### Install and Start Nova Metadata API Source: https://docs.tigera.io/calico/latest/getting-started/openstack/installation/redhat Install and start the Nova Metadata API on compute nodes that are not controllers. ```bash yum install -y openstack-nova-api service openstack-nova-metadata-api restart chkconfig openstack-nova-metadata-api on ``` -------------------------------- ### Calico Installation Output Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/k3s/multi-node-install Example output showing the successful creation of Calico resources after applying the manifest. ```text configmap/calico-config created customresourcedefinition.apiextensions.k8s.io/bgpconfigurations.crd.projectcalico.org created customresourcedefinition.apiextensions.k8s.io/bgppeers.crd.projectcalico.org created customresourcedefinition.apiextensions.k8s.io/blockaffinities.crd.projectcalico.org created customresourcedefinition.apiextensions.k8s.io/clusterinformations.crd.projectcalico.org created customresourcedefinition.apiextensions.k8s.io/felixconfigurations.crd.projectcalico.org created customresourcedefinition.apiextensions.k8s.io/globalnetworkpolicies.crd.projectcalico.org created customresourcedefinition.apiextensions.k8s.io/globalnetworksets.crd.projectcalico.org created customresourcedefinition.apiextensions.k8s.io/hostendpoints.crd.projectcalico.org created customresourcedefinition.apiextensions.k8s.io/ipamblocks.crd.projectcalico.org created customresourcedefinition.apiextensions.k8s.io/ipamconfigs.crd.projectcalico.org created customresourcedefinition.apiextensions.k8s.io/ipamhandles.crd.projectcalico.org created customresourcedefinition.apiextensions.k8s.io/ippools.crd.projectcalico.org created customresourcedefinition.apiextensions.k8s.io/kubecontrollersconfigurations.crd.projectcalico.org created customresourcedefinition.apiextensions.k8s.io/networkpolicies.crd.projectcalico.org created customresourcedefinition.apiextensions.k8s.io/networksets.crd.projectcalico.org created clusterrole.rbac.authorization.k8s.io/calico-kube-controllers created clusterrolebinding.rbac.authorization.k8s.io/calico-kube-controllers created clusterrole.rbac.authorization.k8s.io/calico-node created clusterrolebinding.rbac.authorization.k8s.io/calico-node created daemonset.apps/calico-node created serviceaccount/calico-node created deployment.apps/calico-kube-controllers created serviceaccount/calico-kube-controllers created ``` -------------------------------- ### Start a BusyBox session for testing Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/quickstart Launch an interactive BusyBox pod within the 'quickstart' namespace to perform network tests. ```bash kubectl run --namespace=quickstart access --rm -ti --image busybox /bin/sh ``` -------------------------------- ### Example Pod Status (Running) Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/windows-calico/demo Shows the expected output once all pods, including those on Windows nodes, have successfully started and are in the 'Running' state. ```bash NAME READY STATUS RESTARTS AGE busybox 1/1 Running 0 7m24s nginx 1/1 Running 0 7m24s poter 1/1 Running 0 4m24s pwsh 1/1 Running 0 5m19s ``` -------------------------------- ### Start Minikube with CNI Network Plugin Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/minikube Initiate a minikube cluster with the CNI network plugin enabled, preparing it for Calico installation. ```bash minikube start --network-plugin=cni ``` -------------------------------- ### Install Calico Compute Package Source: https://docs.tigera.io/calico/latest/getting-started/openstack/installation/redhat Install the calico-compute package on the compute host. ```bash yum install -y calico-compute ``` -------------------------------- ### Install Neutron Infrastructure Source: https://docs.tigera.io/calico/latest/getting-started/openstack/installation/redhat Install the OpenStack Neutron package on the compute host. ```bash yum install -y openstack-neutron ``` -------------------------------- ### Install MicroK8s Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/microk8s Installs the MicroK8s package using snap. Ensure your system meets the prerequisites before running. ```bash snap install microk8s --classic ``` -------------------------------- ### Install Docker on VMs Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/self-managed-public-cloud/gce Installs Docker on the controller and worker VMs. This includes updating package lists, installing the docker.io package, enabling the Docker service, and installing apt-transport-https and curl. ```bash sudo apt update sudo apt install -y docker.io sudo systemctl enable docker.service sudo apt install -y apt-transport-https curl ``` -------------------------------- ### Install BIRD BGP Client Source: https://docs.tigera.io/calico/latest/getting-started/openstack/installation/redhat Install the BIRD BGP client for IPv4 and IPv6 connectivity. ```bash yum install -y bird bird6 ``` -------------------------------- ### Install Kubernetes Components Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/self-managed-public-cloud/gce Installs kubelet, kubeadm, and kubectl on worker and controller nodes using apt. The packages are then held to prevent automatic updates. ```bash curl -fsSL https://dl.k8s.io/apt/doc/apt-key.gpg | sudo apt-key add - cat </g" | kubectl apply -f - ``` -------------------------------- ### Install calico-control Package Source: https://docs.tigera.io/calico/latest/getting-started/openstack/installation/ubuntu Install the calico-control package to enable Calico networking on the OpenStack control node. This package contains necessary components for Calico integration. ```bash apt-get install -y calico-control ``` -------------------------------- ### Create Calico Installation custom resource for nftables Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/nftables Define and create the Calico Installation custom resource, specifying nftables as the Linux data plane and configuring IP pools. Ensure the CIDR matches your pod network. ```yaml apiVersion: operator.tigera.io/v1 kind: Installation metadata: name: default spec: calicoNetwork: linuxDataplane: Nftables ipPools: - name: default-ipv4-ippool blockSize: 26 cidr: 192.168.0.0/16 encapsulation: VXLANCrossSubnet natOutgoing: Enabled nodeSelector: all() --- apiVersion: operator.tigera.io/v1 kind: APIServer metadata: name: default spec: {} ``` -------------------------------- ### Install Windows Remote Access and Routing Features Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/windows-calico/operator Installs necessary Windows features for BGP service enablement on Windows nodes. Requires a subsequent computer restart. ```powershell Install-WindowsFeature RemoteAccess Install-WindowsFeature RSAT-RemoteAccess-PowerShell Install-WindowsFeature Routing ``` -------------------------------- ### Example Pod Status (Initial) Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/windows-calico/demo Illustrates the expected output when pods are initially being created. Note that 'porter' and 'pwsh' may show 'ContainerCreating' status. ```bash NAME READY STATUS RESTARTS AGE busybox 1/1 Running 0 4m14s nginx 1/1 Running 0 4m14s poter 0/1 ContainerCreating 0 74s pwsh 0/1 ContainerCreating 0 2m9s ``` -------------------------------- ### Verify Calico Installation Status Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/managed-public-cloud/aks Check the status of Calico components after installation using `kubectl get tigerastatus`. All components should report 'AVAILABLE' as 'True'. ```bash kubectl get tigerastatus ``` -------------------------------- ### Stop and Disable Neutron DHCP Agent Source: https://docs.tigera.io/calico/latest/getting-started/openstack/installation/ubuntu Stop the Neutron DHCP agent and prevent it from starting on reboot, then install the Calico DHCP agent. ```bash service neutron-dhcp-agent stop ``` ```bash echo manual | tee /etc/init/neutron-dhcp-agent.override ``` ```bash apt-get install -y calico-dhcp-agent ``` -------------------------------- ### Start Minikube with Built-in Calico Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/minikube Use this command to quickly enable Calico during minikube cluster creation for testing. ```bash minikube start --cni=calico ``` -------------------------------- ### Ensure Remote Access Service is Running Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/windows-calico/operator Starts the Remote Access service if it is not running automatically after installation. This ensures BGP services can function correctly. ```powershell Start-Service RemoteAccess ``` -------------------------------- ### Create Kind Cluster Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/kind Starts a Kind cluster with the specified configuration and name. ```bash kind create cluster --config values.yaml --name dev ``` -------------------------------- ### Calico Felix systemd Unit File Source: https://docs.tigera.io/calico/latest/getting-started/bare-metal/installation/binary This systemd unit file configures the Calico Felix agent to start at boot and restart on failure. Ensure the `EnvironmentFile` path is correct for your setup. ```systemd [Unit] Description=Calico Felix agent After=syslog.target network.target [Service] User=root EnvironmentFile=/etc/calico/calico.env ExecStartPre=/usr/bin/mkdir -p /var/run/calico ExecStart=/usr/local/bin/calico-node -felix KillMode=process Restart=on-failure LimitNOFILE=32000 [Install] WantedBy=multi-user.target ``` -------------------------------- ### Create Controller VM Instance Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/self-managed-public-cloud/gce Creates an asynchronous controller VM instance with specified configurations including disk size, machine type, private IP, scopes, subnet, zone, and tags. IP forwarding is enabled. ```bash gcloud compute instances create controller \ --async \ --boot-disk-size 