{ "Comment": "This file generated by calico-felix-docgen, DO NOT EDIT.", "Groups": [ { "Name": "Datastore connection", "Fields": [ { "Group": "Datastore connection", "GroupWithSortPrefix": "00 Datastore connection", "NameConfigFile": "DatastoreType", "NameEnvVar": "FELIX_DatastoreType", "NameYAML": "", "NameGoAPI": "", "StringSchema": "One of: `etcdv3`, `kubernetes` (case insensitive)", "StringSchemaHTML": "One of: etcdv3, kubernetes (case insensitive)", "StringDefault": "etcdv3", "ParsedDefault": "etcdv3", "ParsedDefaultJSON": "\"etcdv3\"", "ParsedType": "string", "YAMLType": "", "YAMLSchema": "", "YAMLEnumValues": null, "YAMLSchemaHTML": "", "YAMLDefault": "", "Required": true, "OnParseFailure": "Exit", "AllowedConfigSources": "LocalOnly", "Description": "Controls which datastore driver Felix will use. Typically, this is detected from the environment\nand it does not need to be set manually. (For example, if `KUBECONFIG` is set, the kubernetes datastore driver\nwill be used by default).", "DescriptionHTML": "

Controls which datastore driver Felix will use. Typically, this is detected from the environment\nand it does not need to be set manually. (For example, if KUBECONFIG is set, the kubernetes datastore driver\nwill be used by default).

", "UserEditable": true, "GoType": "" }, { "Group": "Datastore connection", "GroupWithSortPrefix": "00 Datastore connection", "NameConfigFile": "EtcdAddr", "NameEnvVar": "FELIX_EtcdAddr", "NameYAML": "", "NameGoAPI": "", "StringSchema": "String matching regex `^[^:/]+:\\d+$`", "StringSchemaHTML": "String matching regex ^[^:/]+:\\d+$", "StringDefault": "127.0.0.1:2379", "ParsedDefault": "127.0.0.1:2379", "ParsedDefaultJSON": "\"127.0.0.1:2379\"", "ParsedType": "string", "YAMLType": "", "YAMLSchema": "", "YAMLEnumValues": null, "YAMLSchemaHTML": "", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "LocalOnly", "Description": "When using the `etcdv3` datastore driver, the etcd server and port to connect to. If EtcdEndpoints\nis also specified, it takes precedence.", "DescriptionHTML": "

When using the etcdv3 datastore driver, the etcd server and port to connect to. If EtcdEndpoints\nis also specified, it takes precedence.

", "UserEditable": true, "GoType": "" }, { "Group": "Datastore connection", "GroupWithSortPrefix": "00 Datastore connection", "NameConfigFile": "EtcdCaFile", "NameEnvVar": "FELIX_EtcdCaFile", "NameYAML": "", "NameGoAPI": "", "StringSchema": "Path to file, which must exist", "StringSchemaHTML": "Path to file, which must exist", "StringDefault": "", "ParsedDefault": "", "ParsedDefaultJSON": "\"\"", "ParsedType": "string", "YAMLType": "", "YAMLSchema": "", "YAMLEnumValues": null, "YAMLSchemaHTML": "", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "LocalOnly", "Description": "When using the `etcdv3` datastore driver, path to TLS CA file to use when connecting to\netcd. If the CA file is specified, the other TLS parameters are mandatory.", "DescriptionHTML": "

When using the etcdv3 datastore driver, path to TLS CA file to use when connecting to\netcd. If the CA file is specified, the other TLS parameters are mandatory.

", "UserEditable": true, "GoType": "" }, { "Group": "Datastore connection", "GroupWithSortPrefix": "00 Datastore connection", "NameConfigFile": "EtcdCertFile", "NameEnvVar": "FELIX_EtcdCertFile", "NameYAML": "", "NameGoAPI": "", "StringSchema": "Path to file, which must exist", "StringSchemaHTML": "Path to file, which must exist", "StringDefault": "", "ParsedDefault": "", "ParsedDefaultJSON": "\"\"", "ParsedType": "string", "YAMLType": "", "YAMLSchema": "", "YAMLEnumValues": null, "YAMLSchemaHTML": "", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "LocalOnly", "Description": "When using the `etcdv3` datastore driver, path to TLS certificate file to use when connecting to\netcd. If the certificate file is specified, the other TLS parameters are mandatory.", "DescriptionHTML": "

When using the etcdv3 datastore driver, path to TLS certificate file to use when connecting to\netcd. If the certificate file is specified, the other TLS parameters are mandatory.

", "UserEditable": true, "GoType": "" }, { "Group": "Datastore connection", "GroupWithSortPrefix": "00 Datastore connection", "NameConfigFile": "EtcdEndpoints", "NameEnvVar": "FELIX_EtcdEndpoints", "NameYAML": "", "NameGoAPI": "", "StringSchema": "List of HTTP endpoints: comma-delimited list of `http(s)://hostname:port`", "StringSchemaHTML": "List of HTTP endpoints: comma-delimited list of http(s)://hostname:port", "StringDefault": "", "ParsedDefault": "[]", "ParsedDefaultJSON": "null", "ParsedType": "[]string", "YAMLType": "", "YAMLSchema": "", "YAMLEnumValues": null, "YAMLSchemaHTML": "", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "LocalOnly", "Description": "When using the `etcdv3` datastore driver, comma-delimited list of etcd endpoints to connect to,\nreplaces EtcdAddr and EtcdScheme.", "DescriptionHTML": "

When using the etcdv3 datastore driver, comma-delimited list of etcd endpoints to connect to,\nreplaces EtcdAddr and EtcdScheme.

", "UserEditable": true, "GoType": "" }, { "Group": "Datastore connection", "GroupWithSortPrefix": "00 Datastore connection", "NameConfigFile": "EtcdKeyFile", "NameEnvVar": "FELIX_EtcdKeyFile", "NameYAML": "", "NameGoAPI": "", "StringSchema": "Path to file, which must exist", "StringSchemaHTML": "Path to file, which must exist", "StringDefault": "", "ParsedDefault": "", "ParsedDefaultJSON": "\"\"", "ParsedType": "string", "YAMLType": "", "YAMLSchema": "", "YAMLEnumValues": null, "YAMLSchemaHTML": "", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "LocalOnly", "Description": "When using the `etcdv3` datastore driver, path to TLS private key file to use when connecting to\netcd. If the key file is specified, the other TLS parameters are mandatory.", "DescriptionHTML": "

When using the etcdv3 datastore driver, path to TLS private key file to use when connecting to\netcd. If the key file is specified, the other TLS parameters are mandatory.

", "UserEditable": true, "GoType": "" }, { "Group": "Datastore connection", "GroupWithSortPrefix": "00 Datastore connection", "NameConfigFile": "EtcdScheme", "NameEnvVar": "FELIX_EtcdScheme", "NameYAML": "", "NameGoAPI": "", "StringSchema": "One of: `http`, `https` (case insensitive)", "StringSchemaHTML": "One of: http, https (case insensitive)", "StringDefault": "http", "ParsedDefault": "http", "ParsedDefaultJSON": "\"http\"", "ParsedType": "string", "YAMLType": "", "YAMLSchema": "", "YAMLEnumValues": null, "YAMLSchemaHTML": "", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "LocalOnly", "Description": "EtcdAddr: when using the `etcdv3` datastore driver, the URL scheme to use. If EtcdEndpoints\nis also specified, it takes precedence.", "DescriptionHTML": "

EtcdAddr: when using the etcdv3 datastore driver, the URL scheme to use. If EtcdEndpoints\nis also specified, it takes precedence.

", "UserEditable": true, "GoType": "" }, { "Group": "Datastore connection", "GroupWithSortPrefix": "00 Datastore connection", "NameConfigFile": "FelixHostname", "NameEnvVar": "FELIX_FelixHostname", "NameYAML": "", "NameGoAPI": "", "StringSchema": "String matching regex `^[a-zA-Z0-9_.-]+$`", "StringSchemaHTML": "String matching regex ^[a-zA-Z0-9_.-]+$", "StringDefault": "", "ParsedDefault": "", "ParsedDefaultJSON": "\"\"", "ParsedType": "string", "YAMLType": "", "YAMLSchema": "", "YAMLEnumValues": null, "YAMLSchemaHTML": "", "YAMLDefault": "", "Required": true, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "LocalOnly", "Description": "The name of this node, used to identify resources in the datastore that belong to this node.\nAuto-detected from the node's hostname if not provided.", "DescriptionHTML": "

The name of this node, used to identify resources in the datastore that belong to this node.\nAuto-detected from the node's hostname if not provided.

", "UserEditable": true, "GoType": "" }, { "Group": "Datastore connection", "GroupWithSortPrefix": "00 Datastore connection", "NameConfigFile": "TyphaAddr", "NameEnvVar": "FELIX_TyphaAddr", "NameYAML": "", "NameGoAPI": "", "StringSchema": "String matching regex `^[^:/]+:\\d+$`", "StringSchemaHTML": "String matching regex ^[^:/]+:\\d+$", "StringDefault": "", "ParsedDefault": "", "ParsedDefaultJSON": "\"\"", "ParsedType": "string", "YAMLType": "", "YAMLSchema": "", "YAMLEnumValues": null, "YAMLSchemaHTML": "", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "LocalOnly", "Description": "If set, tells Felix to connect to Typha at the given address and port. Overrides TyphaK8sServiceName.", "DescriptionHTML": "

If set, tells Felix to connect to Typha at the given address and port. Overrides TyphaK8sServiceName.

", "UserEditable": true, "GoType": "" }, { "Group": "Datastore connection", "GroupWithSortPrefix": "00 Datastore connection", "NameConfigFile": "TyphaCAFile", "NameEnvVar": "FELIX_TyphaCAFile", "NameYAML": "", "NameGoAPI": "", "StringSchema": "Path to file, which must exist", "StringSchemaHTML": "Path to file, which must exist", "StringDefault": "", "ParsedDefault": "", "ParsedDefaultJSON": "\"\"", "ParsedType": "string", "YAMLType": "", "YAMLSchema": "", "YAMLEnumValues": null, "YAMLSchemaHTML": "", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "LocalOnly", "Description": "Path to the TLS CA file to use when communicating with Typha. If this parameter is specified,\nthe other TLS parameters must also be specified.", "DescriptionHTML": "

Path to the TLS CA file to use when communicating with Typha. If this parameter is specified,\nthe other TLS parameters must also be specified.

", "UserEditable": true, "GoType": "" }, { "Group": "Datastore connection", "GroupWithSortPrefix": "00 Datastore connection", "NameConfigFile": "TyphaCN", "NameEnvVar": "FELIX_TyphaCN", "NameYAML": "", "NameGoAPI": "", "StringSchema": "String", "StringSchemaHTML": "String", "StringDefault": "", "ParsedDefault": "", "ParsedDefaultJSON": "\"\"", "ParsedType": "string", "YAMLType": "", "YAMLSchema": "", "YAMLEnumValues": null, "YAMLSchemaHTML": "", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "LocalOnly", "Description": "Common name to use when authenticating to Typha over TLS. If any TLS parameters are specified then one of\nTyphaCN and TyphaURISAN must be set.", "DescriptionHTML": "

Common name to use when authenticating to Typha over TLS. If any TLS parameters are specified then one of\nTyphaCN and TyphaURISAN must be set.

", "UserEditable": true, "GoType": "" }, { "Group": "Datastore connection", "GroupWithSortPrefix": "00 Datastore connection", "NameConfigFile": "TyphaCertFile", "NameEnvVar": "FELIX_TyphaCertFile", "NameYAML": "", "NameGoAPI": "", "StringSchema": "Path to file, which must exist", "StringSchemaHTML": "Path to file, which must exist", "StringDefault": "", "ParsedDefault": "", "ParsedDefaultJSON": "\"\"", "ParsedType": "string", "YAMLType": "", "YAMLSchema": "", "YAMLEnumValues": null, "YAMLSchemaHTML": "", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "LocalOnly", "Description": "Path to the TLS certificate to use when communicating with Typha. If this parameter is specified,\nthe other TLS parameters must also be specified.", "DescriptionHTML": "

Path to the TLS certificate to use when communicating with Typha. If this parameter is specified,\nthe other TLS parameters must also be specified.

", "UserEditable": true, "GoType": "" }, { "Group": "Datastore connection", "GroupWithSortPrefix": "00 Datastore connection", "NameConfigFile": "TyphaK8sNamespace", "NameEnvVar": "FELIX_TyphaK8sNamespace", "NameYAML": "", "NameGoAPI": "", "StringSchema": "String", "StringSchemaHTML": "String", "StringDefault": "kube-system", "ParsedDefault": "kube-system", "ParsedDefaultJSON": "\"kube-system\"", "ParsedType": "string", "YAMLType": "", "YAMLSchema": "", "YAMLEnumValues": null, "YAMLSchemaHTML": "", "YAMLDefault": "", "Required": true, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "LocalOnly", "Description": "Namespace to look in when looking for Typha's service (see TyphaK8sServiceName).", "DescriptionHTML": "

Namespace to look in when looking for Typha's service (see TyphaK8sServiceName).

", "UserEditable": true, "GoType": "" }, { "Group": "Datastore connection", "GroupWithSortPrefix": "00 Datastore connection", "NameConfigFile": "TyphaK8sServiceName", "NameEnvVar": "FELIX_TyphaK8sServiceName", "NameYAML": "", "NameGoAPI": "", "StringSchema": "String", "StringSchemaHTML": "String", "StringDefault": "", "ParsedDefault": "", "ParsedDefaultJSON": "\"\"", "ParsedType": "string", "YAMLType": "", "YAMLSchema": "", "YAMLEnumValues": null, "YAMLSchemaHTML": "", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "LocalOnly", "Description": "If set, tells Felix to connect to Typha by looking up the Endpoints of the given Kubernetes\nService in namespace specified by TyphaK8sNamespace.", "DescriptionHTML": "

If set, tells Felix to connect to Typha by looking up the Endpoints of the given Kubernetes\nService in namespace specified by TyphaK8sNamespace.

", "UserEditable": true, "GoType": "" }, { "Group": "Datastore connection", "GroupWithSortPrefix": "00 Datastore connection", "NameConfigFile": "TyphaKeyFile", "NameEnvVar": "FELIX_TyphaKeyFile", "NameYAML": "", "NameGoAPI": "", "StringSchema": "Path to file, which must exist", "StringSchemaHTML": "Path to file, which must exist", "StringDefault": "", "ParsedDefault": "", "ParsedDefaultJSON": "\"\"", "ParsedType": "string", "YAMLType": "", "YAMLSchema": "", "YAMLEnumValues": null, "YAMLSchemaHTML": "", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "LocalOnly", "Description": "Path to the TLS private key to use when communicating with Typha. If this parameter is specified,\nthe other TLS parameters must also be specified.", "DescriptionHTML": "

Path to the TLS private key to use when communicating with Typha. If this parameter is specified,\nthe other TLS parameters must also be specified.

", "UserEditable": true, "GoType": "" }, { "Group": "Datastore connection", "GroupWithSortPrefix": "00 Datastore connection", "NameConfigFile": "TyphaReadTimeout", "NameEnvVar": "FELIX_TyphaReadTimeout", "NameYAML": "", "NameGoAPI": "", "StringSchema": "Seconds (floating point)", "StringSchemaHTML": "Seconds (floating point)", "StringDefault": "30", "ParsedDefault": "30s", "ParsedDefaultJSON": "30000000000", "ParsedType": "time.Duration", "YAMLType": "", "YAMLSchema": "", "YAMLEnumValues": null, "YAMLSchemaHTML": "", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "LocalOnly", "Description": "Read timeout when reading from the Typha connection. If typha sends no data for this long,\nFelix will exit and restart. (Note that Typha sends regular pings so traffic is always expected.)", "DescriptionHTML": "

Read timeout when reading from the Typha connection. If typha sends no data for this long,\nFelix will exit and restart. (Note that Typha sends regular pings so traffic is always expected.)

", "UserEditable": true, "GoType": "" }, { "Group": "Datastore connection", "GroupWithSortPrefix": "00 Datastore connection", "NameConfigFile": "TyphaURISAN", "NameEnvVar": "FELIX_TyphaURISAN", "NameYAML": "", "NameGoAPI": "", "StringSchema": "String", "StringSchemaHTML": "String", "StringDefault": "", "ParsedDefault": "", "ParsedDefaultJSON": "\"\"", "ParsedType": "string", "YAMLType": "", "YAMLSchema": "", "YAMLEnumValues": null, "YAMLSchemaHTML": "", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "LocalOnly", "Description": "URI SAN to use when authenticating to Typha over TLS. If any TLS parameters are specified then one of\nTyphaCN and TyphaURISAN must be set.", "DescriptionHTML": "

URI SAN to use when authenticating to Typha over TLS. If any TLS parameters are specified then one of\nTyphaCN and TyphaURISAN must be set.

", "UserEditable": true, "GoType": "" }, { "Group": "Datastore connection", "GroupWithSortPrefix": "00 Datastore connection", "NameConfigFile": "TyphaWriteTimeout", "NameEnvVar": "FELIX_TyphaWriteTimeout", "NameYAML": "", "NameGoAPI": "", "StringSchema": "Seconds (floating point)", "StringSchemaHTML": "Seconds (floating point)", "StringDefault": "10", "ParsedDefault": "10s", "ParsedDefaultJSON": "10000000000", "ParsedType": "time.Duration", "YAMLType": "", "YAMLSchema": "", "YAMLEnumValues": null, "YAMLSchemaHTML": "", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "LocalOnly", "Description": "Write timeout when writing data to Typha.", "DescriptionHTML": "

Write timeout when writing data to Typha.

", "UserEditable": true, "GoType": "" } ] }, { "Name": "Process: Feature detection/overrides", "Fields": [ { "Group": "Process: Feature detection/overrides", "GroupWithSortPrefix": "00 Process: Feature detection/overrides", "NameConfigFile": "FeatureDetectOverride", "NameEnvVar": "FELIX_FeatureDetectOverride", "NameYAML": "featureDetectOverride", "NameGoAPI": "FeatureDetectOverride", "StringSchema": "Comma-delimited list of key=value pairs", "StringSchemaHTML": "Comma-delimited list of key=value pairs", "StringDefault": "", "ParsedDefault": "map[]", "ParsedDefaultJSON": "null", "ParsedType": "map[string]string", "YAMLType": "string", "YAMLSchema": "String matching the regular expression `^([a-zA-Z0-9-_]+=(true|false|),)*([a-zA-Z0-9-_]+=(true|false|))?$`.", "YAMLEnumValues": null, "YAMLSchemaHTML": "String matching the regular expression ^([a-zA-Z0-9-_]+=(true|false|),)*([a-zA-Z0-9-_]+=(true|false|))?$.", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Used to override feature detection based on auto-detected platform\ncapabilities. Values are specified in a comma separated list with no spaces, example;\n\"SNATFullyRandom=true,MASQFullyRandom=false,RestoreSupportsLock=\". A value of \"true\" or \"false\" will\nforce enable/disable feature, empty or omitted values fall back to auto-detection.", "DescriptionHTML": "

Used to override feature detection based on auto-detected platform\ncapabilities. Values are specified in a comma separated list with no spaces, example;\n\"SNATFullyRandom=true,MASQFullyRandom=false,RestoreSupportsLock=\". A value of \"true\" or \"false\" will\nforce enable/disable feature, empty or omitted values fall back to auto-detection.

", "UserEditable": true, "GoType": "string" }, { "Group": "Process: Feature detection/overrides", "GroupWithSortPrefix": "00 Process: Feature detection/overrides", "NameConfigFile": "FeatureGates", "NameEnvVar": "FELIX_FeatureGates", "NameYAML": "featureGates", "NameGoAPI": "FeatureGates", "StringSchema": "Comma-delimited list of key=value pairs", "StringSchemaHTML": "Comma-delimited list of key=value pairs", "StringDefault": "", "ParsedDefault": "map[]", "ParsedDefaultJSON": "null", "ParsedType": "map[string]string", "YAMLType": "string", "YAMLSchema": "String matching the regular expression `^([a-zA-Z0-9-_]+=([^=]+),)*([a-zA-Z0-9-_]+=([^=]+))?$`.", "YAMLEnumValues": null, "YAMLSchemaHTML": "String matching the regular expression ^([a-zA-Z0-9-_]+=([^=]+),)*([a-zA-Z0-9-_]+=([^=]+))?$.", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Used to enable or disable tech-preview Calico features.\nValues are specified in a comma separated list with no spaces, example;\n\"BPFConnectTimeLoadBalancingWorkaround=enabled,XyZ=false\". This is\nused to enable features that are not fully production ready.", "DescriptionHTML": "

Used to enable or disable tech-preview Calico features.\nValues are specified in a comma separated list with no spaces, example;\n\"BPFConnectTimeLoadBalancingWorkaround=enabled,XyZ=false\". This is\nused to enable features that are not fully production ready.

", "UserEditable": true, "GoType": "string" } ] }, { "Name": "Process: Go runtime", "Fields": [ { "Group": "Process: Go runtime", "GroupWithSortPrefix": "00 Process: Go runtime", "NameConfigFile": "GoGCThreshold", "NameEnvVar": "FELIX_GoGCThreshold", "NameYAML": "goGCThreshold", "NameGoAPI": "GoGCThreshold", "StringSchema": "Integer: [-1,2^63-1]", "StringSchemaHTML": "Integer: [-1,263-1]", "StringDefault": "40", "ParsedDefault": "40", "ParsedDefaultJSON": "40", "ParsedType": "int", "YAMLType": "integer", "YAMLSchema": "Integer: [-1,2^63-1]", "YAMLEnumValues": null, "YAMLSchemaHTML": "Integer: [-1,263-1]", "YAMLDefault": "40", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Sets the Go runtime's garbage collection threshold. I.e. the percentage that the heap is\nallowed to grow before garbage collection is triggered. In general, doubling the value halves the CPU time\nspent doing GC, but it also doubles peak GC memory overhead. A special value of -1 can be used\nto disable GC entirely; this should only be used in conjunction with the GoMemoryLimitMB setting.\n\nThis setting is overridden by the GOGC environment variable.", "DescriptionHTML": "

Sets the Go runtime's garbage collection threshold. I.e. the percentage that the heap is\nallowed to grow before garbage collection is triggered. In general, doubling the value halves the CPU time\nspent doing GC, but it also doubles peak GC memory overhead. A special value of -1 can be used\nto disable GC entirely; this should only be used in conjunction with the GoMemoryLimitMB setting.

\n

This setting is overridden by the GOGC environment variable.

", "UserEditable": true, "GoType": "*int" }, { "Group": "Process: Go runtime", "GroupWithSortPrefix": "00 Process: Go runtime", "NameConfigFile": "GoMaxProcs", "NameEnvVar": "FELIX_GoMaxProcs", "NameYAML": "goMaxProcs", "NameGoAPI": "GoMaxProcs", "StringSchema": "Integer: [-1,2^63-1]", "StringSchemaHTML": "Integer: [-1,263-1]", "StringDefault": "-1", "ParsedDefault": "-1", "ParsedDefaultJSON": "-1", "ParsedType": "int", "YAMLType": "integer", "YAMLSchema": "Integer: [-1,2^63-1]", "YAMLEnumValues": null, "YAMLSchemaHTML": "Integer: [-1,263-1]", "YAMLDefault": "-1", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Sets the maximum number of CPUs that the Go runtime will use concurrently. A value of -1 means\n\"use the system default\"; typically the number of real CPUs on the system.\n\nthis setting is overridden by the GOMAXPROCS environment variable.", "DescriptionHTML": "

Sets the maximum number of CPUs that the Go runtime will use concurrently. A value of -1 means\n\"use the system default\"; typically the number of real CPUs on the system.

\n

this setting is overridden by the GOMAXPROCS environment variable.

", "UserEditable": true, "GoType": "*int" }, { "Group": "Process: Go runtime", "GroupWithSortPrefix": "00 Process: Go runtime", "NameConfigFile": "GoMemoryLimitMB", "NameEnvVar": "FELIX_GoMemoryLimitMB", "NameYAML": "goMemoryLimitMB", "NameGoAPI": "GoMemoryLimitMB", "StringSchema": "Integer: [-1,2^63-1]", "StringSchemaHTML": "Integer: [-1,263-1]", "StringDefault": "-1", "ParsedDefault": "-1", "ParsedDefaultJSON": "-1", "ParsedType": "int", "YAMLType": "integer", "YAMLSchema": "Integer: [-1,2^63-1]", "YAMLEnumValues": null, "YAMLSchemaHTML": "Integer: [-1,263-1]", "YAMLDefault": "-1", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Sets a (soft) memory limit for the Go runtime in MB. The Go runtime will try to keep its memory\nusage under the limit by triggering GC as needed. To avoid thrashing, it will exceed the limit if GC starts to\ntake more than 50% of the process's CPU time. A value of -1 disables the memory limit.\n\nNote that the memory limit, if used, must be considerably less than any hard resource limit set at the container\nor pod level. This is because felix is not the only process that must run in the container or pod.\n\nThis setting is overridden by the GOMEMLIMIT environment variable.", "DescriptionHTML": "

Sets a (soft) memory limit for the Go runtime in MB. The Go runtime will try to keep its memory\nusage under the limit by triggering GC as needed. To avoid thrashing, it will exceed the limit if GC starts to\ntake more than 50% of the process's CPU time. A value of -1 disables the memory limit.

\n

Note that the memory limit, if used, must be considerably less than any hard resource limit set at the container\nor pod level. This is because felix is not the only process that must run in the container or pod.

\n

This setting is overridden by the GOMEMLIMIT environment variable.

", "UserEditable": true, "GoType": "*int" } ] }, { "Name": "Process: Health port and timeouts", "Fields": [ { "Group": "Process: Health port and timeouts", "GroupWithSortPrefix": "00 Process: Health port and timeouts", "NameConfigFile": "HealthEnabled", "NameEnvVar": "FELIX_HealthEnabled", "NameYAML": "healthEnabled", "NameGoAPI": "HealthEnabled", "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", "StringDefault": "false", "ParsedDefault": "false", "ParsedDefaultJSON": "false", "ParsedType": "bool", "YAMLType": "boolean", "YAMLSchema": "Boolean.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Boolean.", "YAMLDefault": "false", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "If set to true, enables Felix's health port, which provides readiness and liveness endpoints.", "DescriptionHTML": "

If set to true, enables Felix's health port, which provides readiness and liveness endpoints.

", "UserEditable": true, "GoType": "*bool" }, { "Group": "Process: Health port and timeouts", "GroupWithSortPrefix": "00 Process: Health port and timeouts", "NameConfigFile": "HealthHost", "NameEnvVar": "FELIX_HealthHost", "NameYAML": "healthHost", "NameGoAPI": "HealthHost", "StringSchema": "String matching regex `^[a-zA-Z0-9:._+-]{1,64}$`", "StringSchemaHTML": "String matching regex ^[a-zA-Z0-9:._+-]{1,64}$", "StringDefault": "localhost", "ParsedDefault": "localhost", "ParsedDefaultJSON": "\"localhost\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "String.", "YAMLEnumValues": null, "YAMLSchemaHTML": "String.", "YAMLDefault": "localhost", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "The host that the health server should bind to.", "DescriptionHTML": "

The host that the health server should bind to.

