Questions tagged [calico]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
1answer
103 views

How can I get Egress Static IP per namespace within a EKS cluster

My current setup involves an EKS Cluster with multiple namespaces (multi-tenant) across many different EKS nodes in private subnets. I would like the egress traffic from the pods to have a dedicated ...
1
vote
0answers
37 views

Pods on two different nodes communicate very slow, any idea why?

I am learning k8s and I have 3 nodes k8s cluster. I have just recently deployed k8s with kubeadmin and so far it is working great. everything working perfectly but the only problem that I am facing is ...
0
votes
0answers
18 views

SNAT port of Kubernetes outgoing traffic

I am currently running Kubernetes with Calico v3.20.2 as the CNI. I have a very unique case where I need to send UDP traffic from a specific DaemonSet Pod to an external server which will read the ...
0
votes
2answers
261 views

Calicoctl rejecting certificate on fresh k3s install

I have a fresh install of Ubuntu, a fresh install of k3s, and a fresh download of calicoctl. I have installed it the following way. curl -sfL https://get.k3s.io | K3S_KUBECONFIG_MODE="644"\ ...
1
vote
1answer
55 views

Why does bgp OPEN message get Connect Socket: Connection reset by peer when node is on a different subnet/gateway

My network setup: Kubernetes network setup With this setup, only nodes on same subnet can establish bgp connection. Other nodes (that do a full 3 way tcp handshake), responds to hte OPEN message with [...
0
votes
1answer
51 views

How to fix "Failed to apply 'Node' resource: [update conflict: Node(...)]" while trying to apply Calico node config?

I'm playing with Kubernetes and got two VirtualBox machines - master and worker. Every one has two network interfaces - one for Internet and other for communication between each other VM and host ...
3
votes
0answers
66 views

Kubernetes setup with different networks for intra and inter-cluster communication

I have this use case: Setup multiple k8s clusters that can communicate with each other. I also have one network per cluster for intra-cluster communication and another network for inter-cluster ...
1
vote
0answers
52 views

How to enable ipv6 for ingress-controller services when installing using Helm nginx-ingress chart?

I have a baremetal K8 cluster setup using Kubespray (Calico as CNI) and have dual stack enabled. I can see that all the pods that get deployed get both IPv4 and IPv6 addresses but when I try to ...
1
vote
1answer
116 views

Only have connectivity to nginx pod from the node its running on

I've installed kubernetes master and one node v 1.20. I deployed nginx with kubectl run nginxpod --image=nginx $ kubectl get pods -o wide NAME READY STATUS RESTARTS AGE IP ...
0
votes
1answer
83 views

apply calico manifest through ansible kubernetes core module

I am trying to install calico on an existing single-node kubernetes cluster (installed through kubeadm). The two manifests are tigera-operator and custom-resources. This works fine if I manually ...
0
votes
0answers
54 views

How to reset/reconfigure calico network for kubernetes cluster

I have a Kubernetes cluster with calico policy applied. Below pods display in my cluster: kube-system pod/calico-node-xxxx kube-system pod/calico-kube-controllers-xxxxxx ...
0
votes
0answers
67 views

Cannot reach pod from pod in some machines but tunnel in node is reached

I have a pod with a cluster IP of 10.233.70.35 in a bare metal Kubernetes 1.19 cluster with Calico 3.16.9 as CNI. Let's call this Pod A. In most nodes (which is different from the node of Pod A), a ...
0
votes
0answers
36 views

Change Kubernetes CNI from Weavenet to Calico

I have a Kubernetes cluster with 3 masters and 3 workers, this cluster uses Weavenet as network CNI and I want to change network CNI and use Calico, can I change it inplace without removing resources? ...
2
votes
2answers
211 views

What's necessary for a bare metal dual stack kubernetes setup?

We are about to start setting up a new kubernetes cluster on bare metal at our own datacenter. The documentation for the k8s moduls and services is great, however I was not able to find any ...
0
votes
0answers
73 views

calico networking: pod to pod communication not working

ENVIRONMENT: I am running RKE2 Rancher's Kubernetes distribution. (docs) I have a single node cluster. CNI: Calico; Calico is using iptables backend iptables version: iptables v1.8.7 (legacy) ...
1
vote
2answers
416 views

How can I delete manually calicoctl and iptables created by calico from my k3s setup

I have a K3s setup with calico pods [calico-node- & calico-kube-controllers-] running. On uninstalling K3s, calico pods get deleted but I see that calicoctl and iptables -S commands still running ...
0
votes
0answers
25 views

