Calico

https://docs.tigera.io
Admin
Calico is a unified platform for networking, network security, and observability for Kubernetes...
Tokens:1,907,453
Snippets:14,668
Trust Score:10
Update:2 weeks ago
Show doc for...
Tokens:
Raw
### Run mkectl apply to start MKE 4k installation

Source: https://docs.tigera.io/calico-enterprise/latest/installation/install-calico-enterprise-mke-4k

Starts the MKE 4k installation process. Replace <mke-configuration-file> with the path to your installation configuration file and <cni-timeout-duration> with the time in minutes the installer will wait for cluster networking to be established.

```bash
mkectl apply -f <mke-configuration-file>.yaml --cni-check-timeout <cni-timeout-duration>  


```

--------------------------------

### Example output of license key info

Source: https://docs.tigera.io/calico-cloud/reference/resources/licensekey

Example output of the kubectl get licensekeys.p command.

```text
Name      MaxNodes   Expiry                 Package  

default   100        2021-10-01T23:59:59Z   Enterprise  
```

--------------------------------

### Start minikube with network plugin for Manifest installation

Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/minikube

Starts a minikube cluster with one control plane node using the --network-plugin=cni flag for the Manifest installation method.

```bash
minikube start --network-plugin=cni
```

--------------------------------

### Expected output of kubectl get nodes -o wide

Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/kind

Example output from 'kubectl get nodes -o wide' showing the three nodes with NotReady status, as expected before Calico is installed.

```text
NAME                STATUS      ROLES           AGE    VERSION   INTERNAL-IP   EXTERNAL-IP   OS-IMAGE             KERNEL-VERSION    CONTAINER-RUNTIME  

dev-control-plane   NotReady    control-plane   4m     v1.25.0   172.18.0.2    <none>        Ubuntu 22.04.1 LTS   5.10.0-17-amd64   containerd://1.6.7  

dev-worker          NotReady    <none>          4m     v1.25.0   172.18.0.4    <none>        Ubuntu 22.04.1 LTS   5.10.0-17-amd64   containerd://1.6.7  

dev-worker2         NotReady    <none>          4m     v1.25.0   172.18.0.3    <none>        Ubuntu 22.04.1 LTS   5.10.0-17-amd64   containerd://1.6.7  

```

--------------------------------

### Create quickstart namespace

Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/quickstart

Creates a namespace named 'quickstart' for the NGINX and BusyBox deployment.

```bash
kubectl create namespace quickstart  
```

```text
namespace/quickstart created  
```

--------------------------------

### Apply policy recommendation tutorial deployment YAML

Source: https://docs.tigera.io/calico-cloud/network-policy/recommendations/learn-about-policy-recommendations

Creates the necessary resources for the policy recommendation tutorial by applying the downloaded deployment YAML.

```bash
kubectl apply -f policy-recommendation-deployments.yaml
```

--------------------------------

### Example output of kubectl get tigerastatus

Source: https://docs.tigera.io/calico/latest/operations/istio/deploy-istio-ambient

Example output from the kubectl get tigerastatus command, showing the istio component as available.

```text
NAME        AVAILABLE   PROGRESSING   DEGRADED   SINCE  

apiserver   True        False         False      4m9s  

calico      True        False         False      3m29s  

goldmane    True        False         False      3m39s  

ippools     True        False         False      6m4s  

istio       True        False         False      19s  

whisker     True        False         False      3m19s  

```

--------------------------------

### Example output of kubectl get nodes

Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/managed-public-cloud/eks

Example output from 'kubectl get nodes -o wide' showing a node with Ready status.

```text
NAME              STATUS   ROLES    AGE   VERSION   INTERNAL-IP   EXTERNAL-IP   OS-IMAGE             KERNEL-VERSION    CONTAINER-RUNTIME  

<your-hostname>   Ready    master   52m   v1.12.2   10.128.0.28   <none>        Ubuntu 18.04.1 LTS   4.15.0-1023-gcp   docker://18.6.1  
```

--------------------------------

### Apply YAO Bank application manifest and view created resources

Source: https://docs.tigera.io/calico-cloud/network-policy/application-layer-policies/alp-tutorial

Installs the YAO Bank demo application and shows the expected output, which lists the resources created.

```bash
kubectl apply -f https://docs.tigera.io/files/10-yaobank.yaml  

```

```text
namespace/yaobank configured  
service/database created  
serviceaccount/database created  
deployment.apps/database created  
service/summary created  
serviceaccount/summary created  
deployment.apps/summary created  
service/customer created  
serviceaccount/customer created  
deployment.apps/customer created  

