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls the MTU on the IPv6 Wireguard interface. See Configuring MTU.", + "DescriptionHTML": "

Controls the MTU on the IPv6 Wireguard interface. See Configuring MTU.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Overlay: Wireguard", + "GroupWithSortPrefix": "33 Overlay: Wireguard", + "NameConfigFile": "WireguardPersistentKeepAlive", + "NameEnvVar": "FELIX_WireguardPersistentKeepAlive", + "NameYAML": "wireguardKeepAlive", + "NameGoAPI": "WireguardPersistentKeepAlive", + "StringSchema": "Seconds (floating point)", + "StringSchemaHTML": "Seconds (floating point)", + "StringDefault": "0", + "ParsedDefault": "0s", + "ParsedDefaultJSON": "0", + "ParsedType": "time.Duration", + "YAMLType": "string", + "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", + "YAMLDefault": "0s", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls Wireguard PersistentKeepalive option. Set 0 to disable.", + "DescriptionHTML": "

Controls Wireguard PersistentKeepalive option. Set 0 to disable.

", + "UserEditable": true, + "GoType": "*v1.Duration", + "OpenSourceOnly": false + }, + { + "Group": "Overlay: Wireguard", + "GroupWithSortPrefix": "33 Overlay: Wireguard", + "NameConfigFile": "WireguardRoutingRulePriority", + "NameEnvVar": "FELIX_WireguardRoutingRulePriority", + "NameYAML": "wireguardRoutingRulePriority", + "NameGoAPI": "WireguardRoutingRulePriority", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "99", + "ParsedDefault": "99", + "ParsedDefaultJSON": "99", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "99", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls the priority value to use for the Wireguard routing rule.", + "DescriptionHTML": "

Controls the priority value to use for the Wireguard routing rule.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + } + ] + }, + { + "Name": "Overlay: IPSec", + "Fields": [ + { + "Group": "Overlay: IPSec", + "GroupWithSortPrefix": "34 Overlay: IPSec", + "NameConfigFile": "IPSecAllowUnsecuredTraffic", + "NameEnvVar": "FELIX_IPSecAllowUnsecuredTraffic", + "NameYAML": "ipsecAllowUnsecuredTraffic", + "NameGoAPI": "IPSecAllowUnsecuredTraffic", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "false", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "false", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls whether non-IPsec traffic is allowed in addition to IPsec traffic. Enabling this negates the anti-spoofing protections of IPsec but it is useful when migrating to/from IPsec.", + "DescriptionHTML": "

Controls whether non-IPsec traffic is allowed in addition to IPsec traffic. Enabling this negates the anti-spoofing protections of IPsec but it is useful when migrating to/from IPsec.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Overlay: IPSec", + "GroupWithSortPrefix": "34 Overlay: IPSec", + "NameConfigFile": "IPSecESPAlgorithm", + "NameEnvVar": "FELIX_IPSecESPAlgorithm", + "NameYAML": "ipsecESPAlgorithm", + "NameGoAPI": "IPSecESPAlgorithm", + "StringSchema": "String", + "StringSchemaHTML": "String", + "StringDefault": "aes128gcm16-ecp256", + "ParsedDefault": "aes128gcm16-ecp256", + "ParsedDefaultJSON": "\"aes128gcm16-ecp256\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "aes128gcm16-ecp256", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "IPSecESAlgorithm sets IPSec ESP algorithm. Default is NIST suite B recommendation.", + "DescriptionHTML": "

IPSecESAlgorithm sets IPSec ESP algorithm. Default is NIST suite B recommendation.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Overlay: IPSec", + "GroupWithSortPrefix": "34 Overlay: IPSec", + "NameConfigFile": "IPSecIKEAlgorithm", + "NameEnvVar": "FELIX_IPSecIKEAlgorithm", + "NameYAML": "ipsecIKEAlgorithm", + "NameGoAPI": "IPSecIKEAlgorithm", + "StringSchema": "String", + "StringSchemaHTML": "String", + "StringDefault": "aes128gcm16-prfsha256-ecp256", + "ParsedDefault": "aes128gcm16-prfsha256-ecp256", + "ParsedDefaultJSON": "\"aes128gcm16-prfsha256-ecp256\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "aes128gcm16-prfsha256-ecp256", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Sets IPSec IKE algorithm. Default is NIST suite B recommendation.", + "DescriptionHTML": "

Sets IPSec IKE algorithm. Default is NIST suite B recommendation.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Overlay: IPSec", + "GroupWithSortPrefix": "34 Overlay: IPSec", + "NameConfigFile": "IPSecLogLevel", + "NameEnvVar": "FELIX_IPSecLogLevel", + "NameYAML": "ipsecLogLevel", + "NameGoAPI": "IPSecLogLevel", + "StringSchema": "One of: `DEBUG`, `INFO`, `NOTICE`, `VERBOSE` (case insensitive)", + "StringSchemaHTML": "One of: DEBUG, INFO, NOTICE, VERBOSE (case insensitive)", + "StringDefault": "INFO", + "ParsedDefault": "INFO", + "ParsedDefaultJSON": "\"INFO\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `Debug`, `Info`, `None`, `Notice`, `Verbose`.", + "YAMLEnumValues": ["Debug", "Info", "None", "Notice", "Verbose"], + "YAMLSchemaHTML": "One of: Debug, Info, None, Notice, Verbose.", + "YAMLDefault": "Info", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls log level for IPSec components. Set to None for no logging. A generic log level terminology is used [None, Notice, Info, Debug, Verbose].", + "DescriptionHTML": "

Controls log level for IPSec components. Set to None for no logging. A generic log level terminology is used [None, Notice, Info, Debug, Verbose].

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Overlay: IPSec", + "GroupWithSortPrefix": "34 Overlay: IPSec", + "NameConfigFile": "IPSecMode", + "NameEnvVar": "FELIX_IPSecMode", + "NameYAML": "ipsecMode", + "NameGoAPI": "IPSecMode", + "StringSchema": "String", + "StringSchemaHTML": "String", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "\"\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls which mode IPSec is operating on. Default value means IPSec is not enabled.", + "DescriptionHTML": "

Controls which mode IPSec is operating on. Default value means IPSec is not enabled.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Overlay: IPSec", + "GroupWithSortPrefix": "34 Overlay: IPSec", + "NameConfigFile": "IPSecPSKFile", + "NameEnvVar": "FELIX_IPSecPSKFile", + "NameYAML": "", + "NameGoAPI": "", + "StringSchema": "Path to file, which must exist", + "StringSchemaHTML": "Path to file, which must exist", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "\"\"", + "ParsedType": "string", + "YAMLType": "", + "YAMLSchema": "", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "LocalOnly", + "Description": "File contains PSK.", + "DescriptionHTML": "

File contains PSK.

", + "UserEditable": true, + "GoType": "", + "OpenSourceOnly": false + }, + { + "Group": "Overlay: IPSec", + "GroupWithSortPrefix": "34 Overlay: IPSec", + "NameConfigFile": "IPSecPolicyRefreshInterval", + "NameEnvVar": "FELIX_IPSecPolicyRefreshInterval", + "NameYAML": "ipsecPolicyRefreshInterval", + "NameGoAPI": "IPSecPolicyRefreshInterval", + "StringSchema": "Seconds (floating point)", + "StringSchemaHTML": "Seconds (floating point)", + "StringDefault": "600", + "ParsedDefault": "10m0s", + "ParsedDefaultJSON": "600000000000", + "ParsedType": "time.Duration", + "YAMLType": "string", + "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", + "YAMLDefault": "10m0s", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The interval at which Felix will check the kernel's IPsec policy tables and repair any inconsistencies.", + "DescriptionHTML": "

The interval at which Felix will check the kernel's IPsec policy tables and repair any inconsistencies.

", + "UserEditable": true, + "GoType": "*v1.Duration", + "OpenSourceOnly": false + } + ] + }, + { + "Name": "Flow logs: Prometheus reports", + "Fields": [ + { + "Group": "Flow logs: Prometheus reports", + "GroupWithSortPrefix": "40 Flow logs: Prometheus reports", + "NameConfigFile": "DeletedMetricsRetentionSecs", + "NameEnvVar": "FELIX_DeletedMetricsRetentionSecs", + "NameYAML": "deletedMetricsRetentionSecs", + "NameGoAPI": "DeletedMetricsRetentionSecs", + "StringSchema": "Seconds (floating point)", + "StringSchemaHTML": "Seconds (floating point)", + "StringDefault": "30", + "ParsedDefault": "30s", + "ParsedDefaultJSON": "30000000000", + "ParsedType": "time.Duration", + "YAMLType": "integer", + "YAMLSchema": "Integer.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer.", + "YAMLDefault": "30s", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls how long metrics are retianed after the flow is gone.", + "DescriptionHTML": "

Controls how long metrics are retianed after the flow is gone.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Flow logs: Prometheus reports", + "GroupWithSortPrefix": "40 Flow logs: Prometheus reports", + "NameConfigFile": "PrometheusReporterCAFile", + "NameEnvVar": "FELIX_PrometheusReporterCAFile", + "NameYAML": "prometheusReporterCAFile", + "NameGoAPI": "PrometheusReporterCAFile", + "StringSchema": "Path to file, which must exist", + "StringSchemaHTML": "Path to file, which must exist", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "\"\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The path to the TLS CA file for the Prometheus per-flow metrics reporter.", + "DescriptionHTML": "

The path to the TLS CA file for the Prometheus per-flow metrics reporter.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Flow logs: Prometheus reports", + "GroupWithSortPrefix": "40 Flow logs: Prometheus reports", + "NameConfigFile": "PrometheusReporterCertFile", + "NameEnvVar": "FELIX_PrometheusReporterCertFile", + "NameYAML": "prometheusReporterCertFile", + "NameGoAPI": "PrometheusReporterCertFile", + "StringSchema": "Path to file, which must exist", + "StringSchemaHTML": "Path to file, which must exist", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "\"\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The path to the TLS certificate file for the Prometheus per-flow metrics reporter.", + "DescriptionHTML": "

The path to the TLS certificate file for the Prometheus per-flow metrics reporter.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Flow logs: Prometheus reports", + "GroupWithSortPrefix": "40 Flow logs: Prometheus reports", + "NameConfigFile": "PrometheusReporterEnabled", + "NameEnvVar": "FELIX_PrometheusReporterEnabled", + "NameYAML": "prometheusReporterEnabled", + "NameGoAPI": "PrometheusReporterEnabled", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "false", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "false", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls whether the Prometheus per-flow metrics reporter is enabled. This is used to show real-time flow metrics in the UI.", + "DescriptionHTML": "

Controls whether the Prometheus per-flow metrics reporter is enabled. This is used to show real-time flow metrics in the UI.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Flow logs: Prometheus reports", + "GroupWithSortPrefix": "40 Flow logs: Prometheus reports", + "NameConfigFile": "PrometheusReporterKeyFile", + "NameEnvVar": "FELIX_PrometheusReporterKeyFile", + "NameYAML": "prometheusReporterKeyFile", + "NameGoAPI": "PrometheusReporterKeyFile", + "StringSchema": "Path to file, which must exist", + "StringSchemaHTML": "Path to file, which must exist", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "\"\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The path to the TLS private key file for the Prometheus per-flow metrics reporter.", + "DescriptionHTML": "

The path to the TLS private key file for the Prometheus per-flow metrics reporter.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Flow logs: Prometheus reports", + "GroupWithSortPrefix": "40 Flow logs: Prometheus reports", + "NameConfigFile": "PrometheusReporterPort", + "NameEnvVar": "FELIX_PrometheusReporterPort", + "NameYAML": "prometheusReporterPort", + "NameGoAPI": "PrometheusReporterPort", + "StringSchema": "Integer: [0,65535]", + "StringSchemaHTML": "Integer: [0,65535]", + "StringDefault": "9092", + "ParsedDefault": "9092", + "ParsedDefaultJSON": "9092", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer: [0,65535]", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer: [0,65535]", + "YAMLDefault": "9092", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The port that the Prometheus per-flow metrics reporter should bind to.", + "DescriptionHTML": "

The port that the Prometheus per-flow metrics reporter should bind to.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + } + ] + }, + { + "Name": "Flow logs: Syslog reports", + "Fields": [ + { + "Group": "Flow logs: Syslog reports", + "GroupWithSortPrefix": "40 Flow logs: Syslog reports", + "NameConfigFile": "SyslogReporterAddress", + "NameEnvVar": "FELIX_SyslogReporterAddress", + "NameYAML": "syslogReporterAddress", + "NameGoAPI": "SyslogReporterAddress", + "StringSchema": "String", + "StringSchemaHTML": "String", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "\"\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The address to dial to when writing to Syslog. For TCP and UDP networks, the address has the form \"host:port\". The host must be a literal IP address, or a host name that can be resolved to IP addresses. The port must be a literal port number or a service name. For more, see: https://pkg.go.dev/net#Dial.", + "DescriptionHTML": "

The address to dial to when writing to Syslog. For TCP and UDP networks, the address has the form \"host:port\". The host must be a literal IP address, or a host name that can be resolved to IP addresses. The port must be a literal port number or a service name. For more, see: https://pkg.go.dev/net#Dial.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Flow logs: Syslog reports", + "GroupWithSortPrefix": "40 Flow logs: Syslog reports", + "NameConfigFile": "SyslogReporterEnabled", + "NameEnvVar": "FELIX_SyslogReporterEnabled", + "NameYAML": "syslogReporterEnabled", + "NameGoAPI": "SyslogReporterEnabled", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "false", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "false", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Turns on the feature to write logs to Syslog. Please note that this can incur significant disk space usage when running felix on non-cluster hosts.", + "DescriptionHTML": "

Turns on the feature to write logs to Syslog. Please note that this can incur significant disk space usage when running felix on non-cluster hosts.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Flow logs: Syslog reports", + "GroupWithSortPrefix": "40 Flow logs: Syslog reports", + "NameConfigFile": "SyslogReporterNetwork", + "NameEnvVar": "FELIX_SyslogReporterNetwork", + "NameYAML": "syslogReporterNetwork", + "NameGoAPI": "SyslogReporterNetwork", + "StringSchema": "String", + "StringSchemaHTML": "String", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "\"\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The network to dial to when writing to Syslog. Known networks are \"tcp\", \"tcp4\" (IPv4-only), \"tcp6\" (IPv6-only), \"udp\", \"udp4\" (IPv4-only), \"udp6\" (IPv6-only), \"ip\", \"ip4\" (IPv4-only), \"ip6\" (IPv6-only), \"unix\", \"unixgram\" and \"unixpacket\". For more, see: https://pkg.go.dev/net#Dial.", + "DescriptionHTML": "

The network to dial to when writing to Syslog. Known networks are \"tcp\", \"tcp4\" (IPv4-only), \"tcp6\" (IPv6-only), \"udp\", \"udp4\" (IPv4-only), \"udp6\" (IPv6-only), \"ip\", \"ip4\" (IPv4-only), \"ip6\" (IPv6-only), \"unix\", \"unixgram\" and \"unixpacket\". For more, see: https://pkg.go.dev/net#Dial.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + } + ] + }, + { + "Name": "Flow logs: file reports", + "Fields": [ + { + "Group": "Flow logs: file reports", + "GroupWithSortPrefix": "40 Flow logs: file reports", + "NameConfigFile": "FlowLogsAggregationThresholdBytes", + "NameEnvVar": "FELIX_FlowLogsAggregationThresholdBytes", + "NameYAML": "flowLogsAggregationThresholdBytes", + "NameGoAPI": "FlowLogsAggregationThresholdBytes", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "8192", + "ParsedDefault": "8192", + "ParsedDefaultJSON": "8192", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "8192", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Used specify how far behind the external pipeline that reads flow logs can be. Default is 8192 bytes. This parameter only takes effect when FlowLogsDynamicAggregationEnabled is set to true.", + "DescriptionHTML": "

Used specify how far behind the external pipeline that reads flow logs can be. Default is 8192 bytes. This parameter only takes effect when FlowLogsDynamicAggregationEnabled is set to true.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Flow logs: file reports", + "GroupWithSortPrefix": "40 Flow logs: file reports", + "NameConfigFile": "FlowLogsCollectProcessInfo", + "NameEnvVar": "FELIX_FlowLogsCollectProcessInfo", + "NameYAML": "flowLogsCollectProcessInfo", + "NameGoAPI": "FlowLogsCollectProcessInfo", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "false", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "false", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "If enabled Felix will load the kprobe BPF programs to collect process info.", + "DescriptionHTML": "

If enabled Felix will load the kprobe BPF programs to collect process info.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Flow logs: file reports", + "GroupWithSortPrefix": "40 Flow logs: file reports", + "NameConfigFile": "FlowLogsCollectProcessPath", + "NameEnvVar": "FELIX_FlowLogsCollectProcessPath", + "NameYAML": "flowLogsCollectProcessPath", + "NameGoAPI": "FlowLogsCollectProcessPath", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "false", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "false", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "When FlowLogsCollectProcessPath and FlowLogsCollectProcessInfo are both enabled, each flow log will include information about the process that is sending or receiving the packets in that flow: the `process_name` field will contain the full path of the process executable, and the `process_args` field will have the arguments with which the executable was invoked. Process information will not be reported for connections which use raw sockets.", + "DescriptionHTML": "

When FlowLogsCollectProcessPath and FlowLogsCollectProcessInfo are both enabled, each flow log will include information about the process that is sending or receiving the packets in that flow: the process_name field will contain the full path of the process executable, and the process_args field will have the arguments with which the executable was invoked. Process information will not be reported for connections which use raw sockets.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Flow logs: file reports", + "GroupWithSortPrefix": "40 Flow logs: file reports", + "NameConfigFile": "FlowLogsCollectTcpStats", + "NameEnvVar": "FELIX_FlowLogsCollectTcpStats", + "NameYAML": "flowLogsCollectTcpStats", + "NameGoAPI": "FlowLogsCollectTcpStats", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "false", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "false", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Enables flow logs reporting TCP socket stats.", + "DescriptionHTML": "

Enables flow logs reporting TCP socket stats.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Flow logs: file reports", + "GroupWithSortPrefix": "40 Flow logs: file reports", + "NameConfigFile": "FlowLogsCollectorDebugTrace", + "NameEnvVar": "FELIX_FlowLogsCollectorDebugTrace", + "NameYAML": "flowLogsCollectorDebugTrace", + "NameGoAPI": "FlowLogsCollectorDebugTrace", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "false", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "false", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "When FlowLogsCollectorDebugTrace is set to true, enables the logs in the collector to be printed in their entirety.", + "DescriptionHTML": "

When FlowLogsCollectorDebugTrace is set to true, enables the logs in the collector to be printed in their entirety.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Flow logs: file reports", + "GroupWithSortPrefix": "40 Flow logs: file reports", + "NameConfigFile": "FlowLogsDestDomainsByClient", + "NameEnvVar": "FELIX_FlowLogsDestDomainsByClient", + "NameYAML": "flowLogsDestDomainsByClient", + "NameGoAPI": "FlowLogsDestDomainsByClient", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "true", + "ParsedDefault": "true", + "ParsedDefaultJSON": "true", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "true", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Used to configure if the source IP is used in the mapping of top level destination domains.", + "DescriptionHTML": "

Used to configure if the source IP is used in the mapping of top level destination domains.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Flow logs: file reports", + "GroupWithSortPrefix": "40 Flow logs: file reports", + "NameConfigFile": "FlowLogsDynamicAggregationEnabled", + "NameEnvVar": "FELIX_FlowLogsDynamicAggregationEnabled", + "NameYAML": "flowLogsDynamicAggregationEnabled", + "NameGoAPI": "FlowLogsDynamicAggregationEnabled", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "false", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "false", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Used to enable/disable dynamically changing aggregation levels. Default is true.", + "DescriptionHTML": "

Used to enable/disable dynamically changing aggregation levels. Default is true.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Flow logs: file reports", + "GroupWithSortPrefix": "40 Flow logs: file reports", + "NameConfigFile": "FlowLogsEnableHostEndpoint", + "NameEnvVar": "FELIX_FlowLogsEnableHostEndpoint", + "NameYAML": "flowLogsEnableHostEndpoint", + "NameGoAPI": "FlowLogsEnableHostEndpoint", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "false", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "false", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Enables Flow logs reporting for HostEndpoints.", + "DescriptionHTML": "

Enables Flow logs reporting for HostEndpoints.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Flow logs: file reports", + "GroupWithSortPrefix": "40 Flow logs: file reports", + "NameConfigFile": "FlowLogsEnableNetworkSets", + "NameEnvVar": "FELIX_FlowLogsEnableNetworkSets", + "NameYAML": "flowLogsEnableNetworkSets", + "NameGoAPI": "FlowLogsEnableNetworkSets", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "false", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "false", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Enables Flow logs reporting for GlobalNetworkSets.", + "DescriptionHTML": "

Enables Flow logs reporting for GlobalNetworkSets.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Flow logs: file reports", + "GroupWithSortPrefix": "40 Flow logs: file reports", + "NameConfigFile": "FlowLogsFileAggregationKindForAllowed", + "NameEnvVar": "FELIX_FlowLogsFileAggregationKindForAllowed", + "NameYAML": "flowLogsFileAggregationKindForAllowed", + "NameGoAPI": "FlowLogsFileAggregationKindForAllowed", + "StringSchema": "Integer: [0,3]", + "StringSchemaHTML": "Integer: [0,3]", + "StringDefault": "2", + "ParsedDefault": "2", + "ParsedDefaultJSON": "2", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "One of: `0`, `1`, `2`.", + "YAMLEnumValues": ["0", "1", "2"], + "YAMLSchemaHTML": "One of: 0, 1, 2.", + "YAMLDefault": "2", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Used to choose the type of aggregation for flow log entries created for allowed connections. . Accepted values are 0, 1 and 2. 0 - No aggregation. 1 - Source port based aggregation. 2 - Pod prefix name based aggreagation.", + "DescriptionHTML": "

Used to choose the type of aggregation for flow log entries created for allowed connections. . Accepted values are 0, 1 and 2. 0 - No aggregation. 1 - Source port based aggregation. 2 - Pod prefix name based aggreagation.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Flow logs: file reports", + "GroupWithSortPrefix": "40 Flow logs: file reports", + "NameConfigFile": "FlowLogsFileAggregationKindForDenied", + "NameEnvVar": "FELIX_FlowLogsFileAggregationKindForDenied", + "NameYAML": "flowLogsFileAggregationKindForDenied", + "NameGoAPI": "FlowLogsFileAggregationKindForDenied", + "StringSchema": "Integer: [0,3]", + "StringSchemaHTML": "Integer: [0,3]", + "StringDefault": "1", + "ParsedDefault": "1", + "ParsedDefaultJSON": "1", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "One of: `0`, `1`, `2`, `3`.", + "YAMLEnumValues": ["0", "1", "2", "3"], + "YAMLSchemaHTML": "One of: 0, 1, 2, 3.", + "YAMLDefault": "1", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Used to choose the type of aggregation for flow log entries created for denied connections. . Accepted values are 0, 1 and 2. 0 - No aggregation. 1 - Source port based aggregation. 2 - Pod prefix name based aggregation. 3 - No destination ports based aggregation.", + "DescriptionHTML": "

Used to choose the type of aggregation for flow log entries created for denied connections. . Accepted values are 0, 1 and 2. 0 - No aggregation. 1 - Source port based aggregation. 2 - Pod prefix name based aggregation. 3 - No destination ports based aggregation.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Flow logs: file reports", + "GroupWithSortPrefix": "40 Flow logs: file reports", + "NameConfigFile": "FlowLogsFileDirectory", + "NameEnvVar": "FELIX_FlowLogsFileDirectory", + "NameYAML": "flowLogsFileDirectory", + "NameGoAPI": "FlowLogsFileDirectory", + "StringSchema": "String", + "StringSchemaHTML": "String", + "StringDefault": "/var/log/calico/flowlogs", + "ParsedDefault": "/var/log/calico/flowlogs", + "ParsedDefaultJSON": "\"/var/log/calico/flowlogs\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "/var/log/calico/flowlogs", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Sets the directory where flow logs files are stored.", + "DescriptionHTML": "

Sets the directory where flow logs files are stored.

", + "UserEditable": true, + "GoType": "*string", + "OpenSourceOnly": false + }, + { + "Group": "Flow logs: file reports", + "GroupWithSortPrefix": "40 Flow logs: file reports", + "NameConfigFile": "FlowLogsFileDomainsLimit", + "NameEnvVar": "FELIX_FlowLogsFileDomainsLimit", + "NameYAML": "flowLogsFileDomainsLimit", + "NameGoAPI": "FlowLogsFileDomainsLimit", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "5", + "ParsedDefault": "5", + "ParsedDefaultJSON": "5", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "5", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Used to configure the number of (destination) domains to include in the flow log. These are not included for workload or host endpoint destinations.", + "DescriptionHTML": "

Used to configure the number of (destination) domains to include in the flow log. These are not included for workload or host endpoint destinations.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Flow logs: file reports", + "GroupWithSortPrefix": "40 Flow logs: file reports", + "NameConfigFile": "FlowLogsFileEnabled", + "NameEnvVar": "FELIX_FlowLogsFileEnabled", + "NameYAML": "flowLogsFileEnabled", + "NameGoAPI": "FlowLogsFileEnabled", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "false", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "false", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "When set to true, enables logging flow logs to a file. If false no flow logging to file will occur.", + "DescriptionHTML": "

When set to true, enables logging flow logs to a file. If false no flow logging to file will occur.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Flow logs: file reports", + "GroupWithSortPrefix": "40 Flow logs: file reports", + "NameConfigFile": "FlowLogsFileEnabledForAllowed", + "NameEnvVar": "FELIX_FlowLogsFileEnabledForAllowed", + "NameYAML": "flowLogsFileEnabledForAllowed", + "NameGoAPI": "FlowLogsFileEnabledForAllowed", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "true", + "ParsedDefault": "true", + "ParsedDefaultJSON": "true", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "true", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Used to enable/disable flow logs entries created for allowed connections. Default is true. This parameter only takes effect when FlowLogsFileReporterEnabled is set to true.", + "DescriptionHTML": "

Used to enable/disable flow logs entries created for allowed connections. Default is true. This parameter only takes effect when FlowLogsFileReporterEnabled is set to true.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Flow logs: file reports", + "GroupWithSortPrefix": "40 Flow logs: file reports", + "NameConfigFile": "FlowLogsFileEnabledForDenied", + "NameEnvVar": "FELIX_FlowLogsFileEnabledForDenied", + "NameYAML": "flowLogsFileEnabledForDenied", + "NameGoAPI": "FlowLogsFileEnabledForDenied", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "true", + "ParsedDefault": "true", + "ParsedDefaultJSON": "true", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "true", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Used to enable/disable flow logs entries created for denied flows. Default is true. This parameter only takes effect when FlowLogsFileReporterEnabled is set to true.", + "DescriptionHTML": "

Used to enable/disable flow logs entries created for denied flows. Default is true. This parameter only takes effect when FlowLogsFileReporterEnabled is set to true.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Flow logs: file reports", + "GroupWithSortPrefix": "40 Flow logs: file reports", + "NameConfigFile": "FlowLogsFileIncludeLabels", + "NameEnvVar": "FELIX_FlowLogsFileIncludeLabels", + "NameYAML": "flowLogsFileIncludeLabels", + "NameGoAPI": "FlowLogsFileIncludeLabels", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "false", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "false", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Used to configure if endpoint labels are included in a Flow log entry written to file.", + "DescriptionHTML": "

Used to configure if endpoint labels are included in a Flow log entry written to file.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Flow logs: file reports", + "GroupWithSortPrefix": "40 Flow logs: file reports", + "NameConfigFile": "FlowLogsFileIncludePolicies", + "NameEnvVar": "FELIX_FlowLogsFileIncludePolicies", + "NameYAML": "flowLogsFileIncludePolicies", + "NameGoAPI": "FlowLogsFileIncludePolicies", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "false", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "false", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Used to configure if policy information are included in a Flow log entry written to file.", + "DescriptionHTML": "

Used to configure if policy information are included in a Flow log entry written to file.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Flow logs: file reports", + "GroupWithSortPrefix": "40 Flow logs: file reports", + "NameConfigFile": "FlowLogsFileIncludeService", + "NameEnvVar": "FELIX_FlowLogsFileIncludeService", + "NameYAML": "flowLogsFileIncludeService", + "NameGoAPI": "FlowLogsFileIncludeService", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "false", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "false", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Used to configure if the destination service is included in a Flow log entry written to file. The service information can only be included if the flow was explicitly determined to be directed at the service (e.g. when the pre-DNAT destination corresponds to the service ClusterIP and port).", + "DescriptionHTML": "

Used to configure if the destination service is included in a Flow log entry written to file. The service information can only be included if the flow was explicitly determined to be directed at the service (e.g. when the pre-DNAT destination corresponds to the service ClusterIP and port).