", "UserEditable": true, "GoType": "*string" }, { "Group": "Process: Health port and timeouts", "GroupWithSortPrefix": "00 Process: Health port and timeouts", "NameConfigFile": "HealthPort", "NameEnvVar": "FELIX_HealthPort", "NameYAML": "healthPort", "NameGoAPI": "HealthPort", "StringSchema": "Integer: [0,65535]", "StringSchemaHTML": "Integer: [0,65535]", "StringDefault": "9099", "ParsedDefault": "9099", "ParsedDefaultJSON": "9099", "ParsedType": "int", "YAMLType": "integer", "YAMLSchema": "Integer: [0,65535]", "YAMLEnumValues": null, "YAMLSchemaHTML": "Integer: [0,65535]", "YAMLDefault": "9099", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "The TCP port that the health server should bind to.", "DescriptionHTML": "

The TCP port that the health server should bind to.

", "UserEditable": true, "GoType": "*int" }, { "Group": "Process: Health port and timeouts", "GroupWithSortPrefix": "00 Process: Health port and timeouts", "NameConfigFile": "HealthTimeoutOverrides", "NameEnvVar": "FELIX_HealthTimeoutOverrides", "NameYAML": "healthTimeoutOverrides", "NameGoAPI": "HealthTimeoutOverrides", "StringSchema": "Comma-delimited list of `=` pairs, where durations use Go's standard format (e.g. 1s, 1m, 1h3m2s)", "StringSchemaHTML": "Comma-delimited list of <key>=<duration> pairs, where durations use Go's standard format (e.g. 1s, 1m, 1h3m2s)", "StringDefault": "", "ParsedDefault": "map[]", "ParsedDefaultJSON": "null", "ParsedType": "map[string]time.Duration", "YAMLType": "array", "YAMLSchema": "List of health timeout overrides: `[{name: \"\", timeout: \"\"}, ...]` where `` is in the Go duration format, for example `1m30s`.", "YAMLEnumValues": null, "YAMLSchemaHTML": "List of health timeout overrides: [{name: \"<name>\", timeout: \"<duration>\"}, ...] where <duration> is in the Go duration format, for example 1m30s.", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Allows the internal watchdog timeouts of individual subcomponents to be\noverridden. This is useful for working around \"false positive\" liveness timeouts that can occur\nin particularly stressful workloads or if CPU is constrained. For a list of active\nsubcomponents, see Felix's logs.", "DescriptionHTML": "

Allows the internal watchdog timeouts of individual subcomponents to be\noverridden. This is useful for working around \"false positive\" liveness timeouts that can occur\nin particularly stressful workloads or if CPU is constrained. For a list of active\nsubcomponents, see Felix's logs.

", "UserEditable": true, "GoType": "[]v3.HealthTimeoutOverride" } ] }, { "Name": "Process: Logging", "Fields": [ { "Group": "Process: Logging", "GroupWithSortPrefix": "00 Process: Logging", "NameConfigFile": "LogActionRateLimit", "NameEnvVar": "FELIX_LogActionRateLimit", "NameYAML": "logActionRateLimit", "NameGoAPI": "LogActionRateLimit", "StringSchema": "String matching regex `^([1-9]\\d{0,3}/(?:second|minute|hour|day))?$`", "StringSchemaHTML": "String matching regex ^([1-9]\\d{0,3}/(?:second|minute|hour|day))?$", "StringDefault": "", "ParsedDefault": "", "ParsedDefaultJSON": "\"\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "String matching the regular expression `^[1-9]\\d{0,3}/(?:second|minute|hour|day)$`.", "YAMLEnumValues": null, "YAMLSchemaHTML": "String matching the regular expression ^[1-9]\\d{0,3}/(?:second|minute|hour|day)$.", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Sets the rate of hitting a Log action. The value must be in the format \"N/unit\",\nwhere N is a number and unit is one of: second, minute, hour, or day. For example: \"10/second\" or \"100/hour\".", "DescriptionHTML": "

Sets the rate of hitting a Log action. The value must be in the format \"N/unit\",\nwhere N is a number and unit is one of: second, minute, hour, or day. For example: \"10/second\" or \"100/hour\".

", "UserEditable": true, "GoType": "*string" }, { "Group": "Process: Logging", "GroupWithSortPrefix": "00 Process: Logging", "NameConfigFile": "LogActionRateLimitBurst", "NameEnvVar": "FELIX_LogActionRateLimitBurst", "NameYAML": "logActionRateLimitBurst", "NameGoAPI": "LogActionRateLimitBurst", "StringSchema": "Integer: [0,2^63-1], [9999,2^63-1]", "StringSchemaHTML": "Integer: [0,263-1], [9999,263-1]", "StringDefault": "5", "ParsedDefault": "5", "ParsedDefaultJSON": "5", "ParsedType": "int", "YAMLType": "integer", "YAMLSchema": "Integer: [0,2^63-1], [9999,2^63-1]", "YAMLEnumValues": null, "YAMLSchemaHTML": "Integer: [0,263-1], [9999,263-1]", "YAMLDefault": "5", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Sets the rate limit burst of hitting a Log action when LogActionRateLimit is enabled.", "DescriptionHTML": "

Sets the rate limit burst of hitting a Log action when LogActionRateLimit is enabled.

", "UserEditable": true, "GoType": "*int" }, { "Group": "Process: Logging", "GroupWithSortPrefix": "00 Process: Logging", "NameConfigFile": "LogDebugFilenameRegex", "NameEnvVar": "FELIX_LogDebugFilenameRegex", "NameYAML": "logDebugFilenameRegex", "NameGoAPI": "LogDebugFilenameRegex", "StringSchema": "Regular expression", "StringSchemaHTML": "Regular expression", "StringDefault": "", "ParsedDefault": "", "ParsedDefaultJSON": "null", "ParsedType": "*regexp.Regexp", "YAMLType": "string", "YAMLSchema": "String.", "YAMLEnumValues": null, "YAMLSchemaHTML": "String.", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Controls which source code files have their Debug log output included in the logs.\nOnly logs from files with names that match the given regular expression are included. The filter only applies\nto Debug level logs.", "DescriptionHTML": "

Controls which source code files have their Debug log output included in the logs.\nOnly logs from files with names that match the given regular expression are included. The filter only applies\nto Debug level logs.

", "UserEditable": true, "GoType": "string" }, { "Group": "Process: Logging", "GroupWithSortPrefix": "00 Process: Logging", "NameConfigFile": "LogFilePath", "NameEnvVar": "FELIX_LogFilePath", "NameYAML": "logFilePath", "NameGoAPI": "LogFilePath", "StringSchema": "Path to file", "StringSchemaHTML": "Path to file", "StringDefault": "/var/log/calico/felix.log", "ParsedDefault": "/var/log/calico/felix.log", "ParsedDefaultJSON": "\"/var/log/calico/felix.log\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "String.", "YAMLEnumValues": null, "YAMLSchemaHTML": "String.", "YAMLDefault": "/var/log/calico/felix.log", "Required": false, "OnParseFailure": "Exit", "AllowedConfigSources": "All", "Description": "The full path to the Felix log. Set to none to disable file logging.", "DescriptionHTML": "

The full path to the Felix log. Set to none to disable file logging.

", "UserEditable": true, "GoType": "string" }, { "Group": "Process: Logging", "GroupWithSortPrefix": "00 Process: Logging", "NameConfigFile": "LogPrefix", "NameEnvVar": "FELIX_LogPrefix", "NameYAML": "logPrefix", "NameGoAPI": "LogPrefix", "StringSchema": "String", "StringSchemaHTML": "String", "StringDefault": "calico-packet", "ParsedDefault": "calico-packet", "ParsedDefaultJSON": "\"calico-packet\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "String matching the regular expression `^([a-zA-Z0-9%: /_-])*$`.", "YAMLEnumValues": null, "YAMLSchemaHTML": "String matching the regular expression ^([a-zA-Z0-9%: /_-])*$.", "YAMLDefault": "calico-packet", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "The log prefix that Felix uses when rendering LOG rules. It is possible to use the following specifiers\nto include extra information in the log prefix.\n- %t: Tier name.\n- %k: Kind (short names).\n- %n: Policy or profile name.\n- %p: Policy or profile name (namespace/name for namespaced kinds or just name for non namespaced kinds).\nCalico includes \": \" characters at the end of the generated log prefix.\nNote that iptables shows up to 29 characters for the log prefix and nftables up to 127 characters. Extra characters are truncated.", "DescriptionHTML": "

The log prefix that Felix uses when rendering LOG rules. It is possible to use the following specifiers\nto include extra information in the log prefix.\n- %t: Tier name.\n- %k: Kind (short names).\n- %n: Policy or profile name.\n- %p: Policy or profile name (namespace/name for namespaced kinds or just name for non namespaced kinds).\nCalico includes \": \" characters at the end of the generated log prefix.\nNote that iptables shows up to 29 characters for the log prefix and nftables up to 127 characters. Extra characters are truncated.

", "UserEditable": true, "GoType": "string" }, { "Group": "Process: Logging", "GroupWithSortPrefix": "00 Process: Logging", "NameConfigFile": "LogSeverityFile", "NameEnvVar": "FELIX_LogSeverityFile", "NameYAML": "logSeverityFile", "NameGoAPI": "LogSeverityFile", "StringSchema": "One of: `DEBUG`, `ERROR`, `FATAL`, `INFO`, `TRACE`, `WARNING` (case insensitive)", "StringSchemaHTML": "One of: DEBUG, ERROR, FATAL, INFO, TRACE, WARNING (case insensitive)", "StringDefault": "INFO", "ParsedDefault": "INFO", "ParsedDefaultJSON": "\"INFO\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "One of: `Debug`, `Error`, `Fatal`, `Info`, `Trace`, `Warning`.", "YAMLEnumValues": [ "Debug", "Error", "Fatal", "Info", "Trace", "Warning" ], "YAMLSchemaHTML": "One of: Debug, Error, Fatal, Info, Trace, Warning.", "YAMLDefault": "Info", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "The log severity above which logs are sent to the log file.", "DescriptionHTML": "

The log severity above which logs are sent to the log file.

", "UserEditable": true, "GoType": "string" }, { "Group": "Process: Logging", "GroupWithSortPrefix": "00 Process: Logging", "NameConfigFile": "LogSeverityScreen", "NameEnvVar": "FELIX_LogSeverityScreen", "NameYAML": "logSeverityScreen", "NameGoAPI": "LogSeverityScreen", "StringSchema": "One of: `DEBUG`, `ERROR`, `FATAL`, `INFO`, `TRACE`, `WARNING` (case insensitive)", "StringSchemaHTML": "One of: DEBUG, ERROR, FATAL, INFO, TRACE, WARNING (case insensitive)", "StringDefault": "INFO", "ParsedDefault": "INFO", "ParsedDefaultJSON": "\"INFO\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "One of: `Debug`, `Error`, `Fatal`, `Info`, `Trace`, `Warning`.", "YAMLEnumValues": [ "Debug", "Error", "Fatal", "Info", "Trace", "Warning" ], "YAMLSchemaHTML": "One of: Debug, Error, Fatal, Info, Trace, Warning.", "YAMLDefault": "Info", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "The log severity above which logs are sent to the stdout.", "DescriptionHTML": "

The log severity above which logs are sent to the stdout.

", "UserEditable": true, "GoType": "string" }, { "Group": "Process: Logging", "GroupWithSortPrefix": "00 Process: Logging", "NameConfigFile": "LogSeveritySys", "NameEnvVar": "FELIX_LogSeveritySys", "NameYAML": "logSeveritySys", "NameGoAPI": "LogSeveritySys", "StringSchema": "One of: `DEBUG`, `ERROR`, `FATAL`, `INFO`, `TRACE`, `WARNING` (case insensitive)", "StringSchemaHTML": "One of: DEBUG, ERROR, FATAL, INFO, TRACE, WARNING (case insensitive)", "StringDefault": "INFO", "ParsedDefault": "INFO", "ParsedDefaultJSON": "\"INFO\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "One of: `Debug`, `Error`, `Fatal`, `Info`, `Trace`, `Warning`.", "YAMLEnumValues": [ "Debug", "Error", "Fatal", "Info", "Trace", "Warning" ], "YAMLSchemaHTML": "One of: Debug, Error, Fatal, Info, Trace, Warning.", "YAMLDefault": "Info", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "The log severity above which logs are sent to the syslog. Set to None for no logging to syslog.", "DescriptionHTML": "

The log severity above which logs are sent to the syslog. Set to None for no logging to syslog.

", "UserEditable": true, "GoType": "string" } ] }, { "Name": "Process: Prometheus metrics", "Fields": [ { "Group": "Process: Prometheus metrics", "GroupWithSortPrefix": "00 Process: Prometheus metrics", "NameConfigFile": "PrometheusGoMetricsEnabled", "NameEnvVar": "FELIX_PrometheusGoMetricsEnabled", "NameYAML": "prometheusGoMetricsEnabled", "NameGoAPI": "PrometheusGoMetricsEnabled", "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", "StringDefault": "true", "ParsedDefault": "true", "ParsedDefaultJSON": "true", "ParsedType": "bool", "YAMLType": "boolean", "YAMLSchema": "Boolean.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Boolean.", "YAMLDefault": "true", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Disables Go runtime metrics collection, which the Prometheus client does by default, when\nset to false. This reduces the number of metrics reported, reducing Prometheus load.", "DescriptionHTML": "

Disables Go runtime metrics collection, which the Prometheus client does by default, when\nset to false. This reduces the number of metrics reported, reducing Prometheus load.

", "UserEditable": true, "GoType": "*bool" }, { "Group": "Process: Prometheus metrics", "GroupWithSortPrefix": "00 Process: Prometheus metrics", "NameConfigFile": "PrometheusMetricsCAFile", "NameEnvVar": "FELIX_PrometheusMetricsCAFile", "NameYAML": "prometheusMetricsCAFile", "NameGoAPI": "PrometheusMetricsCAFile", "StringSchema": "String", "StringSchemaHTML": "String", "StringDefault": "", "ParsedDefault": "", "ParsedDefaultJSON": "\"\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "String.", "YAMLEnumValues": null, "YAMLSchemaHTML": "String.", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Defines the absolute path to the TLS CA certificate file used for securing the /metrics endpoint.\nThis certificate must be valid and accessible by the calico-node process.", "DescriptionHTML": "

Defines the absolute path to the TLS CA certificate file used for securing the /metrics endpoint.\nThis certificate must be valid and accessible by the calico-node process.

", "UserEditable": true, "GoType": "*string" }, { "Group": "Process: Prometheus metrics", "GroupWithSortPrefix": "00 Process: Prometheus metrics", "NameConfigFile": "PrometheusMetricsCertFile", "NameEnvVar": "FELIX_PrometheusMetricsCertFile", "NameYAML": "prometheusMetricsCertFile", "NameGoAPI": "PrometheusMetricsCertFile", "StringSchema": "String", "StringSchemaHTML": "String", "StringDefault": "", "ParsedDefault": "", "ParsedDefaultJSON": "\"\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "String.", "YAMLEnumValues": null, "YAMLSchemaHTML": "String.", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Defines the absolute path to the TLS certificate file used for securing the /metrics endpoint.\nThis certificate must be valid and accessible by the calico-node process.", "DescriptionHTML": "

Defines the absolute path to the TLS certificate file used for securing the /metrics endpoint.\nThis certificate must be valid and accessible by the calico-node process.

", "UserEditable": true, "GoType": "*string" }, { "Group": "Process: Prometheus metrics", "GroupWithSortPrefix": "00 Process: Prometheus metrics", "NameConfigFile": "PrometheusMetricsClientAuth", "NameEnvVar": "FELIX_PrometheusMetricsClientAuth", "NameYAML": "prometheusMetricsClientAuth", "NameGoAPI": "PrometheusMetricsClientAuth", "StringSchema": "One of: `NoClientCert`, `RequireAndVerifyClientCert`, `RequireAnyClientCert`, `VerifyClientCertIfGiven` (case insensitive)", "StringSchemaHTML": "One of: NoClientCert, RequireAndVerifyClientCert, RequireAnyClientCert, VerifyClientCertIfGiven (case insensitive)", "StringDefault": "RequireAndVerifyClientCert", "ParsedDefault": "RequireAndVerifyClientCert", "ParsedDefaultJSON": "\"RequireAndVerifyClientCert\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "", "YAMLEnumValues": null, "YAMLSchemaHTML": "", "YAMLDefault": "RequireAndVerifyClientCert", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Specifies the client authentication type for the /metrics endpoint.\nThis determines how the server validates client certificates. Default is \"RequireAndVerifyClientCert\".", "DescriptionHTML": "

Specifies the client authentication type for the /metrics endpoint.\nThis determines how the server validates client certificates. Default is \"RequireAndVerifyClientCert\".

", "UserEditable": true, "GoType": "*v3.PrometheusMetricsClientAuthType" }, { "Group": "Process: Prometheus metrics", "GroupWithSortPrefix": "00 Process: Prometheus metrics", "NameConfigFile": "PrometheusMetricsEnabled", "NameEnvVar": "FELIX_PrometheusMetricsEnabled", "NameYAML": "prometheusMetricsEnabled", "NameGoAPI": "PrometheusMetricsEnabled", "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", "StringDefault": "false", "ParsedDefault": "false", "ParsedDefaultJSON": "false", "ParsedType": "bool", "YAMLType": "boolean", "YAMLSchema": "Boolean.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Boolean.", "YAMLDefault": "false", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Enables the Prometheus metrics server in Felix if set to true.", "DescriptionHTML": "

Enables the Prometheus metrics server in Felix if set to true.

", "UserEditable": true, "GoType": "*bool" }, { "Group": "Process: Prometheus metrics", "GroupWithSortPrefix": "00 Process: Prometheus metrics", "NameConfigFile": "PrometheusMetricsHost", "NameEnvVar": "FELIX_PrometheusMetricsHost", "NameYAML": "prometheusMetricsHost", "NameGoAPI": "PrometheusMetricsHost", "StringSchema": "String matching regex `^[a-zA-Z0-9:._+-]{1,64}$`", "StringSchemaHTML": "String matching regex ^[a-zA-Z0-9:._+-]{1,64}$", "StringDefault": "", "ParsedDefault": "", "ParsedDefaultJSON": "\"\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "String.", "YAMLEnumValues": null, "YAMLSchemaHTML": "String.", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "The host that the Prometheus metrics server should bind to.", "DescriptionHTML": "

The host that the Prometheus metrics server should bind to.

", "UserEditable": true, "GoType": "string" }, { "Group": "Process: Prometheus metrics", "GroupWithSortPrefix": "00 Process: Prometheus metrics", "NameConfigFile": "PrometheusMetricsKeyFile", "NameEnvVar": "FELIX_PrometheusMetricsKeyFile", "NameYAML": "prometheusMetricsKeyFile", "NameGoAPI": "PrometheusMetricsKeyFile", "StringSchema": "String", "StringSchemaHTML": "String", "StringDefault": "", "ParsedDefault": "", "ParsedDefaultJSON": "\"\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "String.", "YAMLEnumValues": null, "YAMLSchemaHTML": "String.", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Defines the absolute path to the private key file corresponding to the TLS certificate\nused for securing the /metrics endpoint. The private key must be valid and accessible by the calico-node process.", "DescriptionHTML": "

Defines the absolute path to the private key file corresponding to the TLS certificate\nused for securing the /metrics endpoint. The private key must be valid and accessible by the calico-node process.

", "UserEditable": true, "GoType": "*string" }, { "Group": "Process: Prometheus metrics", "GroupWithSortPrefix": "00 Process: Prometheus metrics", "NameConfigFile": "PrometheusMetricsPort", "NameEnvVar": "FELIX_PrometheusMetricsPort", "NameYAML": "prometheusMetricsPort", "NameGoAPI": "PrometheusMetricsPort", "StringSchema": "Integer: [0,65535]", "StringSchemaHTML": "Integer: [0,65535]", "StringDefault": "9091", "ParsedDefault": "9091", "ParsedDefaultJSON": "9091", "ParsedType": "int", "YAMLType": "integer", "YAMLSchema": "Integer: [0,65535]", "YAMLEnumValues": null, "YAMLSchemaHTML": "Integer: [0,65535]", "YAMLDefault": "9091", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "The TCP port that the Prometheus metrics server should bind to.", "DescriptionHTML": "

The TCP port that the Prometheus metrics server should bind to.

", "UserEditable": true, "GoType": "*int" }, { "Group": "Process: Prometheus metrics", "GroupWithSortPrefix": "00 Process: Prometheus metrics", "NameConfigFile": "PrometheusProcessMetricsEnabled", "NameEnvVar": "FELIX_PrometheusProcessMetricsEnabled", "NameYAML": "prometheusProcessMetricsEnabled", "NameGoAPI": "PrometheusProcessMetricsEnabled", "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", "StringDefault": "true", "ParsedDefault": "true", "ParsedDefaultJSON": "true", "ParsedType": "bool", "YAMLType": "boolean", "YAMLSchema": "Boolean.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Boolean.", "YAMLDefault": "true", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Disables process metrics collection, which the Prometheus client does by default, when\nset to false. This reduces the number of metrics reported, reducing Prometheus load.", "DescriptionHTML": "

Disables process metrics collection, which the Prometheus client does by default, when\nset to false. This reduces the number of metrics reported, reducing Prometheus load.

", "UserEditable": true, "GoType": "*bool" }, { "Group": "Process: Prometheus metrics", "GroupWithSortPrefix": "00 Process: Prometheus metrics", "NameConfigFile": "PrometheusWireGuardMetricsEnabled", "NameEnvVar": "FELIX_PrometheusWireGuardMetricsEnabled", "NameYAML": "prometheusWireGuardMetricsEnabled", "NameGoAPI": "PrometheusWireGuardMetricsEnabled", "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", "StringDefault": "true", "ParsedDefault": "true", "ParsedDefaultJSON": "true", "ParsedType": "bool", "YAMLType": "boolean", "YAMLSchema": "Boolean.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Boolean.", "YAMLDefault": "true", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Disables wireguard metrics collection, which the Prometheus client does by default, when\nset to false. This reduces the number of metrics reported, reducing Prometheus load.", "DescriptionHTML": "

Disables wireguard metrics collection, which the Prometheus client does by default, when\nset to false. This reduces the number of metrics reported, reducing Prometheus load.

", "UserEditable": true, "GoType": "*bool" } ] }, { "Name": "Dataplane: Common", "Fields": [ { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "AllowIPIPPacketsFromWorkloads", "NameEnvVar": "FELIX_AllowIPIPPacketsFromWorkloads", "NameYAML": "allowIPIPPacketsFromWorkloads", "NameGoAPI": "AllowIPIPPacketsFromWorkloads", "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", "StringDefault": "false", "ParsedDefault": "false", "ParsedDefaultJSON": "false", "ParsedType": "bool", "YAMLType": "boolean", "YAMLSchema": "Boolean.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Boolean.", "YAMLDefault": "false", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Controls whether Felix will add a rule to drop IPIP encapsulated traffic\nfrom workloads.", "DescriptionHTML": "

Controls whether Felix will add a rule to drop IPIP encapsulated traffic\nfrom workloads.

", "UserEditable": true, "GoType": "*bool" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "AllowVXLANPacketsFromWorkloads", "NameEnvVar": "FELIX_AllowVXLANPacketsFromWorkloads", "NameYAML": "allowVXLANPacketsFromWorkloads", "NameGoAPI": "AllowVXLANPacketsFromWorkloads", "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", "StringDefault": "false", "ParsedDefault": "false", "ParsedDefaultJSON": "false", "ParsedType": "bool", "YAMLType": "boolean", "YAMLSchema": "Boolean.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Boolean.", "YAMLDefault": "false", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Controls whether Felix will add a rule to drop VXLAN encapsulated traffic\nfrom workloads.", "DescriptionHTML": "

Controls whether Felix will add a rule to drop VXLAN encapsulated traffic\nfrom workloads.

", "UserEditable": true, "GoType": "*bool" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "CgroupV2Path", "NameEnvVar": "FELIX_CgroupV2Path", "NameYAML": "cgroupV2Path", "NameGoAPI": "CgroupV2Path", "StringSchema": "String", "StringSchemaHTML": "String", "StringDefault": "", "ParsedDefault": "", "ParsedDefaultJSON": "\"\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "String.", "YAMLEnumValues": null, "YAMLSchemaHTML": "String.", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Overrides the default location where to find the cgroup hierarchy.", "DescriptionHTML": "

Overrides the default location where to find the cgroup hierarchy.

", "UserEditable": true, "GoType": "string" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "ChainInsertMode", "NameEnvVar": "FELIX_ChainInsertMode", "NameYAML": "chainInsertMode", "NameGoAPI": "ChainInsertMode", "StringSchema": "One of: `append`, `insert` (case insensitive)", "StringSchemaHTML": "One of: append, insert (case insensitive)", "StringDefault": "insert", "ParsedDefault": "insert", "ParsedDefaultJSON": "\"insert\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "One of: `Append`, `Insert`.", "YAMLEnumValues": [ "Append", "Insert" ], "YAMLSchemaHTML": "One of: Append, Insert.", "YAMLDefault": "Insert", "Required": true, "OnParseFailure": "Exit", "AllowedConfigSources": "All", "Description": "Controls whether Felix hooks the kernel's top-level iptables chains by inserting a rule\nat the top of the chain or by appending a rule at the bottom. insert is the safe default since it prevents\nCalico's rules from being bypassed. If you switch to append mode, be sure that the other rules in the chains\nsignal acceptance by falling through to the Calico rules, otherwise the Calico policy will be bypassed.", "DescriptionHTML": "

Controls whether Felix hooks the kernel's top-level iptables chains by inserting a rule\nat the top of the chain or by appending a rule at the bottom. insert is the safe default since it prevents\nCalico's rules from being bypassed. If you switch to append mode, be sure that the other rules in the chains\nsignal acceptance by falling through to the Calico rules, otherwise the Calico policy will be bypassed.

", "UserEditable": true, "GoType": "string" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "DataplaneDriver", "NameEnvVar": "FELIX_DataplaneDriver", "NameYAML": "dataplaneDriver", "NameGoAPI": "DataplaneDriver", "StringSchema": "Path to executable, which must exist. If not an absolute path, the directory containing this binary and the system path will be searched.", "StringSchemaHTML": "Path to executable, which must exist. If not an absolute path, the directory containing this binary and the system path will be searched.", "StringDefault": "calico-iptables-plugin", "ParsedDefault": "calico-iptables-plugin", "ParsedDefaultJSON": "\"calico-iptables-plugin\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "String.", "YAMLEnumValues": null, "YAMLSchemaHTML": "String.", "YAMLDefault": "calico-iptables-plugin", "Required": true, "OnParseFailure": "Exit", "AllowedConfigSources": "All", "Description": "Filename of the external dataplane driver to use. Only used if UseInternalDataplaneDriver\nis set to false.", "DescriptionHTML": "

Filename of the external dataplane driver to use. Only used if UseInternalDataplaneDriver\nis set to false.

", "UserEditable": true, "GoType": "string" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "DataplaneWatchdogTimeout", "NameEnvVar": "FELIX_DataplaneWatchdogTimeout", "NameYAML": "dataplaneWatchdogTimeout", "NameGoAPI": "DataplaneWatchdogTimeout", "StringSchema": "Seconds (floating point)", "StringSchemaHTML": "Seconds (floating point)", "StringDefault": "90", "ParsedDefault": "1m30s", "ParsedDefaultJSON": "90000000000", "ParsedType": "time.Duration", "YAMLType": "string", "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", "YAMLDefault": "1m30s", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "The readiness/liveness timeout used for Felix's (internal) dataplane driver.\nDeprecated: replaced by the generic HealthTimeoutOverrides.", "DescriptionHTML": "

The readiness/liveness timeout used for Felix's (internal) dataplane driver.\nDeprecated: replaced by the generic HealthTimeoutOverrides.