200GB \ --can-ip-forward \ --image-family ubuntu-2204-lts \ --image-project ubuntu-os-cloud \ --machine-type n1-standard-2 \ --private-network-ip 10.240.0.11 \ --scopes compute-rw,storage-ro,service-management,service-control,logging-write,monitoring \ --subnet k8s-nodes \ --zone us-central1-f \ --tags example-k8s,controller ``` -------------------------------- ### Prepare Windows Node for Cluster Join Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/windows-calico/operator Download and execute the PowerShell script to prepare a Windows node for joining a Kubernetes cluster. This installs necessary binaries and configures the kubelet service. ```powershell Invoke-WebRequest https://raw.githubusercontent.com/kubernetes-sigs/sig-windows-tools/master/hostprocess/PrepareNode.ps1 -OutFile c:\PrepareNode.ps1 c:\PrepareNode.ps1 -KubernetesVersion v1.26.6 ``` -------------------------------- ### Install Tigera Operator and CRDs Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/managed-public-cloud/eks Install the Tigera Operator and its associated custom resource definitions (CRDs) using kubectl. This is required for managing Calico installations. ```bash kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/v1_crd_projectcalico_org.yaml kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/tigera-operator.yaml ``` -------------------------------- ### Sample Environment File for etcd Datastore Source: https://docs.tigera.io/calico/latest/getting-started/bare-metal/installation/binary This sample environment file demonstrates how to configure Calico for an etcdv3 datastore. Save this content to a file, typically `/etc/calico/calico.env`, on the target host. ```bash FELIX_DATASTORETYPE=etcdv3 FELIX_ETCDENDPOINTS=https://calico-datastore.example.com:2379 FELIX_ETCDCAFILE="/pki/ca.pem" FELIX_ETCDCERTFILE="/pki/client-cert.pem" FELIX_ETCDKEYFILE="/pki/client-key.pem" ``` -------------------------------- ### Install Tigera Operator and CRDs Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/managed-public-cloud/eks Install the Tigera Operator and the necessary Custom Resource Definitions (CRDs) for Calico. Ensure you use the correct version URL for your Calico installation. ```bash kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/v1_crd_projectcalico_org.yaml kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/tigera-operator.yaml ``` -------------------------------- ### Install WireGuard kmods for OpenShift v4.8 Source: https://docs.tigera.io/calico/latest/network-policy/encrypt-cluster-pod-traffic Clones and installs WireGuard kernel modules using containers for OpenShift v4.8. This process involves cloning repositories, building, and installing the modules. ```bash FAKEROOT=$(mktemp -d) git clone https://github.com/tigera/kmods-via-containers cd kmods-via-containers make install FAKEROOT=${FAKEROOT} cd .. git clone https://github.com/tigera/kvc-wireguard-kmod cd kvc-wireguard-kmod make install FAKEROOT=${FAKEROOT} cd .. ``` -------------------------------- ### Configure kubectl for Ubuntu User Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/self-managed-public-cloud/gce Sets up kubectl for the default Ubuntu user by creating the .kube directory and copying the admin configuration file, then setting the correct ownership. ```bash mkdir -p $HOME/.kube sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config sudo chown $(id -u):$(id -g) $HOME/.kube/config ``` -------------------------------- ### Install WireGuard on Amazon Linux 2 (EKS) Source: https://docs.tigera.io/calico/latest/network-policy/encrypt-cluster-pod-traffic Installs WireGuard and its dependencies on Amazon Linux 2 using yum. Ensure your nodes are rebooted after installation if kernel modules are not immediately available. ```bash sudo yum install kernel-devel-`uname -r` -y sudo yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm -y sudo curl -o /etc/yum.repos.d/jdoss-wireguard-epel-7.repo https://copr.fedorainfracloud.org/coprs/jdoss/wireguard/repo/epel-7/jdoss-wireguard-epel-7.repo sudo yum install wireguard-dkms wireguard-tools -y ``` -------------------------------- ### Initialize Node Resource using calicoctl Source: https://docs.tigera.io/calico/latest/getting-started/bare-metal/installation/binary-mgr Use the `calicoctl create` command to initialize a node resource, which is required for Felix to start. Replace `` with the actual name or hostname of the node. ```bash calicoctl create -f - < EOF ``` -------------------------------- ### Configure kubectl Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/nftables Set up kubectl to interact with the Kubernetes cluster by copying the admin configuration file and setting correct ownership. ```bash mkdir -p $HOME/.kube sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config sudo chown $(id -u):$(id -g) $HOME/.kube/config ``` -------------------------------- ### Install Tigera Operator Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/quickstart