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Flow logs: file reports", + "GroupWithSortPrefix": "40 Flow logs: file reports", + "NameConfigFile": "FlowLogsFileMaxFileSizeMB", + "NameEnvVar": "FELIX_FlowLogsFileMaxFileSizeMB", + "NameYAML": "flowLogsFileMaxFileSizeMB", + "NameGoAPI": "FlowLogsFileMaxFileSizeMB", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "100", + "ParsedDefault": "100", + "ParsedDefaultJSON": "100", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "100", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Sets the max size in MB of flow logs files before rotation.", + "DescriptionHTML": "

Sets the max size in MB of flow logs files before rotation.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Flow logs: file reports", + "GroupWithSortPrefix": "40 Flow logs: file reports", + "NameConfigFile": "FlowLogsFileMaxFiles", + "NameEnvVar": "FELIX_FlowLogsFileMaxFiles", + "NameYAML": "flowLogsFileMaxFiles", + "NameGoAPI": "FlowLogsFileMaxFiles", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "5", + "ParsedDefault": "5", + "ParsedDefaultJSON": "5", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "5", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Sets the number of log files to keep.", + "DescriptionHTML": "

Sets the number of log files to keep.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Flow logs: file reports", + "GroupWithSortPrefix": "40 Flow logs: file reports", + "NameConfigFile": "FlowLogsFileNatOutgoingPortLimit", + "NameEnvVar": "FELIX_FlowLogsFileNatOutgoingPortLimit", + "NameYAML": "flowLogsFileNatOutgoingPortLimit", + "NameGoAPI": "FlowLogsFileNatOutgoingPortLimit", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "3", + "ParsedDefault": "3", + "ParsedDefaultJSON": "3", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "3", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Used to specify the maximum number of distinct post SNAT ports that will appear in the flowLogs. Default value is 3.", + "DescriptionHTML": "

Used to specify the maximum number of distinct post SNAT ports that will appear in the flowLogs. Default value is 3.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Flow logs: file reports", + "GroupWithSortPrefix": "40 Flow logs: file reports", + "NameConfigFile": "FlowLogsFilePerFlowProcessArgsLimit", + "NameEnvVar": "FELIX_FlowLogsFilePerFlowProcessArgsLimit", + "NameYAML": "flowLogsFilePerFlowProcessArgsLimit", + "NameGoAPI": "FlowLogsFilePerFlowProcessArgsLimit", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "5", + "ParsedDefault": "5", + "ParsedDefaultJSON": "5", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "5", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Used to specify the maximum number of distinct process args that will appear in the flowLogs. Default value is 5.", + "DescriptionHTML": "

Used to specify the maximum number of distinct process args that will appear in the flowLogs. Default value is 5.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Flow logs: file reports", + "GroupWithSortPrefix": "40 Flow logs: file reports", + "NameConfigFile": "FlowLogsFilePerFlowProcessLimit", + "NameEnvVar": "FELIX_FlowLogsFilePerFlowProcessLimit", + "NameYAML": "flowLogsFilePerFlowProcessLimit", + "NameGoAPI": "FlowLogsFilePerFlowProcessLimit", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "2", + "ParsedDefault": "2", + "ParsedDefaultJSON": "2", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "2", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Used to specify the maximum number of flow log entries with distinct process information beyond which process information will be aggregated.", + "DescriptionHTML": "

Used to specify the maximum number of flow log entries with distinct process information beyond which process information will be aggregated.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Flow logs: file reports", + "GroupWithSortPrefix": "40 Flow logs: file reports", + "NameConfigFile": "FlowLogsFlushInterval", + "NameEnvVar": "FELIX_FlowLogsFlushInterval", + "NameYAML": "flowLogsFlushInterval", + "NameGoAPI": "FlowLogsFlushInterval", + "StringSchema": "Seconds (floating point)", + "StringSchemaHTML": "Seconds (floating point)", + "StringDefault": "300", + "ParsedDefault": "5m0s", + "ParsedDefaultJSON": "300000000000", + "ParsedType": "time.Duration", + "YAMLType": "string", + "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", + "YAMLDefault": "5m0s", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Configures the interval at which Felix exports flow logs.", + "DescriptionHTML": "

Configures the interval at which Felix exports flow logs.

", + "UserEditable": true, + "GoType": "*v1.Duration", + "OpenSourceOnly": false + }, + { + "Group": "Flow logs: file reports", + "GroupWithSortPrefix": "40 Flow logs: file reports", + "NameConfigFile": "FlowLogsMaxOriginalIPsIncluded", + "NameEnvVar": "FELIX_FlowLogsMaxOriginalIPsIncluded", + "NameYAML": "flowLogsMaxOriginalIPsIncluded", + "NameGoAPI": "FlowLogsMaxOriginalIPsIncluded", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "50", + "ParsedDefault": "50", + "ParsedDefaultJSON": "50", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "50", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Specifies the number of unique IP addresses (if relevant) that should be included in Flow logs.", + "DescriptionHTML": "

Specifies the number of unique IP addresses (if relevant) that should be included in Flow logs.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Flow logs: file reports", + "GroupWithSortPrefix": "40 Flow logs: file reports", + "NameConfigFile": "FlowLogsPositionFilePath", + "NameEnvVar": "FELIX_FlowLogsPositionFilePath", + "NameYAML": "flowLogsPositionFilePath", + "NameGoAPI": "FlowLogsPositionFilePath", + "StringSchema": "String", + "StringSchemaHTML": "String", + "StringDefault": "/var/log/calico/flows.log.pos", + "ParsedDefault": "/var/log/calico/flows.log.pos", + "ParsedDefaultJSON": "\"/var/log/calico/flows.log.pos\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "/var/log/calico/flows.log.pos", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Used specify the position of the external pipeline that reads flow logs. Default is /var/log/calico/flows.log.pos. This parameter only takes effect when FlowLogsDynamicAggregationEnabled is set to true.", + "DescriptionHTML": "

Used specify the position of the external pipeline that reads flow logs. Default is /var/log/calico/flows.log.pos. This parameter only takes effect when FlowLogsDynamicAggregationEnabled is set to true.

", + "UserEditable": true, + "GoType": "*string", + "OpenSourceOnly": false + } + ] + }, + { + "Name": "DNS logs / policy", + "Fields": [ + { + "Group": "DNS logs / policy", + "GroupWithSortPrefix": "50 DNS logs / policy", + "NameConfigFile": "DNSCacheEpoch", + "NameEnvVar": "FELIX_DNSCacheEpoch", + "NameYAML": "dnsCacheEpoch", + "NameGoAPI": "DNSCacheEpoch", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "0", + "ParsedDefault": "0", + "ParsedDefaultJSON": "0", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "0", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "An arbitrary number that can be changed, at runtime, to tell Felix to discard all its learnt DNS information. .", + "DescriptionHTML": "

An arbitrary number that can be changed, at runtime, to tell Felix to discard all its learnt DNS information. .

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "DNS logs / policy", + "GroupWithSortPrefix": "50 DNS logs / policy", + "NameConfigFile": "DNSCacheFile", + "NameEnvVar": "FELIX_DNSCacheFile", + "NameYAML": "dnsCacheFile", + "NameGoAPI": "DNSCacheFile", + "StringSchema": "Path to file", + "StringSchemaHTML": "Path to file", + "StringDefault": "/var/run/calico/felix-dns-cache.txt", + "ParsedDefault": "/var/run/calico/felix-dns-cache.txt", + "ParsedDefaultJSON": "\"/var/run/calico/felix-dns-cache.txt\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "/var/run/calico/felix-dns-cache.txt", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The name of the file that Felix uses to preserve learnt DNS information when restarting. .", + "DescriptionHTML": "

The name of the file that Felix uses to preserve learnt DNS information when restarting. .

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "DNS logs / policy", + "GroupWithSortPrefix": "50 DNS logs / policy", + "NameConfigFile": "DNSCacheSaveInterval", + "NameEnvVar": "FELIX_DNSCacheSaveInterval", + "NameYAML": "dnsCacheSaveInterval", + "NameGoAPI": "DNSCacheSaveInterval", + "StringSchema": "Seconds (floating point)", + "StringSchemaHTML": "Seconds (floating point)", + "StringDefault": "60", + "ParsedDefault": "1m0s", + "ParsedDefaultJSON": "60000000000", + "ParsedType": "time.Duration", + "YAMLType": "string", + "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", + "YAMLDefault": "1m0s", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The periodic interval at which Felix saves learnt DNS information to the cache file. .", + "DescriptionHTML": "

The periodic interval at which Felix saves learnt DNS information to the cache file. .

", + "UserEditable": true, + "GoType": "*v1.Duration", + "OpenSourceOnly": false + }, + { + "Group": "DNS logs / policy", + "GroupWithSortPrefix": "50 DNS logs / policy", + "NameConfigFile": "DNSExtraTTL", + "NameEnvVar": "FELIX_DNSExtraTTL", + "NameYAML": "dnsExtraTTL", + "NameGoAPI": "DNSExtraTTL", + "StringSchema": "Seconds (floating point)", + "StringSchemaHTML": "Seconds (floating point)", + "StringDefault": "0", + "ParsedDefault": "0s", + "ParsedDefaultJSON": "0", + "ParsedType": "time.Duration", + "YAMLType": "string", + "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", + "YAMLDefault": "0s", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Extra time to keep IPs and alias names that are learnt from DNS, in addition to each name or IP's advertised TTL. .", + "DescriptionHTML": "

Extra time to keep IPs and alias names that are learnt from DNS, in addition to each name or IP's advertised TTL. .

", + "UserEditable": true, + "GoType": "*v1.Duration", + "OpenSourceOnly": false + }, + { + "Group": "DNS logs / policy", + "GroupWithSortPrefix": "50 DNS logs / policy", + "NameConfigFile": "DNSLogsFileAggregationKind", + "NameEnvVar": "FELIX_DNSLogsFileAggregationKind", + "NameYAML": "dnsLogsFileAggregationKind", + "NameGoAPI": "DNSLogsFileAggregationKind", + "StringSchema": "Integer: [0,1]", + "StringSchemaHTML": "Integer: [0,1]", + "StringDefault": "1", + "ParsedDefault": "1", + "ParsedDefaultJSON": "1", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "One of: `0`, `1`.", + "YAMLEnumValues": ["0", "1"], + "YAMLSchemaHTML": "One of: 0, 1.", + "YAMLDefault": "1", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Used to choose the type of aggregation for DNS log entries. . Accepted values are 0 and 1. 0 - No aggregation. 1 - Aggregate over clients with the same name prefix.", + "DescriptionHTML": "

Used to choose the type of aggregation for DNS log entries. . Accepted values are 0 and 1. 0 - No aggregation. 1 - Aggregate over clients with the same name prefix.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "DNS logs / policy", + "GroupWithSortPrefix": "50 DNS logs / policy", + "NameConfigFile": "DNSLogsFileDirectory", + "NameEnvVar": "FELIX_DNSLogsFileDirectory", + "NameYAML": "dnsLogsFileDirectory", + "NameGoAPI": "DNSLogsFileDirectory", + "StringSchema": "String", + "StringSchemaHTML": "String", + "StringDefault": "/var/log/calico/dnslogs", + "ParsedDefault": "/var/log/calico/dnslogs", + "ParsedDefaultJSON": "\"/var/log/calico/dnslogs\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "/var/log/calico/dnslogs", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Sets the directory where DNS log files are stored.", + "DescriptionHTML": "

Sets the directory where DNS log files are stored.

", + "UserEditable": true, + "GoType": "*string", + "OpenSourceOnly": false + }, + { + "Group": "DNS logs / policy", + "GroupWithSortPrefix": "50 DNS logs / policy", + "NameConfigFile": "DNSLogsFileEnabled", + "NameEnvVar": "FELIX_DNSLogsFileEnabled", + "NameYAML": "dnsLogsFileEnabled", + "NameGoAPI": "DNSLogsFileEnabled", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "false", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "false", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls logging DNS logs to a file. If false no DNS logging to file will occur.", + "DescriptionHTML": "

Controls logging DNS logs to a file. If false no DNS logging to file will occur.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "DNS logs / policy", + "GroupWithSortPrefix": "50 DNS logs / policy", + "NameConfigFile": "DNSLogsFileIncludeLabels", + "NameEnvVar": "FELIX_DNSLogsFileIncludeLabels", + "NameYAML": "dnsLogsFileIncludeLabels", + "NameGoAPI": "DNSLogsFileIncludeLabels", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "true", + "ParsedDefault": "true", + "ParsedDefaultJSON": "true", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "true", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Used to configure if endpoint labels are included in a DNS log entry written to file.", + "DescriptionHTML": "

Used to configure if endpoint labels are included in a DNS log entry written to file.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "DNS logs / policy", + "GroupWithSortPrefix": "50 DNS logs / policy", + "NameConfigFile": "DNSLogsFileMaxFileSizeMB", + "NameEnvVar": "FELIX_DNSLogsFileMaxFileSizeMB", + "NameYAML": "dnsLogsFileMaxFileSizeMB", + "NameGoAPI": "DNSLogsFileMaxFileSizeMB", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "100", + "ParsedDefault": "100", + "ParsedDefaultJSON": "100", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "100", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Sets the max size in MB of DNS log files before rotation.", + "DescriptionHTML": "

Sets the max size in MB of DNS log files before rotation.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "DNS logs / policy", + "GroupWithSortPrefix": "50 DNS logs / policy", + "NameConfigFile": "DNSLogsFileMaxFiles", + "NameEnvVar": "FELIX_DNSLogsFileMaxFiles", + "NameYAML": "dnsLogsFileMaxFiles", + "NameGoAPI": "DNSLogsFileMaxFiles", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "5", + "ParsedDefault": "5", + "ParsedDefaultJSON": "5", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "5", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Sets the number of DNS log files to keep.", + "DescriptionHTML": "

Sets the number of DNS log files to keep.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "DNS logs / policy", + "GroupWithSortPrefix": "50 DNS logs / policy", + "NameConfigFile": "DNSLogsFilePerNodeLimit", + "NameEnvVar": "FELIX_DNSLogsFilePerNodeLimit", + "NameYAML": "dnsLogsFilePerNodeLimit", + "NameGoAPI": "DNSLogsFilePerNodeLimit", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "0", + "ParsedDefault": "0", + "ParsedDefaultJSON": "0", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "0", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Limit on the number of DNS logs that can be emitted within each flush interval. When this limit has been reached, Felix counts the number of unloggable DNS responses within the flush interval, and emits a WARNING log with that count at the same time as it flushes the buffered DNS logs.", + "DescriptionHTML": "

Limit on the number of DNS logs that can be emitted within each flush interval. When this limit has been reached, Felix counts the number of unloggable DNS responses within the flush interval, and emits a WARNING log with that count at the same time as it flushes the buffered DNS logs.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "DNS logs / policy", + "GroupWithSortPrefix": "50 DNS logs / policy", + "NameConfigFile": "DNSLogsFlushInterval", + "NameEnvVar": "FELIX_DNSLogsFlushInterval", + "NameYAML": "dnsLogsFlushInterval", + "NameGoAPI": "DNSLogsFlushInterval", + "StringSchema": "Seconds (floating point)", + "StringSchemaHTML": "Seconds (floating point)", + "StringDefault": "300", + "ParsedDefault": "5m0s", + "ParsedDefaultJSON": "300000000000", + "ParsedType": "time.Duration", + "YAMLType": "string", + "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", + "YAMLDefault": "5m0s", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Configures the interval at which Felix exports DNS logs.", + "DescriptionHTML": "

Configures the interval at which Felix exports DNS logs.

", + "UserEditable": true, + "GoType": "*v1.Duration", + "OpenSourceOnly": false + }, + { + "Group": "DNS logs / policy", + "GroupWithSortPrefix": "50 DNS logs / policy", + "NameConfigFile": "DNSLogsLatency", + "NameEnvVar": "FELIX_DNSLogsLatency", + "NameYAML": "dnsLogsLatency", + "NameGoAPI": "DNSLogsLatency", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "true", + "ParsedDefault": "true", + "ParsedDefaultJSON": "true", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "true", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Indicates to include measurements of DNS request/response latency in each DNS log.", + "DescriptionHTML": "

Indicates to include measurements of DNS request/response latency in each DNS log.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "DNS logs / policy", + "GroupWithSortPrefix": "50 DNS logs / policy", + "NameConfigFile": "DNSPacketsNfqueueID", + "NameEnvVar": "FELIX_DNSPacketsNfqueueID", + "NameYAML": "dnsPacketsNfqueueID", + "NameGoAPI": "DNSPacketsNfqueueID", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "101", + "ParsedDefault": "101", + "ParsedDefaultJSON": "101", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "101", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The NFQUEUE ID to use for capturing DNS packets to ensure programming IPSets occurs before the response is released. Used when DNSPolicyMode is DelayDNSResponse.", + "DescriptionHTML": "

The NFQUEUE ID to use for capturing DNS packets to ensure programming IPSets occurs before the response is released. Used when DNSPolicyMode is DelayDNSResponse.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "DNS logs / policy", + "GroupWithSortPrefix": "50 DNS logs / policy", + "NameConfigFile": "DNSPacketsNfqueueMaxHoldDuration", + "NameEnvVar": "FELIX_DNSPacketsNfqueueMaxHoldDuration", + "NameYAML": "dnsPacketsNfqueueMaxHoldDuration", + "NameGoAPI": "DNSPacketsNfqueueMaxHoldDuration", + "StringSchema": "Milliseconds (floating point)", + "StringSchemaHTML": "Milliseconds (floating point)", + "StringDefault": "3000", + "ParsedDefault": "3s", + "ParsedDefaultJSON": "3000000000", + "ParsedType": "time.Duration", + "YAMLType": "string", + "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", + "YAMLDefault": "3s", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The max length of time to hold on to a DNS response while waiting for the the dataplane to be programmed. Used when DNSPolicyMode is DelayDNSResponse.", + "DescriptionHTML": "

The max length of time to hold on to a DNS response while waiting for the the dataplane to be programmed. Used when DNSPolicyMode is DelayDNSResponse.

", + "UserEditable": true, + "GoType": "*v1.Duration", + "OpenSourceOnly": false + }, + { + "Group": "DNS logs / policy", + "GroupWithSortPrefix": "50 DNS logs / policy", + "NameConfigFile": "DNSPacketsNfqueueSize", + "NameEnvVar": "FELIX_DNSPacketsNfqueueSize", + "NameYAML": "dnsPacketsNfqueueSize", + "NameGoAPI": "DNSPacketsNfqueueSize", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "100", + "ParsedDefault": "100", + "ParsedDefaultJSON": "100", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "100", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The size of the NFQUEUE for captured DNS packets. This is the maximum number of DNS packets that may be queued awaiting programming in the dataplane. Used when DNSPolicyMode is DelayDNSResponse.", + "DescriptionHTML": "

The size of the NFQUEUE for captured DNS packets. This is the maximum number of DNS packets that may be queued awaiting programming in the dataplane. Used when DNSPolicyMode is DelayDNSResponse.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "DNS logs / policy", + "GroupWithSortPrefix": "50 DNS logs / policy", + "NameConfigFile": "DNSPolicyMode", + "NameEnvVar": "FELIX_DNSPolicyMode", + "NameYAML": "dnsPolicyMode", + "NameGoAPI": "DNSPolicyMode", + "StringSchema": "One of: `DelayDNSResponse`, `DelayDeniedPacket`, `NoDelay` (case insensitive)", + "StringSchemaHTML": "One of: DelayDNSResponse, DelayDeniedPacket, NoDelay (case insensitive)", + "StringDefault": "DelayDeniedPacket", + "ParsedDefault": "DelayDeniedPacket", + "ParsedDefaultJSON": "\"DelayDeniedPacket\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `\"DelayDNSResponse\"`, `\"DelayDeniedPacket\"`, `\"NoDelay\"`.", + "YAMLEnumValues": ["DelayDNSResponse", "DelayDeniedPacket", "NoDelay"], + "YAMLSchemaHTML": "One of: \"DelayDNSResponse\", \"DelayDeniedPacket\", \"NoDelay\".", + "YAMLDefault": "DelayDeniedPacket", + "Required": true, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Specifies how DNS policy programming will be handled. DelayDeniedPacket - Felix delays any denied packet that traversed a policy that included egress domain matches, but did not match. The packet is released after a fixed time, or after the destination IP address was programmed. DelayDNSResponse - Felix delays any DNS response until related IPSets are programmed. This introduces some latency to all DNS packets (even when no IPSet programming is required), but it ensures policy hit statistics are accurate. This is the recommended setting when you are making use of staged policies or policy rule hit statistics. NoDelay - Felix does not introduce any delay to the packets. DNS rules may not have been programmed by the time the first packet traverses the policy rules. Client applications need to handle reconnection attempts if initial connection attempts fail. This may be problematic for some applications or for very low DNS TTLs.\n\nThis setting is ignored on Windows and \"NoDelay\" is always used.\n\nThis setting is ignored by eBPF and BPFDNSPolicyMode is used instead.", + "DescriptionHTML": "

Specifies how DNS policy programming will be handled. DelayDeniedPacket - Felix delays any denied packet that traversed a policy that included egress domain matches, but did not match. The packet is released after a fixed time, or after the destination IP address was programmed. DelayDNSResponse - Felix delays any DNS response until related IPSets are programmed. This introduces some latency to all DNS packets (even when no IPSet programming is required), but it ensures policy hit statistics are accurate. This is the recommended setting when you are making use of staged policies or policy rule hit statistics. NoDelay - Felix does not introduce any delay to the packets. DNS rules may not have been programmed by the time the first packet traverses the policy rules. Client applications need to handle reconnection attempts if initial connection attempts fail. This may be problematic for some applications or for very low DNS TTLs.

\n

This setting is ignored on Windows and \"NoDelay\" is always used.

\n

This setting is ignored by eBPF and BPFDNSPolicyMode is used instead.

", + "UserEditable": true, + "GoType": "*v3.DNSPolicyMode", + "OpenSourceOnly": false + }, + { + "Group": "DNS logs / policy", + "GroupWithSortPrefix": "50 DNS logs / policy", + "NameConfigFile": "DNSPolicyNfqueueID", + "NameEnvVar": "FELIX_DNSPolicyNfqueueID", + "NameYAML": "dnsPolicyNfqueueID", + "NameGoAPI": "DNSPolicyNfqueueID", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "100", + "ParsedDefault": "100", + "ParsedDefaultJSON": "100", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "100", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The NFQUEUE ID to use for DNS Policy re-evaluation when the domains IP hasn't been programmed to ipsets yet. Used when DNSPolicyMode is DelayDeniedPacket.", + "DescriptionHTML": "

The NFQUEUE ID to use for DNS Policy re-evaluation when the domains IP hasn't been programmed to ipsets yet. Used when DNSPolicyMode is DelayDeniedPacket.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "DNS logs / policy", + "GroupWithSortPrefix": "50 DNS logs / policy", + "NameConfigFile": "DNSPolicyNfqueueSize", + "NameEnvVar": "FELIX_DNSPolicyNfqueueSize", + "NameYAML": "dnsPolicyNfqueueSize", + "NameGoAPI": "DNSPolicyNfqueueSize", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "255", + "ParsedDefault": "255", + "ParsedDefaultJSON": "255", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "255", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "DNSPolicyNfqueueID is the size of the NFQUEUE for DNS policy re-evaluation. This is the maximum number of denied packets that may be queued up pending re-evaluation. Used when DNSPolicyMode is DelayDeniedPacket.", + "DescriptionHTML": "

DNSPolicyNfqueueID is the size of the NFQUEUE for DNS policy re-evaluation. This is the maximum number of denied packets that may be queued up pending re-evaluation. Used when DNSPolicyMode is DelayDeniedPacket.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "DNS logs / policy", + "GroupWithSortPrefix": "50 DNS logs / policy", + "NameConfigFile": "DNSTrustedServers", + "NameEnvVar": "FELIX_DNSTrustedServers", + "NameYAML": "dnsTrustedServers", + "NameGoAPI": "DNSTrustedServers", + "StringSchema": "Comma-delimited list of DNS servers. Each entry can be: ``, an `:` (IPv6 addresses must be wrapped in square brackets), or, a Kubernetes service name `k8s-service:(namespace/)service-name`.", + "StringSchemaHTML": "Comma-delimited list of DNS servers. Each entry can be: <IP address>, an <IP address>:<port> (IPv6 addresses must be wrapped in square brackets), or, a Kubernetes service name k8s-service:(namespace/)service-name.", + "StringDefault": "k8s-service:kube-dns", + "ParsedDefault": "[]", + "ParsedDefaultJSON": "[]", + "ParsedType": "[]config.ServerPort", + "YAMLType": "array", + "YAMLSchema": "List of strings: `[\"\", ...]`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "List of strings: [\"<string>\", ...].", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The DNS servers that Felix should trust. Each entry here must be `[:]` - indicating an explicit DNS server IP - or `k8s-service:[/][:port]` - indicating a Kubernetes DNS service. `` defaults to the first service port, or 53 for an IP, and `` to `kube-system`. An IPv6 address with a port must use the square brackets convention, for example `[fd00:83a6::12]:5353`.Note that Felix (calico-node) will need RBAC permission to read the details of each service specified by a `k8s-service:...` form. .", + "DescriptionHTML": "

The DNS servers that Felix should trust. Each entry here must be <ip>[:<port>] - indicating an explicit DNS server IP - or k8s-service:[<namespace>/]<name>[:port] - indicating a Kubernetes DNS service. <port> defaults to the first service port, or 53 for an IP, and <namespace> to kube-system. An IPv6 address with a port must use the square brackets convention, for example [fd00:83a6::12]:5353.Note that Felix (calico-node) will need RBAC permission to read the details of each service specified by a k8s-service:... form. .

", + "UserEditable": true, + "GoType": "*[]string", + "OpenSourceOnly": false + } + ] + }, + { + "Name": "L7 logs", + "Fields": [ + { + "Group": "L7 logs", + "GroupWithSortPrefix": "50 L7 logs", + "NameConfigFile": "L7LogsFileAggregationDestinationInfo", + "NameEnvVar": "FELIX_L7LogsFileAggregationDestinationInfo", + "NameYAML": "l7LogsFileAggregationDestinationInfo", + "NameGoAPI": "L7LogsFileAggregationDestinationInfo", + "StringSchema": "String", + "StringSchemaHTML": "String", + "StringDefault": "IncludeL7DestinationInfo", + "ParsedDefault": "IncludeL7DestinationInfo", + "ParsedDefaultJSON": "\"IncludeL7DestinationInfo\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `ExcludeL7DestinationInfo`, `IncludeL7DestinationInfo`.", + "YAMLEnumValues": ["ExcludeL7DestinationInfo", "IncludeL7DestinationInfo"], + "YAMLSchemaHTML": "One of: ExcludeL7DestinationInfo, IncludeL7DestinationInfo.", + "YAMLDefault": "IncludeL7DestinationInfo", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Used to choose the type of aggregation for the destination metadata on L7 log entries. . Accepted values are IncludeL7DestinationInfo and ExcludeL7DestinationInfo. IncludeL7DestinationInfo - Include destination metadata in the logs. ExcludeL7DestinationInfo - Aggregate over all other fields ignoring the destination aggregated name, namespace, and type.", + "DescriptionHTML": "

Used to choose the type of aggregation for the destination metadata on L7 log entries. . Accepted values are IncludeL7DestinationInfo and ExcludeL7DestinationInfo. IncludeL7DestinationInfo - Include destination metadata in the logs. ExcludeL7DestinationInfo - Aggregate over all other fields ignoring the destination aggregated name, namespace, and type.