", "UserEditable": true, "GoType": "*v1.Duration" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "DefaultEndpointToHostAction", "NameEnvVar": "FELIX_DefaultEndpointToHostAction", "NameYAML": "defaultEndpointToHostAction", "NameGoAPI": "DefaultEndpointToHostAction", "StringSchema": "One of: `ACCEPT`, `DROP`, `RETURN` (case insensitive)", "StringSchemaHTML": "One of: ACCEPT, DROP, RETURN (case insensitive)", "StringDefault": "DROP", "ParsedDefault": "DROP", "ParsedDefaultJSON": "\"DROP\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "One of: `Accept`, `Drop`, `Return`.", "YAMLEnumValues": [ "Accept", "Drop", "Return" ], "YAMLSchemaHTML": "One of: Accept, Drop, Return.", "YAMLDefault": "Drop", "Required": true, "OnParseFailure": "Exit", "AllowedConfigSources": "All", "Description": "Controls what happens to traffic that goes from a workload endpoint to the host\nitself (after the endpoint's egress policy is applied). By default, Calico blocks traffic from workload\nendpoints to the host itself with an iptables \"DROP\" action. If you want to allow some or all traffic from\nendpoint to host, set this parameter to RETURN or ACCEPT. Use RETURN if you have your own rules in the iptables\n\"INPUT\" chain; Calico will insert its rules at the top of that chain, then \"RETURN\" packets to the \"INPUT\" chain\nonce it has completed processing workload endpoint egress policy. Use ACCEPT to unconditionally accept packets\nfrom workloads after processing workload endpoint egress policy.", "DescriptionHTML": "

Controls what happens to traffic that goes from a workload endpoint to the host\nitself (after the endpoint's egress policy is applied). By default, Calico blocks traffic from workload\nendpoints to the host itself with an iptables \"DROP\" action. If you want to allow some or all traffic from\nendpoint to host, set this parameter to RETURN or ACCEPT. Use RETURN if you have your own rules in the iptables\n\"INPUT\" chain; Calico will insert its rules at the top of that chain, then \"RETURN\" packets to the \"INPUT\" chain\nonce it has completed processing workload endpoint egress policy. Use ACCEPT to unconditionally accept packets\nfrom workloads after processing workload endpoint egress policy.

", "UserEditable": true, "GoType": "string" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "DeviceRouteProtocol", "NameEnvVar": "FELIX_DeviceRouteProtocol", "NameYAML": "deviceRouteProtocol", "NameGoAPI": "DeviceRouteProtocol", "StringSchema": "Integer", "StringSchemaHTML": "Integer", "StringDefault": "3", "ParsedDefault": "3", "ParsedDefaultJSON": "3", "ParsedType": "int", "YAMLType": "integer", "YAMLSchema": "Integer", "YAMLEnumValues": null, "YAMLSchemaHTML": "Integer", "YAMLDefault": "3", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Controls the protocol to set on routes programmed by Felix. The protocol is an 8-bit label\nused to identify the owner of the route.", "DescriptionHTML": "

Controls the protocol to set on routes programmed by Felix. The protocol is an 8-bit label\nused to identify the owner of the route.

", "UserEditable": true, "GoType": "*int" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "DeviceRouteSourceAddress", "NameEnvVar": "FELIX_DeviceRouteSourceAddress", "NameYAML": "deviceRouteSourceAddress", "NameGoAPI": "DeviceRouteSourceAddress", "StringSchema": "IPv4 address", "StringSchemaHTML": "IPv4 address", "StringDefault": "", "ParsedDefault": "", "ParsedDefaultJSON": "\"\"", "ParsedType": "net.IP", "YAMLType": "string", "YAMLSchema": "String.", "YAMLEnumValues": null, "YAMLSchemaHTML": "String.", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "IPv4 address to set as the source hint for routes programmed by Felix. When not set\nthe source address for local traffic from host to workload will be determined by the kernel.", "DescriptionHTML": "

IPv4 address to set as the source hint for routes programmed by Felix. When not set\nthe source address for local traffic from host to workload will be determined by the kernel.

", "UserEditable": true, "GoType": "string" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "DeviceRouteSourceAddressIPv6", "NameEnvVar": "FELIX_DeviceRouteSourceAddressIPv6", "NameYAML": "deviceRouteSourceAddressIPv6", "NameGoAPI": "DeviceRouteSourceAddressIPv6", "StringSchema": "IPv6 address", "StringSchemaHTML": "IPv6 address", "StringDefault": "", "ParsedDefault": "", "ParsedDefaultJSON": "\"\"", "ParsedType": "net.IP", "YAMLType": "string", "YAMLSchema": "String.", "YAMLEnumValues": null, "YAMLSchemaHTML": "String.", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "IPv6 address to set as the source hint for routes programmed by Felix. When not set\nthe source address for local traffic from host to workload will be determined by the kernel.", "DescriptionHTML": "

IPv6 address to set as the source hint for routes programmed by Felix. When not set\nthe source address for local traffic from host to workload will be determined by the kernel.

", "UserEditable": true, "GoType": "string" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "DisableConntrackInvalidCheck", "NameEnvVar": "FELIX_DisableConntrackInvalidCheck", "NameYAML": "disableConntrackInvalidCheck", "NameGoAPI": "DisableConntrackInvalidCheck", "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", "StringDefault": "false", "ParsedDefault": "false", "ParsedDefaultJSON": "false", "ParsedType": "bool", "YAMLType": "boolean", "YAMLSchema": "Boolean.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Boolean.", "YAMLDefault": "false", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Disables the check for invalid connections in conntrack. While the conntrack\ninvalid check helps to detect malicious traffic, it can also cause issues with certain multi-NIC scenarios.", "DescriptionHTML": "

Disables the check for invalid connections in conntrack. While the conntrack\ninvalid check helps to detect malicious traffic, it can also cause issues with certain multi-NIC scenarios.

", "UserEditable": true, "GoType": "*bool" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "EndpointStatusPathPrefix", "NameEnvVar": "FELIX_EndpointStatusPathPrefix", "NameYAML": "endpointStatusPathPrefix", "NameGoAPI": "EndpointStatusPathPrefix", "StringSchema": "Path to file", "StringSchemaHTML": "Path to file", "StringDefault": "/var/run/calico", "ParsedDefault": "/var/run/calico", "ParsedDefaultJSON": "\"/var/run/calico\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "String.", "YAMLEnumValues": null, "YAMLSchemaHTML": "String.", "YAMLDefault": "/var/run/calico", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "The path to the directory where endpoint status will be written. Endpoint status\nfile reporting is disabled if field is left empty.\n\nChosen directory should match the directory used by the CNI plugin for PodStartupDelay.", "DescriptionHTML": "

The path to the directory where endpoint status will be written. Endpoint status\nfile reporting is disabled if field is left empty.

\n

Chosen directory should match the directory used by the CNI plugin for PodStartupDelay.

", "UserEditable": true, "GoType": "string" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "ExternalNodesCIDRList", "NameEnvVar": "FELIX_ExternalNodesCIDRList", "NameYAML": "externalNodesList", "NameGoAPI": "ExternalNodesCIDRList", "StringSchema": "Comma-delimited list of CIDRs", "StringSchemaHTML": "Comma-delimited list of CIDRs", "StringDefault": "", "ParsedDefault": "[]", "ParsedDefaultJSON": "null", "ParsedType": "[]string", "YAMLType": "array", "YAMLSchema": "List of strings: `[\"\", ...]`.", "YAMLEnumValues": null, "YAMLSchemaHTML": "List of strings: [\"<string>\", ...].", "YAMLDefault": "", "Required": false, "OnParseFailure": "Exit", "AllowedConfigSources": "All", "Description": "A list of CIDR's of external, non-Calico nodes from which VXLAN/IPIP overlay traffic\nwill be allowed. By default, external tunneled traffic is blocked to reduce attack surface.", "DescriptionHTML": "

A list of CIDR's of external, non-Calico nodes from which VXLAN/IPIP overlay traffic\nwill be allowed. By default, external tunneled traffic is blocked to reduce attack surface.

", "UserEditable": true, "GoType": "*[]string" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "FailsafeInboundHostPorts", "NameEnvVar": "FELIX_FailsafeInboundHostPorts", "NameYAML": "failsafeInboundHostPorts", "NameGoAPI": "FailsafeInboundHostPorts", "StringSchema": "Comma-delimited list of numeric ports with optional protocol and CIDR:`(tcp|udp)::`, `(tcp|udp):` or ``. IPv6 CIDRs must be enclosed in square brackets.", "StringSchemaHTML": "Comma-delimited list of numeric ports with optional protocol and CIDR:(tcp|udp):<cidr>:<port>, (tcp|udp):<port> or <port>. IPv6 CIDRs must be enclosed in square brackets.", "StringDefault": "tcp:22,udp:68,tcp:179,tcp:2379,tcp:2380,tcp:5473,tcp:6443,tcp:6666,tcp:6667", "ParsedDefault": "[{tcp 22 } {udp 68 } {tcp 179 } {tcp 2379 } {tcp 2380 } {tcp 5473 } {tcp 6443 } {tcp 6666 } {tcp 6667 }]", "ParsedDefaultJSON": "[{\"protocol\":\"tcp\",\"port\":22},{\"protocol\":\"udp\",\"port\":68},{\"protocol\":\"tcp\",\"port\":179},{\"protocol\":\"tcp\",\"port\":2379},{\"protocol\":\"tcp\",\"port\":2380},{\"protocol\":\"tcp\",\"port\":5473},{\"protocol\":\"tcp\",\"port\":6443},{\"protocol\":\"tcp\",\"port\":6666},{\"protocol\":\"tcp\",\"port\":6667}]", "ParsedType": "[]v3.ProtoPort", "YAMLType": "array", "YAMLSchema": "List of protocol/port objects with optional CIDR match: `[{protocol: \"TCP|UDP\", port: , net: \"\"}, ...]`.", "YAMLEnumValues": null, "YAMLSchemaHTML": "List of protocol/port objects with optional CIDR match: [{protocol: \"TCP|UDP\", port: <port>, net: \"<cidr>\"}, ...].", "YAMLDefault": "[{\"protocol\":\"tcp\",\"port\":22},{\"protocol\":\"udp\",\"port\":68},{\"protocol\":\"tcp\",\"port\":179},{\"protocol\":\"tcp\",\"port\":2379},{\"protocol\":\"tcp\",\"port\":2380},{\"protocol\":\"tcp\",\"port\":5473},{\"protocol\":\"tcp\",\"port\":6443},{\"protocol\":\"tcp\",\"port\":6666},{\"protocol\":\"tcp\",\"port\":6667}]", "Required": false, "OnParseFailure": "Exit", "AllowedConfigSources": "All", "Description": "A list of ProtoPort struct objects including UDP/TCP/SCTP ports and CIDRs that Felix will\nallow incoming traffic to host endpoints on irrespective of the security policy. This is useful to avoid accidentally\ncutting off a host with incorrect configuration. For backwards compatibility, if the protocol is not specified,\nit defaults to \"tcp\". If a CIDR is not specified, it will allow traffic from all addresses. To disable all inbound host ports,\nuse the value \"[]\". The default value allows ssh access, DHCP, BGP, etcd and the Kubernetes API.", "DescriptionHTML": "

A list of ProtoPort struct objects including UDP/TCP/SCTP ports and CIDRs that Felix will\nallow incoming traffic to host endpoints on irrespective of the security policy. This is useful to avoid accidentally\ncutting off a host with incorrect configuration. For backwards compatibility, if the protocol is not specified,\nit defaults to \"tcp\". If a CIDR is not specified, it will allow traffic from all addresses. To disable all inbound host ports,\nuse the value \"[]\". The default value allows ssh access, DHCP, BGP, etcd and the Kubernetes API.

", "UserEditable": true, "GoType": "*[]v3.ProtoPort" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "FailsafeOutboundHostPorts", "NameEnvVar": "FELIX_FailsafeOutboundHostPorts", "NameYAML": "failsafeOutboundHostPorts", "NameGoAPI": "FailsafeOutboundHostPorts", "StringSchema": "Comma-delimited list of numeric ports with optional protocol and CIDR:`(tcp|udp)::`, `(tcp|udp):` or ``. IPv6 CIDRs must be enclosed in square brackets.", "StringSchemaHTML": "Comma-delimited list of numeric ports with optional protocol and CIDR:(tcp|udp):<cidr>:<port>, (tcp|udp):<port> or <port>. IPv6 CIDRs must be enclosed in square brackets.", "StringDefault": "udp:53,udp:67,tcp:179,tcp:2379,tcp:2380,tcp:5473,tcp:6443,tcp:6666,tcp:6667", "ParsedDefault": "[{udp 53 } {udp 67 } {tcp 179 } {tcp 2379 } {tcp 2380 } {tcp 5473 } {tcp 6443 } {tcp 6666 } {tcp 6667 }]", "ParsedDefaultJSON": "[{\"protocol\":\"udp\",\"port\":53},{\"protocol\":\"udp\",\"port\":67},{\"protocol\":\"tcp\",\"port\":179},{\"protocol\":\"tcp\",\"port\":2379},{\"protocol\":\"tcp\",\"port\":2380},{\"protocol\":\"tcp\",\"port\":5473},{\"protocol\":\"tcp\",\"port\":6443},{\"protocol\":\"tcp\",\"port\":6666},{\"protocol\":\"tcp\",\"port\":6667}]", "ParsedType": "[]v3.ProtoPort", "YAMLType": "array", "YAMLSchema": "List of protocol/port objects with optional CIDR match: `[{protocol: \"TCP|UDP\", port: , net: \"\"}, ...]`.", "YAMLEnumValues": null, "YAMLSchemaHTML": "List of protocol/port objects with optional CIDR match: [{protocol: \"TCP|UDP\", port: <port>, net: \"<cidr>\"}, ...].", "YAMLDefault": "[{\"protocol\":\"udp\",\"port\":53},{\"protocol\":\"udp\",\"port\":67},{\"protocol\":\"tcp\",\"port\":179},{\"protocol\":\"tcp\",\"port\":2379},{\"protocol\":\"tcp\",\"port\":2380},{\"protocol\":\"tcp\",\"port\":5473},{\"protocol\":\"tcp\",\"port\":6443},{\"protocol\":\"tcp\",\"port\":6666},{\"protocol\":\"tcp\",\"port\":6667}]", "Required": false, "OnParseFailure": "Exit", "AllowedConfigSources": "All", "Description": "A list of PortProto struct objects including UDP/TCP/SCTP ports and CIDRs that Felix\nwill allow outgoing traffic from host endpoints to irrespective of the security policy. This is useful to avoid accidentally\ncutting off a host with incorrect configuration. For backwards compatibility, if the protocol is not specified, it defaults\nto \"tcp\". If a CIDR is not specified, it will allow traffic from all addresses. To disable all outbound host ports,\nuse the value \"[]\". The default value opens etcd's standard ports to ensure that Felix does not get cut off from etcd\nas well as allowing DHCP, DNS, BGP and the Kubernetes API.", "DescriptionHTML": "

A list of PortProto struct objects including UDP/TCP/SCTP ports and CIDRs that Felix\nwill allow outgoing traffic from host endpoints to irrespective of the security policy. This is useful to avoid accidentally\ncutting off a host with incorrect configuration. For backwards compatibility, if the protocol is not specified, it defaults\nto \"tcp\". If a CIDR is not specified, it will allow traffic from all addresses. To disable all outbound host ports,\nuse the value \"[]\". The default value opens etcd's standard ports to ensure that Felix does not get cut off from etcd\nas well as allowing DHCP, DNS, BGP and the Kubernetes API.

", "UserEditable": true, "GoType": "*[]v3.ProtoPort" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "FloatingIPs", "NameEnvVar": "FELIX_FloatingIPs", "NameYAML": "floatingIPs", "NameGoAPI": "FloatingIPs", "StringSchema": "One of: `Disabled`, `Enabled` (case insensitive)", "StringSchemaHTML": "One of: Disabled, Enabled (case insensitive)", "StringDefault": "Disabled", "ParsedDefault": "Disabled", "ParsedDefaultJSON": "\"Disabled\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "One of: `\"Disabled\"`, `\"Enabled\"`.", "YAMLEnumValues": [ "`\"Disabled\"`", "`\"Enabled\"`" ], "YAMLSchemaHTML": "One of: \"Disabled\", \"Enabled\".", "YAMLDefault": "Disabled", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Configures whether or not Felix will program non-OpenStack floating IP addresses. (OpenStack-derived\nfloating IPs are always programmed, regardless of this setting.)", "DescriptionHTML": "

Configures whether or not Felix will program non-OpenStack floating IP addresses. (OpenStack-derived\nfloating IPs are always programmed, regardless of this setting.)

", "UserEditable": true, "GoType": "*v3.FloatingIPType" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "IPForwarding", "NameEnvVar": "FELIX_IPForwarding", "NameYAML": "ipForwarding", "NameGoAPI": "IPForwarding", "StringSchema": "One of: `Disabled`, `Enabled` (case insensitive)", "StringSchemaHTML": "One of: Disabled, Enabled (case insensitive)", "StringDefault": "Enabled", "ParsedDefault": "Enabled", "ParsedDefaultJSON": "\"Enabled\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "One of: `\"Disabled\"`, `\"Enabled\"`.", "YAMLEnumValues": [ "`\"Disabled\"`", "`\"Enabled\"`" ], "YAMLSchemaHTML": "One of: \"Disabled\", \"Enabled\".", "YAMLDefault": "Enabled", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Controls whether Felix sets the host sysctls to enable IP forwarding. IP forwarding is required\nwhen using Calico for workload networking. This should be disabled only on hosts where Calico is used solely for\nhost protection. In BPF mode, due to a kernel interaction, either IPForwarding must be enabled or BPFEnforceRPF\nmust be disabled.", "DescriptionHTML": "

Controls whether Felix sets the host sysctls to enable IP forwarding. IP forwarding is required\nwhen using Calico for workload networking. This should be disabled only on hosts where Calico is used solely for\nhost protection. In BPF mode, due to a kernel interaction, either IPForwarding must be enabled or BPFEnforceRPF\nmust be disabled.

", "UserEditable": true, "GoType": "string" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "InterfaceExclude", "NameEnvVar": "FELIX_InterfaceExclude", "NameYAML": "interfaceExclude", "NameGoAPI": "InterfaceExclude", "StringSchema": "Comma-delimited list of Linux interface names/regex patterns. Regex patterns must start/end with `/`.", "StringSchemaHTML": "Comma-delimited list of Linux interface names/regex patterns. Regex patterns must start/end with /.", "StringDefault": "kube-ipvs0", "ParsedDefault": "[^kube-ipvs0$]", "ParsedDefaultJSON": "[\"^kube-ipvs0$\"]", "ParsedType": "[]*regexp.Regexp", "YAMLType": "string", "YAMLSchema": "String.", "YAMLEnumValues": null, "YAMLSchemaHTML": "String.", "YAMLDefault": "kube-ipvs0", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "A comma-separated list of interface names that should be excluded when Felix is resolving\nhost endpoints. The default value ensures that Felix ignores Kubernetes' internal `kube-ipvs0` device. If you\nwant to exclude multiple interface names using a single value, the list supports regular expressions. For\nregular expressions you must wrap the value with `/`. For example having values `/^kube/,veth1` will exclude\nall interfaces that begin with `kube` and also the interface `veth1`.", "DescriptionHTML": "

A comma-separated list of interface names that should be excluded when Felix is resolving\nhost endpoints. The default value ensures that Felix ignores Kubernetes' internal kube-ipvs0 device. If you\nwant to exclude multiple interface names using a single value, the list supports regular expressions. For\nregular expressions you must wrap the value with /. For example having values /^kube/,veth1 will exclude\nall interfaces that begin with kube and also the interface veth1.

", "UserEditable": true, "GoType": "string" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "InterfacePrefix", "NameEnvVar": "FELIX_InterfacePrefix", "NameYAML": "interfacePrefix", "NameGoAPI": "InterfacePrefix", "StringSchema": "String matching regex `^[a-zA-Z0-9_-]{1,15}(,[a-zA-Z0-9_-]{1,15})*$`", "StringSchemaHTML": "String matching regex ^[a-zA-Z0-9_-]{1,15}(,[a-zA-Z0-9_-]{1,15})*$", "StringDefault": "cali", "ParsedDefault": "cali", "ParsedDefaultJSON": "\"cali\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "String.", "YAMLEnumValues": null, "YAMLSchemaHTML": "String.", "YAMLDefault": "cali", "Required": true, "OnParseFailure": "Exit", "AllowedConfigSources": "All", "Description": "The interface name prefix that identifies workload endpoints and so distinguishes\nthem from host endpoint interfaces. Note: in environments other than bare metal, the orchestrators\nconfigure this appropriately. For example our Kubernetes and Docker integrations set the 'cali' value,\nand our OpenStack integration sets the 'tap' value.", "DescriptionHTML": "

The interface name prefix that identifies workload endpoints and so distinguishes\nthem from host endpoint interfaces. Note: in environments other than bare metal, the orchestrators\nconfigure this appropriately. For example our Kubernetes and Docker integrations set the 'cali' value,\nand our OpenStack integration sets the 'tap' value.

", "UserEditable": true, "GoType": "string" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "InterfaceRefreshInterval", "NameEnvVar": "FELIX_InterfaceRefreshInterval", "NameYAML": "interfaceRefreshInterval", "NameGoAPI": "InterfaceRefreshInterval", "StringSchema": "Seconds (floating point)", "StringSchemaHTML": "Seconds (floating point)", "StringDefault": "90", "ParsedDefault": "1m30s", "ParsedDefaultJSON": "90000000000", "ParsedType": "time.Duration", "YAMLType": "string", "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", "YAMLDefault": "1m30s", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "The period at which Felix rescans local interfaces to verify their state.\nThe rescan can be disabled by setting the interval to 0.", "DescriptionHTML": "

The period at which Felix rescans local interfaces to verify their state.\nThe rescan can be disabled by setting the interval to 0.

", "UserEditable": true, "GoType": "*v1.Duration" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "Ipv6Support", "NameEnvVar": "FELIX_Ipv6Support", "NameYAML": "ipv6Support", "NameGoAPI": "IPv6Support", "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", "StringDefault": "true", "ParsedDefault": "true", "ParsedDefaultJSON": "true", "ParsedType": "bool", "YAMLType": "boolean", "YAMLSchema": "Boolean.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Boolean.", "YAMLDefault": "true", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Controls whether Felix enables support for IPv6 (if supported by the in-use dataplane).", "DescriptionHTML": "

Controls whether Felix enables support for IPv6 (if supported by the in-use dataplane).

", "UserEditable": true, "GoType": "*bool" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "MTUIfacePattern", "NameEnvVar": "FELIX_MTUIfacePattern", "NameYAML": "mtuIfacePattern", "NameGoAPI": "MTUIfacePattern", "StringSchema": "Regular expression", "StringSchemaHTML": "Regular expression", "StringDefault": "^((en|wl|ww|sl|ib)[Pcopsvx].*|(eth|wlan|wwan).*)", "ParsedDefault": "^((en|wl|ww|sl|ib)[Pcopsvx].*|(eth|wlan|wwan).*)", "ParsedDefaultJSON": "\"^((en|wl|ww|sl|ib)[Pcopsvx].*|(eth|wlan|wwan).*)\"", "ParsedType": "*regexp.Regexp", "YAMLType": "string", "YAMLSchema": "String.", "YAMLEnumValues": null, "YAMLSchemaHTML": "String.", "YAMLDefault": "^((en|wl|ww|sl|ib)[Pcopsvx].*|(eth|wlan|wwan).*)", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "A regular expression that controls which interfaces Felix should scan in order\nto calculate the host's MTU.\nThis should not match workload interfaces (usually named cali...).", "DescriptionHTML": "

A regular expression that controls which interfaces Felix should scan in order\nto calculate the host's MTU.\nThis should not match workload interfaces (usually named cali...).

", "UserEditable": true, "GoType": "string" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "NATOutgoingAddress", "NameEnvVar": "FELIX_NATOutgoingAddress", "NameYAML": "natOutgoingAddress", "NameGoAPI": "NATOutgoingAddress", "StringSchema": "IPv4 address", "StringSchemaHTML": "IPv4 address", "StringDefault": "", "ParsedDefault": "", "ParsedDefaultJSON": "\"\"", "ParsedType": "net.IP", "YAMLType": "string", "YAMLSchema": "String.", "YAMLEnumValues": null, "YAMLSchemaHTML": "String.", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Specifies an address to use when performing source NAT for traffic in a natOutgoing pool that\nis leaving the network. By default the address used is an address on the interface the traffic is leaving on\n(i.e. it uses the iptables MASQUERADE target).", "DescriptionHTML": "

Specifies an address to use when performing source NAT for traffic in a natOutgoing pool that\nis leaving the network. By default the address used is an address on the interface the traffic is leaving on\n(i.e. it uses the iptables MASQUERADE target).

", "UserEditable": true, "GoType": "string" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "NATOutgoingExclusions", "NameEnvVar": "FELIX_NATOutgoingExclusions", "NameYAML": "natOutgoingExclusions", "NameGoAPI": "NATOutgoingExclusions", "StringSchema": "One of: `IPPoolsAndHostIPs`, `IPPoolsOnly` (case insensitive)", "StringSchemaHTML": "One of: IPPoolsAndHostIPs, IPPoolsOnly (case insensitive)", "StringDefault": "IPPoolsOnly", "ParsedDefault": "IPPoolsOnly", "ParsedDefaultJSON": "\"IPPoolsOnly\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "One of: `\"IPPoolsAndHostIPs\"`, `\"IPPoolsOnly\"`.", "YAMLEnumValues": [ "`\"IPPoolsAndHostIPs\"`", "`\"IPPoolsOnly\"`" ], "YAMLSchemaHTML": "One of: \"IPPoolsAndHostIPs\", \"IPPoolsOnly\".", "YAMLDefault": "IPPoolsOnly", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "When a IP pool setting `natOutgoing` is true, packets sent from Calico networked containers in this IP pool to destinations will be masqueraded.\nConfigure which type of destinations is excluded from being masqueraded.\n- IPPoolsOnly: destinations outside of this IP pool will be masqueraded.\n- IPPoolsAndHostIPs: destinations outside of this IP pool and all hosts will be masqueraded.", "DescriptionHTML": "

When a IP pool setting natOutgoing is true, packets sent from Calico networked containers in this IP pool to destinations will be masqueraded.\nConfigure which type of destinations is excluded from being masqueraded.\n- IPPoolsOnly: destinations outside of this IP pool will be masqueraded.\n- IPPoolsAndHostIPs: destinations outside of this IP pool and all hosts will be masqueraded.

", "UserEditable": true, "GoType": "*v3.NATOutgoingExclusionsType" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "NATPortRange", "NameEnvVar": "FELIX_NATPortRange", "NameYAML": "natPortRange", "NameGoAPI": "NATPortRange", "StringSchema": "Port range: either a single number in [0,65535] or a range of numbers `n:m`", "StringSchemaHTML": "Port range: either a single number in [0,65535] or a range of numbers n:m", "StringDefault": "", "ParsedDefault": "0", "ParsedDefaultJSON": "0", "ParsedType": "numorstring.Port", "YAMLType": "integer or string", "YAMLSchema": "Port range: either an integer in [0,65535] or a string, representing a range, in format `n:m`", "YAMLEnumValues": null, "YAMLSchemaHTML": "Port range: either an integer in [0,65535] or a string, representing a range, in format n:m", "YAMLDefault": "0", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Specifies the range of ports that is used for port mapping when doing outgoing NAT. When unset the default behavior of the\nnetwork stack is used.", "DescriptionHTML": "

Specifies the range of ports that is used for port mapping when doing outgoing NAT. When unset the default behavior of the\nnetwork stack is used.