```

--------------------------------

### Example output of kubectl get nodes

Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/nftables

Example output from `kubectl get nodes -o wide` showing a single ready node.

```text
NAME              STATUS   ROLES    AGE   VERSION   INTERNAL-IP   EXTERNAL-IP   OS-IMAGE             KERNEL-VERSION    CONTAINER-RUNTIME  

<your-hostname>   Ready    master   52m   v1.12.2   10.128.0.28   <none>        Ubuntu 18.04.1 LTS   4.15.0-1023-gcp   docker://18.6.1  


```

--------------------------------

### Deploy sample microservices-demo app

Source: https://docs.tigera.io/calico-cloud/threat/web-application-firewall

Installs the GoogleCloudPlatform/microservices-demo sample application to test WAF. Optional if you don't have an application to test with.

```bash
kubectl apply -f https://raw.githubusercontent.com/GoogleCloudPlatform/microservices-demo/main/release/kubernetes-manifests.yaml  

```

--------------------------------

### Example with multiple kubeconfig files

Source: https://docs.tigera.io/calico-enterprise/latest/operations/clis/calicoq/configure/datastore

Shows how to use multiple kubeconfig files by specifying contexts with the --context flag.

```bash
export DATASTORE_TYPE=kubernetes  
export KUBECONFIG=~/.kube/main:~/.kube/auxy  
calicoctl get --context main workloadendpoints  
calicoctl get --context auxy workloadendpoints  
```

--------------------------------

### Verify calicoctl configuration with get nodes

Source: https://docs.tigera.io/calico/latest/operations/calicoctl/configure/kdd

Checks that the calicoctl installation and configuration are correct. A correct setup returns a list of registered nodes; an empty list indicates the wrong datastore or no registered nodes, and an error indicates a configuration issue.

```bash
calicoctl get nodes
```

--------------------------------

### Verify the installation

Source: https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/vks

Wait for all remaining components to become available and check pods.

```bash
kubectl get tigerastatus
```

```bash
kubectl get pods -A | grep -E 'tigera|calico'
```

--------------------------------

### Example output of kubectl get pods

Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/managed-public-cloud/gke

Example output from the kubectl get pods command, showing the Calico pods and other system pods running in the kube-system namespace.

```text
NAME                                                           READY   STATUS    RESTARTS   AGE  
calico-node-hjnt5                                              1/1     Running   0          13m  
calico-node-phcjw                                              1/1     Running   0          13m  
calico-node-pmrkm                                              1/1     Running   0          12m  
calico-node-vertical-autoscaler-8c79c8dc-q7z7c                 1/1     Running   0          15m  
calico-typha-547bf5ddbd-8jlnt                                  1/1     Running   0          13m  
calico-typha-547bf5ddbd-d2qjd                                  1/1     Running   0          13m  
calico-typha-horizontal-autoscaler-7d99b54d8b-f9fq6            1/1     Running   0          15m  
calico-typha-vertical-autoscaler-bbdb9bc58-wsd6v               1/1     Running   0          15m  
event-exporter-gke-545bc64577-rmgkn                            2/2     Running   0          15m  
fluentbit-gke-8p8tc                                            3/3     Running   0          14m  
...  
```

--------------------------------

### Example using environment variables

Source: https://docs.tigera.io/calico-enterprise/latest/operations/clis/calicoq/configure/datastore

Sets environment variables for the datastore and kubeconfig, then runs calicoctl.

```bash
export DATASTORE_TYPE=kubernetes  
export KUBECONFIG=~/.kube/config  
calicoctl get workloadendpoints  
```

--------------------------------

### Install and start Nova Metadata API on non-controller nodes

Source: https://docs.tigera.io/calico/latest/getting-started/openstack/installation/redhat

On nodes that are not controllers, install and start the Nova Metadata API. Not required on combined compute and controller nodes.

```bash
yum install -y openstack-nova-api

service openstack-nova-metadata-api restart

chkconfig openstack-nova-metadata-api on
```

--------------------------------

### Example: apply license key with kubectl

Source: https://docs.tigera.io/calico-cloud/reference/resources/licensekey

Example of applying a license key using a specific customer name.

```bash
kubectl apply -f awesome-corp-license.yaml  
```

--------------------------------

### Install Istio for testing

Source: https://docs.tigera.io/calico/latest/network-policy/istio/app-layer-policy