", + "UserEditable": true, + "GoType": "*string", + "OpenSourceOnly": false + }, + { + "Group": "L7 logs", + "GroupWithSortPrefix": "50 L7 logs", + "NameConfigFile": "L7LogsFileAggregationHTTPHeaderInfo", + "NameEnvVar": "FELIX_L7LogsFileAggregationHTTPHeaderInfo", + "NameYAML": "l7LogsFileAggregationHTTPHeaderInfo", + "NameGoAPI": "L7LogsFileAggregationHTTPHeaderInfo", + "StringSchema": "String", + "StringSchemaHTML": "String", + "StringDefault": "ExcludeL7HTTPHeaderInfo", + "ParsedDefault": "ExcludeL7HTTPHeaderInfo", + "ParsedDefaultJSON": "\"ExcludeL7HTTPHeaderInfo\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `ExcludeL7HTTPHeaderInfo`, `IncludeL7HTTPHeaderInfo`.", + "YAMLEnumValues": ["ExcludeL7HTTPHeaderInfo", "IncludeL7HTTPHeaderInfo"], + "YAMLSchemaHTML": "One of: ExcludeL7HTTPHeaderInfo, IncludeL7HTTPHeaderInfo.", + "YAMLDefault": "ExcludeL7HTTPHeaderInfo", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Used to choose the type of aggregation for HTTP header data on L7 log entries. . Accepted values are IncludeL7HTTPHeaderInfo and ExcludeL7HTTPHeaderInfo. IncludeL7HTTPHeaderInfo - Include HTTP header data in the logs. ExcludeL7HTTPHeaderInfo - Aggregate over all other fields ignoring the user agent and log type.", + "DescriptionHTML": "

Used to choose the type of aggregation for HTTP header data on L7 log entries. . Accepted values are IncludeL7HTTPHeaderInfo and ExcludeL7HTTPHeaderInfo. IncludeL7HTTPHeaderInfo - Include HTTP header data in the logs. ExcludeL7HTTPHeaderInfo - Aggregate over all other fields ignoring the user agent and log type.

", + "UserEditable": true, + "GoType": "*string", + "OpenSourceOnly": false + }, + { + "Group": "L7 logs", + "GroupWithSortPrefix": "50 L7 logs", + "NameConfigFile": "L7LogsFileAggregationHTTPMethod", + "NameEnvVar": "FELIX_L7LogsFileAggregationHTTPMethod", + "NameYAML": "l7LogsFileAggregationHTTPMethod", + "NameGoAPI": "L7LogsFileAggregationHTTPMethod", + "StringSchema": "String", + "StringSchemaHTML": "String", + "StringDefault": "IncludeL7HTTPMethod", + "ParsedDefault": "IncludeL7HTTPMethod", + "ParsedDefaultJSON": "\"IncludeL7HTTPMethod\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `ExcludeL7HTTPMethod`, `IncludeL7HTTPMethod`.", + "YAMLEnumValues": ["ExcludeL7HTTPMethod", "IncludeL7HTTPMethod"], + "YAMLSchemaHTML": "One of: ExcludeL7HTTPMethod, IncludeL7HTTPMethod.", + "YAMLDefault": "IncludeL7HTTPMethod", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Used to choose the type of aggregation for the HTTP request method on L7 log entries. . Accepted values are IncludeL7HTTPMethod and ExcludeL7HTTPMethod. IncludeL7HTTPMethod - Include HTTP method in the logs. ExcludeL7HTTPMethod - Aggregate over all other fields ignoring the HTTP method.", + "DescriptionHTML": "

Used to choose the type of aggregation for the HTTP request method on L7 log entries. . Accepted values are IncludeL7HTTPMethod and ExcludeL7HTTPMethod. IncludeL7HTTPMethod - Include HTTP method in the logs. ExcludeL7HTTPMethod - Aggregate over all other fields ignoring the HTTP method.

", + "UserEditable": true, + "GoType": "*string", + "OpenSourceOnly": false + }, + { + "Group": "L7 logs", + "GroupWithSortPrefix": "50 L7 logs", + "NameConfigFile": "L7LogsFileAggregationNumURLPath", + "NameEnvVar": "FELIX_L7LogsFileAggregationNumURLPath", + "NameYAML": "l7LogsFileAggregationNumURLPath", + "NameGoAPI": "L7LogsFileAggregationNumURLPath", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "5", + "ParsedDefault": "5", + "ParsedDefaultJSON": "5", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "5", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Used to choose the number of components in the url path to display. This allows for the url to be truncated in case parts of the path provide no value. Setting this value to negative will allow all parts of the path to be displayed. .", + "DescriptionHTML": "

Used to choose the number of components in the url path to display. This allows for the url to be truncated in case parts of the path provide no value. Setting this value to negative will allow all parts of the path to be displayed. .

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "L7 logs", + "GroupWithSortPrefix": "50 L7 logs", + "NameConfigFile": "L7LogsFileAggregationResponseCode", + "NameEnvVar": "FELIX_L7LogsFileAggregationResponseCode", + "NameYAML": "l7LogsFileAggregationResponseCode", + "NameGoAPI": "L7LogsFileAggregationResponseCode", + "StringSchema": "String", + "StringSchemaHTML": "String", + "StringDefault": "IncludeL7ResponseCode", + "ParsedDefault": "IncludeL7ResponseCode", + "ParsedDefaultJSON": "\"IncludeL7ResponseCode\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `ExcludeL7ResponseCode`, `IncludeL7ResponseCode`.", + "YAMLEnumValues": ["ExcludeL7ResponseCode", "IncludeL7ResponseCode"], + "YAMLSchemaHTML": "One of: ExcludeL7ResponseCode, IncludeL7ResponseCode.", + "YAMLDefault": "IncludeL7ResponseCode", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Used to choose the type of aggregation for the response code on L7 log entries. . Accepted values are IncludeL7ResponseCode and ExcludeL7ResponseCode. IncludeL7ResponseCode - Include the response code in the logs. ExcludeL7ResponseCode - Aggregate over all other fields ignoring the response code.", + "DescriptionHTML": "

Used to choose the type of aggregation for the response code on L7 log entries. . Accepted values are IncludeL7ResponseCode and ExcludeL7ResponseCode. IncludeL7ResponseCode - Include the response code in the logs. ExcludeL7ResponseCode - Aggregate over all other fields ignoring the response code.

", + "UserEditable": true, + "GoType": "*string", + "OpenSourceOnly": false + }, + { + "Group": "L7 logs", + "GroupWithSortPrefix": "50 L7 logs", + "NameConfigFile": "L7LogsFileAggregationServiceInfo", + "NameEnvVar": "FELIX_L7LogsFileAggregationServiceInfo", + "NameYAML": "l7LogsFileAggregationServiceInfo", + "NameGoAPI": "L7LogsFileAggregationServiceInfo", + "StringSchema": "String", + "StringSchemaHTML": "String", + "StringDefault": "IncludeL7ServiceInfo", + "ParsedDefault": "IncludeL7ServiceInfo", + "ParsedDefaultJSON": "\"IncludeL7ServiceInfo\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `ExcludeL7ServiceInfo`, `IncludeL7ServiceInfo`.", + "YAMLEnumValues": ["ExcludeL7ServiceInfo", "IncludeL7ServiceInfo"], + "YAMLSchemaHTML": "One of: ExcludeL7ServiceInfo, IncludeL7ServiceInfo.", + "YAMLDefault": "IncludeL7ServiceInfo", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Used to choose the type of aggregation for the service data on L7 log entries. . Accepted values are IncludeL7ServiceInfo and ExcludeL7ServiceInfo. IncludeL7ServiceInfo - Include service data in the logs. ExcludeL7ServiceInfo - Aggregate over all other fields ignoring the service name, namespace, and port.", + "DescriptionHTML": "

Used to choose the type of aggregation for the service data on L7 log entries. . Accepted values are IncludeL7ServiceInfo and ExcludeL7ServiceInfo. IncludeL7ServiceInfo - Include service data in the logs. ExcludeL7ServiceInfo - Aggregate over all other fields ignoring the service name, namespace, and port.

", + "UserEditable": true, + "GoType": "*string", + "OpenSourceOnly": false + }, + { + "Group": "L7 logs", + "GroupWithSortPrefix": "50 L7 logs", + "NameConfigFile": "L7LogsFileAggregationSourceInfo", + "NameEnvVar": "FELIX_L7LogsFileAggregationSourceInfo", + "NameYAML": "l7LogsFileAggregationSourceInfo", + "NameGoAPI": "L7LogsFileAggregationSourceInfo", + "StringSchema": "String", + "StringSchemaHTML": "String", + "StringDefault": "IncludeL7SourceInfoNoPort", + "ParsedDefault": "IncludeL7SourceInfoNoPort", + "ParsedDefaultJSON": "\"IncludeL7SourceInfoNoPort\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `ExcludeL7SourceInfo`, `IncludeL7SourceInfo`, `IncludeL7SourceInfoNoPort`.", + "YAMLEnumValues": ["ExcludeL7SourceInfo", "IncludeL7SourceInfo", "IncludeL7SourceInfoNoPort"], + "YAMLSchemaHTML": "One of: ExcludeL7SourceInfo, IncludeL7SourceInfo, IncludeL7SourceInfoNoPort.", + "YAMLDefault": "IncludeL7SourceInfoNoPort", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "L7LogsFileAggregationExcludeSourceInfo is used to choose the type of aggregation for the source metadata on L7 log entries. . Accepted values are IncludeL7SourceInfo, IncludeL7SourceInfoNoPort, and ExcludeL7SourceInfo. IncludeL7SourceInfo - Include source metadata in the logs. IncludeL7SourceInfoNoPort - Include source metadata in the logs excluding the source port. ExcludeL7SourceInfo - Aggregate over all other fields ignoring the source aggregated name, namespace, and type.", + "DescriptionHTML": "

L7LogsFileAggregationExcludeSourceInfo is used to choose the type of aggregation for the source metadata on L7 log entries. . Accepted values are IncludeL7SourceInfo, IncludeL7SourceInfoNoPort, and ExcludeL7SourceInfo. IncludeL7SourceInfo - Include source metadata in the logs. IncludeL7SourceInfoNoPort - Include source metadata in the logs excluding the source port. ExcludeL7SourceInfo - Aggregate over all other fields ignoring the source aggregated name, namespace, and type.

", + "UserEditable": true, + "GoType": "*string", + "OpenSourceOnly": false + }, + { + "Group": "L7 logs", + "GroupWithSortPrefix": "50 L7 logs", + "NameConfigFile": "L7LogsFileAggregationTrimURL", + "NameEnvVar": "FELIX_L7LogsFileAggregationTrimURL", + "NameYAML": "l7LogsFileAggregationTrimURL", + "NameGoAPI": "L7LogsFileAggregationTrimURL", + "StringSchema": "String", + "StringSchemaHTML": "String", + "StringDefault": "IncludeL7FullURL", + "ParsedDefault": "IncludeL7FullURL", + "ParsedDefaultJSON": "\"IncludeL7FullURL\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `ExcludeL7URL`, `IncludeL7FullURL`, `TrimURLQuery`, `TrimURLQueryAndPath`.", + "YAMLEnumValues": ["ExcludeL7URL", "IncludeL7FullURL", "TrimURLQuery", "TrimURLQueryAndPath"], + "YAMLSchemaHTML": "One of: ExcludeL7URL, IncludeL7FullURL, TrimURLQuery, TrimURLQueryAndPath.", + "YAMLDefault": "IncludeL7FullURL", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Used to choose the type of aggregation for the url on L7 log entries. . Accepted values: IncludeL7FullURL - Include the full URL up to however many path components are allowed by L7LogsFileAggregationNumURLPath. TrimURLQuery - Aggregate over all other fields ignoring the query parameters on the URL. TrimURLQueryAndPath - Aggregate over all other fields and the base URL only. ExcludeL7URL - Aggregate over all other fields ignoring the URL entirely.", + "DescriptionHTML": "

Used to choose the type of aggregation for the url on L7 log entries. . Accepted values: IncludeL7FullURL - Include the full URL up to however many path components are allowed by L7LogsFileAggregationNumURLPath. TrimURLQuery - Aggregate over all other fields ignoring the query parameters on the URL. TrimURLQueryAndPath - Aggregate over all other fields and the base URL only. ExcludeL7URL - Aggregate over all other fields ignoring the URL entirely.

", + "UserEditable": true, + "GoType": "*string", + "OpenSourceOnly": false + }, + { + "Group": "L7 logs", + "GroupWithSortPrefix": "50 L7 logs", + "NameConfigFile": "L7LogsFileAggregationURLCharLimit", + "NameEnvVar": "FELIX_L7LogsFileAggregationURLCharLimit", + "NameYAML": "l7LogsFileAggregationURLCharLimit", + "NameGoAPI": "L7LogsFileAggregationURLCharLimit", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "250", + "ParsedDefault": "250", + "ParsedDefaultJSON": "250", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "250", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Limit on the length of the URL collected in L7 logs. When a URL length reaches this limit it is sliced off, and the sliced URL is sent to log storage.", + "DescriptionHTML": "

Limit on the length of the URL collected in L7 logs. When a URL length reaches this limit it is sliced off, and the sliced URL is sent to log storage.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "L7 logs", + "GroupWithSortPrefix": "50 L7 logs", + "NameConfigFile": "L7LogsFileDirectory", + "NameEnvVar": "FELIX_L7LogsFileDirectory", + "NameYAML": "l7LogsFileDirectory", + "NameGoAPI": "L7LogsFileDirectory", + "StringSchema": "String", + "StringSchemaHTML": "String", + "StringDefault": "/var/log/calico/l7logs", + "ParsedDefault": "/var/log/calico/l7logs", + "ParsedDefaultJSON": "\"/var/log/calico/l7logs\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "/var/log/calico/l7logs", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Sets the directory where L7 log files are stored.", + "DescriptionHTML": "

Sets the directory where L7 log files are stored.

", + "UserEditable": true, + "GoType": "*string", + "OpenSourceOnly": false + }, + { + "Group": "L7 logs", + "GroupWithSortPrefix": "50 L7 logs", + "NameConfigFile": "L7LogsFileEnabled", + "NameEnvVar": "FELIX_L7LogsFileEnabled", + "NameYAML": "l7LogsFileEnabled", + "NameGoAPI": "L7LogsFileEnabled", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "true", + "ParsedDefault": "true", + "ParsedDefaultJSON": "true", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "true", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls logging L7 logs to a file. If false no L7 logging to file will occur.", + "DescriptionHTML": "

Controls logging L7 logs to a file. If false no L7 logging to file will occur.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "L7 logs", + "GroupWithSortPrefix": "50 L7 logs", + "NameConfigFile": "L7LogsFileMaxFileSizeMB", + "NameEnvVar": "FELIX_L7LogsFileMaxFileSizeMB", + "NameYAML": "l7LogsFileMaxFileSizeMB", + "NameGoAPI": "L7LogsFileMaxFileSizeMB", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "100", + "ParsedDefault": "100", + "ParsedDefaultJSON": "100", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "100", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Sets the max size in MB of L7 log files before rotation.", + "DescriptionHTML": "

Sets the max size in MB of L7 log files before rotation.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "L7 logs", + "GroupWithSortPrefix": "50 L7 logs", + "NameConfigFile": "L7LogsFileMaxFiles", + "NameEnvVar": "FELIX_L7LogsFileMaxFiles", + "NameYAML": "l7LogsFileMaxFiles", + "NameGoAPI": "L7LogsFileMaxFiles", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "5", + "ParsedDefault": "5", + "ParsedDefaultJSON": "5", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "5", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Sets the number of L7 log files to keep.", + "DescriptionHTML": "

Sets the number of L7 log files to keep.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "L7 logs", + "GroupWithSortPrefix": "50 L7 logs", + "NameConfigFile": "L7LogsFilePerNodeLimit", + "NameEnvVar": "FELIX_L7LogsFilePerNodeLimit", + "NameYAML": "l7LogsFilePerNodeLimit", + "NameGoAPI": "L7LogsFilePerNodeLimit", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "1500", + "ParsedDefault": "1500", + "ParsedDefaultJSON": "1500", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "1500", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Limit on the number of L7 logs that can be emitted within each flush interval. When this limit has been reached, Felix counts the number of unloggable L7 responses within the flush interval, and emits a WARNING log with that count at the same time as it flushes the buffered L7 logs. A value of 0 means no limit.", + "DescriptionHTML": "

Limit on the number of L7 logs that can be emitted within each flush interval. When this limit has been reached, Felix counts the number of unloggable L7 responses within the flush interval, and emits a WARNING log with that count at the same time as it flushes the buffered L7 logs. A value of 0 means no limit.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "L7 logs", + "GroupWithSortPrefix": "50 L7 logs", + "NameConfigFile": "L7LogsFlushInterval", + "NameEnvVar": "FELIX_L7LogsFlushInterval", + "NameYAML": "l7LogsFlushInterval", + "NameGoAPI": "L7LogsFlushInterval", + "StringSchema": "Seconds (floating point)", + "StringSchemaHTML": "Seconds (floating point)", + "StringDefault": "300", + "ParsedDefault": "5m0s", + "ParsedDefaultJSON": "300000000000", + "ParsedType": "time.Duration", + "YAMLType": "string", + "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", + "YAMLDefault": "5m0s", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Configures the interval at which Felix exports L7 logs.", + "DescriptionHTML": "

Configures the interval at which Felix exports L7 logs.

", + "UserEditable": true, + "GoType": "*v1.Duration", + "OpenSourceOnly": false + } + ] + }, + { + "Name": "AWS integration", + "Fields": [ + { + "Group": "AWS integration", + "GroupWithSortPrefix": "60 AWS integration", + "NameConfigFile": "AWSRequestTimeout", + "NameEnvVar": "FELIX_AWSRequestTimeout", + "NameYAML": "awsRequestTimeout", + "NameGoAPI": "AWSRequestTimeout", + "StringSchema": "Seconds (floating point)", + "StringSchemaHTML": "Seconds (floating point)", + "StringDefault": "30", + "ParsedDefault": "30s", + "ParsedDefaultJSON": "30000000000", + "ParsedType": "time.Duration", + "YAMLType": "string", + "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", + "YAMLDefault": "30s", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The timeout on AWS API requests.", + "DescriptionHTML": "

The timeout on AWS API requests.

", + "UserEditable": true, + "GoType": "*v1.Duration", + "OpenSourceOnly": false + }, + { + "Group": "AWS integration", + "GroupWithSortPrefix": "60 AWS integration", + "NameConfigFile": "AWSSecondaryIPRoutingRulePriority", + "NameEnvVar": "FELIX_AWSSecondaryIPRoutingRulePriority", + "NameYAML": "awsSecondaryIPRoutingRulePriority", + "NameGoAPI": "AWSSecondaryIPRoutingRulePriority", + "StringSchema": "Integer: [0,4294967295]", + "StringSchemaHTML": "Integer: [0,4294967295]", + "StringDefault": "101", + "ParsedDefault": "101", + "ParsedDefaultJSON": "101", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer: [0,4294967295]", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer: [0,4294967295]", + "YAMLDefault": "101", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls the priority that Felix will use for routing rules when programming them for AWS Secondary IP support.", + "DescriptionHTML": "

Controls the priority that Felix will use for routing rules when programming them for AWS Secondary IP support.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "AWS integration", + "GroupWithSortPrefix": "60 AWS integration", + "NameConfigFile": "AWSSecondaryIPSupport", + "NameEnvVar": "FELIX_AWSSecondaryIPSupport", + "NameYAML": "awsSecondaryIPSupport", + "NameGoAPI": "AWSSecondaryIPSupport", + "StringSchema": "One of: `Disabled`, `EnabledENIPerWorkload`, `Enabled` (case insensitive)", + "StringSchemaHTML": "One of: Disabled, EnabledENIPerWorkload, Enabled (case insensitive)", + "StringDefault": "Disabled", + "ParsedDefault": "Disabled", + "ParsedDefaultJSON": "\"Disabled\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `Disabled`, `Enabled`, `EnabledENIPerWorkload`.", + "YAMLEnumValues": ["Disabled", "Enabled", "EnabledENIPerWorkload"], + "YAMLSchemaHTML": "One of: Disabled, Enabled, EnabledENIPerWorkload.", + "YAMLDefault": "Disabled", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls whether Felix will try to provision AWS secondary ENIs for workloads that have IPs from IP pools that are configured with an AWS subnet ID. If the field is set to \"EnabledENIPerWorkload\" then each workload with an AWS-backed IP will be assigned its own secondary ENI. If set to \"Enabled\" then each workload with an AWS-backed IP pool will be allocated a secondary IP address on a secondary ENI; this mode requires additional IP pools to be provisioned for the host to claim IPs for the primary IP of the secondary ENIs. Accepted value must be one of \"Enabled\", \"EnabledENIPerWorkload\" or \"Disabled\".", + "DescriptionHTML": "

Controls whether Felix will try to provision AWS secondary ENIs for workloads that have IPs from IP pools that are configured with an AWS subnet ID. If the field is set to \"EnabledENIPerWorkload\" then each workload with an AWS-backed IP will be assigned its own secondary ENI. If set to \"Enabled\" then each workload with an AWS-backed IP pool will be allocated a secondary IP address on a secondary ENI; this mode requires additional IP pools to be provisioned for the host to claim IPs for the primary IP of the secondary ENIs. Accepted value must be one of \"Enabled\", \"EnabledENIPerWorkload\" or \"Disabled\".

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "AWS integration", + "GroupWithSortPrefix": "60 AWS integration", + "NameConfigFile": "AWSSrcDstCheck", + "NameEnvVar": "FELIX_AWSSrcDstCheck", + "NameYAML": "awsSrcDstCheck", + "NameGoAPI": "AWSSrcDstCheck", + "StringSchema": "One of: `Disable`, `DoNothing`, `Enable` (case insensitive)", + "StringSchemaHTML": "One of: Disable, DoNothing, Enable (case insensitive)", + "StringDefault": "DoNothing", + "ParsedDefault": "DoNothing", + "ParsedDefaultJSON": "\"DoNothing\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `\"Disable\"`, `\"DoNothing\"`, `\"Enable\"`.", + "YAMLEnumValues": ["Disable", "DoNothing", "Enable"], + "YAMLSchemaHTML": "One of: \"Disable\", \"DoNothing\", \"Enable\".", + "YAMLDefault": "DoNothing", + "Required": true, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls whether Felix will try to change the \"source/dest check\" setting on the EC2 instance on which it is running. A value of \"Disable\" will try to disable the source/dest check. Disabling the check allows for sending workload traffic without encapsulation within the same AWS subnet.", + "DescriptionHTML": "

Controls whether Felix will try to change the \"source/dest check\" setting on the EC2 instance on which it is running. A value of \"Disable\" will try to disable the source/dest check. Disabling the check allows for sending workload traffic without encapsulation within the same AWS subnet.

", + "UserEditable": true, + "GoType": "*v3.AWSSrcDstCheckOption", + "OpenSourceOnly": false + } + ] + }, + { + "Name": "Egress gateway", + "Fields": [ + { + "Group": "Egress gateway", + "GroupWithSortPrefix": "70 Egress gateway", + "NameConfigFile": "EgressGatewayPollFailureCount", + "NameEnvVar": "FELIX_EgressGatewayPollFailureCount", + "NameYAML": "egressGatewayPollFailureCount", + "NameGoAPI": "EgressGatewayPollFailureCount", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "3", + "ParsedDefault": "3", + "ParsedDefaultJSON": "3", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "3", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The minimum number of poll failures before a remote Egress Gateway is considered to have failed.", + "DescriptionHTML": "

The minimum number of poll failures before a remote Egress Gateway is considered to have failed.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Egress gateway", + "GroupWithSortPrefix": "70 Egress gateway", + "NameConfigFile": "EgressGatewayPollInterval", + "NameEnvVar": "FELIX_EgressGatewayPollInterval", + "NameYAML": "egressGatewayPollInterval", + "NameGoAPI": "EgressGatewayPollInterval", + "StringSchema": "Seconds (floating point)", + "StringSchemaHTML": "Seconds (floating point)", + "StringDefault": "10", + "ParsedDefault": "10s", + "ParsedDefaultJSON": "10000000000", + "ParsedType": "time.Duration", + "YAMLType": "string", + "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", + "YAMLDefault": "10s", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The interval at which Felix will poll remote egress gateways to check their health. Only Egress Gateways with a named \"health\" port will be polled in this way. Egress Gateways that fail the health check will be taken our of use as if they have been deleted.", + "DescriptionHTML": "

The interval at which Felix will poll remote egress gateways to check their health. Only Egress Gateways with a named \"health\" port will be polled in this way. Egress Gateways that fail the health check will be taken our of use as if they have been deleted.

", + "UserEditable": true, + "GoType": "*v1.Duration", + "OpenSourceOnly": false + }, + { + "Group": "Egress gateway", + "GroupWithSortPrefix": "70 Egress gateway", + "NameConfigFile": "EgressIPRoutingRulePriority", + "NameEnvVar": "FELIX_EgressIPRoutingRulePriority", + "NameYAML": "egressIPRoutingRulePriority", + "NameGoAPI": "EgressIPRoutingRulePriority", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "100", + "ParsedDefault": "100", + "ParsedDefaultJSON": "100", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "100", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls the priority value to use for the egress IP routing rule.", + "DescriptionHTML": "

Controls the priority value to use for the egress IP routing rule.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Egress gateway", + "GroupWithSortPrefix": "70 Egress gateway", + "NameConfigFile": "EgressIPSupport", + "NameEnvVar": "FELIX_EgressIPSupport", + "NameYAML": "egressIPSupport", + "NameGoAPI": "EgressIPSupport", + "StringSchema": "One of: `Disabled`, `EnabledPerNamespaceOrPerPod`, `EnabledPerNamespace` (case insensitive)", + "StringSchemaHTML": "One of: Disabled, EnabledPerNamespaceOrPerPod, EnabledPerNamespace (case insensitive)", + "StringDefault": "Disabled", + "ParsedDefault": "Disabled", + "ParsedDefaultJSON": "\"Disabled\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `Disabled`, `EnabledPerNamespace`, `EnabledPerNamespaceOrPerPod`.", + "YAMLEnumValues": ["Disabled", "EnabledPerNamespace", "EnabledPerNamespaceOrPerPod"], + "YAMLSchemaHTML": "One of: Disabled, EnabledPerNamespace, EnabledPerNamespaceOrPerPod.", + "YAMLDefault": "Disabled", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Defines three different support modes for egress IP function. - Disabled: Egress IP function is disabled. - EnabledPerNamespace: Egress IP function is enabled and can be configured on a per-namespace basis; per-pod egress annotations are ignored. - EnabledPerNamespaceOrPerPod: Egress IP function is enabled and can be configured per-namespace or per-pod, with per-pod egress annotations overriding namespace annotations.", + "DescriptionHTML": "

Defines three different support modes for egress IP function. - Disabled: Egress IP function is disabled. - EnabledPerNamespace: Egress IP function is enabled and can be configured on a per-namespace basis; per-pod egress annotations are ignored. - EnabledPerNamespaceOrPerPod: Egress IP function is enabled and can be configured per-namespace or per-pod, with per-pod egress annotations overriding namespace annotations.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Egress gateway", + "GroupWithSortPrefix": "70 Egress gateway", + "NameConfigFile": "EgressIPVXLANPort", + "NameEnvVar": "FELIX_EgressIPVXLANPort", + "NameYAML": "egressIPVXLANPort", + "NameGoAPI": "EgressIPVXLANPort", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "4790", + "ParsedDefault": "4790", + "ParsedDefaultJSON": "4790", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "4790", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The port number of vxlan tunnel device for egress traffic.", + "DescriptionHTML": "

The port number of vxlan tunnel device for egress traffic.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Egress gateway", + "GroupWithSortPrefix": "70 Egress gateway", + "NameConfigFile": "EgressIPVXLANVNI", + "NameEnvVar": "FELIX_EgressIPVXLANVNI", + "NameYAML": "egressIPVXLANVNI", + "NameGoAPI": "EgressIPVXLANVNI", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "4097", + "ParsedDefault": "4097", + "ParsedDefaultJSON": "4097", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "4097", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The VNI ID of vxlan tunnel device for egress traffic.", + "DescriptionHTML": "

The VNI ID of vxlan tunnel device for egress traffic.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + } + ] + }, + { + "Name": "External network support", + "Fields": [ + { + "Group": "External network support", + "GroupWithSortPrefix": "70 External network support", + "NameConfigFile": "ExternalNetworkRoutingRulePriority", + "NameEnvVar": "FELIX_ExternalNetworkRoutingRulePriority", + "NameYAML": "externalNetworkRoutingRulePriority", + "NameGoAPI": "ExternalNetworkRoutingRulePriority", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "102", + "ParsedDefault": "102", + "ParsedDefaultJSON": "102", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "102", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls the priority value to use for the external network routing rule.", + "DescriptionHTML": "

Controls the priority value to use for the external network routing rule.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "External network support", + "GroupWithSortPrefix": "70 External network support", + "NameConfigFile": "ExternalNetworkSupport", + "NameEnvVar": "FELIX_ExternalNetworkSupport", + "NameYAML": "externalNetworkSupport", + "NameGoAPI": "ExternalNetworkSupport", + "StringSchema": "One of: `Disabled`, `Enabled` (case insensitive)", + "StringSchemaHTML": "One of: Disabled, Enabled (case insensitive)", + "StringDefault": "Disabled", + "ParsedDefault": "Disabled", + "ParsedDefaultJSON": "\"Disabled\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `Disabled`, `Enabled`.", + "YAMLEnumValues": ["Disabled", "Enabled"], + "YAMLSchemaHTML": "One of: Disabled, Enabled.", + "YAMLDefault": "Disabled", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Defines two different support modes for external network function. - Disabled: External network function is disabled. - Enabled: External network function is enabled.", + "DescriptionHTML": "

Defines two different support modes for external network function. - Disabled: External network function is disabled. - Enabled: External network function is enabled.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + } + ] + }, + { + "Name": "Packet capture", + "Fields": [ + { + "Group": "Packet capture", + "GroupWithSortPrefix": "80 Packet capture", + "NameConfigFile": "CaptureDir", + "NameEnvVar": "FELIX_CaptureDir", + "NameYAML": "captureDir", + "NameGoAPI": "CaptureDir", + "StringSchema": "String", + "StringSchemaHTML": "String", + "StringDefault": "/var/log/calico/pcap", + "ParsedDefault": "/var/log/calico/pcap", + "ParsedDefaultJSON": "\"/var/log/calico/pcap\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "/var/log/calico/pcap", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls directory to store file capture.", + "DescriptionHTML": "

Controls directory to store file capture.