Assign pod an IP address which the same as the IP range of the k8s node

Is that possible to assign pod an IP address which the same as the IP range of my K8s node? For example: I have an on-premise K8s cluster that includes 3 work nodes. All nodes are using the 10.138.1.0/...
0
votes
1answer
159 views

Calico pod with CrashLoopBackOff caused by service account

I have Calico installed on my cluster but a few days ago pod routing stopped working. I noticed the calico pods went offline and from the logs I got this: 2021-07-12 08:36:43.524 [INFO][1] main.go 92: ...
1
vote
0answers
99 views

Calico node remains not ready when a new node with a 192.168.178.x IP joins a K8s cluster

kube-system pod/calico-node-9czgm 0/1 Running 3 42d kube-system pod/calico-node-msfjk 0/1 Running 0 ...
2
votes
1answer
116 views

Kubernetes: migrate from flannel to canal or install calico network policy alongside flannel

I installed flannel as a CNI for my Kubernetes cluster. Now I want to add a network policy to my cluster. After searching I find Canal (Calico for policy and flannel for networking). How I can migrate ...
1
vote
1answer
389 views

Calico network policy in Kubernetes based on Domain name & Wildcard char

I have an application running with kubernetes orchestrator. I want to implement calico network policy based on domain name or wildcard characters so that domain names (FQDN/DNS) can be used to allow ...
2
votes
1answer
86 views

Calico network policy in Kubernetes based on Domain name Regex Matching

I have a application running with kubernetes orchestrator. I want to implement calico network policy based on domain name Regex matching. I am seeing in calico doc that they are using ip range(CIDR) ...
-1
votes
1answer
162 views

k8s loadbalancer service with externalTrafficPolicy=local passes through client ip on IPv4, hides it on IPv6

I'm having trouble getting a kubernetes IPv6 SingleStack LoadBalancer service passing through the correct source IP address to pods. It works fine on a sister IPv4 SingleStack LoadBalancer that passes ...
1
vote
0answers
279 views

CoreDNS pod unable to reach the primary DNS server

We are seeing the COREDNS pod is unable to lookup for primary DNS server which is resulting in readtimeout. Connectivity to primary DNS server work fine. Tried deploying Flannel/Calico/CANAL CNI but ...
0
votes
0answers
16 views

What is the best way editing iptables rules while using Calico network plugin

We are running Calico network plugin along with K8S's. We need to modify iptables rules for various reasons, but it seems does not always work well as we also have chains cali-XXX and KUBE-FIREWALL ...
1
vote
2answers
726 views

Kubernetes trouble - /var/lib/calico/nodename: no such file or directory

I'm following guide from Linux Foundation "Kubernetes Administrator" course and stuck on deploying simple app. I think trouble is even earlier than with app deployment. I've created master ...
0
votes
0answers
42 views

Why do Calico rules stop `netfilter-persistent` from starting at boot time?

I run a Kubernetes cluster on Ubuntu 18.04.5 nodes. When I reboot my nodes, netfilter-persistent fails to load because of some bogus Calico rules. As a result, no iptables rules are loaded at boot ...
1
vote
0answers
20 views

Network performance with Kubernetes

I am running a small real time bidder application in Docker Swarm using host mode for networking. I found that other networking modes were giving much higher latency. Soon I plan to switch from Docker ...
1
vote
1answer
774 views

VPN to a Kubernetes-cluster from a remote network

I need to build a VPN connection between a network and a Kubernetes-cluster, so the applications hosted in this in this network could address to K8S-services via a secured tunnel. So, I have a bunch ...
1
vote
0answers
92 views

Kubernetes and iptables not mixing: connection content dropped?

I'm playing around with a bare-metal Kubernetes cluster (using the calico CNI plugin) and having troubles redirecting external traffic into the node. I've set up the nginx kubernetes ingress ...
1
vote
1answer
324 views

the PREROUTING rules set by the calico is anywhere

I'm confused. This is my iptables nat table config [root@k8s-51 woniu.zhang]# iptables -t nat -L -v --line-numbers Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes) num pkts bytes target ...
0
votes
1answer
177 views

Kuberenetes Node to Node Communication Not working as expected

Hello to All I do Have problem on My Kubernete Cluster Specification Cluster NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION ...
0
votes
0answers
53 views

Block Traffic on Nodeport with Calico

I've got an pretty easy requirement: I would like to block open nodeports on masternodes I would like to protect ssh ports of my nodes Sounds not too complicated! However, it is when using ...
2
votes
1answer
4k views

New Kubernetes cluster setup Calico: "Failed to stat() nodename file: stat /var/lib/calico/nodename: no such file or directory"

i have trouble to add a CNI to a kubernetes master node, the CNI plugin does not have access to certain files or folders. The logs from Calico and Flannel say that certain files or folders are not ...
1
vote
1answer
1k views