", "UserEditable": true, "GoType": "*numorstring.Port" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "NFTablesMode", "NameEnvVar": "FELIX_NFTablesMode", "NameYAML": "nftablesMode", "NameGoAPI": "NFTablesMode", "StringSchema": "One of: `Auto`, `Disabled`, `Enabled` (case insensitive)", "StringSchemaHTML": "One of: Auto, Disabled, Enabled (case insensitive)", "StringDefault": "Auto", "ParsedDefault": "Auto", "ParsedDefaultJSON": "\"Auto\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "One of: `\"Auto\"`, `\"Disabled\"`, `\"Enabled\"`.", "YAMLEnumValues": [ "`\"Auto\"`", "`\"Disabled\"`", "`\"Enabled\"`" ], "YAMLSchemaHTML": "One of: \"Auto\", \"Disabled\", \"Enabled\".", "YAMLDefault": "Auto", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Configures nftables support in Felix.", "DescriptionHTML": "

Configures nftables support in Felix.

", "UserEditable": true, "GoType": "*v3.NFTablesMode" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "NetlinkTimeoutSecs", "NameEnvVar": "FELIX_NetlinkTimeoutSecs", "NameYAML": "netlinkTimeout", "NameGoAPI": "NetlinkTimeout", "StringSchema": "Seconds (floating point)", "StringSchemaHTML": "Seconds (floating point)", "StringDefault": "10", "ParsedDefault": "10s", "ParsedDefaultJSON": "10000000000", "ParsedType": "time.Duration", "YAMLType": "string", "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", "YAMLDefault": "10s", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "The timeout when talking to the kernel over the netlink protocol, used for programming\nroutes, rules, and other kernel objects.", "DescriptionHTML": "

The timeout when talking to the kernel over the netlink protocol, used for programming\nroutes, rules, and other kernel objects.

", "UserEditable": true, "GoType": "*v1.Duration" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "PolicySyncPathPrefix", "NameEnvVar": "FELIX_PolicySyncPathPrefix", "NameYAML": "policySyncPathPrefix", "NameGoAPI": "PolicySyncPathPrefix", "StringSchema": "Path to file", "StringSchemaHTML": "Path to file", "StringDefault": "", "ParsedDefault": "", "ParsedDefaultJSON": "\"\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "String.", "YAMLEnumValues": null, "YAMLSchemaHTML": "String.", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Used to by Felix to communicate policy changes to external services,\nlike Application layer policy.", "DescriptionHTML": "

Used to by Felix to communicate policy changes to external services,\nlike Application layer policy.

", "UserEditable": true, "GoType": "string" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "ProgramClusterRoutes", "NameEnvVar": "FELIX_ProgramClusterRoutes", "NameYAML": "programClusterRoutes", "NameGoAPI": "ProgramClusterRoutes", "StringSchema": "One of: `Disabled`, `Enabled` (case insensitive)", "StringSchemaHTML": "One of: Disabled, Enabled (case insensitive)", "StringDefault": "Disabled", "ParsedDefault": "Disabled", "ParsedDefaultJSON": "\"Disabled\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "One of: `\"Disabled\"`, `\"Enabled\"`.", "YAMLEnumValues": [ "`\"Disabled\"`", "`\"Enabled\"`" ], "YAMLSchemaHTML": "One of: \"Disabled\", \"Enabled\".", "YAMLDefault": "Disabled", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Specifies whether Felix should program IPIP routes instead of BIRD.\nFelix always programs VXLAN routes.", "DescriptionHTML": "

Specifies whether Felix should program IPIP routes instead of BIRD.\nFelix always programs VXLAN routes.

", "UserEditable": true, "GoType": "*string" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "RemoveExternalRoutes", "NameEnvVar": "FELIX_RemoveExternalRoutes", "NameYAML": "removeExternalRoutes", "NameGoAPI": "RemoveExternalRoutes", "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", "StringDefault": "true", "ParsedDefault": "true", "ParsedDefaultJSON": "true", "ParsedType": "bool", "YAMLType": "boolean", "YAMLSchema": "Boolean.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Boolean.", "YAMLDefault": "true", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Controls whether Felix will remove unexpected routes to workload interfaces. Felix will\nalways clean up expected routes that use the configured DeviceRouteProtocol. To add your own routes, you must\nuse a distinct protocol (in addition to setting this field to false).", "DescriptionHTML": "

Controls whether Felix will remove unexpected routes to workload interfaces. Felix will\nalways clean up expected routes that use the configured DeviceRouteProtocol. To add your own routes, you must\nuse a distinct protocol (in addition to setting this field to false).

", "UserEditable": true, "GoType": "*bool" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "RequireMTUFile", "NameEnvVar": "FELIX_RequireMTUFile", "NameYAML": "requireMTUFile", "NameGoAPI": "RequireMTUFile", "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", "StringDefault": "false", "ParsedDefault": "false", "ParsedDefaultJSON": "false", "ParsedType": "bool", "YAMLType": "boolean", "YAMLSchema": "Boolean.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Boolean.", "YAMLDefault": "false", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Specifies whether mtu file is required to start the felix.\nOptional as to keep the same as previous behavior.", "DescriptionHTML": "

Specifies whether mtu file is required to start the felix.\nOptional as to keep the same as previous behavior.

", "UserEditable": true, "GoType": "*bool" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "RouteRefreshInterval", "NameEnvVar": "FELIX_RouteRefreshInterval", "NameYAML": "routeRefreshInterval", "NameGoAPI": "RouteRefreshInterval", "StringSchema": "Seconds (floating point)", "StringSchemaHTML": "Seconds (floating point)", "StringDefault": "90", "ParsedDefault": "1m30s", "ParsedDefaultJSON": "90000000000", "ParsedType": "time.Duration", "YAMLType": "string", "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", "YAMLDefault": "1m30s", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "The period at which Felix re-checks the routes\nin the dataplane to ensure that no other process has accidentally broken Calico's rules.\nSet to 0 to disable route refresh.", "DescriptionHTML": "

The period at which Felix re-checks the routes\nin the dataplane to ensure that no other process has accidentally broken Calico's rules.\nSet to 0 to disable route refresh.

", "UserEditable": true, "GoType": "*v1.Duration" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "RouteSource", "NameEnvVar": "FELIX_RouteSource", "NameYAML": "routeSource", "NameGoAPI": "RouteSource", "StringSchema": "One of: `CalicoIPAM`, `WorkloadIPs` (case insensitive)", "StringSchemaHTML": "One of: CalicoIPAM, WorkloadIPs (case insensitive)", "StringDefault": "CalicoIPAM", "ParsedDefault": "CalicoIPAM", "ParsedDefaultJSON": "\"CalicoIPAM\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "One of: `CalicoIPAM`, `WorkloadIPs`.", "YAMLEnumValues": [ "CalicoIPAM", "WorkloadIPs" ], "YAMLSchemaHTML": "One of: CalicoIPAM, WorkloadIPs.", "YAMLDefault": "CalicoIPAM", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Configures where Felix gets its routing information.\n- WorkloadIPs: use workload endpoints to construct routes.\n- CalicoIPAM: the default - use IPAM data to construct routes.", "DescriptionHTML": "

Configures where Felix gets its routing information.\n- WorkloadIPs: use workload endpoints to construct routes.\n- CalicoIPAM: the default - use IPAM data to construct routes.

", "UserEditable": true, "GoType": "string" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "RouteSyncDisabled", "NameEnvVar": "FELIX_RouteSyncDisabled", "NameYAML": "routeSyncDisabled", "NameGoAPI": "RouteSyncDisabled", "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", "StringDefault": "false", "ParsedDefault": "false", "ParsedDefaultJSON": "false", "ParsedType": "bool", "YAMLType": "boolean", "YAMLSchema": "Boolean.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Boolean.", "YAMLDefault": "false", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Will disable all operations performed on the route table. Set to true to\nrun in network-policy mode only.", "DescriptionHTML": "

Will disable all operations performed on the route table. Set to true to\nrun in network-policy mode only.

", "UserEditable": true, "GoType": "*bool" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "RouteTableRange", "NameEnvVar": "FELIX_RouteTableRange", "NameYAML": "routeTableRange", "NameGoAPI": "RouteTableRange", "StringSchema": "Range of route table indices `n-m`, where `n` and `m` are integers in [0,250].", "StringSchemaHTML": "Range of route table indices n-m, where n and m are integers in [0,250].", "StringDefault": "", "ParsedDefault": "{0 0}", "ParsedDefaultJSON": "{\"Min\":0,\"Max\":0}", "ParsedType": "idalloc.IndexRange", "YAMLType": "object", "YAMLSchema": "Route table range: `{min:, max}`.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Route table range: {min:<n>, max<m>}.", "YAMLDefault": "", "Required": false, "OnParseFailure": "Exit", "AllowedConfigSources": "All", "Description": "Deprecated in favor of RouteTableRanges.\nCalico programs additional Linux route tables for various purposes.\nRouteTableRange specifies the indices of the route tables that Calico should use.", "DescriptionHTML": "

Deprecated in favor of RouteTableRanges.\nCalico programs additional Linux route tables for various purposes.\nRouteTableRange specifies the indices of the route tables that Calico should use.

", "UserEditable": true, "GoType": "*v3.RouteTableRange" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "RouteTableRanges", "NameEnvVar": "FELIX_RouteTableRanges", "NameYAML": "routeTableRanges", "NameGoAPI": "RouteTableRanges", "StringSchema": "Comma or space-delimited list of route table ranges of the form `n-m` where `n` and `m` are integers in [0,4294967295]. The sum of the sizes of all ranges may not exceed 65535.", "StringSchemaHTML": "Comma or space-delimited list of route table ranges of the form n-m where n and m are integers in [0,4294967295]. The sum of the sizes of all ranges may not exceed 65535.", "StringDefault": "", "ParsedDefault": "[]", "ParsedDefaultJSON": "null", "ParsedType": "[]idalloc.IndexRange", "YAMLType": "array", "YAMLSchema": "List of route table ranges: `[{min:, max}, ...]`.", "YAMLEnumValues": null, "YAMLSchemaHTML": "List of route table ranges: [{min:<n>, max<m>}, ...].", "YAMLDefault": "", "Required": false, "OnParseFailure": "Exit", "AllowedConfigSources": "All", "Description": "Calico programs additional Linux route tables for various purposes.\nRouteTableRanges specifies a set of table index ranges that Calico should use.\nDeprecates`RouteTableRange`, overrides `RouteTableRange`.", "DescriptionHTML": "

Calico programs additional Linux route tables for various purposes.\nRouteTableRanges specifies a set of table index ranges that Calico should use.\nDeprecatesRouteTableRange, overrides RouteTableRange.

", "UserEditable": true, "GoType": "*v3.RouteTableRanges" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "ServiceLoopPrevention", "NameEnvVar": "FELIX_ServiceLoopPrevention", "NameYAML": "serviceLoopPrevention", "NameGoAPI": "ServiceLoopPrevention", "StringSchema": "One of: `Disabled`, `Drop`, `Reject` (case insensitive)", "StringSchemaHTML": "One of: Disabled, Drop, Reject (case insensitive)", "StringDefault": "Drop", "ParsedDefault": "Drop", "ParsedDefaultJSON": "\"Drop\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "One of: `Disabled`, `Drop`, `Reject`.", "YAMLEnumValues": [ "Disabled", "Drop", "Reject" ], "YAMLSchemaHTML": "One of: Disabled, Drop, Reject.", "YAMLDefault": "Drop", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "When service IP advertisement is enabled, prevent routing loops to service IPs that are\nnot in use, by dropping or rejecting packets that do not get DNAT'd by kube-proxy.\nUnless set to \"Disabled\", in which case such routing loops continue to be allowed.", "DescriptionHTML": "

When service IP advertisement is enabled, prevent routing loops to service IPs that are\nnot in use, by dropping or rejecting packets that do not get DNAT'd by kube-proxy.\nUnless set to \"Disabled\", in which case such routing loops continue to be allowed.

", "UserEditable": true, "GoType": "string" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "SidecarAccelerationEnabled", "NameEnvVar": "FELIX_SidecarAccelerationEnabled", "NameYAML": "sidecarAccelerationEnabled", "NameGoAPI": "SidecarAccelerationEnabled", "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", "StringDefault": "false", "ParsedDefault": "false", "ParsedDefaultJSON": "false", "ParsedType": "bool", "YAMLType": "boolean", "YAMLSchema": "Boolean.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Boolean.", "YAMLDefault": "false", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Enables experimental sidecar acceleration.", "DescriptionHTML": "

Enables experimental sidecar acceleration.

", "UserEditable": true, "GoType": "*bool" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "UseInternalDataplaneDriver", "NameEnvVar": "FELIX_UseInternalDataplaneDriver", "NameYAML": "useInternalDataplaneDriver", "NameGoAPI": "UseInternalDataplaneDriver", "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", "StringDefault": "true", "ParsedDefault": "true", "ParsedDefaultJSON": "true", "ParsedType": "bool", "YAMLType": "boolean", "YAMLSchema": "Boolean.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Boolean.", "YAMLDefault": "true", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "If true, Felix will use its internal dataplane programming logic. If false, it\nwill launch an external dataplane driver and communicate with it over protobuf.", "DescriptionHTML": "

If true, Felix will use its internal dataplane programming logic. If false, it\nwill launch an external dataplane driver and communicate with it over protobuf.

", "UserEditable": true, "GoType": "*bool" }, { "Group": "Dataplane: Common", "GroupWithSortPrefix": "10 Dataplane: Common", "NameConfigFile": "WorkloadSourceSpoofing", "NameEnvVar": "FELIX_WorkloadSourceSpoofing", "NameYAML": "workloadSourceSpoofing", "NameGoAPI": "WorkloadSourceSpoofing", "StringSchema": "One of: `Any`, `Disabled` (case insensitive)", "StringSchemaHTML": "One of: Any, Disabled (case insensitive)", "StringDefault": "Disabled", "ParsedDefault": "Disabled", "ParsedDefaultJSON": "\"Disabled\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "One of: `Any`, `Disabled`.", "YAMLEnumValues": [ "Any", "Disabled" ], "YAMLSchemaHTML": "One of: Any, Disabled.", "YAMLDefault": "Disabled", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Controls whether pods can use the allowedSourcePrefixes annotation to send traffic with a source IP\naddress that is not theirs. This is disabled by default. When set to \"Any\", pods can request any prefix.", "DescriptionHTML": "

Controls whether pods can use the allowedSourcePrefixes annotation to send traffic with a source IP\naddress that is not theirs. This is disabled by default. When set to \"Any\", pods can request any prefix.

", "UserEditable": true, "GoType": "string" } ] }, { "Name": "Dataplane: iptables", "Fields": [ { "Group": "Dataplane: iptables", "GroupWithSortPrefix": "20 Dataplane: iptables", "NameConfigFile": "IpsetsRefreshInterval", "NameEnvVar": "FELIX_IpsetsRefreshInterval", "NameYAML": "ipsetsRefreshInterval", "NameGoAPI": "IpsetsRefreshInterval", "StringSchema": "Seconds (floating point)", "StringSchemaHTML": "Seconds (floating point)", "StringDefault": "90", "ParsedDefault": "1m30s", "ParsedDefaultJSON": "90000000000", "ParsedType": "time.Duration", "YAMLType": "string", "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", "YAMLDefault": "1m30s", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Controls the period at which Felix re-checks all IP sets to look for discrepancies.\nSet to 0 to disable the periodic refresh.", "DescriptionHTML": "

Controls the period at which Felix re-checks all IP sets to look for discrepancies.\nSet to 0 to disable the periodic refresh.

", "UserEditable": true, "GoType": "*v1.Duration" }, { "Group": "Dataplane: iptables", "GroupWithSortPrefix": "20 Dataplane: iptables", "NameConfigFile": "IptablesBackend", "NameEnvVar": "FELIX_IptablesBackend", "NameYAML": "iptablesBackend", "NameGoAPI": "IptablesBackend", "StringSchema": "One of: `auto`, `legacy`, `nft` (case insensitive)", "StringSchemaHTML": "One of: auto, legacy, nft (case insensitive)", "StringDefault": "auto", "ParsedDefault": "auto", "ParsedDefaultJSON": "\"auto\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "One of: `Auto`, `Legacy`, `NFT`.", "YAMLEnumValues": [ "Auto", "Legacy", "NFT" ], "YAMLSchemaHTML": "One of: Auto, Legacy, NFT.", "YAMLDefault": "Auto", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Controls which backend of iptables will be used. The default is `Auto`.\n\nWarning: changing this on a running system can leave \"orphaned\" rules in the \"other\" backend. These\nshould be cleaned up to avoid confusing interactions.", "DescriptionHTML": "

Controls which backend of iptables will be used. The default is Auto.

\n

Warning: changing this on a running system can leave \"orphaned\" rules in the \"other\" backend. These\nshould be cleaned up to avoid confusing interactions.

", "UserEditable": true, "GoType": "*v3.IptablesBackend" }, { "Group": "Dataplane: iptables", "GroupWithSortPrefix": "20 Dataplane: iptables", "NameConfigFile": "IptablesFilterAllowAction", "NameEnvVar": "FELIX_IptablesFilterAllowAction", "NameYAML": "iptablesFilterAllowAction", "NameGoAPI": "IptablesFilterAllowAction", "StringSchema": "One of: `ACCEPT`, `RETURN` (case insensitive)", "StringSchemaHTML": "One of: ACCEPT, RETURN (case insensitive)", "StringDefault": "ACCEPT", "ParsedDefault": "ACCEPT", "ParsedDefaultJSON": "\"ACCEPT\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "One of: `Accept`, `Return`.", "YAMLEnumValues": [ "Accept", "Return" ], "YAMLSchemaHTML": "One of: Accept, Return.", "YAMLDefault": "Accept", "Required": true, "OnParseFailure": "Exit", "AllowedConfigSources": "All", "Description": "Controls what happens to traffic that is accepted by a Felix policy chain in the\niptables filter table (which is used for \"normal\" policy). The default will immediately `Accept` the traffic. Use\n`Return` to send the traffic back up to the system chains for further processing.", "DescriptionHTML": "

Controls what happens to traffic that is accepted by a Felix policy chain in the\niptables filter table (which is used for \"normal\" policy). The default will immediately Accept the traffic. Use\nReturn to send the traffic back up to the system chains for further processing.

", "UserEditable": true, "GoType": "string" }, { "Group": "Dataplane: iptables", "GroupWithSortPrefix": "20 Dataplane: iptables", "NameConfigFile": "IptablesFilterDenyAction", "NameEnvVar": "FELIX_IptablesFilterDenyAction", "NameYAML": "iptablesFilterDenyAction", "NameGoAPI": "IptablesFilterDenyAction", "StringSchema": "One of: `DROP`, `REJECT` (case insensitive)", "StringSchemaHTML": "One of: DROP, REJECT (case insensitive)", "StringDefault": "DROP", "ParsedDefault": "DROP", "ParsedDefaultJSON": "\"DROP\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "One of: `Drop`, `Reject`.", "YAMLEnumValues": [ "Drop", "Reject" ], "YAMLSchemaHTML": "One of: Drop, Reject.", "YAMLDefault": "Drop", "Required": true, "OnParseFailure": "Exit", "AllowedConfigSources": "All", "Description": "Controls what happens to traffic that is denied by network policy. By default Calico blocks traffic\nwith an iptables \"DROP\" action. If you want to use \"REJECT\" action instead you can configure it in here.", "DescriptionHTML": "

Controls what happens to traffic that is denied by network policy. By default Calico blocks traffic\nwith an iptables \"DROP\" action. If you want to use \"REJECT\" action instead you can configure it in here.

", "UserEditable": true, "GoType": "string" }, { "Group": "Dataplane: iptables", "GroupWithSortPrefix": "20 Dataplane: iptables", "NameConfigFile": "IptablesLockProbeIntervalMillis", "NameEnvVar": "FELIX_IptablesLockProbeIntervalMillis", "NameYAML": "iptablesLockProbeInterval", "NameGoAPI": "IptablesLockProbeInterval", "StringSchema": "Milliseconds (floating point)", "StringSchemaHTML": "Milliseconds (floating point)", "StringDefault": "50", "ParsedDefault": "50ms", "ParsedDefaultJSON": "50000000", "ParsedType": "time.Duration", "YAMLType": "string", "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", "YAMLDefault": "50ms", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Configures the interval between attempts to claim\nthe xtables lock. Shorter intervals are more responsive but use more CPU.", "DescriptionHTML": "

Configures the interval between attempts to claim\nthe xtables lock. Shorter intervals are more responsive but use more CPU.

", "UserEditable": true, "GoType": "*v1.Duration" }, { "Group": "Dataplane: iptables", "GroupWithSortPrefix": "20 Dataplane: iptables", "NameConfigFile": "IptablesMangleAllowAction", "NameEnvVar": "FELIX_IptablesMangleAllowAction", "NameYAML": "iptablesMangleAllowAction", "NameGoAPI": "IptablesMangleAllowAction", "StringSchema": "One of: `ACCEPT`, `RETURN` (case insensitive)", "StringSchemaHTML": "One of: ACCEPT, RETURN (case insensitive)", "StringDefault": "ACCEPT", "ParsedDefault": "ACCEPT", "ParsedDefaultJSON": "\"ACCEPT\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "One of: `Accept`, `Return`.", "YAMLEnumValues": [ "Accept", "Return" ], "YAMLSchemaHTML": "One of: Accept, Return.", "YAMLDefault": "Accept", "Required": true, "OnParseFailure": "Exit", "AllowedConfigSources": "All", "Description": "Controls what happens to traffic that is accepted by a Felix policy chain in the\niptables mangle table (which is used for \"pre-DNAT\" policy). The default will immediately `Accept` the traffic.\nUse `Return` to send the traffic back up to the system chains for further processing.", "DescriptionHTML": "

Controls what happens to traffic that is accepted by a Felix policy chain in the\niptables mangle table (which is used for \"pre-DNAT\" policy). The default will immediately Accept the traffic.\nUse Return to send the traffic back up to the system chains for further processing.

", "UserEditable": true, "GoType": "string" }, { "Group": "Dataplane: iptables", "GroupWithSortPrefix": "20 Dataplane: iptables", "NameConfigFile": "IptablesMarkMask", "NameEnvVar": "FELIX_IptablesMarkMask", "NameYAML": "iptablesMarkMask", "NameGoAPI": "IptablesMarkMask", "StringSchema": "32-bit bitmask (hex or deccimal allowed) with at least 2 bits set, example: `0xffff0000`", "StringSchemaHTML": "32-bit bitmask (hex or deccimal allowed) with at least 2 bits set, example: 0xffff0000", "StringDefault": "0xffff0000", "ParsedDefault": "4294901760", "ParsedDefaultJSON": "4294901760", "ParsedType": "uint32", "YAMLType": "integer", "YAMLSchema": "Unsigned 32-bit integer.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Unsigned 32-bit integer.", "YAMLDefault": "0xffff0000", "Required": true, "OnParseFailure": "Exit", "AllowedConfigSources": "All", "Description": "The mask that Felix selects its IPTables Mark bits from. Should be a 32 bit hexadecimal\nnumber with at least 8 bits set, none of which clash with any other mark bits in use on the system.", "DescriptionHTML": "

The mask that Felix selects its IPTables Mark bits from. Should be a 32 bit hexadecimal\nnumber with at least 8 bits set, none of which clash with any other mark bits in use on the system.

", "UserEditable": true, "GoType": "*uint32" }, { "Group": "Dataplane: iptables", "GroupWithSortPrefix": "20 Dataplane: iptables", "NameConfigFile": "IptablesNATOutgoingInterfaceFilter", "NameEnvVar": "FELIX_IptablesNATOutgoingInterfaceFilter", "NameYAML": "iptablesNATOutgoingInterfaceFilter", "NameGoAPI": "IptablesNATOutgoingInterfaceFilter", "StringSchema": "String matching regex `^[a-zA-Z0-9:._+-]{1,15}$`", "StringSchemaHTML": "String matching regex ^[a-zA-Z0-9:._+-]{1,15}$", "StringDefault": "", "ParsedDefault": "", "ParsedDefaultJSON": "\"\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "String.", "YAMLEnumValues": null, "YAMLSchemaHTML": "String.", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "This parameter can be used to limit the host interfaces on which Calico will apply SNAT to traffic leaving a\nCalico IPAM pool with \"NAT outgoing\" enabled. This can be useful if you have a main data interface, where\ntraffic should be SNATted and a secondary device (such as the docker bridge) which is local to the host and\ndoesn't require SNAT. This parameter uses the iptables interface matching syntax, which allows + as a\nwildcard. Most users will not need to set this. Example: if your data interfaces are eth0 and eth1 and you\nwant to exclude the docker bridge, you could set this to eth+.", "DescriptionHTML": "

This parameter can be used to limit the host interfaces on which Calico will apply SNAT to traffic leaving a\nCalico IPAM pool with \"NAT outgoing\" enabled. This can be useful if you have a main data interface, where\ntraffic should be SNATted and a secondary device (such as the docker bridge) which is local to the host and\ndoesn't require SNAT. This parameter uses the iptables interface matching syntax, which allows + as a\nwildcard. Most users will not need to set this. Example: if your data interfaces are eth0 and eth1 and you\nwant to exclude the docker bridge, you could set this to eth+.

", "UserEditable": true, "GoType": "string" }, { "Group": "Dataplane: iptables", "GroupWithSortPrefix": "20 Dataplane: iptables", "NameConfigFile": "IptablesPostWriteCheckIntervalSecs", "NameEnvVar": "FELIX_IptablesPostWriteCheckIntervalSecs", "NameYAML": "iptablesPostWriteCheckInterval", "NameGoAPI": "IptablesPostWriteCheckInterval", "StringSchema": "Seconds (floating point)", "StringSchemaHTML": "Seconds (floating point)", "StringDefault": "5", "ParsedDefault": "5s", "ParsedDefaultJSON": "5000000000", "ParsedType": "time.Duration", "YAMLType": "string", "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", "YAMLDefault": "5s", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "The period after Felix has done a write\nto the dataplane that it schedules an extra read back in order to check the write was not\nclobbered by another process. This should only occur if another application on the system\ndoesn't respect the iptables lock.", "DescriptionHTML": "

The period after Felix has done a write\nto the dataplane that it schedules an extra read back in order to check the write was not\nclobbered by another process. This should only occur if another application on the system\ndoesn't respect the iptables lock.

", "UserEditable": true, "GoType": "*v1.Duration" }, { "Group": "Dataplane: iptables", "GroupWithSortPrefix": "20 Dataplane: iptables", "NameConfigFile": "IptablesRefreshInterval", "NameEnvVar": "FELIX_IptablesRefreshInterval", "NameYAML": "iptablesRefreshInterval", "NameGoAPI": "IptablesRefreshInterval", "StringSchema": "Seconds (floating point)", "StringSchemaHTML": "Seconds (floating point)", "StringDefault": "180", "ParsedDefault": "3m0s", "ParsedDefaultJSON": "180000000000", "ParsedType": "time.Duration", "YAMLType": "string", "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", "YAMLDefault": "3m0s", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "The period at which Felix re-checks the IP sets\nin the dataplane to ensure that no other process has accidentally broken Calico's rules.\nSet to 0 to disable IP sets refresh. Note: the default for this value is lower than the\nother refresh intervals as a workaround for a Linux kernel bug that was fixed in kernel\nversion 4.11. If you are using v4.11 or greater you may want to set this to, a higher value\nto reduce Felix CPU usage.", "DescriptionHTML": "

The period at which Felix re-checks the IP sets\nin the dataplane to ensure that no other process has accidentally broken Calico's rules.\nSet to 0 to disable IP sets refresh. Note: the default for this value is lower than the\nother refresh intervals as a workaround for a Linux kernel bug that was fixed in kernel\nversion 4.11. If you are using v4.11 or greater you may want to set this to, a higher value\nto reduce Felix CPU usage.