", + "UserEditable": true, + "GoType": "*string", + "OpenSourceOnly": false + }, + { + "Group": "Packet capture", + "GroupWithSortPrefix": "80 Packet capture", + "NameConfigFile": "CaptureMaxFiles", + "NameEnvVar": "FELIX_CaptureMaxFiles", + "NameYAML": "captureMaxFiles", + "NameGoAPI": "CaptureMaxFiles", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "2", + "ParsedDefault": "2", + "ParsedDefaultJSON": "2", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "2", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls number of rotated capture file to keep.", + "DescriptionHTML": "

Controls number of rotated capture file to keep.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Packet capture", + "GroupWithSortPrefix": "80 Packet capture", + "NameConfigFile": "CaptureMaxSizeBytes", + "NameEnvVar": "FELIX_CaptureMaxSizeBytes", + "NameYAML": "captureMaxSizeBytes", + "NameGoAPI": "CaptureMaxSizeBytes", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "10000000", + "ParsedDefault": "10000000", + "ParsedDefaultJSON": "10000000", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "10000000", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls the max size of a file capture.", + "DescriptionHTML": "

Controls the max size of a file capture.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Packet capture", + "GroupWithSortPrefix": "80 Packet capture", + "NameConfigFile": "CaptureRotationSeconds", + "NameEnvVar": "FELIX_CaptureRotationSeconds", + "NameYAML": "captureRotationSeconds", + "NameGoAPI": "CaptureRotationSeconds", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "3600", + "ParsedDefault": "3600", + "ParsedDefaultJSON": "3600", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "3600", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Controls the time rotation of a packet capture.", + "DescriptionHTML": "

Controls the time rotation of a packet capture.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + } + ] + }, + { + "Name": "L7 proxy", + "Fields": [ + { + "Group": "L7 proxy", + "GroupWithSortPrefix": "90 L7 proxy", + "NameConfigFile": "TPROXYMode", + "NameEnvVar": "FELIX_TPROXYMode", + "NameYAML": "tproxyMode", + "NameGoAPI": "TPROXYMode", + "StringSchema": "One of: `Disabled`, `EnabledAllServices`, `Enabled` (case insensitive)", + "StringSchemaHTML": "One of: Disabled, EnabledAllServices, Enabled (case insensitive)", + "StringDefault": "Disabled", + "ParsedDefault": "Disabled", + "ParsedDefaultJSON": "\"Disabled\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "One of: `Disabled`, `Enabled`, `EnabledAllServices`.", + "YAMLEnumValues": ["Disabled", "Enabled", "EnabledAllServices"], + "YAMLSchemaHTML": "One of: Disabled, Enabled, EnabledAllServices.", + "YAMLDefault": "Disabled", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Sets whether traffic is directed through a transparent proxy for further processing or not and how is the proxying done.", + "DescriptionHTML": "

Sets whether traffic is directed through a transparent proxy for further processing or not and how is the proxying done.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "L7 proxy", + "GroupWithSortPrefix": "90 L7 proxy", + "NameConfigFile": "TPROXYPort", + "NameEnvVar": "FELIX_TPROXYPort", + "NameYAML": "tproxyPort", + "NameGoAPI": "TPROXYPort", + "StringSchema": "Integer", + "StringSchemaHTML": "Integer", + "StringDefault": "16001", + "ParsedDefault": "16001", + "ParsedDefaultJSON": "16001", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer", + "YAMLDefault": "16001", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Sets to which port proxied traffic should be redirected.", + "DescriptionHTML": "

Sets to which port proxied traffic should be redirected.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "L7 proxy", + "GroupWithSortPrefix": "90 L7 proxy", + "NameConfigFile": "TPROXYUpstreamConnMark", + "NameEnvVar": "FELIX_TPROXYUpstreamConnMark", + "NameYAML": "tproxyUpstreamConnMark", + "NameGoAPI": "TPROXYUpstreamConnMark", + "StringSchema": "32-bit bitmask (hex or deccimal allowed) with at least 2 bits set, example: `0xffff0000`", + "StringSchemaHTML": "32-bit bitmask (hex or deccimal allowed) with at least 2 bits set, example: 0xffff0000", + "StringDefault": "0x17", + "ParsedDefault": "23", + "ParsedDefaultJSON": "23", + "ParsedType": "uint32", + "YAMLType": "integer", + "YAMLSchema": "Unsigned 32-bit integer.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Unsigned 32-bit integer.", + "YAMLDefault": "0x17", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Tells Felix which mark is used by the proxy for its upstream connections so that Felix can program the dataplane correctly.", + "DescriptionHTML": "

Tells Felix which mark is used by the proxy for its upstream connections so that Felix can program the dataplane correctly.

", + "UserEditable": true, + "GoType": "*uint32", + "OpenSourceOnly": false + } + ] + }, + { + "Name": "Debug/test-only (generally unsupported)", + "Fields": [ + { + "Group": "Debug/test-only (generally unsupported)", + "GroupWithSortPrefix": "97 Debug/test-only (generally unsupported)", + "NameConfigFile": "DebugBPFCgroupV2", + "NameEnvVar": "FELIX_DebugBPFCgroupV2", + "NameYAML": "", + "NameGoAPI": "", + "StringSchema": "String", + "StringSchemaHTML": "String", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "\"\"", + "ParsedType": "string", + "YAMLType": "", + "YAMLSchema": "", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "LocalOnly", + "Description": "Controls the cgroup v2 path that we apply the connect-time load balancer to. Most distros\nare configured for cgroup v1, which prevents all but the root cgroup v2 from working so this is only useful\nfor development right now.", + "DescriptionHTML": "

Controls the cgroup v2 path that we apply the connect-time load balancer to. Most distros\nare configured for cgroup v1, which prevents all but the root cgroup v2 from working so this is only useful\nfor development right now.

", + "UserEditable": true, + "GoType": "", + "OpenSourceOnly": false + }, + { + "Group": "Debug/test-only (generally unsupported)", + "GroupWithSortPrefix": "97 Debug/test-only (generally unsupported)", + "NameConfigFile": "DebugBPFMapRepinEnabled", + "NameEnvVar": "FELIX_DebugBPFMapRepinEnabled", + "NameYAML": "", + "NameGoAPI": "", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "false", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "", + "YAMLSchema": "", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "LocalOnly", + "Description": "Can be used to prevent Felix from repinning its BPF maps at startup. This is useful for\ntesting with multiple Felix instances running on one host.", + "DescriptionHTML": "

Can be used to prevent Felix from repinning its BPF maps at startup. This is useful for\ntesting with multiple Felix instances running on one host.

", + "UserEditable": true, + "GoType": "", + "OpenSourceOnly": false + }, + { + "Group": "Debug/test-only (generally unsupported)", + "GroupWithSortPrefix": "97 Debug/test-only (generally unsupported)", + "NameConfigFile": "DebugCPUProfilePath", + "NameEnvVar": "FELIX_DebugCPUProfilePath", + "NameYAML": "", + "NameGoAPI": "", + "StringSchema": "Path to file", + "StringSchemaHTML": "Path to file", + "StringDefault": "/tmp/felix-cpu-.pprof", + "ParsedDefault": "/tmp/felix-cpu-.pprof", + "ParsedDefaultJSON": "\"/tmp/felix-cpu-\\u003ctimestamp\\u003e.pprof\"", + "ParsedType": "string", + "YAMLType": "", + "YAMLSchema": "", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Unsupported diagnostic setting, used when testing Felix. Not exposed in `FelixConfiguration`.", + "DescriptionHTML": "

Unsupported diagnostic setting, used when testing Felix. Not exposed in FelixConfiguration.

", + "UserEditable": true, + "GoType": "", + "OpenSourceOnly": false + }, + { + "Group": "Debug/test-only (generally unsupported)", + "GroupWithSortPrefix": "97 Debug/test-only (generally unsupported)", + "NameConfigFile": "DebugCloudWatchLogsFile", + "NameEnvVar": "FELIX_DebugCloudWatchLogsFile", + "NameYAML": "", + "NameGoAPI": "", + "StringSchema": "Path to file", + "StringSchemaHTML": "Path to file", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "\"\"", + "ParsedType": "string", + "YAMLType": "", + "YAMLSchema": "", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Unsupported diagnostic setting, used when testing Felix. Not exposed in `FelixConfiguration`.", + "DescriptionHTML": "

Unsupported diagnostic setting, used when testing Felix. Not exposed in FelixConfiguration.

", + "UserEditable": true, + "GoType": "", + "OpenSourceOnly": false + }, + { + "Group": "Debug/test-only (generally unsupported)", + "GroupWithSortPrefix": "97 Debug/test-only (generally unsupported)", + "NameConfigFile": "DebugConsoleEnabled", + "NameEnvVar": "FELIX_DebugConsoleEnabled", + "NameYAML": "", + "NameGoAPI": "", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "false", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "", + "YAMLSchema": "", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Unsupported diagnostic setting, used when testing Felix. Not exposed in `FelixConfiguration`.", + "DescriptionHTML": "

Unsupported diagnostic setting, used when testing Felix. Not exposed in FelixConfiguration.

", + "UserEditable": true, + "GoType": "", + "OpenSourceOnly": false + }, + { + "Group": "Debug/test-only (generally unsupported)", + "GroupWithSortPrefix": "97 Debug/test-only (generally unsupported)", + "NameConfigFile": "DebugDNSDoNotWriteIPSets", + "NameEnvVar": "FELIX_DebugDNSDoNotWriteIPSets", + "NameYAML": "", + "NameGoAPI": "", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "false", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "", + "YAMLSchema": "", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Unsupported diagnostic setting, used when testing Felix. Not exposed in `FelixConfiguration`.", + "DescriptionHTML": "

Unsupported diagnostic setting, used when testing Felix. Not exposed in FelixConfiguration.

", + "UserEditable": true, + "GoType": "", + "OpenSourceOnly": false + }, + { + "Group": "Debug/test-only (generally unsupported)", + "GroupWithSortPrefix": "97 Debug/test-only (generally unsupported)", + "NameConfigFile": "DebugDNSResponseDelay", + "NameEnvVar": "FELIX_DebugDNSResponseDelay", + "NameYAML": "", + "NameGoAPI": "", + "StringSchema": "Milliseconds (floating point)", + "StringSchemaHTML": "Milliseconds (floating point)", + "StringDefault": "0", + "ParsedDefault": "0s", + "ParsedDefaultJSON": "0", + "ParsedType": "time.Duration", + "YAMLType": "", + "YAMLSchema": "", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Unsupported diagnostic setting, used when testing Felix. Not exposed in `FelixConfiguration`.", + "DescriptionHTML": "

Unsupported diagnostic setting, used when testing Felix. Not exposed in FelixConfiguration.

", + "UserEditable": true, + "GoType": "", + "OpenSourceOnly": false + }, + { + "Group": "Debug/test-only (generally unsupported)", + "GroupWithSortPrefix": "97 Debug/test-only (generally unsupported)", + "NameConfigFile": "DebugDisableLogDropping", + "NameEnvVar": "FELIX_DebugDisableLogDropping", + "NameYAML": "debugDisableLogDropping", + "NameGoAPI": "DebugDisableLogDropping", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "false", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "false", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Disables the dropping of log messages when the log buffer is full. This can significantly impact performance if log write-out is a bottleneck.", + "DescriptionHTML": "

Disables the dropping of log messages when the log buffer is full. This can significantly impact performance if log write-out is a bottleneck.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": false + }, + { + "Group": "Debug/test-only (generally unsupported)", + "GroupWithSortPrefix": "97 Debug/test-only (generally unsupported)", + "NameConfigFile": "DebugHost", + "NameEnvVar": "FELIX_DebugHost", + "NameYAML": "debugHost", + "NameGoAPI": "DebugHost", + "StringSchema": "String matching regex `^[a-zA-Z0-9:._+-]{1,64}$`", + "StringSchemaHTML": "String matching regex ^[a-zA-Z0-9:._+-]{1,64}$", + "StringDefault": "localhost", + "ParsedDefault": "localhost", + "ParsedDefaultJSON": "\"localhost\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "localhost", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The host IP or hostname to bind the debug port to. Only used if DebugPort is set.", + "DescriptionHTML": "

The host IP or hostname to bind the debug port to. Only used if DebugPort is set.

", + "UserEditable": true, + "GoType": "*string", + "OpenSourceOnly": false + }, + { + "Group": "Debug/test-only (generally unsupported)", + "GroupWithSortPrefix": "97 Debug/test-only (generally unsupported)", + "NameConfigFile": "DebugMemoryProfilePath", + "NameEnvVar": "FELIX_DebugMemoryProfilePath", + "NameYAML": "debugMemoryProfilePath", + "NameGoAPI": "DebugMemoryProfilePath", + "StringSchema": "Path to file", + "StringSchemaHTML": "Path to file", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "\"\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "The path to write the memory profile to when triggered by signal.", + "DescriptionHTML": "

The path to write the memory profile to when triggered by signal.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + }, + { + "Group": "Debug/test-only (generally unsupported)", + "GroupWithSortPrefix": "97 Debug/test-only (generally unsupported)", + "NameConfigFile": "DebugPanicAfter", + "NameEnvVar": "FELIX_DebugPanicAfter", + "NameYAML": "", + "NameGoAPI": "", + "StringSchema": "Seconds (floating point)", + "StringSchemaHTML": "Seconds (floating point)", + "StringDefault": "0", + "ParsedDefault": "0s", + "ParsedDefaultJSON": "0", + "ParsedType": "time.Duration", + "YAMLType": "", + "YAMLSchema": "", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Unsupported diagnostic setting, used when testing Felix. Not exposed in `FelixConfiguration`.", + "DescriptionHTML": "

Unsupported diagnostic setting, used when testing Felix. Not exposed in FelixConfiguration.

", + "UserEditable": true, + "GoType": "", + "OpenSourceOnly": false + }, + { + "Group": "Debug/test-only (generally unsupported)", + "GroupWithSortPrefix": "97 Debug/test-only (generally unsupported)", + "NameConfigFile": "DebugPort", + "NameEnvVar": "FELIX_DebugPort", + "NameYAML": "debugPort", + "NameGoAPI": "DebugPort", + "StringSchema": "Integer: [0,65535]", + "StringSchemaHTML": "Integer: [0,65535]", + "StringDefault": "", + "ParsedDefault": "0", + "ParsedDefaultJSON": "0", + "ParsedType": "int", + "YAMLType": "integer", + "YAMLSchema": "Integer: [0,65535]", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Integer: [0,65535]", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "If set, enables Felix's debug HTTP port, which allows memory and CPU profiles to be retrieved. The debug port is not secure, it should not be exposed to the internet.", + "DescriptionHTML": "

If set, enables Felix's debug HTTP port, which allows memory and CPU profiles to be retrieved. The debug port is not secure, it should not be exposed to the internet.

", + "UserEditable": true, + "GoType": "*int", + "OpenSourceOnly": false + }, + { + "Group": "Debug/test-only (generally unsupported)", + "GroupWithSortPrefix": "97 Debug/test-only (generally unsupported)", + "NameConfigFile": "DebugSimulateCalcGraphHangAfter", + "NameEnvVar": "FELIX_DebugSimulateCalcGraphHangAfter", + "NameYAML": "debugSimulateCalcGraphHangAfter", + "NameGoAPI": "DebugSimulateCalcGraphHangAfter", + "StringSchema": "Seconds (floating point)", + "StringSchemaHTML": "Seconds (floating point)", + "StringDefault": "0", + "ParsedDefault": "0s", + "ParsedDefaultJSON": "0", + "ParsedType": "time.Duration", + "YAMLType": "string", + "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", + "YAMLDefault": "0s", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Used to simulate a hang in the calculation graph after the specified duration. This is useful in tests of the watchdog system only!", + "DescriptionHTML": "

Used to simulate a hang in the calculation graph after the specified duration. This is useful in tests of the watchdog system only!

", + "UserEditable": true, + "GoType": "*v1.Duration", + "OpenSourceOnly": false + }, + { + "Group": "Debug/test-only (generally unsupported)", + "GroupWithSortPrefix": "97 Debug/test-only (generally unsupported)", + "NameConfigFile": "DebugSimulateDataRace", + "NameEnvVar": "FELIX_DebugSimulateDataRace", + "NameYAML": "", + "NameGoAPI": "", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "false", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "", + "YAMLSchema": "", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Unsupported diagnostic setting, used when testing Felix. Not exposed in `FelixConfiguration`.", + "DescriptionHTML": "

Unsupported diagnostic setting, used when testing Felix. Not exposed in FelixConfiguration.

", + "UserEditable": true, + "GoType": "", + "OpenSourceOnly": false + }, + { + "Group": "Debug/test-only (generally unsupported)", + "GroupWithSortPrefix": "97 Debug/test-only (generally unsupported)", + "NameConfigFile": "DebugSimulateDataplaneApplyDelay", + "NameEnvVar": "FELIX_DebugSimulateDataplaneApplyDelay", + "NameYAML": "debugSimulateDataplaneApplyDelay", + "NameGoAPI": "DebugSimulateDataplaneApplyDelay", + "StringSchema": "Seconds (floating point)", + "StringSchemaHTML": "Seconds (floating point)", + "StringDefault": "0", + "ParsedDefault": "0s", + "ParsedDefaultJSON": "0", + "ParsedType": "time.Duration", + "YAMLType": "string", + "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", + "YAMLDefault": "0s", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Adds an artificial delay to every dataplane operation. This is useful for simulating a heavily loaded system for test purposes only.", + "DescriptionHTML": "

Adds an artificial delay to every dataplane operation. This is useful for simulating a heavily loaded system for test purposes only.

", + "UserEditable": true, + "GoType": "*v1.Duration", + "OpenSourceOnly": false + }, + { + "Group": "Debug/test-only (generally unsupported)", + "GroupWithSortPrefix": "97 Debug/test-only (generally unsupported)", + "NameConfigFile": "DebugSimulateDataplaneHangAfter", + "NameEnvVar": "FELIX_DebugSimulateDataplaneHangAfter", + "NameYAML": "debugSimulateDataplaneHangAfter", + "NameGoAPI": "DebugSimulateDataplaneHangAfter", + "StringSchema": "Seconds (floating point)", + "StringSchemaHTML": "Seconds (floating point)", + "StringDefault": "0", + "ParsedDefault": "0s", + "ParsedDefaultJSON": "0", + "ParsedType": "time.Duration", + "YAMLType": "string", + "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", + "YAMLDefault": "0s", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Used to simulate a hang in the dataplane after the specified duration. This is useful in tests of the watchdog system only!", + "DescriptionHTML": "

Used to simulate a hang in the dataplane after the specified duration. This is useful in tests of the watchdog system only!

", + "UserEditable": true, + "GoType": "*v1.Duration", + "OpenSourceOnly": false + }, + { + "Group": "Debug/test-only (generally unsupported)", + "GroupWithSortPrefix": "97 Debug/test-only (generally unsupported)", + "NameConfigFile": "DebugUseShortPollIntervals", + "NameEnvVar": "FELIX_DebugUseShortPollIntervals", + "NameYAML": "", + "NameGoAPI": "", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "false", + "ParsedDefault": "false", + "ParsedDefaultJSON": "false", + "ParsedType": "bool", + "YAMLType": "", + "YAMLSchema": "", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Unsupported diagnostic setting, used when testing Felix. Not exposed in `FelixConfiguration`.", + "DescriptionHTML": "

Unsupported diagnostic setting, used when testing Felix. Not exposed in FelixConfiguration.

", + "UserEditable": true, + "GoType": "", + "OpenSourceOnly": false + }, + { + "Group": "Debug/test-only (generally unsupported)", + "GroupWithSortPrefix": "97 Debug/test-only (generally unsupported)", + "NameConfigFile": "DebugWindowsPktMonStartArgs", + "NameEnvVar": "FELIX_DebugWindowsPktMonStartArgs", + "NameYAML": "", + "NameGoAPI": "", + "StringSchema": "String", + "StringSchemaHTML": "String", + "StringDefault": "", + "ParsedDefault": "", + "ParsedDefaultJSON": "\"\"", + "ParsedType": "string", + "YAMLType": "", + "YAMLSchema": "", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "", + "YAMLDefault": "", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Unsupported diagnostic setting, used when testing Felix. Not exposed in `FelixConfiguration`.", + "DescriptionHTML": "

Unsupported diagnostic setting, used when testing Felix. Not exposed in FelixConfiguration.

", + "UserEditable": true, + "GoType": "", + "OpenSourceOnly": false + }, + { + "Group": "Debug/test-only (generally unsupported)", + "GroupWithSortPrefix": "97 Debug/test-only (generally unsupported)", + "NameConfigFile": "StatsDumpFilePath", + "NameEnvVar": "FELIX_StatsDumpFilePath", + "NameYAML": "statsDumpFilePath", + "NameGoAPI": "StatsDumpFilePath", + "StringSchema": "Path to file", + "StringSchemaHTML": "Path to file", + "StringDefault": "/var/log/calico/stats/dump", + "ParsedDefault": "/var/log/calico/stats/dump", + "ParsedDefaultJSON": "\"/var/log/calico/stats/dump\"", + "ParsedType": "string", + "YAMLType": "string", + "YAMLSchema": "String.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "String.", + "YAMLDefault": "/var/log/calico/stats/dump", + "Required": false, + "OnParseFailure": "Exit", + "AllowedConfigSources": "All", + "Description": "The path to write a diagnostic flow logs statistics dump to when triggered by signal.", + "DescriptionHTML": "

The path to write a diagnostic flow logs statistics dump to when triggered by signal.

", + "UserEditable": true, + "GoType": "string", + "OpenSourceOnly": false + } + ] + }, + { + "Name": "Usage reporting", + "Fields": [ + { + "Group": "Usage reporting", + "GroupWithSortPrefix": "99 Usage reporting", + "NameConfigFile": "UsageReportingEnabled", + "NameEnvVar": "FELIX_UsageReportingEnabled", + "NameYAML": "usageReportingEnabled", + "NameGoAPI": "UsageReportingEnabled", + "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", + "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", + "StringDefault": "true", + "ParsedDefault": "true", + "ParsedDefaultJSON": "true", + "ParsedType": "bool", + "YAMLType": "boolean", + "YAMLSchema": "Boolean.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Boolean.", + "YAMLDefault": "true", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Unused in Calico Enterprise, usage reporting is permanently disabled.", + "DescriptionHTML": "

Unused in Calico Enterprise, usage reporting is permanently disabled.

", + "UserEditable": true, + "GoType": "*bool", + "OpenSourceOnly": true + }, + { + "Group": "Usage reporting", + "GroupWithSortPrefix": "99 Usage reporting", + "NameConfigFile": "UsageReportingInitialDelaySecs", + "NameEnvVar": "FELIX_UsageReportingInitialDelaySecs", + "NameYAML": "usageReportingInitialDelay", + "NameGoAPI": "UsageReportingInitialDelay", + "StringSchema": "Seconds (floating point)", + "StringSchemaHTML": "Seconds (floating point)", + "StringDefault": "300", + "ParsedDefault": "5m0s", + "ParsedDefaultJSON": "300000000000", + "ParsedType": "time.Duration", + "YAMLType": "string", + "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", + "YAMLDefault": "5m0s", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Unused in Calico Enterprise, usage reporting is permanently disabled.", + "DescriptionHTML": "

Unused in Calico Enterprise, usage reporting is permanently disabled.

", + "UserEditable": true, + "GoType": "*v1.Duration", + "OpenSourceOnly": true + }, + { + "Group": "Usage reporting", + "GroupWithSortPrefix": "99 Usage reporting", + "NameConfigFile": "UsageReportingIntervalSecs", + "NameEnvVar": "FELIX_UsageReportingIntervalSecs", + "NameYAML": "usageReportingInterval", + "NameGoAPI": "UsageReportingInterval", + "StringSchema": "Seconds (floating point)", + "StringSchemaHTML": "Seconds (floating point)", + "StringDefault": "86400", + "ParsedDefault": "24h0m0s", + "ParsedDefaultJSON": "86400000000000", + "ParsedType": "time.Duration", + "YAMLType": "string", + "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", + "YAMLEnumValues": null, + "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", + "YAMLDefault": "24h0m0s", + "Required": false, + "OnParseFailure": "ReplaceWithDefault", + "AllowedConfigSources": "All", + "Description": "Unused in Calico Enterprise, usage reporting is permanently disabled.", + "DescriptionHTML": "

Unused in Calico Enterprise, usage reporting is permanently disabled.

", + "UserEditable": true, + "GoType": "*v1.Duration", + "OpenSourceOnly": true + } + ] + } + ] +} diff --git a/calico-enterprise/_includes/components/FelixConfig/index.js b/calico-enterprise/_includes/components/FelixConfig/index.js new file mode 100644 index 0000000000..1d0612c2e9 --- /dev/null +++ b/calico-enterprise/_includes/components/FelixConfig/index.js @@ -0,0 +1,100 @@ +import React, { useState, useEffect } from 'react'; +import jsonData from './file.json'; +import Tabs from '@theme/Tabs'; +import TabItem from '@theme/TabItem'; +import TableResource from './TableResource'; +import TableConfig from './TableConfig'; +import TableEnv from './TableEnv'; +import styles from './styles.module.css'; + +const FelixConfigTable = ({ configType, fieldData }) => { + let table; + + switch (configType) { + case 'yaml': + table = ; + break; + case 'config': + table = ; + break; + case 'env': + table = ; + break; + default: + table =

Unknown config type

; + } + + return
{table}
; +}; + +const FelixConfig = ({ configType, name }) => { + const matchedGroup = jsonData.Groups.find((group) => group.Name === name); + // Debugging logs + + if (!matchedGroup) { + return

No matching group found for '{name}'.