Kubernetes Calico networking: calicoctl reports "reset by peer" and "bird: BGP: Unexpected connect from unknown address"

This is a new cluster built using Kubespray on bare metal. The issue that calicoctl reports not Established status, StatefulSet members cannot communicate between each other and majority of Ingress ...
1
vote
0answers
588 views

Trying to Install Kubernetes with Vagrant and Ansible on Ubuntu 16.04 lab

So I am trying to install Kubernetes on a lab with Vagrant and Ansible. I am using the following documentation on Ubuntu 16.04: https://kubernetes.io/blog/2019/03/15/kubernetes-setup-using-ansible-and-...
0
votes
2answers
3k views

Stopping IPTables is the only way to make Kubernetes cluster work

We have an inhouse 1.17.5 K8s cluster - 5 nodes. I cannot deploy, collect logs, anything on the cluster when IPTables is enabled. [root@lpdkubpoc01a ~]# kubectl run --generator=run-pod/v1 --rm utils -...
1
vote
0answers
52 views

Kubernetes 1.18.6 : inter pod communication on google cloud custom vm nodes not working

[Problem statement] Ping from pod {busybox-minion1} running on worker1 {named as : minion1} to the pod {busybox-minion2} on worker2 {named as : minion2} is not working. It is a three-node cluster ...
0
votes
1answer
746 views

Kubernetes-calico service accessible only from where the pod is deployed

I'm facing this issue for the last 3 days and still can't figure out why I can't access NodePort outside k8s cluster using NodePort service type. Basically I have set up a 3 node cluster in rhel8, I ...
1
vote
1answer
155 views

RedHat 7.6, reboot cause applications listen on tcp6 sockets only

We have some vmware virtual machines with RHEL 7.6 installed, recently all of them got a reboot due data center move location. The problem is, after reboot some applicaiton, such as Java, kube-proxy ...
0
votes
1answer
226 views

Calico-node pods not becoming READY until iptables is disabled - Kubernetes on RHEL 7

I have provisioned a Kubernetes cluster on RHEL 7 and deployed Calico to it. The calic-node pods running on the master and worker nodes do not become ready until I SSH into the master and temporarily ...
1
vote
1answer
2k views

How to change the k8s internal ip addresses?

I provisioned a kubernetes cluster on my own couple of virtual machines via kubespray. The VM's network is bridged adapter and kubespray uses calico as default network-plugin. Before sometime, I've ...
0
votes
1answer
1k views

Kubernetes kube-proxy NodePort with IPv6

I am trying to expose a service using NodePort on a on premise bare metal kubernetes (1.17) cluster (calico for CNI and CRI-O 1.17) All nodes (Ubuntu 18.04) have IPv4 and IPv6 adresses and are ...
0
votes
1answer
475 views

Istio & K8S - Ingress with IPv6 and IPv4

We are currently evaluating a K8S (version 1.17 using CRI-0 version 1.17 & Calico CNI) installation using Istio 1.5.0. All nodes have a valid and reachable IPv4 and IPv6 (ubuntu server 18.04 - on ...
0
votes
1answer
464 views

Installing kubernetes with external etcd - calico problems

I faced multiple problems during installation of k8s multimaster cluster with external etcd. I did it before twice, on other sites, successfully, but this time I need help. calico was installed from ...
0
votes
1answer
302 views

Disable Source NAT for Calico

The default settings that kubeadm + calico use is to NAT any incoming connection that is not from a pod_ip. I have calico publishing the service network to my outside LAN, and would rather the ...
3
votes
2answers
2k views

Does Amazon EKS support IPv6 networking?

I have been searching for hours, but can't find any direct information on this topic. Here is what I know: Calico can be deployed into EKS Configuring IPv6 networking is possible with Calico. ...
0
votes
1answer
460 views

For route command output, what does an asterisk under interface column mean?

For my Kubernetes nodes, I see following entry with a star under the interface column. I do not see this mentioned in "route" command's documentation. The only star mentioned there is for gateway. ...
0
votes
1answer
439 views

Kubernetes with Dual Stack on both Pod and Service level

I have 3 Ubuntu VMs where all of them have 2 interfaces. One interface with v4 address and other with both v4 and v6 address. 3 VMs are reachable from each other on all 3 (2 v4 and 1 v6) addresses. I'...
2
votes
0answers
785 views

Connects to OpenVPN but no access to local network or internet in Kubernetes GKE with Calico

I've been using VPN (openvpn in helm) to access internal services in my cluster for development. I enabled network policy in nodes in GKE to manage access of services, that enabled Calico network in ...