", "UserEditable": true, "GoType": "*v1.Duration" }, { "Group": "Dataplane: iptables", "GroupWithSortPrefix": "20 Dataplane: iptables", "NameConfigFile": "KubeNodePortRanges", "NameEnvVar": "FELIX_KubeNodePortRanges", "NameYAML": "kubeNodePortRanges", "NameGoAPI": "KubeNodePortRanges", "StringSchema": "List of port ranges: comma-delimited list of either single numbers in range [0,65535] or a ranges of numbers `n:m`", "StringSchemaHTML": "List of port ranges: comma-delimited list of either single numbers in range [0,65535] or a ranges of numbers n:m", "StringDefault": "30000:32767", "ParsedDefault": "[30000:32767]", "ParsedDefaultJSON": "[\"30000:32767\"]", "ParsedType": "[]numorstring.Port", "YAMLType": "array", "YAMLSchema": "List of ports: `[, ...]` where `` is a port number (integer) or range (string), for example `80`, `8080:8089`.", "YAMLEnumValues": null, "YAMLSchemaHTML": "List of ports: [<port>, ...] where <port> is a port number (integer) or range (string), for example 80, 8080:8089.", "YAMLDefault": "[\"30000:32767\"]", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Holds list of port ranges used for service node ports. Only used if felix detects kube-proxy running in ipvs mode.\nFelix uses these ranges to separate host and workload traffic. .", "DescriptionHTML": "

Holds list of port ranges used for service node ports. Only used if felix detects kube-proxy running in ipvs mode.\nFelix uses these ranges to separate host and workload traffic. .

", "UserEditable": true, "GoType": "*[]numorstring.Port" }, { "Group": "Dataplane: iptables", "GroupWithSortPrefix": "20 Dataplane: iptables", "NameConfigFile": "MaxIpsetSize", "NameEnvVar": "FELIX_MaxIpsetSize", "NameYAML": "maxIpsetSize", "NameGoAPI": "MaxIpsetSize", "StringSchema": "Integer", "StringSchemaHTML": "Integer", "StringDefault": "1048576", "ParsedDefault": "1048576", "ParsedDefaultJSON": "1048576", "ParsedType": "int", "YAMLType": "integer", "YAMLSchema": "Integer", "YAMLEnumValues": null, "YAMLSchemaHTML": "Integer", "YAMLDefault": "1048576", "Required": true, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "The maximum number of IP addresses that can be stored in an IP set. Not applicable\nif using the nftables backend.", "DescriptionHTML": "

The maximum number of IP addresses that can be stored in an IP set. Not applicable\nif using the nftables backend.

", "UserEditable": true, "GoType": "*int" } ] }, { "Name": "Dataplane: nftables", "Fields": [ { "Group": "Dataplane: nftables", "GroupWithSortPrefix": "21 Dataplane: nftables", "NameConfigFile": "NftablesFilterAllowAction", "NameEnvVar": "FELIX_NftablesFilterAllowAction", "NameYAML": "nftablesFilterAllowAction", "NameGoAPI": "NftablesFilterAllowAction", "StringSchema": "One of: `ACCEPT`, `RETURN` (case insensitive)", "StringSchemaHTML": "One of: ACCEPT, RETURN (case insensitive)", "StringDefault": "ACCEPT", "ParsedDefault": "ACCEPT", "ParsedDefaultJSON": "\"ACCEPT\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "One of: `Accept`, `Return`.", "YAMLEnumValues": [ "Accept", "Return" ], "YAMLSchemaHTML": "One of: Accept, Return.", "YAMLDefault": "Accept", "Required": true, "OnParseFailure": "Exit", "AllowedConfigSources": "All", "Description": "Controls the nftables action that Felix uses to represent the \"allow\" policy verdict\nin the filter table. The default is to `ACCEPT` the traffic, which is a terminal action. Alternatively,\n`RETURN` can be used to return the traffic back to the top-level chain for further processing by your rules.", "DescriptionHTML": "

Controls the nftables action that Felix uses to represent the \"allow\" policy verdict\nin the filter table. The default is to ACCEPT the traffic, which is a terminal action. Alternatively,\nRETURN can be used to return the traffic back to the top-level chain for further processing by your rules.

", "UserEditable": true, "GoType": "string" }, { "Group": "Dataplane: nftables", "GroupWithSortPrefix": "21 Dataplane: nftables", "NameConfigFile": "NftablesFilterDenyAction", "NameEnvVar": "FELIX_NftablesFilterDenyAction", "NameYAML": "nftablesFilterDenyAction", "NameGoAPI": "NftablesFilterDenyAction", "StringSchema": "One of: `DROP`, `REJECT` (case insensitive)", "StringSchemaHTML": "One of: DROP, REJECT (case insensitive)", "StringDefault": "DROP", "ParsedDefault": "DROP", "ParsedDefaultJSON": "\"DROP\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "One of: `Drop`, `Reject`.", "YAMLEnumValues": [ "Drop", "Reject" ], "YAMLSchemaHTML": "One of: Drop, Reject.", "YAMLDefault": "Drop", "Required": true, "OnParseFailure": "Exit", "AllowedConfigSources": "All", "Description": "Controls what happens to traffic that is denied by network policy. By default, Calico\nblocks traffic with a \"drop\" action. If you want to use a \"reject\" action instead you can configure it here.", "DescriptionHTML": "

Controls what happens to traffic that is denied by network policy. By default, Calico\nblocks traffic with a \"drop\" action. If you want to use a \"reject\" action instead you can configure it here.

", "UserEditable": true, "GoType": "string" }, { "Group": "Dataplane: nftables", "GroupWithSortPrefix": "21 Dataplane: nftables", "NameConfigFile": "NftablesMangleAllowAction", "NameEnvVar": "FELIX_NftablesMangleAllowAction", "NameYAML": "nftablesMangleAllowAction", "NameGoAPI": "NftablesMangleAllowAction", "StringSchema": "One of: `ACCEPT`, `RETURN` (case insensitive)", "StringSchemaHTML": "One of: ACCEPT, RETURN (case insensitive)", "StringDefault": "ACCEPT", "ParsedDefault": "ACCEPT", "ParsedDefaultJSON": "\"ACCEPT\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "One of: `Accept`, `Return`.", "YAMLEnumValues": [ "Accept", "Return" ], "YAMLSchemaHTML": "One of: Accept, Return.", "YAMLDefault": "Accept", "Required": true, "OnParseFailure": "Exit", "AllowedConfigSources": "All", "Description": "Controls the nftables action that Felix uses to represent the \"allow\" policy verdict\nin the mangle table. The default is to `ACCEPT` the traffic, which is a terminal action. Alternatively,\n`RETURN` can be used to return the traffic back to the top-level chain for further processing by your rules.", "DescriptionHTML": "

Controls the nftables action that Felix uses to represent the \"allow\" policy verdict\nin the mangle table. The default is to ACCEPT the traffic, which is a terminal action. Alternatively,\nRETURN can be used to return the traffic back to the top-level chain for further processing by your rules.

", "UserEditable": true, "GoType": "string" }, { "Group": "Dataplane: nftables", "GroupWithSortPrefix": "21 Dataplane: nftables", "NameConfigFile": "NftablesMarkMask", "NameEnvVar": "FELIX_NftablesMarkMask", "NameYAML": "nftablesMarkMask", "NameGoAPI": "NftablesMarkMask", "StringSchema": "32-bit bitmask (hex or deccimal allowed) with at least 2 bits set, example: `0xffff0000`", "StringSchemaHTML": "32-bit bitmask (hex or deccimal allowed) with at least 2 bits set, example: 0xffff0000", "StringDefault": "0xffff0000", "ParsedDefault": "4294901760", "ParsedDefaultJSON": "4294901760", "ParsedType": "uint32", "YAMLType": "integer", "YAMLSchema": "Unsigned 32-bit integer.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Unsigned 32-bit integer.", "YAMLDefault": "0xffff0000", "Required": true, "OnParseFailure": "Exit", "AllowedConfigSources": "All", "Description": "The mask that Felix selects its nftables Mark bits from. Should be a 32 bit hexadecimal\nnumber with at least 8 bits set, none of which clash with any other mark bits in use on the system.", "DescriptionHTML": "

The mask that Felix selects its nftables Mark bits from. Should be a 32 bit hexadecimal\nnumber with at least 8 bits set, none of which clash with any other mark bits in use on the system.

", "UserEditable": true, "GoType": "*uint32" }, { "Group": "Dataplane: nftables", "GroupWithSortPrefix": "21 Dataplane: nftables", "NameConfigFile": "NftablesRefreshInterval", "NameEnvVar": "FELIX_NftablesRefreshInterval", "NameYAML": "nftablesRefreshInterval", "NameGoAPI": "NftablesRefreshInterval", "StringSchema": "Seconds (floating point)", "StringSchemaHTML": "Seconds (floating point)", "StringDefault": "180", "ParsedDefault": "3m0s", "ParsedDefaultJSON": "180000000000", "ParsedType": "time.Duration", "YAMLType": "string", "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", "YAMLDefault": "3m0s", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Controls the interval at which Felix periodically refreshes the nftables rules.", "DescriptionHTML": "

Controls the interval at which Felix periodically refreshes the nftables rules.

", "UserEditable": true, "GoType": "*v1.Duration" } ] }, { "Name": "Dataplane: eBPF", "Fields": [ { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFAttachType", "NameEnvVar": "FELIX_BPFAttachType", "NameYAML": "bpfAttachType", "NameGoAPI": "BPFAttachType", "StringSchema": "One of: `TCX`, `TC` (case insensitive)", "StringSchemaHTML": "One of: TCX, TC (case insensitive)", "StringDefault": "TCX", "ParsedDefault": "TCX", "ParsedDefaultJSON": "\"TCX\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "One of: `\"TC\"`, `\"TCX\"`.", "YAMLEnumValues": [ "`\"TC\"`", "`\"TCX\"`" ], "YAMLSchemaHTML": "One of: \"TC\", \"TCX\".", "YAMLDefault": "TCX", "Required": true, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Controls how are the BPF programs at the network interfaces attached.\nBy default `TCX` is used where available to enable easier coexistence with 3rd party programs.\n`TC` can force the legacy method of attaching via a qdisc. `TCX` falls back to `TC` if `TCX` is not available.", "DescriptionHTML": "

Controls how are the BPF programs at the network interfaces attached.\nBy default TCX is used where available to enable easier coexistence with 3rd party programs.\nTC can force the legacy method of attaching via a qdisc. TCX falls back to TC if TCX is not available.

", "UserEditable": true, "GoType": "*v3.BPFAttachOption" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFCTLBLogFilter", "NameEnvVar": "FELIX_BPFCTLBLogFilter", "NameYAML": "bpfCTLBLogFilter", "NameGoAPI": "BPFCTLBLogFilter", "StringSchema": "One of: `all` (case insensitive)", "StringSchemaHTML": "One of: all (case insensitive)", "StringDefault": "", "ParsedDefault": "", "ParsedDefaultJSON": "\"\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "String.", "YAMLEnumValues": null, "YAMLSchemaHTML": "String.", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Specifies, what is logged by connect time load balancer when BPFLogLevel is\ndebug. Currently has to be specified as 'all' when BPFLogFilters is set\nto see CTLB logs.", "DescriptionHTML": "

Specifies, what is logged by connect time load balancer when BPFLogLevel is\ndebug. Currently has to be specified as 'all' when BPFLogFilters is set\nto see CTLB logs.

", "UserEditable": true, "GoType": "string" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFConnectTimeLoadBalancing", "NameEnvVar": "FELIX_BPFConnectTimeLoadBalancing", "NameYAML": "bpfConnectTimeLoadBalancing", "NameGoAPI": "BPFConnectTimeLoadBalancing", "StringSchema": "One of: `Disabled`, `Enabled`, `TCP` (case insensitive)", "StringSchemaHTML": "One of: Disabled, Enabled, TCP (case insensitive)", "StringDefault": "TCP", "ParsedDefault": "TCP", "ParsedDefaultJSON": "\"TCP\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "One of: `\"Disabled\"`, `\"Enabled\"`, `\"TCP\"`.", "YAMLEnumValues": [ "`\"Disabled\"`", "`\"Enabled\"`", "`\"TCP\"`" ], "YAMLSchemaHTML": "One of: \"Disabled\", \"Enabled\", \"TCP\".", "YAMLDefault": "TCP", "Required": true, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "When in BPF mode, controls whether Felix installs the connect-time load\nbalancer. The connect-time load balancer is required for the host to be able to reach Kubernetes services\nand it improves the performance of pod-to-service connections.When set to TCP, connect time load balancing\nis available only for services with TCP ports.", "DescriptionHTML": "

When in BPF mode, controls whether Felix installs the connect-time load\nbalancer. The connect-time load balancer is required for the host to be able to reach Kubernetes services\nand it improves the performance of pod-to-service connections.When set to TCP, connect time load balancing\nis available only for services with TCP ports.

", "UserEditable": true, "GoType": "*v3.BPFConnectTimeLBType" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFConnectTimeLoadBalancingEnabled", "NameEnvVar": "FELIX_BPFConnectTimeLoadBalancingEnabled", "NameYAML": "bpfConnectTimeLoadBalancingEnabled", "NameGoAPI": "BPFConnectTimeLoadBalancingEnabled", "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", "StringDefault": "", "ParsedDefault": "false", "ParsedDefaultJSON": "false", "ParsedType": "bool", "YAMLType": "boolean", "YAMLSchema": "Boolean.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Boolean.", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "When in BPF mode, controls whether Felix installs the connection-time load\nbalancer. The connect-time load balancer is required for the host to be able to reach Kubernetes services\nand it improves the performance of pod-to-service connections. The only reason to disable it is for debugging\npurposes.\n\nDeprecated: Use BPFConnectTimeLoadBalancing.", "DescriptionHTML": "

When in BPF mode, controls whether Felix installs the connection-time load\nbalancer. The connect-time load balancer is required for the host to be able to reach Kubernetes services\nand it improves the performance of pod-to-service connections. The only reason to disable it is for debugging\npurposes.

\n

Deprecated: Use BPFConnectTimeLoadBalancing.

", "UserEditable": true, "GoType": "*bool" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFConntrackCleanupMode", "NameEnvVar": "FELIX_BPFConntrackCleanupMode", "NameYAML": "bpfConntrackMode", "NameGoAPI": "BPFConntrackCleanupMode", "StringSchema": "One of: `Auto`, `BPFProgram`, `Userspace` (case insensitive)", "StringSchemaHTML": "One of: Auto, BPFProgram, Userspace (case insensitive)", "StringDefault": "Auto", "ParsedDefault": "Auto", "ParsedDefaultJSON": "\"Auto\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "One of: `\"Auto\"`, `\"BPFProgram\"`, `\"Userspace\"`.", "YAMLEnumValues": [ "`\"Auto\"`", "`\"BPFProgram\"`", "`\"Userspace\"`" ], "YAMLSchemaHTML": "One of: \"Auto\", \"BPFProgram\", \"Userspace\".", "YAMLDefault": "Auto", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Controls how BPF conntrack entries are cleaned up. `Auto` will use a BPF program if supported,\nfalling back to userspace if not. `Userspace` will always use the userspace cleanup code. `BPFProgram` will\nalways use the BPF program (failing if not supported).\n\n/To be deprecated in future versions as conntrack map type changed to\nlru_hash and userspace cleanup is the only mode that is supported.", "DescriptionHTML": "

Controls how BPF conntrack entries are cleaned up. Auto will use a BPF program if supported,\nfalling back to userspace if not. Userspace will always use the userspace cleanup code. BPFProgram will\nalways use the BPF program (failing if not supported).

\n

/To be deprecated in future versions as conntrack map type changed to\nlru_hash and userspace cleanup is the only mode that is supported.

", "UserEditable": true, "GoType": "*v3.BPFConntrackMode" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFConntrackLogLevel", "NameEnvVar": "FELIX_BPFConntrackLogLevel", "NameYAML": "bpfConntrackLogLevel", "NameGoAPI": "BPFConntrackLogLevel", "StringSchema": "One of: `debug`, `off` (case insensitive)", "StringSchemaHTML": "One of: debug, off (case insensitive)", "StringDefault": "off", "ParsedDefault": "off", "ParsedDefaultJSON": "\"off\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "One of: `\"Debug\"`, `\"Off\"`.", "YAMLEnumValues": [ "`\"Debug\"`", "`\"Off\"`" ], "YAMLSchemaHTML": "One of: \"Debug\", \"Off\".", "YAMLDefault": "off", "Required": true, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Controls the log level of the BPF conntrack cleanup program, which runs periodically\nto clean up expired BPF conntrack entries.\n.", "DescriptionHTML": "

Controls the log level of the BPF conntrack cleanup program, which runs periodically\nto clean up expired BPF conntrack entries.\n.

", "UserEditable": true, "GoType": "string" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFConntrackTimeouts", "NameEnvVar": "FELIX_BPFConntrackTimeouts", "NameYAML": "bpfConntrackTimeouts", "NameGoAPI": "BPFConntrackTimeouts", "StringSchema": "Comma-delimited list of key=value pairs", "StringSchemaHTML": "Comma-delimited list of key=value pairs", "StringDefault": "CreationGracePeriod=10s,TCPSynSent=20s,TCPEstablished=1h,TCPFinsSeen=Auto,TCPResetSeen=40s,UDPTimeout=60s,GenericTimeout=10m,ICMPTimeout=5s", "ParsedDefault": "map[CreationGracePeriod:10s GenericTimeout:10m ICMPTimeout:5s TCPEstablished:1h TCPFinsSeen:Auto TCPResetSeen:40s TCPSynSent:20s UDPTimeout:60s]", "ParsedDefaultJSON": "{\"CreationGracePeriod\":\"10s\",\"GenericTimeout\":\"10m\",\"ICMPTimeout\":\"5s\",\"TCPEstablished\":\"1h\",\"TCPFinsSeen\":\"Auto\",\"TCPResetSeen\":\"40s\",\"TCPSynSent\":\"20s\",\"UDPTimeout\":\"60s\"}", "ParsedType": "map[string]string", "YAMLType": "object", "YAMLSchema": "", "YAMLEnumValues": null, "YAMLSchemaHTML": "", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "BPFConntrackTimers overrides the default values for the specified conntrack timer if\nset. Each value can be either a duration or `Auto` to pick the value from\na Linux conntrack timeout.\n\nConfigurable timers are: CreationGracePeriod, TCPSynSent,\nTCPEstablished, TCPFinsSeen, TCPResetSeen, UDPTimeout, GenericTimeout,\nICMPTimeout.\n\nUnset values are replaced by the default values with a warning log for\nincorrect values.", "DescriptionHTML": "

BPFConntrackTimers overrides the default values for the specified conntrack timer if\nset. Each value can be either a duration or Auto to pick the value from\na Linux conntrack timeout.

\n

Configurable timers are: CreationGracePeriod, TCPSynSent,\nTCPEstablished, TCPFinsSeen, TCPResetSeen, UDPTimeout, GenericTimeout,\nICMPTimeout.

\n

Unset values are replaced by the default values with a warning log for\nincorrect values.

", "UserEditable": true, "GoType": "*v3.BPFConntrackTimeouts" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFDSROptoutCIDRs", "NameEnvVar": "FELIX_BPFDSROptoutCIDRs", "NameYAML": "bpfDSROptoutCIDRs", "NameGoAPI": "BPFDSROptoutCIDRs", "StringSchema": "Comma-delimited list of CIDRs", "StringSchemaHTML": "Comma-delimited list of CIDRs", "StringDefault": "", "ParsedDefault": "[]", "ParsedDefaultJSON": "null", "ParsedType": "[]string", "YAMLType": "array", "YAMLSchema": "List of CIDRs: `[\"\", ...]`.", "YAMLEnumValues": null, "YAMLSchemaHTML": "List of CIDRs: [\"<cidr>\", ...].", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "A list of CIDRs which are excluded from DSR. That is, clients\nin those CIDRs will access service node ports as if BPFExternalServiceMode was set to\nTunnel.", "DescriptionHTML": "

A list of CIDRs which are excluded from DSR. That is, clients\nin those CIDRs will access service node ports as if BPFExternalServiceMode was set to\nTunnel.

", "UserEditable": true, "GoType": "*[]string" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFDataIfacePattern", "NameEnvVar": "FELIX_BPFDataIfacePattern", "NameYAML": "bpfDataIfacePattern", "NameGoAPI": "BPFDataIfacePattern", "StringSchema": "Regular expression", "StringSchemaHTML": "Regular expression", "StringDefault": "^((en|wl|ww|sl|ib)[Popsx].*|(eth|wlan|wwan|bond).*)", "ParsedDefault": "^((en|wl|ww|sl|ib)[Popsx].*|(eth|wlan|wwan|bond).*)", "ParsedDefaultJSON": "\"^((en|wl|ww|sl|ib)[Popsx].*|(eth|wlan|wwan|bond).*)\"", "ParsedType": "*regexp.Regexp", "YAMLType": "string", "YAMLSchema": "String.", "YAMLEnumValues": null, "YAMLSchemaHTML": "String.", "YAMLDefault": "^((en|wl|ww|sl|ib)[Popsx].*|(eth|wlan|wwan|bond).*)", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "A regular expression that controls which interfaces Felix should attach BPF programs to\nin order to catch traffic to/from the network. This needs to match the interfaces that Calico workload traffic\nflows over as well as any interfaces that handle incoming traffic to nodeports and services from outside the\ncluster. It should not match the workload interfaces (usually named cali...) or any other special device managed\nby Calico itself (e.g., tunnels).", "DescriptionHTML": "

A regular expression that controls which interfaces Felix should attach BPF programs to\nin order to catch traffic to/from the network. This needs to match the interfaces that Calico workload traffic\nflows over as well as any interfaces that handle incoming traffic to nodeports and services from outside the\ncluster. It should not match the workload interfaces (usually named cali...) or any other special device managed\nby Calico itself (e.g., tunnels).

", "UserEditable": true, "GoType": "string" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFDisableGROForIfaces", "NameEnvVar": "FELIX_BPFDisableGROForIfaces", "NameYAML": "bpfDisableGROForIfaces", "NameGoAPI": "BPFDisableGROForIfaces", "StringSchema": "Regular expression", "StringSchemaHTML": "Regular expression", "StringDefault": "", "ParsedDefault": "", "ParsedDefaultJSON": "null", "ParsedType": "*regexp.Regexp", "YAMLType": "string", "YAMLSchema": "String.", "YAMLEnumValues": null, "YAMLSchemaHTML": "String.", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "A regular expression that controls which interfaces Felix should disable the\nGeneric Receive Offload [GRO] option. It should not match the workload interfaces (usually named cali...).", "DescriptionHTML": "

A regular expression that controls which interfaces Felix should disable the\nGeneric Receive Offload [GRO] option. It should not match the workload interfaces (usually named cali...).

", "UserEditable": true, "GoType": "string" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFDisableUnprivileged", "NameEnvVar": "FELIX_BPFDisableUnprivileged", "NameYAML": "bpfDisableUnprivileged", "NameGoAPI": "BPFDisableUnprivileged", "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", "StringDefault": "true", "ParsedDefault": "true", "ParsedDefaultJSON": "true", "ParsedType": "bool", "YAMLType": "boolean", "YAMLSchema": "Boolean.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Boolean.", "YAMLDefault": "true", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "If enabled, Felix sets the kernel.unprivileged_bpf_disabled sysctl to disable\nunprivileged use of BPF. This ensures that unprivileged users cannot access Calico's BPF maps and\ncannot insert their own BPF programs to interfere with Calico's.", "DescriptionHTML": "

If enabled, Felix sets the kernel.unprivileged_bpf_disabled sysctl to disable\nunprivileged use of BPF. This ensures that unprivileged users cannot access Calico's BPF maps and\ncannot insert their own BPF programs to interfere with Calico's.

", "UserEditable": true, "GoType": "*bool" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFEnabled", "NameEnvVar": "FELIX_BPFEnabled", "NameYAML": "bpfEnabled", "NameGoAPI": "BPFEnabled", "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", "StringDefault": "false", "ParsedDefault": "false", "ParsedDefaultJSON": "false", "ParsedType": "bool", "YAMLType": "boolean", "YAMLSchema": "Boolean.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Boolean.", "YAMLDefault": "false", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "If enabled Felix will use the BPF dataplane.", "DescriptionHTML": "

If enabled Felix will use the BPF dataplane.

", "UserEditable": true, "GoType": "*bool" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFEnforceRPF", "NameEnvVar": "FELIX_BPFEnforceRPF", "NameYAML": "bpfEnforceRPF", "NameGoAPI": "BPFEnforceRPF", "StringSchema": "One of: `Disabled`, `Loose`, `Strict` (case insensitive)", "StringSchemaHTML": "One of: Disabled, Loose, Strict (case insensitive)", "StringDefault": "Loose", "ParsedDefault": "Loose", "ParsedDefaultJSON": "\"Loose\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "One of: `Disabled`, `Loose`, `Strict`.", "YAMLEnumValues": [ "Disabled", "Loose", "Strict" ], "YAMLSchemaHTML": "One of: Disabled, Loose, Strict.", "YAMLDefault": "Loose", "Required": true, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Enforce strict RPF on all host interfaces with BPF programs regardless of\nwhat is the per-interfaces or global setting. Possible values are Disabled, Strict\nor Loose.", "DescriptionHTML": "

Enforce strict RPF on all host interfaces with BPF programs regardless of\nwhat is the per-interfaces or global setting. Possible values are Disabled, Strict\nor Loose.

", "UserEditable": true, "GoType": "string" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFExcludeCIDRsFromNAT", "NameEnvVar": "FELIX_BPFExcludeCIDRsFromNAT", "NameYAML": "bpfExcludeCIDRsFromNAT", "NameGoAPI": "BPFExcludeCIDRsFromNAT", "StringSchema": "Comma-delimited list of CIDRs", "StringSchemaHTML": "Comma-delimited list of CIDRs", "StringDefault": "", "ParsedDefault": "[]", "ParsedDefaultJSON": "null", "ParsedType": "[]string", "YAMLType": "array", "YAMLSchema": "List of CIDRs: `[\"\", ...]`.", "YAMLEnumValues": null, "YAMLSchemaHTML": "List of CIDRs: [\"<cidr>\", ...].", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "A list of CIDRs that are to be excluded from NAT\nresolution so that host can handle them. A typical usecase is node local\nDNS cache.", "DescriptionHTML": "

A list of CIDRs that are to be excluded from NAT\nresolution so that host can handle them. A typical usecase is node local\nDNS cache.

", "UserEditable": true, "GoType": "*[]string" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFExportBufferSizeMB", "NameEnvVar": "FELIX_BPFExportBufferSizeMB", "NameYAML": "bpfExportBufferSizeMB", "NameGoAPI": "BPFExportBufferSizeMB", "StringSchema": "Integer", "StringSchemaHTML": "Integer", "StringDefault": "1", "ParsedDefault": "1", "ParsedDefaultJSON": "1", "ParsedType": "int", "YAMLType": "integer", "YAMLSchema": "Integer", "YAMLEnumValues": null, "YAMLSchemaHTML": "Integer", "YAMLDefault": "1", "Required": true, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "In BPF mode, controls the buffer size used for sending BPF events to felix.", "DescriptionHTML": "

In BPF mode, controls the buffer size used for sending BPF events to felix.