; + } + + let content; + + if (configType === 'yaml') { + content = ( +
+ {matchedGroup.Fields.map((field, index) => + field.NameYAML ? ( +
+
+ {field.NameYAML} +
+ +
+ ) : null + )} +
+ ); + } else if (configType === 'configenv') { + content = ( +
+ {matchedGroup.Fields.map((field, index) => ( +
+
+ {field.NameConfigFile} +
+ + + + + + + + +
+ ))} +
+ ); + } else { + content = ( +
+

You got it wrong

+
+ ); + } + return
{content}
; +}; + +export default FelixConfig; diff --git a/calico-enterprise/_includes/components/FelixConfig/styles.module.css b/calico-enterprise/_includes/components/FelixConfig/styles.module.css new file mode 100644 index 0000000000..d831a8ed05 --- /dev/null +++ b/calico-enterprise/_includes/components/FelixConfig/styles.module.css @@ -0,0 +1,12 @@ +.felixTable { + width: 100%; + display: table; +} + +.felixTable td p:last-child { + margin-bottom: 0; +} + +.tabsContainer { + margin-bottom: 60px; +} diff --git a/calico-enterprise/reference/component-resources/node/felix/configuration.mdx b/calico-enterprise/reference/component-resources/node/felix/configuration.mdx index 85b6c7022f..72b8cce4ad 100644 --- a/calico-enterprise/reference/component-resources/node/felix/configuration.mdx +++ b/calico-enterprise/reference/component-resources/node/felix/configuration.mdx @@ -4,16 +4,7 @@ description: Configure Felix, the daemon that runs on every machine that provide # Configuring Felix -import Tabs from '@theme/Tabs'; -import TabItem from '@theme/TabItem'; - - - - -If you have installed Calico using the operator, you cannot modify the environment provided to felix directly. To configure felix, see the [FelixConfiguration](../../../resources/felixconfig.mdx) resource instead. - - - +import FelixConfig from '../../../../_includes/components/FelixConfig'; :::note @@ -39,359 +30,210 @@ defaults, and it should be rare to have to explicitly set them. The full list of parameters which can be set is as follows. -### General configuration - -| Configuration file parameter | Environment variable | Description | Schema | -| ----------------------------------- | ---------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------- | --- | --- | ------------ | ---- | ---- | ---------- | ----- | -| `DataplaneWatchdogTimeout` | `FELIX_DATAPLANEWATCHDOGTIMEOUT` | Deprecated: superseded by `HealthTimeoutOverrides`. Timeout before the main dataplane goroutine is determined to have hung and Felix will report non-live and non-ready. Can be increased if the liveness check incorrectly fails (for example if Felix is running slowly on a heavily loaded system). [Default: `90`] | int | -| `AwsSrcDstCheck` | `FELIX_AWSSRCDSTCHECK` | Set the [source-destination-check](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_NAT_Instance.html#EIP_Disable_SrcDestCheck) when using AWS EC2 instances. Check [IAM role and profile configuration](../../../resources/felixconfig.mdx#aws-iam-rolepolicy-for-source-destination-check-configuration) for setting the necessary permission for this setting to work. [Default: `DoNothing`] | `DoNothing`, `Disable`, `Enable` | -| `AWSSecondaryIPSupport` | `FELIX_AWSSECONDARYIPSUPPORT` | Controls whether Felix will create secondary AWS ENIs for AWS-backed IP pools. This feature is documented in the [egress gateways on AWS guide](../../../../networking/egress/egress-gateway-aws.mdx). Should only be enabled on AWS. [Default: "Disabled"] | `Enabled`, `EnabledENIPerWorkload`, `Disabled` | -| `AWSSecondaryIPRoutingRulePriority` | `FELIX_AWSSECONDARYIPROUTINGRULEPRIORITY` | Controls the priority of the policy-based routing rules used to implement AWS-backed IP addresses. Should only be changed to avoid conflicts if your nodes have additional policy based routing rules. [Default: 101] | int | -| `AWSRequestTimeout` | `FELIX_AWSREQUESTTIMEOUT` Timeout used for communicating with the AWS API (seconds). [Default: "30"] | int | -| `DatastoreType` | `FELIX_DATASTORETYPE` | The datastore that Felix should read endpoints and policy information from. [Default: `etcdv3`] | `etcdv3`, `kubernetes` | -| `DeviceRouteSourceAddress` | `FELIX_DEVICEROUTESOURCEADDRESS` | IPv4 address to use as the source hint on device routes programmed by Felix [Default: No source hint is set on programmed routes and for local traffic from host to workload the source address will be chosen by the kernel.] | `` | -| `DeviceRouteSourceAddressIPv6` | `FELIX_DEVICEROUTESOURCEADDRESSIPV6` | IPv6 address to use as the source hint on device routes programmed by Felix [Default: No source hint is set on programmed routes and for local traffic from host to workload the source address will be chosen by the kernel.] | `` | -| `DeviceRouteProtocol` | `FELIX_DEVICEROUTEPROTOCOL` | This defines the route protocol added to programmed device routes. [Default: `RTPROT_BOOT`] | int | -| `DisableConntrackInvalidCheck` | `FELIX_DISABLECONNTRACKINVALIDCHECK` | Disable the dropping of packets that aren't either a valid handshake or part of an established connection. [Default: `false`] | boolean | -| `EndpointReportingDelaySecs` | `FELIX_ENDPOINTREPORTINGDELAYSECS` | Set the endpoint reporting delay between status check intervals, in seconds. Only used if endpoint reporting is enabled. [Default: `1`] | int | -| `EndpointReportingEnabled` | `FELIX_ENDPOINTREPORTINGENABLED` | Enable the endpoint status reporter. [Default: `false`] | boolean | -| `EndpointStatusPathPrefix` | `FELIX_ENDPOINTSTATUSPATHPREFIX` | Path to the directory where Felix should create the `endpoint-status` directory. Choosing a mounted volume such as `/var/run/calico` is recommended as the directory can then be monitored by host processes such as the Calico CNI. Leaving this field empty disables endpoint-status files. [Default: ""] | string | -| `ExternalNodesCIDRList` | `FELIX_EXTERNALNODESCIDRLIST` | Comma-delimited list of IPv4 or CIDR of external-non-calico-nodes from which IPIP traffic is accepted by calico-nodes. [Default: ""] | string | -| `FailsafeInboundHostPorts` | `FELIX_FAILSAFEINBOUNDHOSTPORTS` | Comma-delimited list of UDP/TCP/SCTP ports and CIDRs that Felix will allow incoming traffic to host endpoints on irrespective of the security policy. This is useful to avoid accidentally cutting off a host with incorrect configuration. For backwards compatibility, if the protocol is not specified, it defaults to "tcp". If a CIDR is not specified, it will allow traffic from all addresses. To disable all inbound host ports, use the value `none`. The default value allows ssh access, DHCP, BGP, etcd and the Kubernetes API. [Default: `tcp:22, udp:68, tcp:179, tcp:2379, tcp:2380, tcp:5473, tcp:6443, tcp:6666, tcp:6667`] | string | -| `FailsafeOutboundHostPorts` | `FELIX_FAILSAFEOUTBOUNDHOSTPORTS` | Comma-delimited list of UDP/TCP/SCTP ports and CIDRs that Felix will allow outgoing traffic from host endpoints to irrespective of the security policy. This is useful to avoid accidentally cutting off a host with incorrect configuration. For backwards compatibility, if the protocol is not specified, it defaults to "tcp". If a CIDR is not specified, it will allow traffic from all addresses. To disable all outbound host ports, use the value `none`. The default value opens etcd's standard ports to ensure that Felix does not get cut off from etcd as well as allowing DHCP, DNS, BGP and the Kubernetes API. [Default: `udp:53, udp:67, tcp:179, tcp:2379, tcp:2380, tcp:5473, tcp:6443, tcp:6666, tcp:6667`] | string | -| `FelixHostname` | `FELIX_FELIXHOSTNAME` | The hostname Felix reports to the plugin. Should be used if the hostname Felix autodetects is incorrect or does not match what the plugin will expect. [Default: `socket.gethostname()`] | string | -| `HealthEnabled` | `FELIX_HEALTHENABLED` | When enabled, exposes felix health information via an http endpoint. | boolean | -| `HealthHost` | `FELIX_HEALTHHOST` | The address on which Felix will respond to health requests. [Default: `localhost`] | string | -| `HealthPort` | `FELIX_HEALTHPORT` | The port on which Felix will respond to health requests. [Default: `9099`] | int | -| `HealthTimeoutOverrides` | `FELIX_HEALTHTIMEOUTOVERRIDES` | Allows the internal watchdog timeouts of individual subcomponents to be overridden; example: "InternalDataplaneMainLoop=30s,CalculationGraph=2m". This is useful for working around "false positive" liveness timeouts that can occur in particularly stressful workloads or if CPU is constrained. For a list of active subcomponents, see Felix's logs. [Default: ``] | Comma-delimited list of key/value pairs where the values are durations: `1s`, `10s`, `5m`, etc. | -| `IpInIpEnabled` | `FELIX_IPINIPENABLED` | Optional, you shouldn't need to change this setting as Felix calculates if IPIP should be enabled based on the existing IP Pools. When set, this overrides whether Felix should configure an IPinIP interface on the host. When explicitly disabled in FelixConfiguration, Felix will not clean up addresses from the `tunl0` interface (use this if you need to add addresses to that interface and don't want to have them removed). [Default: unset] | optional boolean | -| `IpInIpMtu` | `FELIX_IPINIPMTU` | The MTU to set on the IPIP tunnel device. Zero value means auto-detect. See [Configuring MTU](../../../../networking/configuring/mtu.mdx) [Default: `0`] | int | -| `IPForwarding` | `FELIX_IPFORWARDING` | Controls whether Felix sets the host sysctls to enable IP forwarding. IP forwarding is required when using Calico for workload networking. This should be disabled only on hosts where Calico is used for host protection. | `Enabled` or `Disabled` | -| `IPv4VXLANTunnelAddr` | | IP address of the IPv4 VXLAN tunnel. This is system configured and should not be updated manually. | string | -| `LogFilePath` | `FELIX_LOGFILEPATH` | The full path to the Felix log. Set to `none` to disable file logging. [Default: `/var/log/calico/felix.log`] | string | -| `LogSeverityFile` | `FELIX_LOGSEVERITYFILE` | The log severity above which logs are sent to the log file. [Default: `Info`] | `Debug`, `Info`, `Warning`, `Error`, `Fatal` | -| `LogSeverityScreen` | `FELIX_LOGSEVERITYSCREEN` | The log severity above which logs are sent to the stdout. [Default: `Info`] | `Debug`, `Info`, `Warning`, `Error`, `Fatal` | -| `LogSeveritySys` | `FELIX_LOGSEVERITYSYS` | The log severity above which logs are sent to the syslog. Set to `none` for no logging to syslog. [Default: `Info`] | `Debug`, `Info`, `Warning`, `Error`, `Fatal` | -| `LogDebugFilenameRegex` | `FELIX_LOGDEBUGFILENAMEREGEX` | Controls which source code files have their Debug log output included in the logs. Only logs from files with names that match the given regular expression are included. The filter only applies to Debug level logs. [Default: `""`] | regex | -| `PolicySyncPathPrefix` | `FELIX_POLICYSYNCPATHPREFIX` | File system path where Felix notifies services of policy changes over Unix domain sockets. This is required only if you're configuring [L7 logs](../../../../visibility/elastic/l7/configure.mdx), or [egress gateways](../../../../networking/egress/index.mdx). Set to `""` to disable. [Default: `""`] | string | -| `PrometheusGoMetricsEnabled` | `FELIX_PROMETHEUSGOMETRICSENABLED` | Set to `false` to disable Go runtime metrics collection, which the Prometheus client does by default. This reduces the number of metrics reported, reducing Prometheus load. [Default: `true`] | boolean | -| `PrometheusMetricsEnabled` | `FELIX_PROMETHEUSMETRICSENABLED` | Set to `true` to enable the Prometheus metrics server in Felix. [Default: `false`] | boolean | -| `PrometheusMetricsHost` | `FELIX_PROMETHEUSMETRICSHOST` | TCP network address that the Prometheus metrics server should bind to. [Default: `""`] | string | -| `PrometheusMetricsPort` | `FELIX_PROMETHEUSMETRICSPORT` | TCP port that the Prometheus metrics server should bind to. [Default: `9091`] | int | -| `PrometheusProcessMetricsEnabled` | `FELIX_PROMETHEUSPROCESSMETRICSENABLED` | Set to `false` to disable process metrics collection, which the Prometheus client does by default. This reduces the number of metrics reported, reducing Prometheus load. [Default: `true`] | boolean | -| `PrometheusWireguardMetricsEnabled` | `FELIX_PROMETHEUSWIREGUARDMETRICSENABLED` | Set to `false` to disable wireguard device metrics collection, which Felix does by default. [Default: `true`] | boolean | -| `RemoveExternalRoutes` | `FELIX_REMOVEEXTERNALROUTES` | Whether or not to remove device routes that have not been programmed by Felix. Disabling this will allow external applications to also add device routes. [Default: `true`] | bool | -| `ReportingIntervalSecs` | `FELIX_REPORTINGINTERVALSECS` | Interval at which Felix reports its status into the datastore. 0 means disabled and is correct for Kubernetes-only clusters. Must be non-zero in OpenStack deployments. [Default: `30`] | int | -| `ReportingTTLSecs` | `FELIX_REPORTINGTTLSECS` | Time-to-live setting for process-wide status reports. [Default: `90`] | int | -| `RouteTableRange` | `FELIX_ROUTETABLERANGE` | _deprecated in favor of `RouteTableRanges`_ Calico programs additional Linux route tables for various purposes. `RouteTableRange` specifies the indices of the route tables that Calico should use. [Default: `""`] | `-` | -| `RouteTableRanges` | `FELIX_ROUTETABLERANGES` | Calico programs additional Linux route tables for various purposes. `RouteTableRanges` specifies a set of table index ranges that Calico should use. Deprecates `RouteTableRange`, overrides `RouteTableRange`. [Default: `"1-250"`] | `-,-,...` | -| `RouteSyncDisabled` | `FELIX_ROUTESYNCDISABLED` | Set to `true` to disable Calico programming routes to local workloads. [Default: `false`] | boolean | -| `VXLANEnabled` | `FELIX_VXLANENABLED` | Optional, you shouldn't need to change this setting as Felix calculates if VXLAN should be enabled based on the existing IP Pools. When set, this overrides whether Felix should create the VXLAN tunnel device for VXLAN networking. [Default: unset] | optional boolean | -| `VXLANMTU` | `FELIX_VXLANMTU` | The MTU to set on the IPv4 VXLAN tunnel device. Zero value means auto-detect. Also controls NodePort MTU when eBPF enabled. See [Configuring MTU](../../../../networking/configuring/mtu.mdx) [Default: `0`] | int | -| `VXLANMTUV6` | `FELIX_VXLANMTUV6` | The MTU to set on the IPv6 VXLAN tunnel device. Zero value means auto-detect. Also controls NodePort MTU when eBPF enabled. See [Configuring MTU](../../../../networking/configuring/mtu.mdx) [Default: `0`] | int | -| `VXLANPort` | `FELIX_VXLANPORT` | The UDP port to use for VXLAN. [Default: `4789`] | int | -| `VXLANTunnelMACAddr` | | MAC address of the IPv4 VXLAN tunnel. This is system configured and should not be updated manually. | string | -| `VXLANVNI` | `FELIX_VXLANVNI` | The virtual network ID to use for VXLAN. [Default: `4096`] | int | -| `AllowVXLANPacketsFromWorkloads` | `FELIX_ALLOWVXLANPACKETSFROMWORKLOADS` | Set to `true` to allow VXLAN encapsulated traffic from workloads. [Default: `false`] | boolean | -| `AllowIPIPPacketsFromWorkloads` | `FELIX_ALLOWIPIPPACKETSFROMWORKLOADS` | Set to `true` to allow IPIP encapsulated traffic from workloads. [Default: `false`] | boolean | -| `TyphaAddr` | `FELIX_TYPHAADDR` | IPv4 address at which Felix should connect to Typha. [Default: none] | string | -| `TyphaK8sServiceName` | `FELIX_TYPHAK8SSERVICENAME` | Name of the Typha Kubernetes service | string | -| `Ipv6Support` | `FELIX_IPV6SUPPORT` | Enable $[prodname] networking and security for IPv6 traffic as well as for IPv4. | boolean | -| `RouteSource` | `FELIX_ROUTESOURCE` | Where Felix gets is routing information from for VXLAN and the BPF dataplane. The CalicoIPAM setting is more efficient because it supports route aggregation, but it only works when Calico's IPAM or host-local IPAM is in use. Use the WorkloadIPs setting if you are using Calico's VXLAN or BPF dataplane and not using Calico IPAM or host-local IPAM. [Default: "CalicoIPAM"] | 'CalicoIPAM', or 'WorkloadIPs' | -| `mtuIfacePattern` | `FELIX_MTUIFACEPATTERN` | Pattern used to discover the host's interface for MTU auto-detection. [Default: `^((en | wl | ww | sl | ib)[opsvx].\* | (eth | wlan | wwan).\*)` | regex | -| `TPROXYMode` | `FELIX_TPROXYMODE` | Sets transparent proxying mode. [Default: "Disabled"] | 'Disabled', 'Enabled' | -| `TPROXYPort` | `FELIX_TPROXYPORT` | What local ports is the proxied traffic sent to. [Default: `16001`] | int | -| `FeatureDetectOverride` | `FELIX_FEATUREDETECTOVERRIDE` | Is used to override the feature detection. Values are specified in a comma separated list with no spaces, example; "SNATFullyRandom=true,MASQFullyRandom=false,RestoreSupportsLock=true,IPIPDeviceIsL3=true. "true" or "false" will force the feature, empty or omitted values are auto-detected. [Default: `""`] | string | -| `FeatureGates` | `FELIX_FEATUREGATES` | Is used to enable or disable tech-preview Calico features. Values are specified in a comma separated list with no spaces. This is used to enable features that are not fully production ready. Example; "AbC=enabled,XyZ=false" [Default: not set] | string - -#### Feature Gates - -* `BPFConnectTimeLoadBalancingWorkaround` - Use when connect-time loadbalancer (CTLB) is turned off or if you want to turn it off for UDP only. When CTLB is turned off, host networked processes cannot always reach services. This workaround makes sure that they can. When CTLB is turned on, UDP clients may get stuck sending traffic to endpoint that does not exist anymore. So CTLB needs to be turned off sometimes. - * `enabled` - when CTLB is turned off make sure that services are always accessible. - * `udp` - turns off CTLB for UDP only and makes sure that services are always accessible. Preferred setting to make sure that DNS works. - -### Go runtime configuration - -These configuration pararmeters allow configuration of the Go language runtime. -They allow the `GOGC`, `GOMEMLIMIT` and `GOMAXPROCS` tunables to be accessed -via Felix's configuration. - -| Configuration file parameter | Environment variable | Description | Schema | -| ----------------------------------- | ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------- | -| `GoGCThreshold` | `FELIX_GOGCTHRESHOLD`, `GOGC` | Sets the Go runtime's garbage collection threshold; this is the percentage that the heap is allowed to grow before GC is triggered. In general, doubling the value halves the CPU timespent doing GC, but it also doubles peak GC memory overhead. A special value of -1 can be used to disable GC entirely; this should only be used in conjunction with the `GoMemoryLimitMB` setting. This setting is overridden by the `GOGC` environment variable. | int | -| `GoMemoryLimitMB` | `FELIX_GOMEMORYLIMITMB`, `GOMEMLIMIT` | GoMemoryLimitMB sets a (soft) memory limit for the Go runtime in MB. The Go runtime will try to keep its memory usage under the limit by triggering GC as needed. To avoid thrashing, it will exceed the limit if GC starts to take more than 50% of the process's CPU time. A value of -1 disables the memory limit. Note that the memory limit, if used, must be considerably less than any hard resource limit set at the container or pod level. This is because Felix is not the only process that must run in the container or pod. This setting is overridden by the `GOMEMLIMIT` environment variable. | int | -| `GoMaxProcs` | `FELIX_GOMAXPROCS`, `GOMAXPROCS` | Sets the maximum number of CPUs that the Go runtime will use concurrently. A value of -1 means "use the system default"; typically the number of real CPUs on the system. This setting is overridden by the `GOMAXPROCS` environment variable. | int | - -### etcd datastore configuration - -| Configuration parameter | Environment variable | Description | Schema | -| ----------------------- | --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------- | -| `EtcdCaFile` | `FELIX_ETCDCAFILE` | Path to the file containing the root certificate of the certificate authority (CA) that issued the etcd server certificate. Configures Felix to trust the CA that signed the root certificate. The file may contain multiple root certificates, causing Felix to trust each of the CAs included. To disable authentication of the server by Felix, set the value to `none`. [Default: `/etc/ssl/certs/ca-certificates.crt`] | string | -| `EtcdCertFile` | `FELIX_ETCDCERTFILE` | Path to the file containing the client certificate issued to Felix. Enables Felix to participate in mutual TLS authentication and identify itself to the etcd server. Example: `/etc/felix/cert.pem` (optional) | string | -| `EtcdEndpoints` | `FELIX_ETCDENDPOINTS` | Comma-delimited list of etcd endpoints to connect to. Example: `http://127.0.0.1:2379,http://127.0.0.2:2379`. | `://:` | -| `EtcdKeyFile` | `FELIX_ETCDKEYFILE` | Path to the file containing the private key matching Felix's client certificate. Enables Felix to participate in mutual TLS authentication and identify itself to the etcd server. Example: `/etc/felix/key.pem` (optional) | string | - -### Kubernetes API datastore configuration - -The Kubernetes API datastore driver reads its configuration from Kubernetes-provided environment variables. - -### iptables dataplane configuration - -| Configuration parameter | Environment variable | Description | Schema | -| ------------------------------------ | ------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | -| `ChainInsertMode` | `FELIX_CHAININSERTMODE` | Controls whether Felix hooks the kernel's top-level iptables chains by inserting a rule at the top of the chain or by appending a rule at the bottom. `Insert` is the safe default since it prevents $[prodname]'s rules from being bypassed. If you switch to `Append` mode, be sure that the other rules in the chains signal acceptance by falling through to the $[prodname] rules, otherwise the $[prodname] policy will be bypassed. [Default: `Insert`] | `Insert`, `Append` | -| `DefaultEndpointToHostAction` | `FELIX_DEFAULTENDPOINTTOHOSTACTION` | This parameter controls what happens to traffic that goes from a workload endpoint to the host itself (after the traffic hits the endpoint egress policy). By default $[prodname] blocks traffic from workload endpoints to the host itself with an iptables `Drop` action. If you want to allow some or all traffic from endpoint to host, set this parameter to `Return` or `Accept`. Use `Return` if you have your own rules in the iptables "INPUT" chain; $[prodname] will insert its rules at the top of that chain, then `Return` packets to the "INPUT" chain once it has completed processing workload endpoint egress policy. Use `Accept` to unconditionally accept packets from workloads after processing workload endpoint egress policy. [Default: `Drop`] | `Drop`, `Return`, `Accept` | -| `GenericXDPEnabled` | `FELIX_GENERICXDPENABLED` | When enabled, Felix can fallback to the non-optimized `generic` XDP mode. This should only be used for testing since it doesn't improve performance over the non-XDP mode. [Default: `false`] | boolean | -| `InterfaceExclude` | `FELIX_INTERFACEEXCLUDE` | A comma-separated list of interface names that should be excluded when Felix is resolving host endpoints. The default value ensures that Felix ignores Kubernetes' internal `kube-ipvs0` device. If you want to exclude multiple interface names using a single value, the list supports regular expressions. For regular expressions you must wrap the value with `/`. For example having values `/^kube/,veth1` will exclude all interfaces that begin with `kube` and also the interface `veth1`. [Default: `kube-ipvs0`] | string | -| `IpsetsRefreshInterval` | `FELIX_IPSETSREFRESHINTERVAL` | Period, in seconds, at which Felix re-checks the IP sets in the dataplane to ensure that no other process has accidentally broken $[prodname]'s rules. Set to 0 to disable IP sets refresh. [Default: `10`] | int | -| `IptablesBackend` | `FELIX_IPTABLESBACKEND` | This parameter controls which variant of iptables Felix uses. Set this to `Auto` for auto detection of the backend. If a specific backend is needed then use `nft` for hosts using a netfilter backend or `Legacy` for others. [Default: `Auto`] | `Legacy`, `nft`, `Auto` | -| `IptablesFilterAllowAction` | `FELIX_IPTABLESFILTERALLOWACTION` | This parameter controls what happens to traffic that is allowed by a Felix policy chain in the iptables filter table (i.e., a normal policy chain). The default will immediately `Accept` the traffic. Use `Return` to send the traffic back up to the system chains for further processing. [Default: `Accept`] | `Accept`, `Return` | -| `IptablesLockFilePath` | `FELIX_IPTABLESLOCKFILEPATH` | _Deprecated:_ For iptables versions prior to v1.6.2, location of the iptables lock file (later versions of iptables always use value "/run/xtables.lock"). You may need to change this if the lock file is not in its standard