Downloads and installs Istio for testing. Review the script before running it. Sets the PATH to include the istioctl binary.

```bash
curl -L https://istio.io/downloadIstio -o install-istio.sh

# Review the script before running it, then install:

ISTIO_VERSION=1.28.1 sh install-istio.sh

cd istio-1.28.1

export PATH=$PWD/bin:$PATH
```

--------------------------------

### Check etcd configuration with calicoctl get nodes

Source: https://docs.tigera.io/calico/latest/operations/calicoctl/configure/etcd

Simple command to check that the installation and configuration is correct. A correct setup yields a list of registered nodes; an empty list indicates wrong datastore or no nodes registered, and an error indicates a configuration issue.

```bash
calicoctl get nodes  


```

--------------------------------

### Verify Calico installation with kubectl get pods -A

Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/k3s/multi-node-install

Output of `kubectl get pods -A` after installing Calico on a multi-node K3s cluster. The first block shows the operator-based installation with pods in the tigera-operator and calico-system namespaces; the second shows the manifest-based installation with pods in the kube-system namespace. All pods are Running.

```text
NAMESPACE         NAME                                      READY   STATUS    RESTARTS   AGE  

tigera-operator   tigera-operator-c9cf5b94d-gj9qp           1/1     Running   0          107s  

calico-system     calico-typha-7dcd87597-npqsf              1/1     Running   0          88s  

calico-system     calico-node-rdwwz                         1/1     Running   0          88s  

kube-system       local-path-provisioner-6d59f47c7-4q8l2    1/1     Running   0          2m14s  

kube-system       metrics-server-7566d596c8-xf66d           1/1     Running   0          2m14s  

kube-system       coredns-8655855d6-wfdbm                   1/1     Running   0          2m14s  

calico-system     calico-kube-controllers-89df8c6f8-7hxc5   1/1     Running   0          87s  

```

```text
NAMESPACE     NAME                                       READY   STATUS    RESTARTS   AGE  

kube-system   calico-node-9hn9z                    1/1     Running   0          23m  

kube-system   local-path-provisioner-6d59f47c7-drznc     1/1     Running   0          38m  

kube-system   calico-kube-controllers-789f6df884-928lt   1/1     Running   0          23m  

kube-system   metrics-server-7566d596c8-qxlfz            1/1     Running   0          38m  

kube-system   coredns-8655855d6-blzl5                    1/1     Running   0          38m  

```

--------------------------------

### Output of calicoctl get ippools

Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/hardway/the-calico-datastore

Example empty result from 'calicoctl get ippools'.

```text
NAME   CIDR   SELECTOR  
```

--------------------------------

### Display help for calicoctl create

Source: https://docs.tigera.io/calico/latest/reference/calicoctl/create

Run `calicoctl create --help` to display the help menu for the create command. The output shows usage, examples, flags, and global flags. Note that the available actions for a resource type may be limited based on the datastore used (etcdv3 or Kubernetes API).

```bash
calicoctl create --help
```

```text
Create one or more Calico resources from a file, directory, or stdin, in YAML  

or JSON format. Use create when you want the command to fail if a resource  

already exists; use apply if you'd rather create-or-update.  

  

Usage:  

  calicoctl create [flags]  

  

Examples:  

  # Create resources from a file.  

  calicoctl create -f ./policy.yaml  

  

  # Create resources from stdin.  

  cat policy.json | calicoctl create -f -  

  

Flags:  

  -c, --config string      Path to the file containing connection configuration in YAML or JSON format. (default "/etc/calico/calicoctl.cfg")  

  -f, --filename string    Filename to use to create/apply/replace/delete the resource. Use '-' for stdin.  

  -h, --help               help for create  

  -n, --namespace string   Namespace of the resource.  

  -R, --recursive          Process the filename specified in -f recursively.  

      --skip-empty         Do not error if files contain no data.  

      --skip-exists        Skip over resources that already exist.  

  

Global Flags:  

      --allow-version-mismatch   Allow client and cluster versions mismatch  

      --context string           The name of the kubeconfig context to use  

  -l, --log-level string         Set the log level (panic, fatal, error, warn, info, debug) (default "panic")  