", "UserEditable": true, "GoType": "*int" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFExtToServiceConnmark", "NameEnvVar": "FELIX_BPFExtToServiceConnmark", "NameYAML": "bpfExtToServiceConnmark", "NameGoAPI": "BPFExtToServiceConnmark", "StringSchema": "Integer", "StringSchemaHTML": "Integer", "StringDefault": "0", "ParsedDefault": "0", "ParsedDefaultJSON": "0", "ParsedType": "int", "YAMLType": "integer", "YAMLSchema": "Integer", "YAMLEnumValues": null, "YAMLSchemaHTML": "Integer", "YAMLDefault": "0", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "In BPF mode, controls a 32bit mark that is set on connections from an\nexternal client to a local service. This mark allows us to control how packets of that\nconnection are routed within the host and how is routing interpreted by RPF check.", "DescriptionHTML": "

In BPF mode, controls a 32bit mark that is set on connections from an\nexternal client to a local service. This mark allows us to control how packets of that\nconnection are routed within the host and how is routing interpreted by RPF check.

", "UserEditable": true, "GoType": "*int" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFExternalServiceMode", "NameEnvVar": "FELIX_BPFExternalServiceMode", "NameYAML": "bpfExternalServiceMode", "NameGoAPI": "BPFExternalServiceMode", "StringSchema": "One of: `dsr`, `tunnel` (case insensitive)", "StringSchemaHTML": "One of: dsr, tunnel (case insensitive)", "StringDefault": "tunnel", "ParsedDefault": "tunnel", "ParsedDefaultJSON": "\"tunnel\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "One of: `DSR`, `Tunnel`.", "YAMLEnumValues": [ "DSR", "Tunnel" ], "YAMLSchemaHTML": "One of: DSR, Tunnel.", "YAMLDefault": "Tunnel", "Required": true, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "In BPF mode, controls how connections from outside the cluster to services (node ports\nand cluster IPs) are forwarded to remote workloads. If set to \"Tunnel\" then both request and response traffic\nis tunneled to the remote node. If set to \"DSR\", the request traffic is tunneled but the response traffic\nis sent directly from the remote node. In \"DSR\" mode, the remote node appears to use the IP of the ingress\nnode; this requires a permissive L2 network.", "DescriptionHTML": "

In BPF mode, controls how connections from outside the cluster to services (node ports\nand cluster IPs) are forwarded to remote workloads. If set to \"Tunnel\" then both request and response traffic\nis tunneled to the remote node. If set to \"DSR\", the request traffic is tunneled but the response traffic\nis sent directly from the remote node. In \"DSR\" mode, the remote node appears to use the IP of the ingress\nnode; this requires a permissive L2 network.

", "UserEditable": true, "GoType": "string" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFForceTrackPacketsFromIfaces", "NameEnvVar": "FELIX_BPFForceTrackPacketsFromIfaces", "NameYAML": "bpfForceTrackPacketsFromIfaces", "NameGoAPI": "BPFForceTrackPacketsFromIfaces", "StringSchema": "Comma-delimited list of strings, each matching the regex `^[a-zA-Z0-9:._+-]{1,15}$`", "StringSchemaHTML": "Comma-delimited list of strings, each matching the regex ^[a-zA-Z0-9:._+-]{1,15}$", "StringDefault": "docker+", "ParsedDefault": "[docker+]", "ParsedDefaultJSON": "[\"docker+\"]", "ParsedType": "[]string", "YAMLType": "array", "YAMLSchema": "List of interface names (may use `+` as a wildcard: `[\"\", ...]`.", "YAMLEnumValues": null, "YAMLSchemaHTML": "List of interface names (may use + as a wildcard: [\"<name>\", ...].", "YAMLDefault": "[\"docker+\"]", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "In BPF mode, forces traffic from these interfaces\nto skip Calico's iptables NOTRACK rule, allowing traffic from those interfaces to be\ntracked by Linux conntrack. Should only be used for interfaces that are not used for\nthe Calico fabric. For example, a docker bridge device for non-Calico-networked\ncontainers.", "DescriptionHTML": "

In BPF mode, forces traffic from these interfaces\nto skip Calico's iptables NOTRACK rule, allowing traffic from those interfaces to be\ntracked by Linux conntrack. Should only be used for interfaces that are not used for\nthe Calico fabric. For example, a docker bridge device for non-Calico-networked\ncontainers.

", "UserEditable": true, "GoType": "*[]string" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFHostConntrackBypass", "NameEnvVar": "FELIX_BPFHostConntrackBypass", "NameYAML": "bpfHostConntrackBypass", "NameGoAPI": "BPFHostConntrackBypass", "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", "StringDefault": "false", "ParsedDefault": "false", "ParsedDefaultJSON": "false", "ParsedType": "bool", "YAMLType": "boolean", "YAMLSchema": "Boolean.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Boolean.", "YAMLDefault": "false", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Controls whether to bypass Linux conntrack in BPF mode for\nworkloads and services.", "DescriptionHTML": "

Controls whether to bypass Linux conntrack in BPF mode for\nworkloads and services.

", "UserEditable": true, "GoType": "*bool" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFHostNetworkedNATWithoutCTLB", "NameEnvVar": "FELIX_BPFHostNetworkedNATWithoutCTLB", "NameYAML": "bpfHostNetworkedNATWithoutCTLB", "NameGoAPI": "BPFHostNetworkedNATWithoutCTLB", "StringSchema": "One of: `Disabled`, `Enabled` (case insensitive)", "StringSchemaHTML": "One of: Disabled, Enabled (case insensitive)", "StringDefault": "Enabled", "ParsedDefault": "Enabled", "ParsedDefaultJSON": "\"Enabled\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "One of: `\"Disabled\"`, `\"Enabled\"`.", "YAMLEnumValues": [ "`\"Disabled\"`", "`\"Enabled\"`" ], "YAMLSchemaHTML": "One of: \"Disabled\", \"Enabled\".", "YAMLDefault": "Enabled", "Required": true, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "When in BPF mode, controls whether Felix does a NAT without CTLB. This along with BPFConnectTimeLoadBalancing\ndetermines the CTLB behavior.", "DescriptionHTML": "

When in BPF mode, controls whether Felix does a NAT without CTLB. This along with BPFConnectTimeLoadBalancing\ndetermines the CTLB behavior.

", "UserEditable": true, "GoType": "*v3.BPFHostNetworkedNATType" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFJITHardening", "NameEnvVar": "FELIX_BPFJITHardening", "NameYAML": "bpfJITHardening", "NameGoAPI": "BPFJITHardening", "StringSchema": "One of: `Auto`, `Strict` (case insensitive)", "StringSchemaHTML": "One of: Auto, Strict (case insensitive)", "StringDefault": "Auto", "ParsedDefault": "Auto", "ParsedDefaultJSON": "\"Auto\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "", "YAMLEnumValues": null, "YAMLSchemaHTML": "", "YAMLDefault": "Auto", "Required": true, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Controls BPF JIT hardening. When set to \"Auto\", Felix will set JIT hardening to 1\nif it detects the current value is 2 (strict mode that hurts performance). When set to \"Strict\",\nFelix will not modify the JIT hardening setting.", "DescriptionHTML": "

Controls BPF JIT hardening. When set to \"Auto\", Felix will set JIT hardening to 1\nif it detects the current value is 2 (strict mode that hurts performance). When set to \"Strict\",\nFelix will not modify the JIT hardening setting.

", "UserEditable": true, "GoType": "*v3.BPFJITHardeningType" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFKubeProxyHealthzPort", "NameEnvVar": "FELIX_BPFKubeProxyHealthzPort", "NameYAML": "bpfKubeProxyHealthzPort", "NameGoAPI": "BPFKubeProxyHealthzPort", "StringSchema": "Integer", "StringSchemaHTML": "Integer", "StringDefault": "10256", "ParsedDefault": "10256", "ParsedDefaultJSON": "10256", "ParsedType": "int", "YAMLType": "integer", "YAMLSchema": "Integer", "YAMLEnumValues": null, "YAMLSchemaHTML": "Integer", "YAMLDefault": "10256", "Required": true, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "In BPF mode, controls the port that Felix's embedded kube-proxy health check server binds to.\nThe health check server is used by external load balancers to determine if this node should receive traffic.", "DescriptionHTML": "

In BPF mode, controls the port that Felix's embedded kube-proxy health check server binds to.\nThe health check server is used by external load balancers to determine if this node should receive traffic.

", "UserEditable": true, "GoType": "*int" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFKubeProxyIptablesCleanupEnabled", "NameEnvVar": "FELIX_BPFKubeProxyIptablesCleanupEnabled", "NameYAML": "bpfKubeProxyIptablesCleanupEnabled", "NameGoAPI": "BPFKubeProxyIptablesCleanupEnabled", "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", "StringDefault": "true", "ParsedDefault": "true", "ParsedDefaultJSON": "true", "ParsedType": "bool", "YAMLType": "boolean", "YAMLSchema": "Boolean.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Boolean.", "YAMLDefault": "true", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "If enabled in BPF mode, Felix will proactively clean up the upstream\nKubernetes kube-proxy's iptables chains. Should only be enabled if kube-proxy is not running.", "DescriptionHTML": "

If enabled in BPF mode, Felix will proactively clean up the upstream\nKubernetes kube-proxy's iptables chains. Should only be enabled if kube-proxy is not running.

", "UserEditable": true, "GoType": "*bool" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFKubeProxyMinSyncPeriod", "NameEnvVar": "FELIX_BPFKubeProxyMinSyncPeriod", "NameYAML": "bpfKubeProxyMinSyncPeriod", "NameGoAPI": "BPFKubeProxyMinSyncPeriod", "StringSchema": "Seconds (floating point)", "StringSchemaHTML": "Seconds (floating point)", "StringDefault": "1", "ParsedDefault": "1s", "ParsedDefaultJSON": "1000000000", "ParsedType": "time.Duration", "YAMLType": "string", "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", "YAMLDefault": "1s", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "In BPF mode, controls the minimum time between updates to the dataplane for Felix's\nembedded kube-proxy. Lower values give reduced set-up latency. Higher values reduce Felix CPU usage by\nbatching up more work.", "DescriptionHTML": "

In BPF mode, controls the minimum time between updates to the dataplane for Felix's\nembedded kube-proxy. Lower values give reduced set-up latency. Higher values reduce Felix CPU usage by\nbatching up more work.

", "UserEditable": true, "GoType": "*v1.Duration" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFL3IfacePattern", "NameEnvVar": "FELIX_BPFL3IfacePattern", "NameYAML": "bpfL3IfacePattern", "NameGoAPI": "BPFL3IfacePattern", "StringSchema": "Regular expression", "StringSchemaHTML": "Regular expression", "StringDefault": "", "ParsedDefault": "", "ParsedDefaultJSON": "null", "ParsedType": "*regexp.Regexp", "YAMLType": "string", "YAMLSchema": "String.", "YAMLEnumValues": null, "YAMLSchemaHTML": "String.", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "A regular expression that allows to list tunnel devices like wireguard or vxlan (i.e., L3 devices)\nin addition to BPFDataIfacePattern. That is, tunnel interfaces not created by Calico, that Calico workload traffic flows\nover as well as any interfaces that handle incoming traffic to nodeports and services from outside the cluster.", "DescriptionHTML": "

A regular expression that allows to list tunnel devices like wireguard or vxlan (i.e., L3 devices)\nin addition to BPFDataIfacePattern. That is, tunnel interfaces not created by Calico, that Calico workload traffic flows\nover as well as any interfaces that handle incoming traffic to nodeports and services from outside the cluster.

", "UserEditable": true, "GoType": "string" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFLogFilters", "NameEnvVar": "FELIX_BPFLogFilters", "NameYAML": "bpfLogFilters", "NameGoAPI": "BPFLogFilters", "StringSchema": "Comma-delimited list of key=value pairs", "StringSchemaHTML": "Comma-delimited list of key=value pairs", "StringDefault": "", "ParsedDefault": "map[]", "ParsedDefaultJSON": "null", "ParsedType": "map[string]string", "YAMLType": "object", "YAMLSchema": "", "YAMLEnumValues": null, "YAMLSchemaHTML": "", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "A map of key=values where the value is\na pcap filter expression and the key is an interface name with 'all'\ndenoting all interfaces, 'weps' all workload endpoints and 'heps' all host\nendpoints.\n\nWhen specified as an env var, it accepts a comma-separated list of\nkey=values.", "DescriptionHTML": "

A map of key=values where the value is\na pcap filter expression and the key is an interface name with 'all'\ndenoting all interfaces, 'weps' all workload endpoints and 'heps' all host\nendpoints.

\n

When specified as an env var, it accepts a comma-separated list of\nkey=values.

", "UserEditable": true, "GoType": "*map[string]string" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFLogLevel", "NameEnvVar": "FELIX_BPFLogLevel", "NameYAML": "bpfLogLevel", "NameGoAPI": "BPFLogLevel", "StringSchema": "One of: `debug`, `info`, `off` (case insensitive)", "StringSchemaHTML": "One of: debug, info, off (case insensitive)", "StringDefault": "off", "ParsedDefault": "off", "ParsedDefaultJSON": "\"off\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "One of: `Debug`, `Info`, `Off`.", "YAMLEnumValues": [ "Debug", "Info", "Off" ], "YAMLSchemaHTML": "One of: Debug, Info, Off.", "YAMLDefault": "Off", "Required": true, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Controls the log level of the BPF programs when in BPF dataplane mode. One of \"Off\", \"Info\", or\n\"Debug\". The logs are emitted to the BPF trace pipe, accessible with the command `tc exec bpf debug`.\n.", "DescriptionHTML": "

Controls the log level of the BPF programs when in BPF dataplane mode. One of \"Off\", \"Info\", or\n\"Debug\". The logs are emitted to the BPF trace pipe, accessible with the command tc exec bpf debug.\n.

", "UserEditable": true, "GoType": "string" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFMaglevMaxEndpointsPerService", "NameEnvVar": "FELIX_BPFMaglevMaxEndpointsPerService", "NameYAML": "bpfMaglevMaxEndpointsPerService", "NameGoAPI": "BPFMaglevMaxEndpointsPerService", "StringSchema": "Integer: [1,3000]", "StringSchemaHTML": "Integer: [1,3000]", "StringDefault": "100", "ParsedDefault": "100", "ParsedDefaultJSON": "100", "ParsedType": "int", "YAMLType": "integer", "YAMLSchema": "Integer: [1,3000]", "YAMLEnumValues": null, "YAMLSchemaHTML": "Integer: [1,3000]", "YAMLDefault": "100", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "The maximum number of endpoints\nexpected to be part of a single Maglev-enabled service.\n\nInfluences the size of the per-service Maglev lookup-tables generated by Felix\nand thus the amount of memory reserved.", "DescriptionHTML": "

The maximum number of endpoints\nexpected to be part of a single Maglev-enabled service.

\n

Influences the size of the per-service Maglev lookup-tables generated by Felix\nand thus the amount of memory reserved.

", "UserEditable": true, "GoType": "*int" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFMaglevMaxServices", "NameEnvVar": "FELIX_BPFMaglevMaxServices", "NameYAML": "bpfMaglevMaxServices", "NameGoAPI": "BPFMaglevMaxServices", "StringSchema": "Integer: [1,3000]", "StringSchemaHTML": "Integer: [1,3000]", "StringDefault": "100", "ParsedDefault": "100", "ParsedDefaultJSON": "100", "ParsedType": "int", "YAMLType": "integer", "YAMLSchema": "Integer: [1,3000]", "YAMLEnumValues": null, "YAMLSchemaHTML": "Integer: [1,3000]", "YAMLDefault": "100", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "The maximum number of expected Maglev-enabled\nservices that Felix will allocate lookup-tables for.", "DescriptionHTML": "

The maximum number of expected Maglev-enabled\nservices that Felix will allocate lookup-tables for.

", "UserEditable": true, "GoType": "*int" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFMapSizeConntrack", "NameEnvVar": "FELIX_BPFMapSizeConntrack", "NameYAML": "bpfMapSizeConntrack", "NameGoAPI": "BPFMapSizeConntrack", "StringSchema": "Integer", "StringSchemaHTML": "Integer", "StringDefault": "512000", "ParsedDefault": "512000", "ParsedDefaultJSON": "512000", "ParsedType": "int", "YAMLType": "integer", "YAMLSchema": "Integer", "YAMLEnumValues": null, "YAMLSchemaHTML": "Integer", "YAMLDefault": "512000", "Required": true, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Sets the size for the conntrack map. This map must be large enough to hold\nan entry for each active connection. Warning: changing the size of the conntrack map can cause disruption.", "DescriptionHTML": "

Sets the size for the conntrack map. This map must be large enough to hold\nan entry for each active connection. Warning: changing the size of the conntrack map can cause disruption.

", "UserEditable": true, "GoType": "*int" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFMapSizeConntrackCleanupQueue", "NameEnvVar": "FELIX_BPFMapSizeConntrackCleanupQueue", "NameYAML": "bpfMapSizeConntrackCleanupQueue", "NameGoAPI": "BPFMapSizeConntrackCleanupQueue", "StringSchema": "Integer", "StringSchemaHTML": "Integer", "StringDefault": "100000", "ParsedDefault": "100000", "ParsedDefaultJSON": "100000", "ParsedType": "int", "YAMLType": "integer", "YAMLSchema": "Integer", "YAMLEnumValues": null, "YAMLSchemaHTML": "Integer", "YAMLDefault": "100000", "Required": true, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Sets the size for the map used to hold NAT conntrack entries that are queued\nfor cleanup. This should be big enough to hold all the NAT entries that expire within one cleanup interval.", "DescriptionHTML": "

Sets the size for the map used to hold NAT conntrack entries that are queued\nfor cleanup. This should be big enough to hold all the NAT entries that expire within one cleanup interval.

", "UserEditable": true, "GoType": "*int" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFMapSizeConntrackScaling", "NameEnvVar": "FELIX_BPFMapSizeConntrackScaling", "NameYAML": "bpfMapSizeConntrackScaling", "NameGoAPI": "BPFMapSizeConntrackScaling", "StringSchema": "One of: `Disabled`, `DoubleIfFull` (case insensitive)", "StringSchemaHTML": "One of: Disabled, DoubleIfFull (case insensitive)", "StringDefault": "DoubleIfFull", "ParsedDefault": "DoubleIfFull", "ParsedDefaultJSON": "\"DoubleIfFull\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "One of: `Disabled`, `DoubleIfFull`.", "YAMLEnumValues": [ "Disabled", "DoubleIfFull" ], "YAMLSchemaHTML": "One of: Disabled, DoubleIfFull.", "YAMLDefault": "DoubleIfFull", "Required": true, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Controls whether and how we scale the conntrack map size depending\non its usage. 'Disabled' make the size stay at the default or whatever is set by\nBPFMapSizeConntrack*. 'DoubleIfFull' doubles the size when the map is pretty much full even\nafter cleanups.", "DescriptionHTML": "

Controls whether and how we scale the conntrack map size depending\non its usage. 'Disabled' make the size stay at the default or whatever is set by\nBPFMapSizeConntrack*. 'DoubleIfFull' doubles the size when the map is pretty much full even\nafter cleanups.

", "UserEditable": true, "GoType": "string" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFMapSizeIPSets", "NameEnvVar": "FELIX_BPFMapSizeIPSets", "NameYAML": "bpfMapSizeIPSets", "NameGoAPI": "BPFMapSizeIPSets", "StringSchema": "Integer", "StringSchemaHTML": "Integer", "StringDefault": "1048576", "ParsedDefault": "1048576", "ParsedDefaultJSON": "1048576", "ParsedType": "int", "YAMLType": "integer", "YAMLSchema": "Integer", "YAMLEnumValues": null, "YAMLSchemaHTML": "Integer", "YAMLDefault": "1048576", "Required": true, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Sets the size for ipsets map. The IP sets map must be large enough to hold an entry\nfor each endpoint matched by every selector in the source/destination matches in network policy. Selectors\nsuch as \"all()\" can result in large numbers of entries (one entry per endpoint in that case).", "DescriptionHTML": "

Sets the size for ipsets map. The IP sets map must be large enough to hold an entry\nfor each endpoint matched by every selector in the source/destination matches in network policy. Selectors\nsuch as \"all()\" can result in large numbers of entries (one entry per endpoint in that case).

", "UserEditable": true, "GoType": "*int" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFMapSizeIfState", "NameEnvVar": "FELIX_BPFMapSizeIfState", "NameYAML": "bpfMapSizeIfState", "NameGoAPI": "BPFMapSizeIfState", "StringSchema": "Integer", "StringSchemaHTML": "Integer", "StringDefault": "1000", "ParsedDefault": "1000", "ParsedDefaultJSON": "1000", "ParsedType": "int", "YAMLType": "integer", "YAMLSchema": "Integer", "YAMLEnumValues": null, "YAMLSchemaHTML": "Integer", "YAMLDefault": "1000", "Required": true, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Sets the size for ifstate map. The ifstate map must be large enough to hold an entry\nfor each device (host + workloads) on a host.", "DescriptionHTML": "

Sets the size for ifstate map. The ifstate map must be large enough to hold an entry\nfor each device (host + workloads) on a host.

", "UserEditable": true, "GoType": "*int" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFMapSizeNATAffinity", "NameEnvVar": "FELIX_BPFMapSizeNATAffinity", "NameYAML": "bpfMapSizeNATAffinity", "NameGoAPI": "BPFMapSizeNATAffinity", "StringSchema": "Integer", "StringSchemaHTML": "Integer", "StringDefault": "65536", "ParsedDefault": "65536", "ParsedDefaultJSON": "65536", "ParsedType": "int", "YAMLType": "integer", "YAMLSchema": "Integer", "YAMLEnumValues": null, "YAMLSchemaHTML": "Integer", "YAMLDefault": "65536", "Required": true, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Sets the size of the BPF map that stores the affinity of a connection (for services that\nenable that feature.", "DescriptionHTML": "

Sets the size of the BPF map that stores the affinity of a connection (for services that\nenable that feature.

", "UserEditable": true, "GoType": "*int" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFMapSizeNATBackend", "NameEnvVar": "FELIX_BPFMapSizeNATBackend", "NameYAML": "bpfMapSizeNATBackend", "NameGoAPI": "BPFMapSizeNATBackend", "StringSchema": "Integer", "StringSchemaHTML": "Integer", "StringDefault": "262144", "ParsedDefault": "262144", "ParsedDefaultJSON": "262144", "ParsedType": "int", "YAMLType": "integer", "YAMLSchema": "Integer", "YAMLEnumValues": null, "YAMLSchemaHTML": "Integer", "YAMLDefault": "262144", "Required": true, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Sets the size for NAT back end map.\nThis is the total number of endpoints. This is mostly\nmore than the size of the number of services.", "DescriptionHTML": "

Sets the size for NAT back end map.\nThis is the total number of endpoints. This is mostly\nmore than the size of the number of services.

", "UserEditable": true, "GoType": "*int" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFMapSizeNATFrontend", "NameEnvVar": "FELIX_BPFMapSizeNATFrontend", "NameYAML": "bpfMapSizeNATFrontend", "NameGoAPI": "BPFMapSizeNATFrontend", "StringSchema": "Integer", "StringSchemaHTML": "Integer", "StringDefault": "65536", "ParsedDefault": "65536", "ParsedDefaultJSON": "65536", "ParsedType": "int", "YAMLType": "integer", "YAMLSchema": "Integer", "YAMLEnumValues": null, "YAMLSchemaHTML": "Integer", "YAMLDefault": "65536", "Required": true, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Sets the size for NAT front end map.\nFrontendMap should be large enough to hold an entry for each nodeport,\nexternal IP and each port in each service.", "DescriptionHTML": "

Sets the size for NAT front end map.\nFrontendMap should be large enough to hold an entry for each nodeport,\nexternal IP and each port in each service.

", "UserEditable": true, "GoType": "*int" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFMapSizePerCPUConntrack", "NameEnvVar": "FELIX_BPFMapSizePerCPUConntrack", "NameYAML": "bpfMapSizePerCpuConntrack", "NameGoAPI": "BPFMapSizePerCPUConntrack", "StringSchema": "Integer", "StringSchemaHTML": "Integer", "StringDefault": "0", "ParsedDefault": "0", "ParsedDefaultJSON": "0", "ParsedType": "int", "YAMLType": "integer", "YAMLSchema": "Integer", "YAMLEnumValues": null, "YAMLSchemaHTML": "Integer", "YAMLDefault": "0", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Determines the size of conntrack map based on the number of CPUs. If set to a\nnon-zero value, overrides BPFMapSizeConntrack with `BPFMapSizePerCPUConntrack * (Number of CPUs)`.\nThis map must be large enough to hold an entry for each active connection. Warning: changing the size of the\nconntrack map can cause disruption.", "DescriptionHTML": "

Determines the size of conntrack map based on the number of CPUs. If set to a\nnon-zero value, overrides BPFMapSizeConntrack with BPFMapSizePerCPUConntrack * (Number of CPUs).\nThis map must be large enough to hold an entry for each active connection. Warning: changing the size of the\nconntrack map can cause disruption.

", "UserEditable": true, "GoType": "*int" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFMapSizeRoute", "NameEnvVar": "FELIX_BPFMapSizeRoute", "NameYAML": "bpfMapSizeRoute", "NameGoAPI": "BPFMapSizeRoute", "StringSchema": "Integer", "StringSchemaHTML": "Integer", "StringDefault": "262144", "ParsedDefault": "262144", "ParsedDefaultJSON": "262144", "ParsedType": "int", "YAMLType": "integer", "YAMLSchema": "Integer", "YAMLEnumValues": null, "YAMLSchemaHTML": "Integer", "YAMLDefault": "262144", "Required": true, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Sets the size for the routes map. The routes map should be large enough\nto hold one entry per workload and a handful of entries per host (enough to cover its own IPs and\ntunnel IPs).", "DescriptionHTML": "

Sets the size for the routes map. The routes map should be large enough\nto hold one entry per workload and a handful of entries per host (enough to cover its own IPs and\ntunnel IPs).

", "UserEditable": true, "GoType": "*int" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFPSNATPorts", "NameEnvVar": "FELIX_BPFPSNATPorts", "NameYAML": "bpfPSNATPorts", "NameGoAPI": "BPFPSNATPorts", "StringSchema": "Port range: either a single number in [0,65535] or a range of numbers `n:m`", "StringSchemaHTML": "Port range: either a single number in [0,65535] or a range of numbers n:m", "StringDefault": "20000:29999", "ParsedDefault": "20000:29999", "ParsedDefaultJSON": "\"20000:29999\"", "ParsedType": "numorstring.Port", "YAMLType": "integer or string", "YAMLSchema": "Port range: either an integer in [0,65535] or a string, representing a range, in format `n:m`", "YAMLEnumValues": null, "YAMLSchemaHTML": "Port range: either an integer in [0,65535] or a string, representing a range, in format n:m", "YAMLDefault": "20000:29999", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Sets the range from which we randomly pick a port if there is a source port\ncollision. This should be within the ephemeral range as defined by RFC 6056 (1024–65535) and\npreferably outside the ephemeral ranges used by common operating systems. Linux uses\n32768–60999, while others mostly use the IANA defined range 49152–65535. It is not necessarily\na problem if this range overlaps with the operating systems. Both ends of the range are\ninclusive.", "DescriptionHTML": "

Sets the range from which we randomly pick a port if there is a source port\ncollision. This should be within the ephemeral range as defined by RFC 6056 (1024–65535) and\npreferably outside the ephemeral ranges used by common operating systems. Linux uses\n32768–60999, while others mostly use the IANA defined range 49152–65535. It is not necessarily\na problem if this range overlaps with the operating systems. Both ends of the range are\ninclusive.