location (for example if you have mapped it into Felix's container at a different path). [Default: `/run/xtables.lock`] | string | -| `IptablesLockProbeIntervalMillis` | `FELIX_IPTABLESLOCKPROBEINTERVALMILLIS` | Time, in milliseconds, that Felix will wait between attempts to acquire the iptables lock if it is not available. Lower values make Felix more responsive when the lock is contended, but use more CPU. [Default: `50`] | int | -| `IptablesLockTimeoutSecs` | `FELIX_IPTABLESLOCKTIMEOUTSECS` | Time, in seconds, that Felix will wait for the iptables lock. Versions of iptables prior to v1.6.2 support disabling the iptables lock by setting this value to 0; v1.6.2 and above do not so Felix will default to 10s if a non-positive number is used. To use this feature, Felix must share the iptables lock file with all other processes that also take the lock. When running Felix inside a container, this typically requires the file /run/xtables.lock on the host to be mounted into the `$[nodecontainer]` or `calico/felix` container. [Default: `0` disabled for iptables <v1.6.2 or 10s for later versions] | int | -| `IptablesMangleAllowAction` | `FELIX_IPTABLESMANGLEALLOWACTION` | This parameter controls what happens to traffic that is allowed by a Felix policy chain in the iptables mangle table (i.e., a pre-DNAT policy chain). The default will immediately `Accept` the traffic. Use `Return` to send the traffic back up to the system chains for further processing. [Default: `Accept`] | `Accept`, `Return` | -| `IptablesMarkMask` | `FELIX_IPTABLESMARKMASK` | Mask that Felix selects its IPTables Mark bits from. Should be a 32 bit hexadecimal number with at least 8 bits set, none of which clash with any other mark bits in use on the system. When using $[prodname] with Kubernetes' `kube-proxy` in IPVS mode, [we recommend allowing at least 16 bits](#ipvs-bits). [Default: `0xffff0000`] | netmask | -| `IptablesNATOutgoingInterfaceFilter` | `FELIX_IPTABLESNATOUTGOINGINTERFACEFILTER` | This parameter can be used to limit the host interfaces on which Calico will apply SNAT to traffic leaving a Calico IPAM pool with "NAT outgoing" enabled. This can be useful if you have a main data interface, where traffic should be SNATted and a secondary device (such as the docker bridge) which is local to the host and doesn't require SNAT. This parameter uses the iptables interface matching syntax, which allows `+` as a wildcard. Most users will not need to set this. Example: if your data interfaces are eth0 and eth1 and you want to exclude the docker bridge, you could set this to `eth+` | string | -| `IptablesPostWriteCheckIntervalSecs` | `FELIX_IPTABLESPOSTWRITECHECKINTERVALSECS` | Period, in seconds, after Felix has done a write to the dataplane that it schedules an extra read back to check the write was not clobbered by another process. This should only occur if another application on the system doesn't respect the iptables lock. [Default: `1`] | int | -| `IptablesRefreshInterval` | `FELIX_IPTABLESREFRESHINTERVAL` | Period, in seconds, at which Felix re-checks all iptables state to ensure that no other process has accidentally broken $[prodname]'s rules. Set to 0 to disable iptables refresh. [Default: `90`] | int | -| `LogPrefix` | `FELIX_LOGPREFIX` | The log prefix that Felix uses when rendering LOG rules. [Default: `calico-packet`] | string | -| `MaxIpsetSize` | `FELIX_MAXIPSETSIZE` | Maximum size for the ipsets used by Felix. Should be set to a number that is greater than the maximum number of IP addresses that are ever expected in a selector. [Default: `1048576`] | int | -| `NATPortRange` | `FELIX_NATPORTRANGE` | Port range used by iptables for port mapping when doing outgoing NAT. (Example: `32768:65000`). [Default: iptables maps source ports below 512 to other ports below 512: those between 512 and 1023 inclusive will be mapped to ports below 1024, and other ports will be mapped to 1024 or above. Where possible, no port alteration will occur.] | string | -| `NATOutgoingAddress` | `FELIX_NATOUTGOINGADDRESS` | Source address used by iptables for an SNAT rule when doing outgoing NAT. [Default: an iptables `MASQUERADE` rule is used for outgoing NAT which will use the address on the interface traffic is leaving on.] | `` | -| `NetlinkTimeoutSecs` | `FELIX_NETLINKTIMEOUTSECS` | Time, in seconds, that Felix will wait for netlink (i.e. routing table list/update) operations to complete before giving up and retrying. [Default: `10`] | float | -| `RouteRefreshInterval` | `FELIX_ROUTEREFRESHINTERVAL` | Period, in seconds, at which Felix re-checks the routes in the dataplane to ensure that no other process has accidentally broken $[prodname]'s rules. Set to 0 to disable route refresh. [Default: `90`] | int | -| `ServiceLoopPrevention` | `FELIX_SERVICELOOPPREVENTION` | When [service IP advertisement is enabled](../../../../networking/configuring/advertise-service-ips.mdx), prevent routing loops to service IPs that are not in use, by dropping or rejecting packets that do not get DNAT'd by kube-proxy. Unless set to "Disabled", in which case such routing loops continue to be allowed. [Default: `Drop`] | `Drop`, `Reject`, `Disabled` | -| `WorkloadSourceSpoofing` | `FELIX_WORKLOADSOURCESPOOFING` | Controls whether pods can enable source IP address spoofing with the `cni.projectcalico.org/allowedSourcePrefixes` annotation. When set to `Any`, pods can use this annotation to send packets from any IP address. [Default: `Disabled`] | `Any`, `Disabled` | -| `XDPRefreshInterval` | `FELIX_XDPREFRESHINTERVAL` | Period, in seconds, at which Felix re-checks the XDP state in the dataplane to ensure that no other process has accidentally broken $[prodname]'s rules. Set to 0 to disable XDP refresh. [Default: `90`] | int | -| `XDPEnabled` | `FELIX_XDPENABLED` | Enable XDP acceleration for host endpoint policies. [Default: `true`] | boolean | - -### eBPF dataplane configuration - -eBPF dataplane mode uses the Linux Kernel's eBPF virtual machine to implement networking and policy instead of iptables. When BPFEnabled is set to `true`, Felix will: - -- Require a v5.3 Linux kernel. -- Implement policy with eBPF programs instead of iptables. -- Activate its embedded implementation of `kube-proxy` to implement Kubernetes service load balancing. -- Disable support for IPv6. - -See [Enable the eBPF dataplane](../../../../operations/ebpf/enabling-ebpf.mdx) for step-by step instructions to enable this feature. - -| Configuration parameter / Environment variable | Description | Schema | Default | -| ----------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------ | -------------- | ------ | ------ | ----------------- | -| BPFEnabled /
FELIX_BPFENABLED | Enable eBPF dataplane mode. eBPF mode has a number of limitations, see the [HOWTO guide](../../../../operations/ebpf/enabling-ebpf.mdx). | true, false | false | -| BPFDisableUnprivileged /
FELIX_BPFDISABLEUNPRIVILEGED | If true, Felix sets the kernel.unprivileged_bpf_disabled sysctl to disable unprivileged use of BPF. This ensures that unprivileged users cannot access Calico's BPF maps and cannot insert their own BPF programs to interfere with the ones that $[prodname] installs. | true, false | true | -| BPFLogLevel /
FELIX_BPFLOGLEVEL | The log level used by the BPF programs. The logs are emitted to the BPF trace pipe, accessible with the command `tc exec BPF debug`. | Off,Info,Debug | Off | -| BPFDataIfacePattern /
FELIX_BPFDATAIFACEPATTERN | Controls which interfaces Felix should attach BPF programs to catch traffic to/from the external network. This needs to match the interfaces that Calico workload traffic flows over as well as any interfaces that handle incoming traffic to NodePorts and services from outside the cluster. It should not match the workload interfaces (usually named cali...).. | regular expression | `^(en[opsvx].\* | eth.\* | tunl0$ | wireguard.cali$)` | -| BPFConnectTimeLoadBalancingEnabled /
FELIX_BPFCONNECTTIMELOADBALANCINGENABLED | Controls whether Felix installs the connect-time load balancer. In the current release, the connect-time load balancer is required for the host to reach kubernetes services. | true,false | true | -| BPFExternalServiceMode /
FELIX_BPFEXTERNALSERVICEMODE | Controls how traffic from outside the cluster to NodePorts and ClusterIPs is handled. In Tunnel mode, packet is tunneled from the ingress host to the host with the backing pod and back again. In DSR mode, traffic is tunneled to the host with the backing pod and then returned directly; this requires a network that allows direct return. | Tunnel,DSR | Tunnel | -| BPFDSROptoutCIDRs /
FELIX_BPFDSROPTOUTCIDRS | BPFDSROptoutCIDRs is a list of CIDRs that are excluded from DSR. That is, clients in those CIDRs will access nodeports as if BPFExternalServiceMode was set to Tunnel. | string | "" | -| BPFExtToServiceConnmark /
FELIX_BPFEXTTOSERVICECONNMARK | Controls a 32bit mark that is set on connections from an external client to a local service. This mark allows us to control how packets of that connection are routed within the host and how is routing interpreted by RPF check. | int | 0 | -| BPFKubeProxyIptablesCleanupEnabled /
FELIX_BPFKUBEPROXYIPTABLESCLEANUPENABLED | Controls whether Felix will clean up the iptables rules created by the Kubernetes `kube-proxy`; should only be enabled if `kube-proxy` is not running. | true,false | true | -| BPFKubeProxyMinSyncPeriod /
FELIX_BPFKUBEPROXYMINSYNCPERIOD | Controls the minimum time between dataplane updates for Felix's embedded `kube-proxy` implementation. | seconds | `1` | -| BPFKubeProxyEndpointSlicesEnabled /
FELIX_BPFKUBEPROXYENDPOINTSLICESENABLED | Controls whether Felix's embedded kube-proxy derives its services from Kubernetes' EndpointSlices resources. Using EndpointSlices is more efficient but it requires EndpointSlices support to be enabled at the Kubernetes API server. | true,false | false | -| BPFMapSizeConntrack /
FELIX_BPFMapSizeConntrack | Controls the size of the conntrack map. This map must be large enough to hold an entry for each active connection. Warning: changing the size of the conntrack map can cause disruption. | int | 512000 | -| BPFMapSizeNATFrontend /
FELIX_BPFMapSizeNATFrontend | Controls the size of the NAT frontend map. FrontendMap should be large enough to hold an entry for each nodeport, external IP and each port in each service. | int | 65536 | -| BPFMapSizeNATBackend /
FELIX_BPFMapSizeNATBackend | Controls the size of the NAT backend map. This is the total number of endpoints. This is mostly more than the size of the number of services. | int | 262144 | -| BPFMapSizeNATAffinity /
FELIX_BPFMapSizeNATAffinity | Controls the size of the NAT affinity map. | int | 65536 | -| BPFMapSizeIPSets /
FELIX_BPFMapSizeIPSets | Controls the size of the IPSets map. The IP sets map must be large enough to hold an entry for each endpoint matched by every selector in the source/destination matches in network policy. Selectors such as "all()" can result in large numbers of entries (one entry per endpoint in that case). | int | 1048576 | -| BPFMapSizeRoute /
FELIX_BPFMapSizeRoute | Controls the size of the route map. The routes map should be large enough to hold one entry per workload and a handful of entries per host (enough to cover its own IPs and tunnel IPs). | int | 262144 | -| BPFHostConntrackBypass /
FELIX_BPFHostConntrackBypass | Controls whether to bypass Linux conntrack in BPF mode for workloads and services. | true,false | true | -| BPFPolicyDebugEnabled /
FELIX_BPFPOLICYDEBUGENABLED | In eBPF dataplane mode, Felix records detailed information about the BPF policy programs, which can be examined with the calico-bpf command-line tool. | true, false | true | - -### Windows-specific configuration - -| Configuration parameter | Environment variable | Description | Schema | Default | -| ------------------------------- | ------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ------------------------------------------- | -| windowsFlowLogsFileDirectory |
FELIX_WINDOWSFLOWLOGSFILEDIRECTORY | Set the directory where flow logs files are stored on Windows nodes. This parameter only takes effect when `flowLogsFileEnabled` is set to `true`. | string | `c:\\TigeraCalico\\flowlogs` | -| windowsFlowLogsPositionFilePath |
FELIX_WINDOWSFLOWLOGSPOSITIONFILEPATH | Specify the position of the external pipeline that reads flow logs on Windows nodes. This parameter only takes effect when `FlowLogsDynamicAggregationEnabled` is set to `true`. | string | `c:\\TigeraCalico\\flowlogs\\flows.log.pos` | -| windowsStatsDumpFilePath |
FELIX_WINDOWSTATSDUMPFILEPATH | Specify the position of the file used for dumping flow log statistics on Windows nodes. Note this is an internal setting that users shouldn't need to modify. | string | `c:\\TigeraCalico\\stats\\dump` | -| WindowsDNSCacheFile |
FELIX_WINDOWSDNSCACHEFILE | Specify the name of the file that Felix uses to preserve learned DNS information when restarting. | string | `c:\\TigeraCalico\\felix-dns-cache.txt` | -| WindowsDNSExtraTTL |
FELIX_WINDOWSDNSEXTRATTL | Specify extra time in seconds to keep IPs and alias names that are learned from DNS, in addition to each name or IP's advertised TTL. | seconds | `120` | - -### Kubernetes-specific configuration - -| Configuration parameter | Environment variable | Description | Schema | -| ----------------------- | -------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------ | -| `KubeNodePortRanges` | `FELIX_KUBENODEPORTRANGES` | A list of port ranges that Felix should treat as Kubernetes node ports. Only when `kube-proxy` is configured to use IPVS mode: Felix assumes that traffic arriving at the host of one of these ports will ultimately be forwarded instead of being terminated by a host process. [Default: `30000:32767`] | Comma-delimited list of `:` port ranges or single ports. | -| `KubeMasqueradeBit` | `FELIX_KUBEMASQUERADEBIT` | KubeMasqueradeBit should be set to the same value as --iptables-masquerade-bit of kube-proxy when TPROXY is used. This defaults to the corresponding kube-proxy default value so it only needs to change if kube-proxy is using a non-standard setting. Must be within the range of 0-31. OpenShift sets the bit to 0 by default. [Default: 14] | integer | +## Spec -:::note +### Datastore connection - When using $[prodname] with Kubernetes' `kube-proxy` in IPVS mode, $[prodname] uses additional -iptables mark bits to store an ID for each local $[prodname] endpoint. For example, the default `IptablesMarkMask` value, -`0xffff0000` gives $[prodname] 16 bits, up to 6 of which are used for internal purposes, leaving 10 bits for endpoint -IDs. 10 bits is enough for 1024 different values and $[prodname] uses 2 of those for internal purposes, leaving enough -for 1022 endpoints on the host. + -::: +### Process: Feature detection/overrides + + + +### Process: Go runtime + + + +### Process: Health port and timeouts + + + +### Process: Logging + + + +### Process: Prometheus metrics + + + +### Dataplane: Common + + + +### Dataplane: iptables + + + +### Dataplane: nftables + + + +### Dataplane: eBPF + + + +### Dataplane: Windows + + + +### Dataplane: OpenStack support + + + +### Dataplane: XDP acceleration for iptables dataplane + + + +### Overlay: VXLAN overlay + + + +### Overlay: IP-in-IP -### Bare metal specific configuration - -| Configuration parameter | Environment variable | Description | Schema | -| ----------------------- | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ | -| `InterfacePrefix` | `FELIX_INTERFACEPREFIX` | The interface name prefix that identifies workload endpoints and so distinguishes them from host endpoint interfaces. Accepts more than one interface name prefix in comma-delimited format, e.g., `tap,cali`. Note: in environments other than bare metal, the orchestrators configure this appropriately. For example our Kubernetes and Docker integrations set the `cali` value, and our OpenStack integration sets the `tap` value. [Default: `cali`] | string | - -### $[prodname] specific configuration - -| Setting | Environment variable | Default | Meaning | -| --------------------------------------- | --------------------------------------------- | ------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| `DropActionOverride` | `FELIX_DROPACTIONOVERRIDE` | `Drop` | How to treat packets that are disallowed by the current $[prodname] policy. For more detail please see below. | -| `LogDropActionOverride` | `FELIX_LOGDROPACTIONOVERRIDE` | `false` | Set to `true` to add the `DropActionOverride` to the syslog entries. For more detail please see below. | -| `PrometheusReporterEnabled` | `FELIX_PROMETHEUSREPORTERENABLED` | `false` | Set to `true` to enable Prometheus reporting of denied packet metrics. For more detail please see below. | -| `PrometheusReporterPort` | `FELIX_PROMETHEUSREPORTERPORT` | `9092` | The TCP port on which to report denied packet metrics. | -| `PrometheusReporterCertFile` | `FELIX_PROMETHEUSREPORTERCERTFILE` | None | Certificate for encrypting Prometheus denied packet metrics. | -| `PrometheusReporterKeyFile` | `FELIX_PROMETHEUSREPORTERKEYFILE` | None | Private key for encrypting Prometheus denied packet metrics. | -| `PrometheusReporterCAFile` | `FELIX_PROMETHEUSREPORTERCAFILE` | None | Trusted CA file for clients attempting to read Prometheus denied packet metrics. | -| `PrometheusMetricsCertFile` | `FELIX_PROMETHEUSMETRICSCERTFILE` | None | Certificate for encrypting general Felix Prometheus metrics. | -| `PrometheusMetricsKeyFile` | `FELIX_PROMETHEUSMETRICSKEYFILE` | None | Private key for encrypting general Felix Prometheus metrics. | -| `PrometheusMetricsCAFile` | `FELIX_PROMETHEUSMETRICSCAFILE` | None | Trusted CA file for clients attempting to read general Felix Prometheus metrics. | -| `IPSecMode` | `FELIX_IPSECMODE` | None | Controls which mode IPsec is operating on. The only supported value is `PSK`. An empty value means IPsec is not enabled. | -| `IPSecAllowUnsecuredTraffic` | `FELIX_IPSECALLOWUNSECUREDTRAFFIC` | `false` | When set to false, only IPsec-protected traffic will be allowed on the packet paths where IPsec is supported. When set to true, IPsec will be used but non-IPsec traffic will be accepted. In general, setting this to `true` is less safe since it allows an attacker to inject packets. However, it is useful when transitioning from non-IPsec to IPsec since it allows traffic to flow while the cluster negotiates the IPsec mesh. | -| `IPSecIKEAlgorithm` | `FELIX_IPSECIKEALGORITHM` | `aes128gcm16-prfsha256-ecp256` | IPsec IKE algorithm. Default is NIST suite B recommendation. | -| `IPSecESPAlgorithm` | `FELIX_IPSECESPALGORITHM` | `aes128gcm16-ecp256` | IPsec ESP algorithm. Default is NIST suite B recommendation. | -| `IPSecLogLevel` | `FELIX_IPSECLOGLEVEL` | `Info` | Controls log level for IPsec components. Set to `None` for no logging. Other valid values are `Notice`, `Info`, `Debug` and `Verbose`. | -| `IPSecPSKFile` | `FELIX_IPSECPSKFILE` | None | The path to the pre shared key file for IPsec. | -| `FlowLogsFileEnabled` | `FELIX_FLOWLOGSFILEENABLED` | `false` | Set to `true`, enables flow logs. If set to `false` no flow logging will occur. Flow logs are written to a file `flows.log` and sent to Elasticsearch. The location of this file can be configured using the `FlowLogsFileDirectory` field. File rotation settings for this `flows.log` file can be configured using the fields `FlowLogsFileMaxFiles` and `FlowLogsFileMaxFileSizeMB`. Note that flow log exports to Elasticsearch are dependent on flow logs getting written to this file. Setting this parameter to `false` will disable flow logs. | -| `FlowLogsFileIncludeLabels` | `FELIX_FLOWLOGSFILEINCLUDELABELS` | `false` | Set to `true` to include endpoint label information in flow logs. This parameter only takes effect when `FlowLogsFileEnabled` is set to `true`. | -| `FlowLogsFileIncludePolicies` | `FELIX_FLOWLOGSFILEINCLUDEPOLICIES` | `false` | Set to `true` to include policy match information in flow logs. This parameter only takes effect when `FlowLogsFileEnabled` is set to `true`. | -| `FlowLogsFileIncludeService` | `FELIX_FLOWLOGSFILEINCLUDESERVICE` | `false` | Set to `true` to include destination service information in flow logs. The service information is derived from pre-DNAT destination IP and is therefore only available on the node where DNAT occurs. This parameter only takes effect when `FlowLogsFileEnabled` is set to `true`. | -| `FlowLogsFileDirectory` | `FELIX_FLOWLOGSFILEDIRECTORY` | `/var/log/calico/flowlogs` | The directory where flow logs files are stored. This parameter only takes effect when `FlowLogsFileEnabled` is set to `true`. | -| `FlowLogsFileMaxFiles` | `FELIX_FLOWLOGSFILEMAXFILES` | `5` | The number of files to keep when rotating flow log files. This parameter only takes effect when `FlowLogsFileEnabled` is set to `true`. | -| `FlowLogsFileMaxFileSizeMB` | `FELIX_FLOWLOGSFILEMAXFILESIZEMB` | `100` | The max size in MB of flow logs files before rotation. This parameter only takes effect when `FlowLogsFileEnabled` is set to `true`. | -| `FlowLogsFlushInterval` | `FELIX_FLOWLOGSFLUSHINTERVAL` | `300` | The period, in seconds, at which Felix exports the flow logs. | -| `FlowLogsEnableNetworkSets` | `FELIX_FLOWLOGSENABLENETWORKSETS` | `false` | Whether to specify the network set a flow log originates from. | -| `FlowLogsFileAggregationKindForAllowed` | `FELIX_FLOWLOGSFILEAGGREGATIONKINDFORALLOWED` | `2` | How much to aggregate the flow logs sent to Elasticsearch for allowed traffic. Bear in mind that changing this value may have a dramatic impact on the volume of flow logs sent to Elasticsearch. `0` means no aggregation, `1` means aggregate all flows that share a source port on each node, `2` means aggregate all flows that share source ports or are from the same ReplicaSet and `3` means aggregate all flows that share destination and source ports and are from the same ReplicateSet | -| `FlowLogsFileAggregationKindForDenied` | `FELIX_FLOWLOGSFILEAGGREGATIONKINDFORDENIED` | `1` | How much to aggregate the flow logs sent to Elasticsearch for denied traffic. Bear in mind that changing this value may have a dramatic impact on the volume of flow logs sent to Elasticsearch. `0` means no aggregation, `1` means aggregate all flows that share a source port on each node, and `2` means aggregate all flows that share source ports or are from the same ReplicaSet and `3` means aggregate all flows that share destination and source ports and are from the same ReplicateSet. | -| `FlowLogsDynamicAggregationEnabled` | `FELIX_FLOWLOGSDYNAMICAGGREGATIONENABLED` | `false` | Enable dynamic aggregation for flow logs. This will increase aggregation up to the maximum level allowed (which is 3 and means aggregate all flows that share destination and source ports and are from the same ReplicateSet) when it detects the pipeline for reading flow logs is stalled. It will revert to its initial aggregation level when this condition changes. The initial aggregation level can be specified using `FlowLogsFileAggregationKindForAllowed` and `FlowLogsFileAggregationKindForDenied`. If these values are not specified, default values of `2` and `1` will be used. | -| `FlowLogsPositionFilePath` | `FELIX_FLOWLOGSPOSITIONPATH` | `/var/log/calico/flows.log.pos` | Default path of the position file. It is used to read the current state of pipeline for flow logs. This parameter will be used only when `FlowLogsDynamicAggregationEnabled` is set to `true` | -| `FlowLogsAggregationThresholdBytes` | `FELIX_FLOWLOGSAGGREGATIONTHRESHOLDBYTES` | `8192` | Default threshold to determine how far behind the pipeline for flow logs can get before aggregation starts in. Detecting a difference of 8192 bytes means increase 1 level, while a difference of 16384 means increasing two levels. This parameter will be used only when `FlowLogsDynamicAggregationEnabled` is set to `true`. | -| `FlowLogsCollectProcessInfo` | `FELIX_FLOWLOGSCOLLECTPROCESSINFO` | `true` | If enabled Felix will load the kprobe BPF programs to collect process info. | -| `FlowLogsCollectTcpStats` | `FELIX_FLOWLOGSCOLLECTTCPSTATS` | `true` | If enabled Felix will collect TCP socket stats using BPF and requires a recent kernel that supports BPF | -| `FlowLogsCollectProcessPath` | `FELIX_FLOWLOGSCOLLECTPROCESSPATH` | `true` | If enabled, along with FlowLogsCollectProcessInfo, each flow log will contain the full path of the process executable and the arguments with which the executable was invoked. If path or arguments cannot be determined, Felix will fallback to using task names and arguments will be empty. For full functionality, this feature should be enabled via operator see [Enabling process path](../../../../visibility/elastic/flow/processpath.mdx) | -| `FlowLogsFilePerFlowProcessLimit` | `FELIX_FLOWLOGSFILEPERFLOWPROCESSLIMIT` | `2` | Specify the maximum number of flow log entries with distinct process information beyond which process information will be aggregated. | -| `FlowLogsFilePerFlowProcessArgsLimit` | `FELIX_FLOWLOGSFILEPERFLOWPROCESSARGSLIMIT` | `5` | Specify the maximum number of arguments beyond which the process arguments will be aggregated. | -| `DNSCacheFile` | `FELIX_DNSCACHEFILE` | `/var/run/calico/felix-dns-cache.txt` | The name of the file that Felix uses to preserve learned DNS information when restarting. | -| `DNSCacheSaveInterval` | `FELIX_DNSCACHESAVEINTERVAL` | `60` | The periodic interval at which Felix saves learned DNS information to the cache file. | -| `DNSCacheEpoch` | `FELIX_DNSCACHEEPOCH` | `0` | An arbitrary number that can be changed, at runtime, to tell Felix to discard all its learned DNS information. | -| `DNSExtraTTL` | `FELIX_DNSEXTRATTL` | `0` | Extra time, in seconds, to keep IPs and alias names that are learned from DNS, in addition to each name or IP's advertised TTL. | -| `DNSTrustedServers` | `FELIX_DNSTRUSTEDSERVERS` | `k8s-service:kube-dns` | The DNS servers that Felix should trust. Each entry here must be `[:]` - indicating an explicit DNS server IP - or `k8s-service:[/][:port]` - indicating a Kubernetes DNS service. `` defaults to the first service port, or 53 for an IP, and `` to `kube-system`. An IPv6 address with a port must use the square brackets convention, for example `[fd00:83a6::12]:5353`. Note that Felix (calico-node) will need RBAC permission to read the details of each service specified by a `k8s-service:...