```

--------------------------------

### Install Calico using the manifest method

Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/k3s/quickstart

Run this command to install Calico using the manifest method. The output shows the resources created.

```bash
kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.33.0/manifests/calico.yaml
```

```bash
configmap/calico-config created

customresourcedefinition.apiextensions.k8s.io/bgpconfigurations.crd.projectcalico.org created

customresourcedefinition.apiextensions.k8s.io/bgppeers.crd.projectcalico.org created

customresourcedefinition.apiextensions.k8s.io/blockaffinities.crd.projectcalico.org created

customresourcedefinition.apiextensions.k8s.io/clusterinformations.crd.projectcalico.org created

customresourcedefinition.apiextensions.k8s.io/felixconfigurations.crd.projectcalico.org created

customresourcedefinition.apiextensions.k8s.io/globalnetworkpolicies.crd.projectcalico.org created

customresourcedefinition.apiextensions.k8s.io/globalnetworksets.crd.projectcalico.org created

customresourcedefinition.apiextensions.k8s.io/hostendpoints.crd.projectcalico.org created

customresourcedefinition.apiextensions.k8s.io/ipamblocks.crd.projectcalico.org created

customresourcedefinition.apiextensions.k8s.io/ipamconfigs.crd.projectcalico.org created

customresourcedefinition.apiextensions.k8s.io/ipamhandles.crd.projectcalico.org created

customresourcedefinition.apiextensions.k8s.io/ippools.crd.projectcalico.org created

customresourcedefinition.apiextensions.k8s.io/kubecontrollersconfigurations.crd.projectcalico.org created

customresourcedefinition.apiextensions.k8s.io/networkpolicies.crd.projectcalico.org created

customresourcedefinition.apiextensions.k8s.io/networksets.crd.projectcalico.org created

clusterrole.rbac.authorization.k8s.io/calico-kube-controllers created

clusterrolebinding.rbac.authorization.k8s.io/calico-kube-controllers created

clusterrole.rbac.authorization.k8s.io/calico-node created

clusterrolebinding.rbac.authorization.k8s.io/calico-node created

daemonset.apps/calico-node created

serviceaccount/calico-node created

deployment.apps/calico-kube-controllers created

serviceaccount/calico-kube-controllers created
```

--------------------------------

### Example output: waiting for cluster networking

Source: https://docs.tigera.io/calico-enterprise/latest/installation/install-calico-enterprise-mke-4k

Example output shown after running mkectl apply, indicating the installer is waiting for cluster networking to be established using the custom CNI provider.

```text
waiting 60 minutes for cluster networking to be established using custom CNI provider  


```

--------------------------------

### Example output of calicoctl get heps -owide

Source: https://docs.tigera.io/calico/latest/network-policy/hosts/kubernetes-nodes

Example output from 'calicoctl get heps -owide' after enabling automatic host endpoints. Shows auto-created host endpoints for each node with their interfaces, IPs, and profiles.

```bash
calicoctl get heps -owide  

NAME                                                    NODE                                           INTERFACE   IPS                              PROFILES  

ip-172-16-101-147.us-west-2.compute.internal-auto-hep   ip-172-16-101-147.us-west-2.compute.internal   *           172.16.101.147,192.168.228.128   projectcalico-default-allow  

ip-172-16-101-54.us-west-2.compute.internal-auto-hep    ip-172-16-101-54.us-west-2.compute.internal    *           172.16.101.54,192.168.107.128    projectcalico-default-allow  

ip-172-16-101-79.us-west-2.compute.internal-auto-hep    ip-172-16-101-79.us-west-2.compute.internal    *           172.16.101.79,192.168.91.64      projectcalico-default-allow  

ip-172-16-101-9.us-west-2.compute.internal-auto-hep     ip-172-16-101-9.us-west-2.compute.internal     *           172.16.101.9,192.168.71.192      projectcalico-default-allow  

ip-172-16-102-63.us-west-2.compute.internal-auto-hep    ip-172-16-102-63.us-west-2.compute.internal    *           172.16.102.63,192.168.108.192    projectcalico-default-allow
```

--------------------------------

### Output of calicoctl get nodes

Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/hardway/the-calico-datastore

Example output from 'calicoctl get nodes' showing node names.

```text
NAME  

ip-172-31-37-123  

ip-172-31-40-217  

ip-172-31-40-30  

ip-172-31-42-47  

ip-172-31-45-29  
```

--------------------------------

### Create and expose nginx deployment, then start access pod

Source: https://docs.tigera.io/calico-cloud/network-policy/beginners/simple-policy-cnx

Creates an nginx deployment in the policy-demo namespace, exposes it on port 80, and starts an interactive shell in a temporary access pod using busybox.

```bash
kubectl create deployment --namespace=policy-demo nginx --image=nginx
```

```bash
kubectl expose --namespace=policy-demo deployment nginx --port=80
```

```bash
kubectl run --namespace=policy-demo access --rm -ti --image busybox /bin/sh
```
Tokens:
Raw