", "UserEditable": true, "GoType": "*numorstring.Port" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFPolicyDebugEnabled", "NameEnvVar": "FELIX_BPFPolicyDebugEnabled", "NameYAML": "bpfPolicyDebugEnabled", "NameGoAPI": "BPFPolicyDebugEnabled", "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", "StringDefault": "true", "ParsedDefault": "true", "ParsedDefaultJSON": "true", "ParsedType": "bool", "YAMLType": "boolean", "YAMLSchema": "Boolean.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Boolean.", "YAMLDefault": "true", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "When true, Felix records detailed information\nabout the BPF policy programs, which can be examined with the calico-bpf command-line tool.", "DescriptionHTML": "

When true, Felix records detailed information\nabout the BPF policy programs, which can be examined with the calico-bpf command-line tool.

", "UserEditable": true, "GoType": "*bool" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFProfiling", "NameEnvVar": "FELIX_BPFProfiling", "NameYAML": "bpfProfiling", "NameGoAPI": "BPFProfiling", "StringSchema": "One of: `Disabled`, `Enabled` (case insensitive)", "StringSchemaHTML": "One of: Disabled, Enabled (case insensitive)", "StringDefault": "Disabled", "ParsedDefault": "Disabled", "ParsedDefaultJSON": "\"Disabled\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "One of: `\"Disabled\"`, `\"Enabled\"`.", "YAMLEnumValues": [ "`\"Disabled\"`", "`\"Enabled\"`" ], "YAMLSchemaHTML": "One of: \"Disabled\", \"Enabled\".", "YAMLDefault": "Disabled", "Required": true, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Controls profiling of BPF programs. At the monent, it can be\nDisabled or Enabled.", "DescriptionHTML": "

Controls profiling of BPF programs. At the monent, it can be\nDisabled or Enabled.

", "UserEditable": true, "GoType": "string" }, { "Group": "Dataplane: eBPF", "GroupWithSortPrefix": "22 Dataplane: eBPF", "NameConfigFile": "BPFRedirectToPeer", "NameEnvVar": "FELIX_BPFRedirectToPeer", "NameYAML": "bpfRedirectToPeer", "NameGoAPI": "BPFRedirectToPeer", "StringSchema": "One of: `Disabled`, `Enabled`, `L2Only` (case insensitive)", "StringSchemaHTML": "One of: Disabled, Enabled, L2Only (case insensitive)", "StringDefault": "Enabled", "ParsedDefault": "Enabled", "ParsedDefaultJSON": "\"Enabled\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "One of: `\"Disabled\"`, `\"Enabled\"`.", "YAMLEnumValues": [ "`\"Disabled\"`", "`\"Enabled\"`" ], "YAMLSchemaHTML": "One of: \"Disabled\", \"Enabled\".", "YAMLDefault": "Enabled", "Required": true, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Controls whether traffic may be forwarded directly to the peer side of a workload’s device.\nNote that the legacy \"L2Only\" option is now deprecated and if set it is treated like \"Enabled.\nSetting this option to \"Enabled\" allows direct redirection (including from L3 host devices such as IPIP tunnels or WireGuard),\nwhich can improve redirection performance but causes the redirected packets to bypass the host‑side ingress path.\nAs a result, packet‑capture tools on the host side of the workload device (for example, tcpdump) will not see that traffic.", "DescriptionHTML": "

Controls whether traffic may be forwarded directly to the peer side of a workload’s device.\nNote that the legacy \"L2Only\" option is now deprecated and if set it is treated like \"Enabled.\nSetting this option to \"Enabled\" allows direct redirection (including from L3 host devices such as IPIP tunnels or WireGuard),\nwhich can improve redirection performance but causes the redirected packets to bypass the host‑side ingress path.\nAs a result, packet‑capture tools on the host side of the workload device (for example, tcpdump) will not see that traffic.

", "UserEditable": true, "GoType": "string" } ] }, { "Name": "Dataplane: Windows", "Fields": [ { "Group": "Dataplane: Windows", "GroupWithSortPrefix": "23 Dataplane: Windows", "NameConfigFile": "WindowsManageFirewallRules", "NameEnvVar": "FELIX_WindowsManageFirewallRules", "NameYAML": "windowsManageFirewallRules", "NameGoAPI": "WindowsManageFirewallRules", "StringSchema": "One of: `Disabled`, `Enabled` (case insensitive)", "StringSchemaHTML": "One of: Disabled, Enabled (case insensitive)", "StringDefault": "Disabled", "ParsedDefault": "Disabled", "ParsedDefaultJSON": "\"Disabled\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "One of: `\"Disabled\"`, `\"Enabled\"`.", "YAMLEnumValues": [ "`\"Disabled\"`", "`\"Enabled\"`" ], "YAMLSchemaHTML": "One of: \"Disabled\", \"Enabled\".", "YAMLDefault": "Disabled", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Configures whether or not Felix will program Windows Firewall rules (to allow inbound access to its own metrics ports).", "DescriptionHTML": "

Configures whether or not Felix will program Windows Firewall rules (to allow inbound access to its own metrics ports).

", "UserEditable": true, "GoType": "*v3.WindowsManageFirewallRulesMode" } ] }, { "Name": "Dataplane: OpenStack support", "Fields": [ { "Group": "Dataplane: OpenStack support", "GroupWithSortPrefix": "25 Dataplane: OpenStack support", "NameConfigFile": "EndpointReportingDelaySecs", "NameEnvVar": "FELIX_EndpointReportingDelaySecs", "NameYAML": "endpointReportingDelay", "NameGoAPI": "EndpointReportingDelay", "StringSchema": "Seconds (floating point)", "StringSchemaHTML": "Seconds (floating point)", "StringDefault": "1", "ParsedDefault": "1s", "ParsedDefaultJSON": "1000000000", "ParsedType": "time.Duration", "YAMLType": "string", "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", "YAMLDefault": "1s", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "The delay before Felix reports endpoint status to the datastore. This is only used\nby the OpenStack integration.", "DescriptionHTML": "

The delay before Felix reports endpoint status to the datastore. This is only used\nby the OpenStack integration.

", "UserEditable": true, "GoType": "*v1.Duration" }, { "Group": "Dataplane: OpenStack support", "GroupWithSortPrefix": "25 Dataplane: OpenStack support", "NameConfigFile": "EndpointReportingEnabled", "NameEnvVar": "FELIX_EndpointReportingEnabled", "NameYAML": "endpointReportingEnabled", "NameGoAPI": "EndpointReportingEnabled", "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", "StringDefault": "false", "ParsedDefault": "false", "ParsedDefaultJSON": "false", "ParsedType": "bool", "YAMLType": "boolean", "YAMLSchema": "Boolean.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Boolean.", "YAMLDefault": "false", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Controls whether Felix reports endpoint status to the datastore. This is only used\nby the OpenStack integration.", "DescriptionHTML": "

Controls whether Felix reports endpoint status to the datastore. This is only used\nby the OpenStack integration.

", "UserEditable": true, "GoType": "*bool" }, { "Group": "Dataplane: OpenStack support", "GroupWithSortPrefix": "25 Dataplane: OpenStack support", "NameConfigFile": "MetadataAddr", "NameEnvVar": "FELIX_MetadataAddr", "NameYAML": "metadataAddr", "NameGoAPI": "MetadataAddr", "StringSchema": "String matching regex `^[a-zA-Z0-9_.-]+$`", "StringSchemaHTML": "String matching regex ^[a-zA-Z0-9_.-]+$", "StringDefault": "127.0.0.1", "ParsedDefault": "127.0.0.1", "ParsedDefaultJSON": "\"127.0.0.1\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "String.", "YAMLEnumValues": null, "YAMLSchemaHTML": "String.", "YAMLDefault": "127.0.0.1", "Required": false, "OnParseFailure": "Exit", "AllowedConfigSources": "All", "Description": "The IP address or domain name of the server that can answer VM queries for\ncloud-init metadata. In OpenStack, this corresponds to the machine running nova-api (or in\nUbuntu, nova-api-metadata). A value of none (case-insensitive) means that Felix should not\nset up any NAT rule for the metadata path.", "DescriptionHTML": "

The IP address or domain name of the server that can answer VM queries for\ncloud-init metadata. In OpenStack, this corresponds to the machine running nova-api (or in\nUbuntu, nova-api-metadata). A value of none (case-insensitive) means that Felix should not\nset up any NAT rule for the metadata path.

", "UserEditable": true, "GoType": "string" }, { "Group": "Dataplane: OpenStack support", "GroupWithSortPrefix": "25 Dataplane: OpenStack support", "NameConfigFile": "MetadataPort", "NameEnvVar": "FELIX_MetadataPort", "NameYAML": "metadataPort", "NameGoAPI": "MetadataPort", "StringSchema": "Integer: [0,65535]", "StringSchemaHTML": "Integer: [0,65535]", "StringDefault": "8775", "ParsedDefault": "8775", "ParsedDefaultJSON": "8775", "ParsedType": "int", "YAMLType": "integer", "YAMLSchema": "Integer: [0,65535]", "YAMLEnumValues": null, "YAMLSchemaHTML": "Integer: [0,65535]", "YAMLDefault": "8775", "Required": false, "OnParseFailure": "Exit", "AllowedConfigSources": "All", "Description": "The port of the metadata server. This, combined with global.MetadataAddr (if\nnot 'None'), is used to set up a NAT rule, from 169.254.169.254:80 to MetadataAddr:MetadataPort.\nIn most cases this should not need to be changed .", "DescriptionHTML": "

The port of the metadata server. This, combined with global.MetadataAddr (if\nnot 'None'), is used to set up a NAT rule, from 169.254.169.254:80 to MetadataAddr:MetadataPort.\nIn most cases this should not need to be changed .

", "UserEditable": true, "GoType": "*int" }, { "Group": "Dataplane: OpenStack support", "GroupWithSortPrefix": "25 Dataplane: OpenStack support", "NameConfigFile": "OpenstackRegion", "NameEnvVar": "FELIX_OpenstackRegion", "NameYAML": "openstackRegion", "NameGoAPI": "OpenstackRegion", "StringSchema": "OpenStack region name (must be a valid DNS label)", "StringSchemaHTML": "OpenStack region name (must be a valid DNS label)", "StringDefault": "", "ParsedDefault": "", "ParsedDefaultJSON": "\"\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "String.", "YAMLEnumValues": null, "YAMLSchemaHTML": "String.", "YAMLDefault": "", "Required": false, "OnParseFailure": "Exit", "AllowedConfigSources": "All", "Description": "The name of the region that a particular Felix belongs to. In a multi-region\nCalico/OpenStack deployment, this must be configured somehow for each Felix (here in the datamodel,\nor in felix.cfg or the environment on each compute node), and must match the [calico]\nopenstack_region value configured in neutron.conf on each node.", "DescriptionHTML": "

The name of the region that a particular Felix belongs to. In a multi-region\nCalico/OpenStack deployment, this must be configured somehow for each Felix (here in the datamodel,\nor in felix.cfg or the environment on each compute node), and must match the [calico]\nopenstack_region value configured in neutron.conf on each node.

", "UserEditable": true, "GoType": "string" }, { "Group": "Dataplane: OpenStack support", "GroupWithSortPrefix": "25 Dataplane: OpenStack support", "NameConfigFile": "ReportingIntervalSecs", "NameEnvVar": "FELIX_ReportingIntervalSecs", "NameYAML": "reportingInterval", "NameGoAPI": "ReportingInterval", "StringSchema": "Seconds (floating point)", "StringSchemaHTML": "Seconds (floating point)", "StringDefault": "30", "ParsedDefault": "30s", "ParsedDefaultJSON": "30000000000", "ParsedType": "time.Duration", "YAMLType": "string", "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", "YAMLDefault": "30s", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "The interval at which Felix reports its status into the datastore or 0 to disable.\nMust be non-zero in OpenStack deployments.", "DescriptionHTML": "

The interval at which Felix reports its status into the datastore or 0 to disable.\nMust be non-zero in OpenStack deployments.

", "UserEditable": true, "GoType": "*v1.Duration" }, { "Group": "Dataplane: OpenStack support", "GroupWithSortPrefix": "25 Dataplane: OpenStack support", "NameConfigFile": "ReportingTTLSecs", "NameEnvVar": "FELIX_ReportingTTLSecs", "NameYAML": "reportingTTL", "NameGoAPI": "ReportingTTL", "StringSchema": "Seconds (floating point)", "StringSchemaHTML": "Seconds (floating point)", "StringDefault": "90", "ParsedDefault": "1m30s", "ParsedDefaultJSON": "90000000000", "ParsedType": "time.Duration", "YAMLType": "string", "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", "YAMLDefault": "1m30s", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "The time-to-live setting for process-wide status reports.", "DescriptionHTML": "

The time-to-live setting for process-wide status reports.

", "UserEditable": true, "GoType": "*v1.Duration" } ] }, { "Name": "Dataplane: XDP acceleration for iptables dataplane", "Fields": [ { "Group": "Dataplane: XDP acceleration for iptables dataplane", "GroupWithSortPrefix": "25 Dataplane: XDP acceleration for iptables dataplane", "NameConfigFile": "GenericXDPEnabled", "NameEnvVar": "FELIX_GenericXDPEnabled", "NameYAML": "genericXDPEnabled", "NameGoAPI": "GenericXDPEnabled", "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", "StringDefault": "false", "ParsedDefault": "false", "ParsedDefaultJSON": "false", "ParsedType": "bool", "YAMLType": "boolean", "YAMLSchema": "Boolean.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Boolean.", "YAMLDefault": "false", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Enables Generic XDP so network cards that don't support XDP offload or driver\nmodes can use XDP. This is not recommended since it doesn't provide better performance than\niptables.", "DescriptionHTML": "

Enables Generic XDP so network cards that don't support XDP offload or driver\nmodes can use XDP. This is not recommended since it doesn't provide better performance than\niptables.

", "UserEditable": true, "GoType": "*bool" }, { "Group": "Dataplane: XDP acceleration for iptables dataplane", "GroupWithSortPrefix": "25 Dataplane: XDP acceleration for iptables dataplane", "NameConfigFile": "XDPEnabled", "NameEnvVar": "FELIX_XDPEnabled", "NameYAML": "xdpEnabled", "NameGoAPI": "XDPEnabled", "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", "StringDefault": "true", "ParsedDefault": "true", "ParsedDefaultJSON": "true", "ParsedType": "bool", "YAMLType": "boolean", "YAMLSchema": "Boolean.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Boolean.", "YAMLDefault": "true", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Enables XDP acceleration for suitable untracked incoming deny rules.", "DescriptionHTML": "

Enables XDP acceleration for suitable untracked incoming deny rules.

", "UserEditable": true, "GoType": "*bool" }, { "Group": "Dataplane: XDP acceleration for iptables dataplane", "GroupWithSortPrefix": "25 Dataplane: XDP acceleration for iptables dataplane", "NameConfigFile": "XDPRefreshInterval", "NameEnvVar": "FELIX_XDPRefreshInterval", "NameYAML": "xdpRefreshInterval", "NameGoAPI": "XDPRefreshInterval", "StringSchema": "Seconds (floating point)", "StringSchemaHTML": "Seconds (floating point)", "StringDefault": "90", "ParsedDefault": "1m30s", "ParsedDefaultJSON": "90000000000", "ParsedType": "time.Duration", "YAMLType": "string", "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", "YAMLDefault": "1m30s", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "The period at which Felix re-checks all XDP state to ensure that no\nother process has accidentally broken Calico's BPF maps or attached programs. Set to 0 to\ndisable XDP refresh.", "DescriptionHTML": "

The period at which Felix re-checks all XDP state to ensure that no\nother process has accidentally broken Calico's BPF maps or attached programs. Set to 0 to\ndisable XDP refresh.

", "UserEditable": true, "GoType": "*v1.Duration" } ] }, { "Name": "Overlay: VXLAN overlay", "Fields": [ { "Group": "Overlay: VXLAN overlay", "GroupWithSortPrefix": "31 Overlay: VXLAN overlay", "NameConfigFile": "VXLANEnabled", "NameEnvVar": "FELIX_VXLANEnabled", "NameYAML": "vxlanEnabled", "NameGoAPI": "VXLANEnabled", "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", "StringDefault": "", "ParsedDefault": "", "ParsedDefaultJSON": "null", "ParsedType": "*bool", "YAMLType": "boolean", "YAMLSchema": "Boolean.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Boolean.", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Overrides whether Felix should create the VXLAN tunnel device for IPv4 VXLAN networking.\nOptional as Felix determines this based on the existing IP pools.", "DescriptionHTML": "

Overrides whether Felix should create the VXLAN tunnel device for IPv4 VXLAN networking.\nOptional as Felix determines this based on the existing IP pools.

", "UserEditable": true, "GoType": "*bool" }, { "Group": "Overlay: VXLAN overlay", "GroupWithSortPrefix": "31 Overlay: VXLAN overlay", "NameConfigFile": "VXLANMTU", "NameEnvVar": "FELIX_VXLANMTU", "NameYAML": "vxlanMTU", "NameGoAPI": "VXLANMTU", "StringSchema": "Integer", "StringSchemaHTML": "Integer", "StringDefault": "0", "ParsedDefault": "0", "ParsedDefaultJSON": "0", "ParsedType": "int", "YAMLType": "integer", "YAMLSchema": "Integer", "YAMLEnumValues": null, "YAMLSchemaHTML": "Integer", "YAMLDefault": "0", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "The MTU to set on the IPv4 VXLAN tunnel device. Optional as Felix auto-detects the MTU based on the\nMTU of the host's interfaces.", "DescriptionHTML": "

The MTU to set on the IPv4 VXLAN tunnel device. Optional as Felix auto-detects the MTU based on the\nMTU of the host's interfaces.

", "UserEditable": true, "GoType": "*int" }, { "Group": "Overlay: VXLAN overlay", "GroupWithSortPrefix": "31 Overlay: VXLAN overlay", "NameConfigFile": "VXLANMTUV6", "NameEnvVar": "FELIX_VXLANMTUV6", "NameYAML": "vxlanMTUV6", "NameGoAPI": "VXLANMTUV6", "StringSchema": "Integer", "StringSchemaHTML": "Integer", "StringDefault": "0", "ParsedDefault": "0", "ParsedDefaultJSON": "0", "ParsedType": "int", "YAMLType": "integer", "YAMLSchema": "Integer", "YAMLEnumValues": null, "YAMLSchemaHTML": "Integer", "YAMLDefault": "0", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "The MTU to set on the IPv6 VXLAN tunnel device. Optional as Felix auto-detects the MTU based on the\nMTU of the host's interfaces.", "DescriptionHTML": "

The MTU to set on the IPv6 VXLAN tunnel device. Optional as Felix auto-detects the MTU based on the\nMTU of the host's interfaces.

", "UserEditable": true, "GoType": "*int" }, { "Group": "Overlay: VXLAN overlay", "GroupWithSortPrefix": "31 Overlay: VXLAN overlay", "NameConfigFile": "VXLANPort", "NameEnvVar": "FELIX_VXLANPort", "NameYAML": "vxlanPort", "NameGoAPI": "VXLANPort", "StringSchema": "Integer", "StringSchemaHTML": "Integer", "StringDefault": "4789", "ParsedDefault": "4789", "ParsedDefaultJSON": "4789", "ParsedType": "int", "YAMLType": "integer", "YAMLSchema": "Integer", "YAMLEnumValues": null, "YAMLSchemaHTML": "Integer", "YAMLDefault": "4789", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "The UDP port number to use for VXLAN traffic.", "DescriptionHTML": "

The UDP port number to use for VXLAN traffic.

", "UserEditable": true, "GoType": "*int" }, { "Group": "Overlay: VXLAN overlay", "GroupWithSortPrefix": "31 Overlay: VXLAN overlay", "NameConfigFile": "VXLANVNI", "NameEnvVar": "FELIX_VXLANVNI", "NameYAML": "vxlanVNI", "NameGoAPI": "VXLANVNI", "StringSchema": "Integer", "StringSchemaHTML": "Integer", "StringDefault": "4096", "ParsedDefault": "4096", "ParsedDefaultJSON": "4096", "ParsedType": "int", "YAMLType": "integer", "YAMLSchema": "Integer", "YAMLEnumValues": null, "YAMLSchemaHTML": "Integer", "YAMLDefault": "4096", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "The VXLAN VNI to use for VXLAN traffic. You may need to change this if the default value is\nin use on your system.", "DescriptionHTML": "

The VXLAN VNI to use for VXLAN traffic. You may need to change this if the default value is\nin use on your system.

", "UserEditable": true, "GoType": "*int" } ] }, { "Name": "Overlay: IP-in-IP", "Fields": [ { "Group": "Overlay: IP-in-IP", "GroupWithSortPrefix": "32 Overlay: IP-in-IP", "NameConfigFile": "IpInIpEnabled", "NameEnvVar": "FELIX_IpInIpEnabled", "NameYAML": "ipipEnabled", "NameGoAPI": "IPIPEnabled", "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", "StringDefault": "", "ParsedDefault": "", "ParsedDefaultJSON": "null", "ParsedType": "*bool", "YAMLType": "boolean", "YAMLSchema": "Boolean.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Boolean.", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Overrides whether Felix should configure an IPIP interface on the host. Optional as Felix\ndetermines this based on the existing IP pools.", "DescriptionHTML": "

Overrides whether Felix should configure an IPIP interface on the host. Optional as Felix\ndetermines this based on the existing IP pools.

", "UserEditable": true, "GoType": "*bool" }, { "Group": "Overlay: IP-in-IP", "GroupWithSortPrefix": "32 Overlay: IP-in-IP", "NameConfigFile": "IpInIpMtu", "NameEnvVar": "FELIX_IpInIpMtu", "NameYAML": "ipipMTU", "NameGoAPI": "IPIPMTU", "StringSchema": "Integer", "StringSchemaHTML": "Integer", "StringDefault": "0", "ParsedDefault": "0", "ParsedDefaultJSON": "0", "ParsedType": "int", "YAMLType": "integer", "YAMLSchema": "Integer", "YAMLEnumValues": null, "YAMLSchemaHTML": "Integer", "YAMLDefault": "0", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Controls the MTU to set on the IPIP tunnel device. Optional as Felix auto-detects the MTU based on the\nMTU of the host's interfaces.", "DescriptionHTML": "

Controls the MTU to set on the IPIP tunnel device. Optional as Felix auto-detects the MTU based on the\nMTU of the host's interfaces.

", "UserEditable": true, "GoType": "*int" } ] }, { "Name": "Overlay: Wireguard", "Fields": [ { "Group": "Overlay: Wireguard", "GroupWithSortPrefix": "33 Overlay: Wireguard", "NameConfigFile": "WireguardEnabled", "NameEnvVar": "FELIX_WireguardEnabled", "NameYAML": "wireguardEnabled", "NameGoAPI": "WireguardEnabled", "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", "StringDefault": "false", "ParsedDefault": "false", "ParsedDefaultJSON": "false", "ParsedType": "bool", "YAMLType": "boolean", "YAMLSchema": "Boolean.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Boolean.", "YAMLDefault": "false", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Controls whether Wireguard is enabled for IPv4 (encapsulating IPv4 traffic over an IPv4 underlay network).", "DescriptionHTML": "

Controls whether Wireguard is enabled for IPv4 (encapsulating IPv4 traffic over an IPv4 underlay network).

", "UserEditable": true, "GoType": "*bool" }, { "Group": "Overlay: Wireguard", "GroupWithSortPrefix": "33 Overlay: Wireguard", "NameConfigFile": "WireguardEnabledV6", "NameEnvVar": "FELIX_WireguardEnabledV6", "NameYAML": "wireguardEnabledV6", "NameGoAPI": "WireguardEnabledV6", "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", "StringDefault": "false", "ParsedDefault": "false", "ParsedDefaultJSON": "false", "ParsedType": "bool", "YAMLType": "boolean", "YAMLSchema": "Boolean.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Boolean.", "YAMLDefault": "false", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Controls whether Wireguard is enabled for IPv6 (encapsulating IPv6 traffic over an IPv6 underlay network).", "DescriptionHTML": "

Controls whether Wireguard is enabled for IPv6 (encapsulating IPv6 traffic over an IPv6 underlay network).

", "UserEditable": true, "GoType": "*bool" }, { "Group": "Overlay: Wireguard", "GroupWithSortPrefix": "33 Overlay: Wireguard", "NameConfigFile": "WireguardHostEncryptionEnabled", "NameEnvVar": "FELIX_WireguardHostEncryptionEnabled", "NameYAML": "wireguardHostEncryptionEnabled", "NameGoAPI": "WireguardHostEncryptionEnabled", "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", "StringDefault": "false", "ParsedDefault": "false", "ParsedDefaultJSON": "false", "ParsedType": "bool", "YAMLType": "boolean", "YAMLSchema": "Boolean.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Boolean.", "YAMLDefault": "false", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Controls whether Wireguard host-to-host encryption is enabled.", "DescriptionHTML": "

Controls whether Wireguard host-to-host encryption is enabled.

", "UserEditable": true, "GoType": "*bool" }, { "Group": "Overlay: Wireguard", "GroupWithSortPrefix": "33 Overlay: Wireguard", "NameConfigFile": "WireguardInterfaceName", "NameEnvVar": "FELIX_WireguardInterfaceName", "NameYAML": "wireguardInterfaceName", "NameGoAPI": "WireguardInterfaceName", "StringSchema": "String matching regex `^[a-zA-Z0-9:._+-]{1,15}$`", "StringSchemaHTML": "String matching regex ^[a-zA-Z0-9:._+-]{1,15}$", "StringDefault": "wireguard.cali", "ParsedDefault": "wireguard.cali", "ParsedDefaultJSON": "\"wireguard.cali\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "String.", "YAMLEnumValues": null, "YAMLSchemaHTML": "String.", "YAMLDefault": "wireguard.cali", "Required": true, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Specifies the name to use for the IPv4 Wireguard interface.", "DescriptionHTML": "

Specifies the name to use for the IPv4 Wireguard interface.

", "UserEditable": true, "GoType": "string" }, { "Group": "Overlay: Wireguard", "GroupWithSortPrefix": "33 Overlay: Wireguard", "NameConfigFile": "WireguardInterfaceNameV6", "NameEnvVar": "FELIX_WireguardInterfaceNameV6", "NameYAML": "wireguardInterfaceNameV6", "NameGoAPI": "WireguardInterfaceNameV6", "StringSchema": "String matching regex `^[a-zA-Z0-9:._+-]{1,15}$`", "StringSchemaHTML": "String matching regex ^[a-zA-Z0-9:._+-]{1,15}$", "StringDefault": "wg-v6.cali", "ParsedDefault": "wg-v6.cali", "ParsedDefaultJSON": "\"wg-v6.cali\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "String.", "YAMLEnumValues": null, "YAMLSchemaHTML": "String.", "YAMLDefault": "wg-v6.cali", "Required": true, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Specifies the name to use for the IPv6 Wireguard interface.", "DescriptionHTML": "

Specifies the name to use for the IPv6 Wireguard interface.

", "UserEditable": true, "GoType": "string" }, { "Group": "Overlay: Wireguard", "GroupWithSortPrefix": "33 Overlay: Wireguard", "NameConfigFile": "WireguardListeningPort", "NameEnvVar": "FELIX_WireguardListeningPort", "NameYAML": "wireguardListeningPort", "NameGoAPI": "WireguardListeningPort", "StringSchema": "Integer", "StringSchemaHTML": "Integer", "StringDefault": "51820", "ParsedDefault": "51820", "ParsedDefaultJSON": "51820", "ParsedType": "int", "YAMLType": "integer", "YAMLSchema": "Integer", "YAMLEnumValues": null, "YAMLSchemaHTML": "Integer", "YAMLDefault": "51820", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Controls the listening port used by IPv4 Wireguard.", "DescriptionHTML": "

Controls the listening port used by IPv4 Wireguard.