` form. | -| `DNSLogsFileEnabled` | `FELIX_DNSLOGSFILEENABLED` | `false` | Set to `true`, enables DNS logs. If set to `false` no DNS logging will occur. DNS logs are written to a file `dns.log` and sent to Elasticsearch. The location of this file can be configured using the `DNSLogsFileDirectory` field. File rotation settings for this `dns.log` file can be configured using the fields `DNSLogsFileMaxFiles` and `DNSLogsFileMaxFileSizeMB`. Note that DNS log exports to Elasticsearch are dependent on DNS logs getting written to this file. Setting this parameter to `false` will disable DNS logs. | -| `DNSLogsFileDirectory` | `FELIX_DNSLOGSFILEDIRECTORY` | `/var/log/calico/dnslogs` | The directory where DNS logs files are stored. This parameter only takes effect when `DNSLogsFileEnabled` is `true`. | -| `DNSLogsFileMaxFiles` | `FELIX_DNSLOGSFILEMAXFILES` | `5` | The number of files to keep when rotating DNS log files. This parameter only takes effect when `DNSLogsFileEnabled` is `true`. | -| `DNSLogsFileMaxFileSizeMB` | `FELIX_DNSLOGSFILEMAXFILESIZEMB` | `100` | The max size in MB of DNS log files before rotation. This parameter only takes effect when `DNSLogsFileEnabled` is `true`. | -| `DNSLogsFlushInterval` | `FELIX_DNSLOGSFLUSHINTERVAL` | `300` | The period, in seconds, at which Felix exports DNS logs. | -| `DNSLogsFileAggregationKind` | `FELIX_DNSLOGSFILEAGGREGATIONKIND` | `1` | How much to aggregate DNS logs. Bear in mind that changing this value may have a dramatic impact on the volume of flow logs sent to Elasticsearch. `0` means no aggregation, `1` means aggregate similar DNS logs from workloads in the same ReplicaSet. | -| `DNSLogsFileIncludeLabels` | `FELIX_DNSLOGSFILEINCLUDELABELS` | `true` | Whether to include client and server workload labels in DNS logs. | -| `DNSLogsFilePerNodeLimit` | `FELIX_DNSLOGSFILEPERNODELIMIT` | `0` (no limit) | Limit on the number of DNS logs that can be emitted within each flush interval. When this limit has been reached, Felix counts the number of unloggable DNS responses within the flush interval, and emits a WARNING log with that count at the same time as it flushes the buffered DNS logs. | -| `DNSLogsLatency` | `FELIX_DNSLOGSLATENCY` | `true` | Indicates to include measurements of DNS request/response latency in each DNS log. | -| `EgressIPSupport` | `FELIX_EGRESSIPSUPPORT` | `Disabled` | Defines three different support modes for egress gateway function. `Disabled` means egress gateways are not supported. `EnabledPerNamespace` means egress gateway function is enabled and can be configured on a per-namespace basis (but per-pod egress annotations are ignored). `EnabledPerNamespaceOrPerPod` means egress gateway function is enabled and can be configured per-namespace or per-pod (with per-pod egress annotations overriding namespace annotations). | -| `EgressIPVXLANPort` | `FELIX_EGRESSIPVXLANPORT` | `4097` | Port to use for egress gateway VXLAN traffic. A value of `0` means "use the kernel default". | -| `EgressIPVXLANVNI` | `FELIX_EGRESSIPVXLANVNI` | `4790` | Virtual network ID to use for egress gateway VXLAN traffic. A value of `0` means "use the kernel default". | -| `EgressIPRoutingRulePriority` | `FELIX_EGRESSIPROUTINGRULEPRIORITY` | `100` | Priority value to use for the egress gateway routing rule. | -| `L7LogsFileEnabled` | `FELIX_L7LOGSFILEENABLED` | `true` | If set to `false` no L7 logging will occur. L7 logs are written to a file `l7.log` and sent to Elasticsearch. The location of this file can be configured using the `L7LogsFileDirectory` field. File rotation settings for this `l7.log` file can be configured using the fields `L7LogsFileMaxFiles` and `L7LogsFileMaxFileSizeMB`. Note that L7 log exports to Elasticsearch are dependent on L7 logs getting written to this file. | -| `L7LogsFileDirectory` | `FELIX_L7LOGSFILEDIRECTORY` | `/var/log/calico/l7logs` | The directory where L7 log files are stored. This parameter only takes effect when `L7LogsFileEnabled` is `true`. | -| `L7LogsFileMaxFiles` | `FELIX_L7LOGSFILEMAXFILES` | `5` | The number of files to keep when rotating L7 log files. This parameter only takes effect when `L7LogsFileEnabled` is `true`. | -| `L7LogsFileMaxFileSizeMB` | `FELIX_L7LOGSFILEMAXFILESIZEMB` | `100` | The max size in MB of L7 log files before rotation. This parameter only takes effect when `L7LogsFileEnabled` is `true`. | -| `L7LogsFlushInterval` | `FELIX_L7LOGSFLUSHINTERVAL` | `300` | The period, in seconds, at which Felix exports L7 logs. | -| `L7LogsFileAggregationHTTPHeaderInfo` | `FELIX_L7LOGSFILEAGGREGATIONHTTPHEADERINFO` | `ExcludeL7HTTPHeaderInfo` | How to handle HTTP header information for aggregating L7 logs. Bear in mind that changing this value may have a dramatic impact on the volume of L7 logs sent to Elasticsearch. Possible values include `ExcludeL7HTTPHeaderInfo` and `IncludeL7HTTPHeaderInfo`. | -| `L7LogsFileAggregationHTTPMethod` | `FELIX_L7LOGSFILEAGGREGATIONHTTPMETHOD` | `IncludeL7HTTPMethod` | How to handle HTTP method data for aggregating L7 logs. Bear in mind that changing this value may have a dramatic impact on the volume of L7 logs sent to Elasticsearch. Possible values include `ExcludeL7HTTPMethod` and `IncludeL7HTTPMethod`. | -| `L7LogsFileAggregationServiceInfo` | `FELIX_L7LOGSFILEAGGREGATIONSERVICEINFO` | `IncludeL7ServiceInfo` | How to handle service information for aggregating L7 logs. Bear in mind that changing this value may have a dramatic impact on the volume of L7 logs sent to Elasticsearch. Possible values include `ExcludeL7ServiceInfo` and `IncludeL7ServiceInfo`. | -| `L7LogsFileAggregationDestinationInfo` | `FELIX_L7LOGSFILEAGGREGATIONDESTINATIONINFO` | `IncludeL7DestinationInfo` | How to handle destination metadata for aggregating L7 logs. Bear in mind that changing this value may have a dramatic impact on the volume of L7 logs sent to Elasticsearch. Possible values include `ExcludeL7DestinationInfo` and `IncludeL7DestinationInfo`. | -| `L7LogsFileAggregationSourceInfo` | `FELIX_L7LOGSFILEAGGREGATIONSOURCEINFO` | `IncludeL7SourceInfoNoPort` | How to handle source metadata for aggregating L7 logs. Bear in mind that changing this value may have a dramatic impact on the volume of L7 logs sent to Elasticsearch. Possible values include `ExcludeL7SourceInfo`, `IncludeL7SourceInfoNoPort`, and `IncludeL7SourceInfo`. | -| `L7LogsFileAggregationResponseCode` | `FELIX_L7LOGSFILEAGGREGATIONRESPONSECODE` | `IncludeL7ResponseCode` | How to handle response code data for aggregating L7 logs. Bear in mind that changing this value may have a dramatic impact on the volume of L7 logs sent to Elasticsearch. Possible values include `ExcludeL7ResponseCode` and `IncludeL7ResponseCode`. | -| `L7LogsFileAggregationTrimURL` | `FELIX_L7LOGSFILEAGGREGATIONTRIMURL` | `IncludeL7FullURL` | How to handle URL data for aggregating L7 logs. Bear in mind that changing this value may have a dramatic impact on the volume of L7 logs sent to Elasticsearch. Possible values include `ExcludeL7URL`, `TrimURLQuery`, `TrimURLQueryAndPath`, and `IncludeL7FullURL`. | -| `L7LogsFileAggregationNumURLPath` | `FELIX_L7LOGSFILEAGGREGATIONNUMURLPATH` | `5` | How many components in the path to limit the URL by. This parameter only takes effect when `L7LogsFileAggregationTrimURL` is set to `IncludeL7FullURL`. Bear in mind that changing this value may have a dramatic impact on the volume of L7 logs sent to Elasticsearch. Negative values set the limit to infinity. | - -DropActionOverride controls what happens to each packet that is denied by -the current $[prodname] policy - i.e. by the ordered combination of all the -configured policies and profiles that apply to that packet. It may be -set to one of the following values: - -- `Drop` -- `Accept` -- `LogAndDrop` -- `LogAndAccept` - -Normally the `Drop` or `LogAndDrop` value should be used, as dropping a -packet is the obvious implication of that packet being denied. However when -experimenting, or debugging a scenario that is not behaving as you expect, the -`Accept` and `LogAndAccept` values can be useful: then the packet will be -still be allowed through. - -When set to `LogAndDrop` or `LogAndAccept`, each denied packet is logged in -syslog, with an entry like this: - -``` -May 18 18:42:44 ubuntu kernel: [ 1156.246182] calico-drop: IN=tunl0 OUT=cali76be879f658 MAC= SRC=192.168.128.30 DST=192.168.157.26 LEN=60 TOS=0x00 PREC=0x00 TTL=62 ID=56743 DF PROTO=TCP SPT=56248 DPT=80 WINDOW=29200 RES=0x00 SYN URGP=0 MARK=0xa000000 -``` - -If the `LogDropActionOverride` flag is set, then the `DropActionOverride` will also appear in the syslog entry: - -``` -May 18 18:42:44 ubuntu kernel: [ 1156.246182] calico-drop LOGandDROP: IN=tunl0 OUT=cali76be879f658 MAC= SRC=192.168.128.30 DST=192.168.157.26 LEN=60 TOS=0x00 PREC=0x00 TTL=62 ID=56743 DF PROTO=TCP SPT=56248 DPT=80 WINDOW=29200 RES=0x00 SYN URGP=0 MARK=0xa000000 -``` - -When the reporting of denied packet metrics is enabled, Felix keeps counts of -recently denied packets and publishes these as Prometheus metrics on the port -configured by the `PrometheusReporterPort` setting. - -Note that denied packet metrics are independent of the DropActionOverride -setting. Specifically, if packets that would normally be denied are being -allowed through by a setting of `Accept` or `LogAndAccept`, those packets -still contribute to the denied packet metrics as just described. - -### Felix-Typha Configuration - -| Configuration parameter | Environment variable | Description | Schema | -| ----------------------- | --------------------------- | ----------------------------------------------------------------------------------------- | ------ | -| `TyphaAddr` | `FELIX_TYPHAADDR` | Address of the Typha Server when running outside a K8S Cluster, in the format IP:PORT | string | -| `TyphaK8sServiceName` | `FELIX_TYPHAK8SSERVICENAME` | Service Name of Typha Deployment when running inside a K8S Cluster | string | -| `TyphaK8sNamespace` | `FELIX_TYPHAK8SNAMESPACE` | Namespace of Typha Deployment when running inside a K8S Cluster. [Default: `kube-system`] | string | -| `TyphaReadTimeout` | `FELIX_TYPHAREADTIMEOUT` | Timeout of Felix when reading information from Typha, in seconds. [Default: 30] | int | -| `TyphaWriteTimeout` | `FELIX_TYPHAWRITETIMEOUT` | Timeout of Felix when writing information to Typha, in seconds. [Default: 30] | int | - -### Felix-Typha TLS configuration - -| Configuration parameter | Environment variable | Description | Schema | -| ----------------------- | --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ | -| `TyphaCAFile` | `FELIX_TYPHACAFILE` | Path to the file containing the root certificate of the CA that issued the Typha server certificate. Configures Felix to trust the CA that signed the root certificate. The file may contain multiple root certificates, causing Felix to trust each of the CAs included. Example: `/etc/felix/ca.pem` | string | -| `TyphaCertFile` | `FELIX_TYPHACERTFILE` | Path to the file containing the client certificate issued to Felix. Enables Felix to participate in mutual TLS authentication and identify itself to the Typha server. Example: `/etc/felix/cert.pem` | string | -| `TyphaCN` | `FELIX_TYPHACN` | If set, the `Common Name` that Typha's certificate must have. If you have enabled TLS on the communications from Felix to Typha, you must set a value here or in `TyphaURISAN`. You can set values in both, as well, such as to facilitate a migration from using one to the other. If either matches, the communication succeeds. [Default: none] | string | -| `TyphaKeyFile` | `FELIX_TYPHAKEYFILE` | Path to the file containing the private key matching the Felix client certificate. Enables Felix to participate in mutual TLS authentication and identify itself to the Typha server. Example: `/etc/felix/key.pem` (optional) | string | -| `TyphaURISAN` | `FELIX_TYPHAURISAN` | If set, a URI SAN that Typha's certificate must have. We recommend populating this with a [SPIFFE](https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#2-spiffe-identity) string that identifies Typha. All Typha instances should use the same SPIFFE ID. If you have enabled TLS on the communications from Felix to Typha, you must set a value here or in `TyphaCN`. You can set values in both, as well, such as to facilitate a migration from using one to the other. If either matches, the communication succeeds. [Default: none] | string | - -For more information on how to use and set these variables, refer to -[Connections from Node to Typha (Kubernetes)](../../../../operations/comms/crypto-auth.mdx#connections-from-node-to-typha-kubernetes). - -### PacketCapture configuration - -The following parameters fine tune packet capture rotation: - -| Configuration parameter | Environment variable | Description | Schema | -| ------------------------ | --------------------------------- | --------------------------------------------------------------------------------------------- | ------ | -| `CaptureDir` | `FELIX_CAPTUREDIR` | Controls the directory where packet capture files are stored. Example: `/var/log/calico/pcap` | string | -| `CaptureMaxSizeBytes` | `FELIX_CAPTUREMAXSIZEBYTES` | Controls the maximum size in bytes for a packet capture file before rotation. | int | -| `CaptureRotationSeconds` | `FELIX_CAPTUREMAXROTATIONSECONDS` | Controls the rotation period in seconds for a packet capture file. | int | -| `CaptureMaxFiles` | `FELIX_CAPTUREMAXFILES` | Controls the maximum number rotated packet capture files. | int | - -### WireGuard configuration - -| Configuration parameter | Environment variable | Description | Schema | -| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------- | ------- | -------------- | -| wireguardEnabled | Enable encryption for IPv4 on WireGuard supported nodes in cluster. When enabled, pod to pod traffic will be sent over encrypted tunnels between the nodes. | `true`, `false` | boolean | `false` | -| wireguardEnabledV6 | Enable encryption for IPv6 on WireGuard supported nodes in cluster. When enabled, pod to pod traffic will be sent over encrypted tunnels between the nodes. | `true`, `false` | boolean | `false` | -| wireguardInterfaceName | Name of the IPv4 WireGuard interface created by Felix. If you change the name, and want to clean up the previously-configured interface names on each node, this is a manual process. | string | string | wireguard.cali | -| wireguardInterfaceNameV6 | Name of the IPv6 WireGuard interface created by Felix. If you change the name, and want to clean up the previously-configured interface names on each node, this is a manual process. | string | string | wg-v6.cali | -| wireguardListeningPort | Port used by IPv4 WireGuard tunnels. Felix sets up an IPv4 WireGuard tunnel on each node specified by this port. Available for configuration only in the global FelixConfiguration resource; setting it per host, config-file or environment variable will not work. | 1-65535 | int | 51820 | -| wireguardListeningPortV6 | Port used by IPv6 WireGuard tunnels. Felix sets up an IPv6 WireGuard tunnel on each node specified by this port. Available for configuration only in the global FelixConfiguration resource; setting it per host, config-file or environment variable will not work. | 1-65535 | int | 51821 | -| wireguardMTU | MTU set on the IPv4 WireGuard interface created by Felix. Zero value means auto-detect. See [Configuring MTU](../../../../networking/configuring/mtu.mdx). | int | int | 0 | -| wireguardMTUV6 | MTU set on the IPv6 WireGuard interface created by Felix. Zero value means auto-detect. See [Configuring MTU](../../../../networking/configuring/mtu.mdx). | int | int | 0 | -| wireguardRoutingRulePriority | WireGuard routing rule priority value set up by Felix. If you change the default value, set it to a value most appropriate to routing rules for your nodes. | 1-32765 | int | 99 | -| wireguardHostEncryptionEnabled | **Experimental**: Adds host-namespace workload IP's to WireGuard's list of peers. Should **not** be enabled when WireGuard is enabled on a cluster's control plane node, as networking deadlock can occur. | true, false | boolean | false | -| wireguardKeepAlive | WireguardKeepAlive controls Wireguard PersistentKeepalive option. Set 0 to disable. [Default: 0] | int | int | 25 | - -For more information on encrypting in-cluster traffic with WireGuard, refer to -[Encrypt cluster pod traffic](../../../../compliance/encrypt-cluster-pod-traffic.mdx) + + +### Overlay: Wireguard + + + +### Overlay: IPSec + + + +### Flow logs: Prometheus reports + + + +### Flow logs: Syslog reports + + + +### Flow logs: file reports + + + +### DNS logs / policy + + + +### L7 logs + + + +### AWS integration + + + +### Egress gateway + + + +### External network support + + + +### Packet capture + + + +### L7 proxy + + + +### Debug/test-only (generally unsupported) + + + +### Usage reporting + + ## Environment variables @@ -449,7 +291,3 @@ a global setting and a per-host override. ``` For more information, see [Felix Configuration Resource](../../../resources/felixconfig.mdx). - - - - diff --git a/calico-enterprise/reference/resources/felixconfig.mdx b/calico-enterprise/reference/resources/felixconfig.mdx index 85c1cb013e..dfe9feccf2 100644 --- a/calico-enterprise/reference/resources/felixconfig.mdx +++ b/calico-enterprise/reference/resources/felixconfig.mdx @@ -1,7 +1,10 @@ --- description: API for this Calico Enterprise resource. +toc_max_heading_level: 4 --- +import FelixConfig from '../../_includes/components/FelixConfig'; + # Felix configuration A [Felix](../architecture/overview.mdx#felix) configuration resource (`FelixConfiguration`) represents Felix configuration options for the cluster. @@ -36,179 +39,207 @@ spec: ### Spec -| Field | Description | Accepted Values | Schema | Default | -|---------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------|-----------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| awsSrcDstCheck | Controls automatically setting [source-destination-check](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_NAT_Instance.html#EIP_Disable_SrcDestCheck) on an AWS EC2 instance running Felix. Setting the value to `Enable` will set the check value in the instance description to `true`. For `Disable`, the check value will be `false`. Setting must be `Disable` if you want the EC2 instance to process traffic not matching the host interface IP address. For example, EKS cluster using Calico CNI with `VXLANMode=CrossSubnet`. Check [IAM role and profile configuration](#aws-iam-rolepolicy-for-source-destination-check-configuration) for setting the necessary permission for this setting to work. | DoNothing, Enable, Disable | string | `DoNothing` | -| awsSecondaryIPSupport | Controls whether Felix will create secondary AWS ENIs for AWS-backed IP pools. This feature is documented in the [egress gateways on AWS guide](../../networking/egress/egress-gateway-aws.mdx). Should only be enabled on AWS. | `Enabled`, `EnabledENIPerWorkload`, `Disabled` | string | `Disabled` | -| awsSecondaryIPRoutingRulePriority | Controls the priority of the policy-based routing rules used to implement AWS-backed IP addresses. Should only be changed to avoid conflicts if your nodes have additional policy based routing rules. | 0-4294967295 | int | 101 | -| awsRequestTimeout | Timeout used for communicating with the AWS API. | `5s`, `10s`, `1m` etc. | duration | `30s` | -| dropActionOverride | Controls what happens to each packet that is denied by the current $[prodname] policy. Normally the `Drop` or `LogAndDrop` value should be used. However when experimenting or debugging a scenario that is not behaving as you expect, the `Accept` and `LogAndAccept` values can be useful: then the packet will be still be allowed through. When one of the `LogAnd...` values is set, each denied packet is logged in syslog.\* | `Drop`, `Accept`, `LogAndDrop`, `LogAndAccept` | string | `Drop` | -| chainInsertMode | Controls whether Felix hooks the kernel's top-level iptables chains by inserting a rule at the top of the chain or by appending a rule at the bottom. `Insert` is the safe default since it prevents $[prodname]'s rules from being bypassed. If you switch to `Append` mode, be sure that the other rules in the chains signal acceptance by falling through to the $[prodname] rules, otherwise the $[prodname] policy will be bypassed. | `Insert`, `Append` | string | `Insert` | -| healthTimeoutOverrides | A list of overrides for Felix's internal liveness/readiness timeouts. | see [below](#health-timeout-overrides) | List of `HealthTimeoutOverride` objects | `[]` | -| dataplaneWatchdogTimeout | Deprecated, use `healthTimeoutOverrides` instead. Timeout before the main dataplane goroutine is determined to have hung and Felix will report non-live and non-ready. Can be increased if the liveness check incorrectly fails (for example if Felix is running slowly on a heavily loaded system). | `90s`, `120s`, `10m` etc. | duration | `90s` | -| defaultEndpointToHostAction | This parameter controls what happens to traffic that goes from a workload endpoint to the host itself (after the traffic hits the endpoint egress policy). By default $[prodname] blocks traffic from workload endpoints to the host itself with an iptables "DROP" action. If you want to allow some or all traffic from endpoint to host, set this parameter to `Return` or `Accept`. Use `Return` if you have your own rules in the iptables "INPUT" chain; $[prodname] will insert its rules at the top of that chain, then `Return` packets to the "INPUT" chain once it has completed processing workload endpoint egress policy. Use `Accept` to unconditionally accept packets from workloads after processing workload endpoint egress policy. | Drop, Return, Accept | string | `Drop` | -| deviceRouteSourceAddress | IPv4 address to set as the source hint for routes programmed by Felix. When not set the source address for local traffic from host to workload will be determined by the kernel. | IPv4 | string | `""` | -| deviceRouteSourceAddressIPv6 | IPv6 address to set as the source hint for routes programmed by Felix. When not set the source address for local traffic from host to workload will be determined by the kernel. | IPv6 | string | `""` | -| deviceRouteProtocol | This defines the route protocol added to programmed device routes. | Protocol | int | RTPROT_BOOT | -| endpointStatusPathPrefix | Path to the directory where Felix should create the `endpoint-status` directory. Choosing a mounted volume such as `/var/run/calico` is recommended as the directory can then be monitored by host processes such as the Calico CNI. Leaving this field empty disables endpoint-status files. | Any existing path in the calico-node container | string | `""` | -| externalNodesCIDRList | A comma-delimited list of CIDRs of external non-calico nodes that can source tunnel traffic for acceptance by calico-nodes. | IPv4 | string | `""` | -| failsafeInboundHostPorts | UDP/TCP/SCTP protocol/cidr/port groupings that Felix will allow incoming traffic to host endpoints on irrespective of the security policy. This is useful to avoid accidentally cutting off a host with incorrect configuration. The default value allows SSH access, etcd, BGP, DHCP and the Kubernetes API. | | List of [ProtoPort](#protoport) |

- protocol: tcp
  port: 22
- protocol: udp
  port: 68
- protocol: tcp
  port: 179
- protocol: tcp
  port: 2379
- protocol: tcp
  port: 2380
- protocol: tcp
  port: 5473
- protocol: tcp
  port: 6443
- protocol: tcp
  port: 6666
- protocol: tcp
  port: 6667

| -| failsafeOutboundHostPorts | UDP/TCP/SCTP protocol/port groupings that Felix will allow outgoing traffic from host endpoints to irrespective of the security policy. This is useful to avoid accidentally cutting off a host with incorrect configuration. The default value opens etcd's standard ports to ensure that Felix does not get cut off from etcd as well as allowing DHCP, DNS, BGP and the Kubernetes API. | | List of [ProtoPort](#protoport) |

- protocol: udp
  port: 53
- protocol: udp
  port: 67
- protocol: tcp
  port: 179
- protocol: tcp
  port: 2379
- protocol: tcp
  port: 2380
- protocol: tcp
  port: 5473
- protocol: tcp
  port: 6443
- protocol: tcp
  port: 6666
- protocol: tcp
  port: 6667

| -| featureDetectOverride | Is used to override the feature detection. Values are specified in a comma separated list with no spaces, example; "SNATFullyRandom=true,MASQFullyRandom=false,RestoreSupportsLock=". "true" or "false" will force the feature, empty or omitted values are auto-detected. | string | string | `""` | -| genericXDPEnabled | When enabled, Felix can fallback to the non-optimized `generic` XDP mode. This should only be used for testing since it doesn't improve performance over the non-XDP mode. | true,false | boolean | `false` | -| goGCThreshold | Sets the Go runtime's garbage collection threshold; this is the percentage that the heap is allowed to grow before GC is triggered. In general, doubling the value halves the CPU time spent doing GC, but it also doubles peak GC memory overhead. A special value of -1 can be used to disable GC entirely; this should only be used in conjunction with the `goMemoryLimitMB` setting. This setting is overridden by the GOGC environment variable. | int | int | `40` | -| goMemoryLimitMB | GoMemoryLimitMB sets a (soft) memory limit for the Go runtime in MB. The Go runtime will try to keep its memory usage under the limit by triggering GC as needed. To avoid thrashing, it will exceed the limit if GC starts to take more than 50% of the process's CPU time. A value of -1 disables the memory limit. Note that the memory limit, if used, must be considerably less than any hard resource limit set at the container or pod level. This is because Felix is not the only process that must run in the container or pod. This setting is overridden by the GOMEMLIMIT environment variable. | int | int | `-1` | -| goMaxProcs | Sets the maximum number of CPUs that the Go runtime will use concurrently. A value of -1 means "use the system default"; typically the number of real CPUs on the system. This setting is overridden by the GOMAXPROCS environment variable. | int | int | `-1` | -| interfaceExclude | A comma-separated list of interface names that should be excluded when Felix is resolving host endpoints. The default value ensures that Felix ignores Kubernetes' internal `kube-ipvs0` device. If you want to exclude multiple interface names using a single value, the list supports regular expressions. For regular expressions you must wrap the value with `/`. For example having values `/^kube/,veth1` will exclude all interfaces that begin with `kube` and also the interface `veth1`. | string | string | `kube-ipvs0` | -| interfacePrefix | The interface name prefix that identifies workload endpoints and so distinguishes them from host endpoint interfaces. Note: in environments other than bare metal, the orchestrators configure this appropriately. For example our Kubernetes and Docker integrations set the 'cali' value, and our OpenStack integration sets the 'tap' value. | string | string | `cali` | -| ipipEnabled | Optional, you shouldn't need to change this setting as Felix calculates if IPIP should be enabled based on the existing IP Pools. When set, this overrides whether Felix should configure an IPinIP interface on the host. When explicitly disabled in FelixConfiguration, Felix will not clean up addresses from the `tunl0` interface (use this if you need to add addresses to that interface and don't want to have them removed). | `true`, `false`, unset | optional boolean | unset | -| ipipMTU | The MTU to set on the tunnel device. Zero value means auto-detect. See [Configuring MTU](../../networking/configuring/mtu.mdx) | int | int | `0` | -| ipForwarding | Controls whether Felix sets the host sysctls to enable IP forwarding. IP forwarding is required when using Calico for workload networking. This should be disabled only on hosts where Calico is used for host protection. | `Enabled`, `Disabled` | string | `Enabled` | -| ipsetsRefreshInterval | Period at which Felix re-checks the IP sets in the dataplane to ensure that no other process has accidentally broken $[prodname]'s rules. Set to 0 to disable IP sets refresh. | `5s`, `10s`, `1m` etc. | duration | `10s` | -| iptablesFilterAllowAction | This parameter controls what happens to traffic that is accepted by a Felix policy chain in the iptables filter table (i.e. a normal policy chain). The default will immediately `Accept` the traffic. Use `Return` to send the traffic back up to the system chains for further processing. | Accept, Return | string | `Accept` | -| iptablesBackend | This parameter controls which variant of iptables Felix uses. If using Felix on a system that uses the netfilter-backed iptables binaries, set this to `nft`. | Legacy, nft | string | automatic detection | -| iptablesLockFilePath | Location of the iptables lock file. You may need to change this if the lock file is not in its standard location (for example if you have mapped it into Felix's container at a different path). | string | string | `/run/xtables.lock` | -| iptablesLockProbeInterval | Time that Felix will wait between attempts to acquire the iptables lock if it is not available. Lower values make Felix more responsive when the lock is contended, but use more CPU. | `5s`, `10s`, `1m` etc. | duration | `50ms` | -| iptablesLockTimeout | Time that Felix will wait for the iptables lock, or 0, to disable. To use this feature, Felix must share the iptables lock file with all other processes that also take the lock. When running Felix inside a container, this requires the /run directory of the host to be mounted into the $[nodecontainer] or calico/felix container. | `5s`, `10s`, `1m` etc. | duration | `0` (Disabled) | -| iptablesMangleAllowAction | This parameter controls what happens to traffic that is accepted by a Felix policy chain in the iptables mangle table (i.e. a pre-DNAT policy chain). The default will immediately `Accept` the traffic. Use `Return` to send the traffic back up to the system chains for further processing. | `Accept`, `Return` | string | `Accept` | -| iptablesMarkMask | Mask that Felix selects its IPTables Mark bits from. Should be a 32 bit hexadecimal number with at least 8 bits set, none of which clash with any other mark bits in use on the system. | netmask | netmask | `0xffff0000` | -| iptablesNATOutgoingInterfaceFilter | This parameter can be used to limit the host interfaces on which Calico will apply SNAT to traffic leaving a Calico IPAM pool with "NAT outgoing" enabled. This can be useful if you have a main data interface, where traffic should be SNATted and a secondary device (such as the docker bridge) which is local to the host and doesn't require SNAT. This parameter uses the iptables interface matching syntax, which allows `+` as a wildcard. Most users will not need to set this. Example: if your data interfaces are eth0 and eth1 and you want to exclude the docker bridge, you could set this to `eth+` | string | string | `""` | -| iptablesPostWriteCheckInterval | Period after Felix has done a write to the dataplane that it schedules an extra read back to check the write was not clobbered by another process. This should only occur if another application on the system doesn't respect the iptables lock. | `5s`, `10s`, `1m` etc. | duration | `1s` | -| iptablesRefreshInterval | Period at which Felix re-checks all iptables state to ensure that no other process has accidentally broken $[prodname]'s rules. Set to 0 to disable iptables refresh. | `5s`, `10s`, `1m` etc. | duration | `90s` | -| ipv6Support | IPv6 support for Felix | `true`, `false` | boolean | `true` | -| logFilePath | The full path to the Felix log. Set to `none` to disable file logging. | string | string | `/var/log/calico/felix.log` | -| logPrefix | The log prefix that Felix uses when rendering LOG rules. | string | string | `calico-packet` | -| logSeverityFile | The log severity above which logs are sent to the log file. | Same as logSeveritySys | string | `Info` | -| logSeverityScreen | The log severity above which logs are sent to the stdout. | Same as logSeveritySys | string | `Info` | -| logSeveritySys | The log severity above which logs are sent to the syslog. Set to `none` for no logging to syslog. | Debug, Info, Warning, Error, Fatal | string | `Info` | -| logDebugFilenameRegex | controls which source code files have their Debug log output included in the logs. Only logs from files with names that match the given regular expression are included. The filter only applies to Debug level logs. | regex | string | `""` | -| maxIpsetSize | Maximum size for the ipsets used by Felix. Should be set to a number that is greater than the maximum number of IP addresses that are ever expected in a selector. | int | int | `1048576` | -| metadataAddr | The IP address or domain name of the server that can answer VM queries for cloud-init metadata. In OpenStack, this corresponds to the machine running nova-api (or in Ubuntu, nova-api-metadata). A value of `none` (case insensitive) means that Felix should not set up any NAT rule for the metadata path. | IPv4, hostname, none | string | `127.0.0.1` | -| metadataPort | The port of the metadata server. This, combined with global.MetadataAddr (if not 'None'), is used to set up a NAT rule, from 169.254.169.254:80 to MetadataAddr:MetadataPort. In most cases this should not need to be changed. | int | int | `8775` | -| natOutgoingAddress | The source address to use for outgoing NAT. By default an iptables MASQUERADE rule determines the source address which will use the address on the host interface the traffic leaves on. | IPV4 | string | `""` | -| policySyncPathPrefix | File system path where Felix notifies services of policy changes over Unix domain sockets. This is required only if you're configuring [L7 logs](../../visibility/elastic/l7/configure.mdx), or [egress gateways](../../networking/egress/index.mdx). Set to `""` to disable. | string | string | `""` | -| prometheusGoMetricsEnabled | Set to `false` to disable Go runtime metrics collection, which the Prometheus client does by default. This reduces the number of metrics reported, reducing Prometheus load. | boolean | boolean | `true` | -| prometheusMetricsEnabled | Set to `true` to enable the experimental Prometheus metrics server in Felix. | boolean | boolean | `false` | -| prometheusMetricsHost | TCP network address that the Prometheus metrics server should bind to. | IPv4, IPv6, Hostname | string | `""` | -| prometheusMetricsPort | TCP port that the Prometheus metrics server should bind to. | int | int | `9091` | -| prometheusProcessMetricsEnabled | Set to `false` to disable process metrics collection, which the Prometheus client does by default. This reduces the number of metrics reported, reducing Prometheus load. | boolean | boolean | `true` | -| prometheusReporterEnabled | Set to `true` to enable configure Felix to keep count of recently denied packets and publish these as Prometheus metrics. Note that denied packet metrics are independent of the `dropActionOverride` setting. Specifically, if packets that would normally be denied are being allowed through by a setting of `Accept` or `LogAndAccept`, those packets still get counted as denied packets. | `true`, `false` | boolean | `false` | -| prometheusReporterPort | The TCP port on which to report denied packet metrics, if `prometheusReporterEnabled` is set to `true`. | | | `9092` | -| removeExternalRoutes | Whether or not to remove device routes that have not been programmed by Felix. Disabling this will allow external applications to also add device routes. | bool | boolean | `true` | -| reportingInterval | Interval at which Felix reports its status into the datastore. 0 means disabled and is correct for Kubernetes-only clusters. Must be non-zero in OpenStack deployments. | `5s`, `10s`, `1m` etc. | duration | `30s` | -| reportingTTL | Time-to-live setting for process-wide status reports. | `5s`, `10s`, `1m` etc. | duration | `90s` | -| routeRefreshInterval | Period at which Felix re-checks the routes in the dataplane to ensure that no other process has accidentally broken $[prodname]'s rules. Set to 0 to disable route refresh. | `5s`, `10s`, `1m` etc. | duration | `90s` | -| ipsecMode | Controls which mode IPsec is operating on. The only supported value is `PSK`. An empty value means IPsec is not enabled. | PSK | string | `""` | -| ipsecAllowUnsecuredTraffic | When set to `false`, only IPsec-protected traffic will be allowed on the packet paths where IPsec is supported. When set to `true`, IPsec will be used but non-IPsec traffic will be accepted. In general, setting this to `true` is less safe since it allows an attacker to inject packets. However, it is useful when transitioning from non-IPsec to IPsec since it allows traffic to flow while the cluster negotiates the IPsec mesh. | `true`, `false` | boolean | `false` | -| ipsecIKEAlgorithm | IPsec IKE algorithm. Default is NIST suite B recommendation. | string | string | `aes128gcm16-prfsha256-ecp256` | -| ipsecESPAlgorithm | IPsec ESP algorithm. Default is NIST suite B recommendation. | string | string | `aes128gcm16-ecp256` | -| ipsecLogLevel | Controls log level for IPsec components. Set to `None` for no logging. | `None`, `Notice`, `Info`, `Debug`, `Verbose` | string | `Info` | -| ipsecPSKFile | The path to the pre shared key file for IPsec. | string | string | `""` | -| flowLogsFileEnabled | Set to `true`, enables flow logs. If set to `false` no flow logging will occur. Flow logs are written to a file `flows.log` and sent to Elasticsearch. The location of this file can be configured using the `flowLogsFileDirectory` field. File rotation settings for this `flows.log` file can be configured using the fields `flowLogsFileMaxFiles` and `flowLogsFileMaxFileSizeMB`. Note that flow log exports to Elasticsearch are dependent on flow logs getting written to this file. Setting this parameter to `false` will disable flow logs. | `true`, `false` | boolean | `false` | -| flowLogsFileDirectory | Set the directory where flow logs files are stored on Linux nodes. This parameter only takes effect when `flowLogsFileEnabled` is set to `true`. | string | string | `/var/log/calico/flowlogs` | -| flowLogsPositionFilePath | Specify the position of the external pipeline that reads flow logs on Linux nodes. This parameter only takes effect when `FlowLogsDynamicAggregationEnabled` is set to `true`. | string | string | `/var/log/calico/flows.log.pos` | -| flowLogsFileMaxFiles | Set the number of log files to keep. This parameter only takes effect when `flowLogsFileEnabled` is set to `true`. | int | int | `5` | -| flowLogsFileMaxFileSizeMB | Set the max size in MB of flow logs files before rotation. This parameter only takes effect when `flowLogsFileEnabled` is set to `true`. | int | int | `100` | -| flowLogsFlushInterval | The period, in seconds, at which Felix exports the flow logs. | int | int | `300s` | -| flowLogsFileAggregationKindForAllowed | How much to aggregate the flow logs sent to Elasticsearch for allowed traffic. Bear in mind that changing this value may have a dramatic impact on the volume of flow logs sent to Elasticsearch. | 0-2 | [AggregationKind](#aggregationkind) | 2 | -| flowLogsFileAggregationKindForDenied | How much to aggregate the flow logs sent to Elasticsearch for denied traffic. Bear in mind that changing this value may have a dramatic impact on the volume of flow logs sent to Elasticsearch. | 0-2 | [AggregationKind](#aggregationkind) | 1 | -| flowLogsFileIncludeService | When set to `true`, include destination service information in the aggregated flow log. Note that service information will only be included when the flow can be explicitly determined to be bound to a service (e.g. pre-DNAT destination matches a service ClusterIP). | `true`, `false` | boolean | `false` | -| flowLogsFileIncludeLabels | When set to `true`, include source and destination endpoint labels in the aggregated flow log. Note that only Kubernetes endpoints or network sets are included; arbitrary networks do not contain labels. | `true`, `false` | boolean | `false` | -| flowLogsFileIncludePolicies | When set to `true`, include all policies in the aggregated flow logs that acted upon and matches the flow log traffic. | `true`, `false` | boolean | `false` | -| flowLogsDestDomainsByClient | When set to true, top-level domains are strictly associated with the source IP that originally queried the domains. (default: true) | | | -| flowLogsEnableNetworkSets | When set to `true`, include an arbitrary network set in the aggregated flow log that matches the IP address of the flow log endpoint. | `true`, `false` | boolean | `false` | -| flowLogsCollectProcessInfo | When set to `true`, Felix will load the kprobe BPF programs to collect process info. | `true`, `false` | boolean | `false` | -| flowLogsCollectTcpStats | When set to `true`, Felix will collect the TCP socket stats. | `true`, `false` | boolean | `true` | -| flowLogsCollectProcessPath | When set to `true`, along with flowLogsCollectProcessInfo, each flow log will include the full path of the executable and the arguments with which the executable was invoked. | `true`, `false` | boolean | `false` | -| flowLogsFilePerFlowProcessLimit | Specify the maximum number of flow log entries with distinct process information beyond which process information will be aggregated | int | int | `2` | -| flowLogsFileNatOutgoingPortLimit | Specify the maximum number of distinct post SNAT ports that will appear in the flowLogs | int | int | `3` | -| flowLogsFilePerFlowProcessArgsLimit | Specify the maximum number of unique arguments in the flowlogs beyond which process arguments will be aggregated | int | int | `5` | -| flowLogsFileDomainsLimit | Specify the maximum number of top-level domains to include in a flow log. This only applies to source reported flows to destinations external to the cluster. | int | int | `5` | -| statsDumpFilePath | Specify the position of the file used for dumping flow log statistics on Linux nodes. Note this is an internal setting that users shouldn't need to modify. | string | string | `/var/log/calico/stats/dump` | -| routeTableRange | _deprecated in favor of `RouteTableRanges`_ Calico programs additional Linux route tables for various purposes. `RouteTableRange` specifies the indices of the route tables that Calico should use. | | [RouteTableRanges](#routetablerange) | `""` | -| routeTableRanges | Calico programs additional Linux route tables for various purposes. `RouteTableRanges` specifies a set of table index ranges that Calico should use. Deprecates `RouteTableRange`, overrides `RouteTableRange` | | [RouteTableRanges](#routetableranges) | `[{"min": 1, "max": 250}]` | -| routeSyncDisabled | Set to `true` to disable Calico programming routes to local workloads. | boolean | boolean | `false` | -| serviceLoopPrevention | When [service IP advertisement is enabled](../../networking/configuring/advertise-service-ips.mdx), prevent routing loops to service IPs that are not in use, by dropping or rejecting packets that do not get DNAT'd by kube-proxy. Unless set to "Disabled", in which case such routing loops continue to be allowed. | `Drop`, `Reject`, `Disabled` | string | `Drop` | -| workloadSourceSpoofing | Controls whether pods can enable source IP address spoofing with the `cni.projectcalico.org/allowedSourcePrefixes` annotation. When set to `Any`, pods can use this annotation to send packets from any IP address. | `Any`, `Disabled` | string | `Disabled` | -| vxlanEnabled | Optional, you shouldn't need to change this setting as Felix calculates if VXLAN should be enabled based on the existing IP Pools. When set, this overrides whether Felix should create the VXLAN tunnel device for VXLAN networking. | `true`, `false`, unset | optional boolean | unset | -| vxlanMTU | MTU to use for the IPv4 VXLAN tunnel device. Zero value means auto-detect. Also controls NodePort MTU when eBPF enabled. | int | int | `0` | -| vxlanMTUV6 | MTU to use for the IPv6 VXLAN tunnel device. Zero value means auto-detect. Also controls NodePort MTU when eBPF enabled. | int | int | `0` | -| vxlanPort | Port to use for VXLAN traffic. A value of `0` means "use the kernel default". | int | int | `4789` | -| vxlanVNI | Virtual network ID to use for VXLAN traffic. A value of `0` means "use the kernel default". | int | int | `4096` | -| allowVXLANPacketsFromWorkloads | Set to `true` to allow VXLAN encapsulated traffic from workloads. | boolean | boolean | `false` | -| allowIPIPPacketsFromWorkloads | Set to `true` to allow IPIP encapsulated traffic from workloads. | boolean | boolean | `false` | -| windowsFlowLogsFileDirectory | Set the directory where flow logs files are stored on Windows nodes. This parameter only takes effect when `flowLogsFileEnabled` is set to `true`. | string | string | `c:\\TigeraCalico\\flowlogs` | -| windowsFlowLogsPositionFilePath | Specify the position of the external pipeline that reads flow logs on Windows nodes. This parameter only takes effect when `FlowLogsDynamicAggregationEnabled` is set to `true`. | string | string | `c:\\TigeraCalico\\flowlogs\\flows.log.pos` | -| windowsStatsDumpFilePath | Specify the position of the file used for dumping flow log statistics on Windows nodes. Note this is an internal setting that users shouldn't need to modify. | string | string | `c:\\TigeraCalico\\stats\\dump` | -| windowsDNSCacheFile | Specify the name of the file that Calico uses to preserve learnt DNS information when restarting. | string | string | `c:\\TigeraCalico\\felix-dns-cache.txt` | -| windowsDNSExtraTTL | Specify extra time in seconds to keep IPs and alias names that are learnt from DNS, in addition to each name or IP's advertised TTL. | int | int | `120` | -| windowsManageFirewallRules | Configure whether or not Felix will program Windows Firewall rules. (to allow inbound access to its own metrics ports) [Default: Disabled] | `Enabled`, `Disabled` | string | `Disabled` | -| wireguardEnabled | Enable encryption on WireGuard supported nodes in cluster. When enabled, pod to pod traffic will be sent over encrypted tunnels between the nodes. | `true`, `false` | boolean | `false` | -| wireguardEnabledV6 | Enable encryption for IPv6 on WireGuard supported nodes in cluster. When enabled, pod to pod traffic will be sent over encrypted tunnels between the nodes. | `true`, `false` | boolean | `false` | -| wireguardInterfaceName | Name of the IPv4 WireGuard interface created by Felix. If you change the name and want to clean up the previously configured interface names on each node, this is a manual process. Felix expects the name to end with either .cali or .calico suffix. | string | string | wireguard.cali | -| wireguardInterfaceNameV6 | Name of the IPv6 WireGuard interface created by Felix. If you change the name and want to clean up the previously configured interface names on each node, this is a manual process. Felix expects the name to end with either .cali or .calico suffix. | string | string | wg-v6.cali | -| wireguardListeningPort | Port used by WireGuard tunnels. Felix sets up WireGuard tunnel on each node specified by this port. Available for configuration only in the global FelixConfiguration resource; setting it per host, config-file or environment variable will not work. | 1-65535 | int | 51820 | -| wireguardListeningPortV6 | Port used by IPv6 WireGuard tunnels. Felix sets up an IPv6 WireGuard tunnel on each node specified by this port. Available for configuration only in the global FelixConfiguration resource; setting it per host, config-file or environment variable will not work. | 1-65535 | int | 51821 | -| wireguardMTU | MTU set on the WireGuard interface created by Felix. Zero value means auto-detect. See [Configuring MTU](../../networking/configuring/mtu.mdx). | int | int | 0 | -| wireguardMTUV6 | MTU set on the IPv6 WireGuard interface created by Felix. Zero value means auto-detect. See [Configuring MTU](../../networking/configuring/mtu.mdx). | int | int | 0 | -| wireguardRoutingRulePriority | WireGuard routing rule priority value set up by Felix. If you change the default value, set it to a value most appropriate to routing rules for your nodes. | 1-32765 | int | 99 | -| wireguardHostEncryptionEnabled | **Experimental**: Adds host-namespace workload IP's to WireGuard's list of peers. Should **not** be enabled when WireGuard is enabled on a cluster's control plane node, as networking deadlock can occur. | true, false | boolean | false | -| wireguardKeepAlive | WireguardKeepAlive controls Wireguard PersistentKeepalive option. Set 0 to disable. [Default: 0] | `5s`, `10s`, `1m` etc. | duration | `0` | -| xdpRefreshInterval | Period at which Felix re-checks the XDP state in the dataplane to ensure that no other process has accidentally broken $[prodname]'s rules. Set to 0 to disable XDP refresh. | `5s`, `10s`, `1m` etc. | duration | `90s` | -| xdpEnabled | When `bpfEnabled` is `false`: enable XDP acceleration for host endpoint policies. When `bpfEnabled` is `true`, XDP is automatically used for Calico policy where that makes sense, regardless of this setting. [Default: `true`] | true,false | boolean | `true` | -| dnsCacheFile | The name of the file that Felix uses to preserve learnt DNS information when restarting. | file name | string | `/var/run/calico/felix-dns-cache.txt` | -| dnsCacheSaveInterval | The period, in seconds, at which Felix saves learnt DNS information to the cache file. | `5s`, `10s`, `1m` etc. | duration | `60s` | -| dnsCacheEpoch | An arbitrary number that can be changed, at runtime, to tell Felix to discard all its learnt DNS information. | int | int | `0` | -| dnsExtraTTL | Extra time to keep IPs and alias names that are learnt from DNS, in addition to each name or IP's advertised TTL. | `5s`, `10s`, `1m` etc. | duration | `0s` | -| dnsTrustedServers | The DNS servers that Felix should trust. Each entry here must be `[:]` - indicating an explicit DNS server IP - or `k8s-service:[/][:port]` - indicating a Kubernetes DNS service. `` defaults to the first service port, or 53 for an IP, and `` to `kube-system`. An IPv6 address with a port must use the square brackets convention, for example `[fd00:83a6::12]:5353`. Note that Felix (calico-node) will need RBAC permission to read the details of each service specified by a `k8s-service:...` form. | IPs or service names | comma-separated strings | `k8s-service:kube-dns` | -| dnsLogsFileEnabled | Set to `true`, enables DNS logs. If set to `false` no DNS logging will occur. DNS logs are written to a file `dns.log` and sent to Elasticsearch. The location of this file can be configured using the `DNSLogsFileDirectory` field. File rotation settings for this `dns.log` file can be configured using the fields `DNSLogsFileMaxFiles` and `DNSLogsFileMaxFileSizeMB`. Note that DNS log exports to Elasticsearch are dependent on DNS logs getting written to this file. Setting this parameter to `false` will disable DNS logs. | `true`, `false` | boolean | `false` | -| dnsLogsFileDirectory | The directory where DNS logs files are stored. This parameter only takes effect when `DNSLogsFileEnabled` is `true`. | directory | string | `/var/log/calico/dnslogs` | -| dnsLogsFileMaxFiles | The number of files to keep when rotating DNS log files. This parameter only takes effect when `DNSLogsFileEnabled` is `true`. | int | int | `5` | -| dnsLogsFileMaxFileSizeMB | The max size in MB of DNS log files before rotation. This parameter only takes effect when `DNSLogsFileEnabled` is `true`. | int | int | `100` | -| dnsLogsFlushInterval | The period, in seconds, at which Felix exports DNS logs. | int | int | `300s` | -| dnsLogsFileAggregationKind | How much to aggregate DNS logs. Bear in mind that changing this value may have a dramatic impact on the volume of flow logs sent to Elasticsearch. `0` means no aggregation, `1` means aggregate similar DNS logs from workloads in the same ReplicaSet. | `0`,`1` | int | `1` | -| dnsLogsFileIncludeLabels | Whether to include client and server workload labels in DNS logs. | `true`, `false` | boolean | `true` | -| dnsLogsFilePerNodeLimit | Limit on the number of DNS logs that can be emitted within each flush interval. When this limit has been reached, Felix counts the number of unloggable DNS responses within the flush interval, and emits a WARNING log with that count at the same time as it flushes the buffered DNS logs. | int | int | `0` (no limit) | -| dnsLogsLatency | Indicates to include measurements of DNS request/response latency in each DNS log. | `true`, `false` | boolean | `true` | -| dnsPolicyMode | DNSPolicyMode specifies how DNS policy programming will be handled. | `NoDelay`, `DelayDNSResponse`, `DelayDeniedPacket` | [DNSPolicyMode](#dnspolicymode) | `DelayDeniedPacket` | -| bpfDNSPolicyMode | BPFDNSPolicyMode specifies how DNS policy programming will be handled. | `NoDelay`, `Inline` | [BPFDNSPolicyMode](#bpfdnspolicymode) | `Inline` | -| dnsPolicyNfqueueID | DNSPolicyNfqueueID is the NFQUEUE ID to use for DNS Policy re-evaluation when the domains IP hasn't been programmed to ipsets yet. This value can be changed to avoid conflicts with other users of NFQUEUEs. Used when `DNSPolicyMode` is `DelayDeniedPacket`. | 0-65535 | int | `100` | -| dnsPolicyNfqueueSize | DNSPolicyNfqueueID is the size of the NFQUEUE for DNS policy re-evaluation. This is the maximum number of denied packets that may be queued up pending re-evaluation. Used when `DNSPolicyMode` is `DelayDeniedPacket`. | 0-65535 | int | `100` | -| dnsPacketsNfqueueID | DNSPacketsNfqueueID is the NFQUEUE ID to use for capturing DNS packets to ensure programming IPSets occurs before the response is released. Used when `DNSPolicyMode` is `DelayDNSResponse`. | 0-65535 | int | `101` | -| dnsPacketsNfqueueSize | DNSPacketsNfqueueSize is the size of the NFQUEUE for captured DNS packets. This is the maximum number of DNS packets that may be queued awaiting programming in the dataplane. Used when `DNSPolicyMode` is `DelayDNSResponse`. | 0-65535 | int | `100` | -| dnsPacketsNfqueueMaxHoldDuration | DNSPacketsNfqueueMaxHoldDuration is the max length of time to hold on to a DNS response while waiting for the dataplane to be programmed. Used when `DNSPolicyMode` is `DelayDNSResponse`. | `5s`, `10s`, `1m` etc. | duration | `3s` | -| bpfEnabled | Enable eBPF dataplane mode. eBPF mode has some limitations, see the [HOWTO guide](../../operations/ebpf/enabling-ebpf.mdx) for more details. | true, false | boolean | false | -| bpfDisableUnprivileged | If true, Felix sets the kernel.unprivileged_bpf_disabled sysctl to disable unprivileged use of BPF. This ensures that unprivileged users cannot access Calico's BPF maps and cannot insert their own BPF programs to interfere with the ones that $[prodname] installs. | true, false | boolean | true | -| bpfLogLevel | In eBPF dataplane mode, the log level used by the BPF programs. The logs are emitted to the BPF trace pipe, accessible with the command `tc exec bpf debug`. This is a tech preview feature and subject to change in future releases. | Off,Info,Debug | string | Off | -| bpfDataIfacePattern | In eBPF dataplane mode, controls which interfaces Felix should attach BPF programs to catch traffic to/from the external network. This needs to match the interfaces that Calico workload traffic flows over as well as any interfaces that handle incoming traffic to NodePorts and services from outside the cluster. It should not match the workload interfaces (usually named cali...).. This is a tech preview feature and subject to change in future releases. | regular expression | string | ^((en|wl|ww|sl|ib)[Popsx].\*|(eth|wlan|wwan|bond).\*|tunl0$|vxlan.calico$|vxlan-v6.calico$|wireguard.cali$|wg-v6.cali$) | -| bpfConnectTimeLoadBalancingEnabled | In eBPF dataplane mode, controls whether Felix installs the connect-time load balancer. In the current release, the connect-time load balancer is required for the host to reach kubernetes services. This is a tech preview feature and subject to change in future releases. | true,false | boolean | true | -| bpfExternalServiceMode | In eBPF dataplane mode, controls how traffic from outside the cluster to NodePorts and ClusterIPs is handled. In Tunnel mode, packet is tunneled from the ingress host to the host with the backing pod and back again. In DSR mode, traffic is tunneled to the host with the backing pod and then returned directly; this requires a network that allows direct return. | Tunnel,DSR | string | Tunnel | -| bpfKubeProxyIptablesCleanupEnabled | In eBPF dataplane mode, controls whether Felix will clean up the iptables rules created by the Kubernetes `kube-proxy`; should only be enabled if `kube-proxy` is not running. This is a tech preview feature and subject to change in future releases. | true,false | boolean | true | -| bpfKubeProxyMinSyncPeriod | In eBPF dataplane mode, controls the minimum time between dataplane updates for Felix's embedded `kube-proxy` implementation. | `5s`, `10s`, `1m` etc. | duration | `1s` | -| BPFKubeProxyEndpointSlicesEnabled | In eBPF dataplane mode, controls whether Felix's embedded kube-proxy derives its services from Kubernetes' EndpointSlices resources. Using EndpointSlices is more efficient but it requires EndpointSlices support to be enabled at the Kubernetes API server. | true,false | boolean | false | -| bpfMapSizeConntrack | In eBPF dataplane mode, controls the size of the conntrack map. | int | int | 512000 | -| bpfMapSizeIPSets | In eBPF dataplane mode, controls the size of the ipsets map. | int | int | 1048576 | -| bpfMapSizeNATAffinity | In eBPF dataplane mode, controls the size of the NAT affinity map. | int | int | 65536 | -| bpfMapSizeNATFrontend | In eBPF dataplane mode, controls the size of the NAT front end map. | int | int | 65536 | -| bpfMapSizeNATBackend | In eBPF dataplane mode, controls the size of the NAT back end map. | int | int | 262144 | -| bpfMapSizeRoute | In eBPF dataplane mode, controls the size of the route map. | int | int | 262144 | -| bpfPolicyDebugEnabled | In eBPF dataplane mode, controls whether Felix will collect policy dump for each interface. | true, false | boolean | true | -| routeSource | Where Felix gets is routing information from for VXLAN and the BPF dataplane. The CalicoIPAM setting is more efficient because it supports route aggregation, but it only works when Calico's IPAM or host-local IPAM is in use. Use the WorkloadIPs setting if you are using Calico's VXLAN or BPF dataplane and not using Calico IPAM or host-local IPAM. | CalicoIPAM,WorkloadIPs | string | `CalicoIPAM` | -| mtuIfacePattern | Pattern used to discover the host's interface for MTU auto-detection. | regex | string | ^((en|wl|ww|sl|ib)[opsvx].*|(eth|wlan|wwan).*) | -| bpfForceTrackPacketsFromIfaces | Forces traffic from these interfaces in BPF mode to skip Calico's iptables NOTRACK rule, allowing traffic from those interfaces to be tracked by Linux conntrack. Use only for interfaces that are not used for the Calico fabric, for example, a docker bridge device for non-Calico-networked containers. | A list of strings | A list of strings | docker+ | -| bpfDisableGROForIfaces | BPFDisableGROForIfaces is a regular expression that controls which interfaces Felix should disable the Generic Receive Offload [GRO] option. It should not match the workload interfaces (usually named cali...). | regex | string | "" | -| egressIPSupport | Defines three different support modes for egress gateway function. `Disabled` means egress gateways are not supported. `EnabledPerNamespace` means egress gateway function is enabled and can be configured on a per-namespace basis (but per-pod egress annotations are ignored). `EnabledPerNamespaceOrPerPod` means egress gateway function is enabled and can be configured per-namespace or per-pod (with per-pod egress annotations overriding namespace annotations). | Disabled,
EnabledPerNamespace,
EnabledPerNamespaceOrPerPod | string | `Disabled` | -| egressIPVXLANPort | Port to use for egress gateway VXLAN traffic. A value of `0` means "use the kernel default". | int | int | `4790` | -| egressIPVXLANVNI | Virtual network ID to use for egress gateway VXLAN traffic. A value of `0` means "use the kernel default". | int | int | `4097` | -| egressIPRoutingRulePriority | Controls the priority value to use for the egress gateway routing rule. | int | int | `100` | -| egressGatewayPollInterval | Controls the interval at which Felix will poll remote egress gateways to check their health. Only Egress Gateways with a named "health" port will be polled in this way. Egress Gateways that fail the health check will be taken our of use as if they have been deleted. | `5s`, `10s`, `1m` etc. | duration | `10s` | -| egressGatewayPollFailureCount | Controls the minimum number of poll failures before a remote Egress Gateway is considered to have failed. | int | int | `3` | -| externalNetworkSupport | Defines two different support modes for external network function. `Disabled` means external network is not supported. `Enabled` means external network support is enabled. | Disabled,
Enabled | string | `Disabled` | -| externalNetworkRoutingRulePriority | controls the priority value to use for the external network routing rule. | int | int | `102` | -| captureDir | Controls the directory where packet capture files are stored. | string | string | `/var/log/calico/pcap` | -| captureMaxSizeBytes | Controls the maximum size in bytes for a packet capture file before rotation. | int | int | `10000000` | -| captureRotationSeconds | Controls the rotation period in seconds for a packet capture file. | int | int | `3600` | -| captureMaxFiles | Controls the maximum number rotated packet capture files. | int | int | `2` | +#### Datastore connection + + + +#### Process: Feature detection/overrides + + + +#### Process: Go runtime + + + +#### Process: Health port and timeouts + + + +#### Process: Logging + + + +#### Process: Prometheus metrics + + + +#### Dataplane: Common + + + +#### Dataplane: iptables + + + +#### Dataplane: nftables + + + +#### Dataplane: eBPF + + + +#### Dataplane: Windows + + + +#### Dataplane: OpenStack support + + + +#### Dataplane: XDP acceleration for iptables dataplane + + + +#### Overlay: VXLAN overlay + + + +#### Overlay: IP-in-IP + + + +#### Overlay: Wireguard + + + +#### Overlay: IPSec + + + +#### Flow logs: Prometheus reports + + + +#### Flow logs: Syslog reports + + + +#### Flow logs: file reports + + + +#### DNS logs / policy + + + +#### L7 logs + + + +#### AWS integration + + + +#### Egress gateway + + + +#### External network support + + + +#### Packet capture + + + +#### L7 proxy + + +#### Debug/test-only (generally unsupported) + + + +#### Usage reporting + + \* When `dropActionOverride` is set to `LogAndDrop` or `LogAndAccept`, the `syslog` entries look something like the following. @@ -301,21 +332,20 @@ failsafeOutboundHostPorts: ### DNSPolicyMode -| Value | Description | -| ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| DelayDeniedPacket | Felix delays any denied packet that traversed a policy that included egress domain matches, but did not match. The packet is released after a fixed time, or after the destination IP address was programmed. | +| Value | Description | +| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | +| DelayDeniedPacket | Felix delays any denied packet that traversed a policy that included egress domain matches, but did not match. The packet is released after a fixed time, or after the destination IP address was programmed. | | DelayDNSResponse | Felix delays any DNS response until related IPSets are programmed. This introduces some latency to all DNS packets (even when no IPSet programming is required), but it ensures policy hit statistics are accurate. This is the recommended setting when you are making use of staged policies or policy rule hit statistics. A Linux kernel version of 3.13 or greater is required to use `DelayDNSResponse`. For earlier kernel versions, this value is modified to `DelayDeniedPacket`. | -| NoDelay | Felix does not introduce any delay to the packets. DNS rules may not have been programmed by the time the first packet traverses the policy rules. Client applications need to handle reconnection attempts if initial connection attempts fail. This may be problematic for some applications or for very low DNS TTLs. | +| NoDelay | Felix does not introduce any delay to the packets. DNS rules may not have been programmed by the time the first packet traverses the policy rules. Client applications need to handle reconnection attempts if initial connection attempts fail. This may be problematic for some applications or for very low DNS TTLs. | On Windows, or when using the eBPF dataplane, this setting is ignored. Windows always uses `NoDelay` while eBPF has its own [BPFDNSPolicyMode](#bpfdnspolicymode) option. - ### BPFDNSPolicyMode -| Value | Description | -| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -| Inline | Felix does not introduce any delay to any packets. Felix's eBPF programs parse DNS responses and program policy rules immediately, before the DNS response is passed to the application. This only applies to wildcard prefixes: `*.x.y.z` will be processed in this manner, but wildcards such as `x.*.y.z` will not match. A Linux kernel version of 5.17 or greater is required. | -| NoDelay | Felix does not introduce any delay to the packets. DNS rules may not have been programmed by the time the first packet traverses the policy rules. Client applications need to handle reconnection attempts if initial connection attempts fail. This may be problematic for some applications or for very low DNS TTLs. | +| Value | Description | +| ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Inline | Felix does not introduce any delay to any packets. Felix's eBPF programs parse DNS responses and program policy rules immediately, before the DNS response is passed to the application. This only applies to wildcard prefixes: `*.x.y.z` will be processed in this manner, but wildcards such as `x.*.y.z` will not match. A Linux kernel version of 5.17 or greater is required. | +| NoDelay | Felix does not introduce any delay to the packets. DNS rules may not have been programmed by the time the first packet traverses the policy rules. Client applications need to handle reconnection attempts if initial connection attempts fail. This may be problematic for some applications or for very low DNS TTLs. | ### RouteTableRange