", "UserEditable": true, "GoType": "*int" }, { "Group": "Overlay: Wireguard", "GroupWithSortPrefix": "33 Overlay: Wireguard", "NameConfigFile": "WireguardListeningPortV6", "NameEnvVar": "FELIX_WireguardListeningPortV6", "NameYAML": "wireguardListeningPortV6", "NameGoAPI": "WireguardListeningPortV6", "StringSchema": "Integer", "StringSchemaHTML": "Integer", "StringDefault": "51821", "ParsedDefault": "51821", "ParsedDefaultJSON": "51821", "ParsedType": "int", "YAMLType": "integer", "YAMLSchema": "Integer", "YAMLEnumValues": null, "YAMLSchemaHTML": "Integer", "YAMLDefault": "51821", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Controls the listening port used by IPv6 Wireguard.", "DescriptionHTML": "

Controls the listening port used by IPv6 Wireguard.

", "UserEditable": true, "GoType": "*int" }, { "Group": "Overlay: Wireguard", "GroupWithSortPrefix": "33 Overlay: Wireguard", "NameConfigFile": "WireguardMTU", "NameEnvVar": "FELIX_WireguardMTU", "NameYAML": "wireguardMTU", "NameGoAPI": "WireguardMTU", "StringSchema": "Integer", "StringSchemaHTML": "Integer", "StringDefault": "0", "ParsedDefault": "0", "ParsedDefaultJSON": "0", "ParsedType": "int", "YAMLType": "integer", "YAMLSchema": "Integer", "YAMLEnumValues": null, "YAMLSchemaHTML": "Integer", "YAMLDefault": "0", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Controls the MTU on the IPv4 Wireguard interface. See Configuring MTU.", "DescriptionHTML": "

Controls the MTU on the IPv4 Wireguard interface. See Configuring MTU.

", "UserEditable": true, "GoType": "*int" }, { "Group": "Overlay: Wireguard", "GroupWithSortPrefix": "33 Overlay: Wireguard", "NameConfigFile": "WireguardMTUV6", "NameEnvVar": "FELIX_WireguardMTUV6", "NameYAML": "wireguardMTUV6", "NameGoAPI": "WireguardMTUV6", "StringSchema": "Integer", "StringSchemaHTML": "Integer", "StringDefault": "0", "ParsedDefault": "0", "ParsedDefaultJSON": "0", "ParsedType": "int", "YAMLType": "integer", "YAMLSchema": "Integer", "YAMLEnumValues": null, "YAMLSchemaHTML": "Integer", "YAMLDefault": "0", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Controls the MTU on the IPv6 Wireguard interface. See Configuring MTU.", "DescriptionHTML": "

Controls the MTU on the IPv6 Wireguard interface. See Configuring MTU.

", "UserEditable": true, "GoType": "*int" }, { "Group": "Overlay: Wireguard", "GroupWithSortPrefix": "33 Overlay: Wireguard", "NameConfigFile": "WireguardPersistentKeepAlive", "NameEnvVar": "FELIX_WireguardPersistentKeepAlive", "NameYAML": "wireguardKeepAlive", "NameGoAPI": "WireguardPersistentKeepAlive", "StringSchema": "Seconds (floating point)", "StringSchemaHTML": "Seconds (floating point)", "StringDefault": "0", "ParsedDefault": "0s", "ParsedDefaultJSON": "0", "ParsedType": "time.Duration", "YAMLType": "string", "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", "YAMLDefault": "0s", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Controls Wireguard PersistentKeepalive option. Set 0 to disable.", "DescriptionHTML": "

Controls Wireguard PersistentKeepalive option. Set 0 to disable.

", "UserEditable": true, "GoType": "*v1.Duration" }, { "Group": "Overlay: Wireguard", "GroupWithSortPrefix": "33 Overlay: Wireguard", "NameConfigFile": "WireguardRoutingRulePriority", "NameEnvVar": "FELIX_WireguardRoutingRulePriority", "NameYAML": "wireguardRoutingRulePriority", "NameGoAPI": "WireguardRoutingRulePriority", "StringSchema": "Integer", "StringSchemaHTML": "Integer", "StringDefault": "99", "ParsedDefault": "99", "ParsedDefaultJSON": "99", "ParsedType": "int", "YAMLType": "integer", "YAMLSchema": "Integer", "YAMLEnumValues": null, "YAMLSchemaHTML": "Integer", "YAMLDefault": "99", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Controls the priority value to use for the Wireguard routing rule.", "DescriptionHTML": "

Controls the priority value to use for the Wireguard routing rule.

", "UserEditable": true, "GoType": "*int" }, { "Group": "Overlay: Wireguard", "GroupWithSortPrefix": "33 Overlay: Wireguard", "NameConfigFile": "WireguardThreadingEnabled", "NameEnvVar": "FELIX_WireguardThreadingEnabled", "NameYAML": "wireguardThreadingEnabled", "NameGoAPI": "WireguardThreadingEnabled", "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", "StringDefault": "false", "ParsedDefault": "false", "ParsedDefaultJSON": "false", "ParsedType": "bool", "YAMLType": "boolean", "YAMLSchema": "Boolean.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Boolean.", "YAMLDefault": "false", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Controls whether Wireguard has Threaded NAPI enabled. \nThis increases the maximum number of packets a Wireguard interface can process.\nConsider threaded NAPI only if you have high packets per second workloads that are causing dropping packets due to a saturated `softirq` CPU core.\nThere is a [known issue](https://lore.kernel.org/netdev/CALrw=nEoT2emQ0OAYCjM1d_6Xe_kNLSZ6dhjb5FxrLFYh4kozA@mail.gmail.com/T/) with this setting\nthat may cause NAPI to get stuck holding the global `rtnl_mutex` when a peer is removed.\nWorkaround: Make sure your Linux kernel [includes this patch](https://github.com/torvalds/linux/commit/56364c910691f6d10ba88c964c9041b9ab777bd6) to unwedge NAPI.", "DescriptionHTML": "

Controls whether Wireguard has Threaded NAPI enabled. \nThis increases the maximum number of packets a Wireguard interface can process.\nConsider threaded NAPI only if you have high packets per second workloads that are causing dropping packets due to a saturated softirq CPU core.\nThere is a [known issue](https://lore.kernel.org/netdev/CALrw=nEoT2emQ0OAYCjM1d_6Xe_kNLSZ6dhjb5FxrLFYh4kozA@mail.gmail.com/T/) with this setting\nthat may cause NAPI to get stuck holding the global rtnl_mutex when a peer is removed.\nWorkaround: Make sure your Linux kernel [includes this patch](https://github.com/torvalds/linux/commit/56364c910691f6d10ba88c964c9041b9ab777bd6) to unwedge NAPI.

", "UserEditable": true, "GoType": "*bool" } ] }, { "Name": "Flow logs: file reports", "Fields": [ { "Group": "Flow logs: file reports", "GroupWithSortPrefix": "40 Flow logs: file reports", "NameConfigFile": "FlowLogsCollectorDebugTrace", "NameEnvVar": "FELIX_FlowLogsCollectorDebugTrace", "NameYAML": "flowLogsCollectorDebugTrace", "NameGoAPI": "FlowLogsCollectorDebugTrace", "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", "StringDefault": "false", "ParsedDefault": "false", "ParsedDefaultJSON": "false", "ParsedType": "bool", "YAMLType": "boolean", "YAMLSchema": "Boolean.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Boolean.", "YAMLDefault": "false", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "When FlowLogsCollectorDebugTrace is set to true, enables the logs in the collector to be\nprinted in their entirety.", "DescriptionHTML": "

When FlowLogsCollectorDebugTrace is set to true, enables the logs in the collector to be\nprinted in their entirety.

", "UserEditable": true, "GoType": "*bool" }, { "Group": "Flow logs: file reports", "GroupWithSortPrefix": "40 Flow logs: file reports", "NameConfigFile": "FlowLogsFlushInterval", "NameEnvVar": "FELIX_FlowLogsFlushInterval", "NameYAML": "flowLogsFlushInterval", "NameGoAPI": "FlowLogsFlushInterval", "StringSchema": "Seconds (floating point)", "StringSchemaHTML": "Seconds (floating point)", "StringDefault": "300", "ParsedDefault": "5m0s", "ParsedDefaultJSON": "300000000000", "ParsedType": "time.Duration", "YAMLType": "string", "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", "YAMLDefault": "5m0s", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Configures the interval at which Felix exports flow logs.", "DescriptionHTML": "

Configures the interval at which Felix exports flow logs.

", "UserEditable": true, "GoType": "*v1.Duration" }, { "Group": "Flow logs: file reports", "GroupWithSortPrefix": "40 Flow logs: file reports", "NameConfigFile": "FlowLogsGoldmaneServer", "NameEnvVar": "FELIX_FlowLogsGoldmaneServer", "NameYAML": "flowLogsGoldmaneServer", "NameGoAPI": "FlowLogsGoldmaneServer", "StringSchema": "String", "StringSchemaHTML": "String", "StringDefault": "", "ParsedDefault": "", "ParsedDefaultJSON": "\"\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "String.", "YAMLEnumValues": null, "YAMLSchemaHTML": "String.", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "FlowLogGoldmaneServer is the flow server endpoint to which flow data should be published.", "DescriptionHTML": "

FlowLogGoldmaneServer is the flow server endpoint to which flow data should be published.

", "UserEditable": true, "GoType": "*string" }, { "Group": "Flow logs: file reports", "GroupWithSortPrefix": "40 Flow logs: file reports", "NameConfigFile": "FlowLogsLocalReporter", "NameEnvVar": "FELIX_FlowLogsLocalReporter", "NameYAML": "flowLogsLocalReporter", "NameGoAPI": "FlowLogsLocalReporter", "StringSchema": "One of: `Disabled`, `Enabled` (case insensitive)", "StringSchemaHTML": "One of: Disabled, Enabled (case insensitive)", "StringDefault": "Disabled", "ParsedDefault": "Disabled", "ParsedDefaultJSON": "\"Disabled\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "One of: `\"Disabled\"`, `\"Enabled\"`.", "YAMLEnumValues": [ "`\"Disabled\"`", "`\"Enabled\"`" ], "YAMLSchemaHTML": "One of: \"Disabled\", \"Enabled\".", "YAMLDefault": "Disabled", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Configures local unix socket for reporting flow data from each node.", "DescriptionHTML": "

Configures local unix socket for reporting flow data from each node.

", "UserEditable": true, "GoType": "*string" }, { "Group": "Flow logs: file reports", "GroupWithSortPrefix": "40 Flow logs: file reports", "NameConfigFile": "FlowLogsPolicyEvaluationMode", "NameEnvVar": "FELIX_FlowLogsPolicyEvaluationMode", "NameYAML": "flowLogsPolicyEvaluationMode", "NameGoAPI": "FlowLogsPolicyEvaluationMode", "StringSchema": "One of: `Continuous`, `None` (case insensitive)", "StringSchemaHTML": "One of: Continuous, None (case insensitive)", "StringDefault": "Continuous", "ParsedDefault": "Continuous", "ParsedDefaultJSON": "\"Continuous\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "One of: `\"Continuous\"`, `\"None\"`.", "YAMLEnumValues": [ "`\"Continuous\"`", "`\"None\"`" ], "YAMLSchemaHTML": "One of: \"Continuous\", \"None\".", "YAMLDefault": "Continuous", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Continuous - Felix evaluates active flows on a regular basis to determine the rule\ntraces in the flow logs. Any policy updates that impact a flow will be reflected in the\npending_policies field, offering a near-real-time view of policy changes across flows.\nNone - Felix stops evaluating pending traces.", "DescriptionHTML": "

Continuous - Felix evaluates active flows on a regular basis to determine the rule\ntraces in the flow logs. Any policy updates that impact a flow will be reflected in the\npending_policies field, offering a near-real-time view of policy changes across flows.\nNone - Felix stops evaluating pending traces.

", "UserEditable": true, "GoType": "*v3.FlowLogsPolicyEvaluationModeType" } ] }, { "Name": "AWS integration", "Fields": [ { "Group": "AWS integration", "GroupWithSortPrefix": "60 AWS integration", "NameConfigFile": "AWSSrcDstCheck", "NameEnvVar": "FELIX_AWSSrcDstCheck", "NameYAML": "awsSrcDstCheck", "NameGoAPI": "AWSSrcDstCheck", "StringSchema": "One of: `Disable`, `DoNothing`, `Enable` (case insensitive)", "StringSchemaHTML": "One of: Disable, DoNothing, Enable (case insensitive)", "StringDefault": "DoNothing", "ParsedDefault": "DoNothing", "ParsedDefaultJSON": "\"DoNothing\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "One of: `\"Disable\"`, `\"DoNothing\"`, `\"Enable\"`.", "YAMLEnumValues": [ "`\"Disable\"`", "`\"DoNothing\"`", "`\"Enable\"`" ], "YAMLSchemaHTML": "One of: \"Disable\", \"DoNothing\", \"Enable\".", "YAMLDefault": "DoNothing", "Required": true, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Controls whether Felix will try to change the \"source/dest check\" setting on the EC2 instance\non which it is running. A value of \"Disable\" will try to disable the source/dest check. Disabling the check\nallows for sending workload traffic without encapsulation within the same AWS subnet.", "DescriptionHTML": "

Controls whether Felix will try to change the \"source/dest check\" setting on the EC2 instance\non which it is running. A value of \"Disable\" will try to disable the source/dest check. Disabling the check\nallows for sending workload traffic without encapsulation within the same AWS subnet.

", "UserEditable": true, "GoType": "*v3.AWSSrcDstCheckOption" } ] }, { "Name": "Debug/test-only (generally unsupported)", "Fields": [ { "Group": "Debug/test-only (generally unsupported)", "GroupWithSortPrefix": "97 Debug/test-only (generally unsupported)", "NameConfigFile": "DebugBPFCgroupV2", "NameEnvVar": "FELIX_DebugBPFCgroupV2", "NameYAML": "", "NameGoAPI": "", "StringSchema": "String", "StringSchemaHTML": "String", "StringDefault": "", "ParsedDefault": "", "ParsedDefaultJSON": "\"\"", "ParsedType": "string", "YAMLType": "", "YAMLSchema": "", "YAMLEnumValues": null, "YAMLSchemaHTML": "", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "LocalOnly", "Description": "Controls the cgroup v2 path that we apply the connect-time load balancer to. Most distros\nare configured for cgroup v1, which prevents all but the root cgroup v2 from working so this is only useful\nfor development right now.", "DescriptionHTML": "

Controls the cgroup v2 path that we apply the connect-time load balancer to. Most distros\nare configured for cgroup v1, which prevents all but the root cgroup v2 from working so this is only useful\nfor development right now.

", "UserEditable": true, "GoType": "" }, { "Group": "Debug/test-only (generally unsupported)", "GroupWithSortPrefix": "97 Debug/test-only (generally unsupported)", "NameConfigFile": "DebugCPUProfilePath", "NameEnvVar": "FELIX_DebugCPUProfilePath", "NameYAML": "", "NameGoAPI": "", "StringSchema": "Path to file", "StringSchemaHTML": "Path to file", "StringDefault": "/tmp/felix-cpu-.pprof", "ParsedDefault": "/tmp/felix-cpu-.pprof", "ParsedDefaultJSON": "\"/tmp/felix-cpu-\\u003ctimestamp\\u003e.pprof\"", "ParsedType": "string", "YAMLType": "", "YAMLSchema": "", "YAMLEnumValues": null, "YAMLSchemaHTML": "", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Unsupported diagnostic setting, used when testing Felix. Not exposed in `FelixConfiguration`.", "DescriptionHTML": "

Unsupported diagnostic setting, used when testing Felix. Not exposed in FelixConfiguration.

", "UserEditable": true, "GoType": "" }, { "Group": "Debug/test-only (generally unsupported)", "GroupWithSortPrefix": "97 Debug/test-only (generally unsupported)", "NameConfigFile": "DebugDisableLogDropping", "NameEnvVar": "FELIX_DebugDisableLogDropping", "NameYAML": "debugDisableLogDropping", "NameGoAPI": "DebugDisableLogDropping", "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", "StringDefault": "false", "ParsedDefault": "false", "ParsedDefaultJSON": "false", "ParsedType": "bool", "YAMLType": "boolean", "YAMLSchema": "Boolean.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Boolean.", "YAMLDefault": "false", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Disables the dropping of log messages when the log buffer is full. This can\nsignificantly impact performance if log write-out is a bottleneck.", "DescriptionHTML": "

Disables the dropping of log messages when the log buffer is full. This can\nsignificantly impact performance if log write-out is a bottleneck.

", "UserEditable": true, "GoType": "*bool" }, { "Group": "Debug/test-only (generally unsupported)", "GroupWithSortPrefix": "97 Debug/test-only (generally unsupported)", "NameConfigFile": "DebugHost", "NameEnvVar": "FELIX_DebugHost", "NameYAML": "debugHost", "NameGoAPI": "DebugHost", "StringSchema": "String matching regex `^[a-zA-Z0-9:._+-]{1,64}$`", "StringSchemaHTML": "String matching regex ^[a-zA-Z0-9:._+-]{1,64}$", "StringDefault": "localhost", "ParsedDefault": "localhost", "ParsedDefaultJSON": "\"localhost\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "String.", "YAMLEnumValues": null, "YAMLSchemaHTML": "String.", "YAMLDefault": "localhost", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "The host IP or hostname to bind the debug port to. Only used\nif DebugPort is set.", "DescriptionHTML": "

The host IP or hostname to bind the debug port to. Only used\nif DebugPort is set.

", "UserEditable": true, "GoType": "*string" }, { "Group": "Debug/test-only (generally unsupported)", "GroupWithSortPrefix": "97 Debug/test-only (generally unsupported)", "NameConfigFile": "DebugMemoryProfilePath", "NameEnvVar": "FELIX_DebugMemoryProfilePath", "NameYAML": "debugMemoryProfilePath", "NameGoAPI": "DebugMemoryProfilePath", "StringSchema": "Path to file", "StringSchemaHTML": "Path to file", "StringDefault": "", "ParsedDefault": "", "ParsedDefaultJSON": "\"\"", "ParsedType": "string", "YAMLType": "string", "YAMLSchema": "String.", "YAMLEnumValues": null, "YAMLSchemaHTML": "String.", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "The path to write the memory profile to when triggered by signal.", "DescriptionHTML": "

The path to write the memory profile to when triggered by signal.

", "UserEditable": true, "GoType": "string" }, { "Group": "Debug/test-only (generally unsupported)", "GroupWithSortPrefix": "97 Debug/test-only (generally unsupported)", "NameConfigFile": "DebugPanicAfter", "NameEnvVar": "FELIX_DebugPanicAfter", "NameYAML": "", "NameGoAPI": "", "StringSchema": "Seconds (floating point)", "StringSchemaHTML": "Seconds (floating point)", "StringDefault": "0", "ParsedDefault": "0s", "ParsedDefaultJSON": "0", "ParsedType": "time.Duration", "YAMLType": "", "YAMLSchema": "", "YAMLEnumValues": null, "YAMLSchemaHTML": "", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Unsupported diagnostic setting, used when testing Felix. Not exposed in `FelixConfiguration`.", "DescriptionHTML": "

Unsupported diagnostic setting, used when testing Felix. Not exposed in FelixConfiguration.

", "UserEditable": true, "GoType": "" }, { "Group": "Debug/test-only (generally unsupported)", "GroupWithSortPrefix": "97 Debug/test-only (generally unsupported)", "NameConfigFile": "DebugPort", "NameEnvVar": "FELIX_DebugPort", "NameYAML": "debugPort", "NameGoAPI": "DebugPort", "StringSchema": "Integer: [0,65535]", "StringSchemaHTML": "Integer: [0,65535]", "StringDefault": "", "ParsedDefault": "0", "ParsedDefaultJSON": "0", "ParsedType": "int", "YAMLType": "integer", "YAMLSchema": "Integer: [0,65535]", "YAMLEnumValues": null, "YAMLSchemaHTML": "Integer: [0,65535]", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "If set, enables Felix's debug HTTP port, which allows memory and CPU profiles\nto be retrieved. The debug port is not secure, it should not be exposed to the internet.", "DescriptionHTML": "

If set, enables Felix's debug HTTP port, which allows memory and CPU profiles\nto be retrieved. The debug port is not secure, it should not be exposed to the internet.

", "UserEditable": true, "GoType": "*int" }, { "Group": "Debug/test-only (generally unsupported)", "GroupWithSortPrefix": "97 Debug/test-only (generally unsupported)", "NameConfigFile": "DebugSimulateCalcGraphHangAfter", "NameEnvVar": "FELIX_DebugSimulateCalcGraphHangAfter", "NameYAML": "debugSimulateCalcGraphHangAfter", "NameGoAPI": "DebugSimulateCalcGraphHangAfter", "StringSchema": "Seconds (floating point)", "StringSchemaHTML": "Seconds (floating point)", "StringDefault": "0", "ParsedDefault": "0s", "ParsedDefaultJSON": "0", "ParsedType": "time.Duration", "YAMLType": "string", "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", "YAMLDefault": "0s", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Used to simulate a hang in the calculation graph after the specified duration.\nThis is useful in tests of the watchdog system only!", "DescriptionHTML": "

Used to simulate a hang in the calculation graph after the specified duration.\nThis is useful in tests of the watchdog system only!

", "UserEditable": true, "GoType": "*v1.Duration" }, { "Group": "Debug/test-only (generally unsupported)", "GroupWithSortPrefix": "97 Debug/test-only (generally unsupported)", "NameConfigFile": "DebugSimulateDataRace", "NameEnvVar": "FELIX_DebugSimulateDataRace", "NameYAML": "", "NameGoAPI": "", "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", "StringDefault": "false", "ParsedDefault": "false", "ParsedDefaultJSON": "false", "ParsedType": "bool", "YAMLType": "", "YAMLSchema": "", "YAMLEnumValues": null, "YAMLSchemaHTML": "", "YAMLDefault": "", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Unsupported diagnostic setting, used when testing Felix. Not exposed in `FelixConfiguration`.", "DescriptionHTML": "

Unsupported diagnostic setting, used when testing Felix. Not exposed in FelixConfiguration.

", "UserEditable": true, "GoType": "" }, { "Group": "Debug/test-only (generally unsupported)", "GroupWithSortPrefix": "97 Debug/test-only (generally unsupported)", "NameConfigFile": "DebugSimulateDataplaneApplyDelay", "NameEnvVar": "FELIX_DebugSimulateDataplaneApplyDelay", "NameYAML": "debugSimulateDataplaneApplyDelay", "NameGoAPI": "DebugSimulateDataplaneApplyDelay", "StringSchema": "Seconds (floating point)", "StringSchemaHTML": "Seconds (floating point)", "StringDefault": "0", "ParsedDefault": "0s", "ParsedDefaultJSON": "0", "ParsedType": "time.Duration", "YAMLType": "string", "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", "YAMLDefault": "0s", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Adds an artificial delay to every dataplane operation. This is useful for\nsimulating a heavily loaded system for test purposes only.", "DescriptionHTML": "

Adds an artificial delay to every dataplane operation. This is useful for\nsimulating a heavily loaded system for test purposes only.

", "UserEditable": true, "GoType": "*v1.Duration" }, { "Group": "Debug/test-only (generally unsupported)", "GroupWithSortPrefix": "97 Debug/test-only (generally unsupported)", "NameConfigFile": "DebugSimulateDataplaneHangAfter", "NameEnvVar": "FELIX_DebugSimulateDataplaneHangAfter", "NameYAML": "debugSimulateDataplaneHangAfter", "NameGoAPI": "DebugSimulateDataplaneHangAfter", "StringSchema": "Seconds (floating point)", "StringSchemaHTML": "Seconds (floating point)", "StringDefault": "0", "ParsedDefault": "0s", "ParsedDefaultJSON": "0", "ParsedType": "time.Duration", "YAMLType": "string", "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", "YAMLDefault": "0s", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Used to simulate a hang in the dataplane after the specified duration.\nThis is useful in tests of the watchdog system only!", "DescriptionHTML": "

Used to simulate a hang in the dataplane after the specified duration.\nThis is useful in tests of the watchdog system only!

", "UserEditable": true, "GoType": "*v1.Duration" } ] }, { "Name": "Usage reporting", "Fields": [ { "Group": "Usage reporting", "GroupWithSortPrefix": "99 Usage reporting", "NameConfigFile": "UsageReportingEnabled", "NameEnvVar": "FELIX_UsageReportingEnabled", "NameYAML": "usageReportingEnabled", "NameGoAPI": "UsageReportingEnabled", "StringSchema": "Boolean: `true`, `1`, `yes`, `y`, `t` accepted as True; `false`, `0`, `no`, `n`, `f` accepted (case insensitively) as False.", "StringSchemaHTML": "Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.", "StringDefault": "true", "ParsedDefault": "true", "ParsedDefaultJSON": "true", "ParsedType": "bool", "YAMLType": "boolean", "YAMLSchema": "Boolean.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Boolean.", "YAMLDefault": "true", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Reports anonymous Calico version number and cluster size to projectcalico.org. Logs warnings returned by the usage\nserver. For example, if a significant security vulnerability has been discovered in the version of Calico being used.", "DescriptionHTML": "

Reports anonymous Calico version number and cluster size to projectcalico.org. Logs warnings returned by the usage\nserver. For example, if a significant security vulnerability has been discovered in the version of Calico being used.

", "UserEditable": true, "GoType": "*bool" }, { "Group": "Usage reporting", "GroupWithSortPrefix": "99 Usage reporting", "NameConfigFile": "UsageReportingInitialDelaySecs", "NameEnvVar": "FELIX_UsageReportingInitialDelaySecs", "NameYAML": "usageReportingInitialDelay", "NameGoAPI": "UsageReportingInitialDelay", "StringSchema": "Seconds (floating point)", "StringSchemaHTML": "Seconds (floating point)", "StringDefault": "300", "ParsedDefault": "5m0s", "ParsedDefaultJSON": "300000000000", "ParsedType": "time.Duration", "YAMLType": "string", "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", "YAMLDefault": "5m0s", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Controls the minimum delay before Felix makes a report.", "DescriptionHTML": "

Controls the minimum delay before Felix makes a report.

", "UserEditable": true, "GoType": "*v1.Duration" }, { "Group": "Usage reporting", "GroupWithSortPrefix": "99 Usage reporting", "NameConfigFile": "UsageReportingIntervalSecs", "NameEnvVar": "FELIX_UsageReportingIntervalSecs", "NameYAML": "usageReportingInterval", "NameGoAPI": "UsageReportingInterval", "StringSchema": "Seconds (floating point)", "StringSchemaHTML": "Seconds (floating point)", "StringDefault": "86400", "ParsedDefault": "24h0m0s", "ParsedDefaultJSON": "86400000000000", "ParsedType": "time.Duration", "YAMLType": "string", "YAMLSchema": "Duration string, for example `1m30s123ms` or `1h5m`.", "YAMLEnumValues": null, "YAMLSchemaHTML": "Duration string, for example 1m30s123ms or 1h5m.", "YAMLDefault": "24h0m0s", "Required": false, "OnParseFailure": "ReplaceWithDefault", "AllowedConfigSources": "All", "Description": "Controls the interval at which Felix makes reports.", "DescriptionHTML": "

Controls the interval at which Felix makes reports.

", "UserEditable": true, "GoType": "*v1.Duration" } ] } ] }