Install the Tigera Operator, which manages Calico components and configurations. ```bash kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/tigera-operator.yaml ``` -------------------------------- ### List OpenStack Instances Source: https://docs.tigera.io/calico/latest/getting-started/openstack/installation/verification Run this command on your control node to list all instances and their assigned hosts. This helps verify that new instances are evenly distributed across your hypervisors. ```bash nova list --fields host ``` -------------------------------- ### Install Calico Custom Resource Definitions Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/quickstart Apply the Calico CRDs to your Kubernetes cluster before installing the operator. ```bash kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/v1_crd_projectcalico_org.yaml ``` -------------------------------- ### Initialize Kubernetes control plane Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/nftables Initialize the Kubernetes control plane using the previously created kubeadm configuration file. ```bash sudo kubeadm init --config=config.yaml ``` -------------------------------- ### Create Worker VM Instances Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/self-managed-public-cloud/gce Creates three worker VM instances in a loop, each with similar configurations to the controller VM but with different private IP addresses. IP forwarding is enabled. ```bash for i in 0 1 2; do gcloud compute instances create worker-${i} \ --async \ --boot-disk-size 200GB \ --can-ip-forward \ --image-family ubuntu-2204-lts \ --image-project ubuntu-os-cloud \ --machine-type n1-standard-2 \ --private-network-ip 10.240.0.2${i} \ --scopes compute-rw,storage-ro,service-management,service-control,logging-write,monitoring \ --subnet k8s-nodes \ --zone us-central1-f \ --tags example-k8s,worker done ``` -------------------------------- ### Configure Kubectl Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/k8s-single-node Sets up the kubectl configuration for the current user, allowing interaction with the Kubernetes cluster. This command group is typically returned by `kubeadm init`. ```bash mkdir -p $HOME/.kube sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config sudo chown $(id -u):$(id -g) $HOME/.kube/config ``` -------------------------------- ### Sample Environment File for etcdv3 Datastore Source: https://docs.tigera.io/calico/latest/getting-started/bare-metal/installation/container This sample environment file configures Calico for an etcdv3 datastore. It specifies etcd endpoints, TLS certificates, and Calico-specific settings like node name and networking backend. Ensure volume mounts are configured for certificate files if TLS is enabled. ```bash DATASTORE_TYPE=etcdv3 ETCD_ENDPOINTS=https://calico-datastore.example.com:2379 ETCD_CA_CERT_FILE="/pki/ca.pem" ETCD_CERT_FILE="/pki/client-cert.pem" ETCD_KEY_FILE="/pki/client-key.pem" CALICO_NODENAME="" NO_DEFAULT_POOLS="true" CALICO_IP="" CALICO_IP6="" CALICO_AS="" CALICO_NETWORKING_BACKEND=bird ``` -------------------------------- ### Invoke-WebRequest Timeout Error Example Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/windows-calico/demo Example of the expected timeout error message when a request is blocked by the network policy. ```powershell Invoke-WebRequest : The operation has timed out. At line:1 char:1 + Invoke-WebRequest -Uri http://192.168.40.166 -UseBasicParsing -Timeout ... + CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], WebException + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand command terminated with exit code 1 ``` -------------------------------- ### Monitor Calico for Windows Installation InitContainers Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/windows-calico/operator Monitors the execution of the 'uninstall-calico' and 'install-cni' initContainers for Calico for Windows HPC installation. ```bash kubectl logs -f -n calico-system -l k8s-app=calico-node-windows -c uninstall-calico ``` ```bash kubectl logs -f -n calico-system -l k8s-app=calico-node-windows -c install-cni ``` -------------------------------- ### Create a namespace for the application Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/quickstart Create a new Kubernetes namespace to isolate application resources. ```bash kubectl create namespace quickstart ``` -------------------------------- ### Patch Calico Installation to Disable BGP Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/windows-calico/operator Run this command if you installed Calico using the operator and need to disable BGP. ```bash kubectl patch installation default --type=merge -p '{"spec": {"calicoNetwork": {"bgp": "Disabled"}}}' ``` -------------------------------- ### Install Tigera Operator and Calico CRDs Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/managed-public-cloud/aks Installs the Tigera Operator and necessary Custom Resource Definitions (CRDs) for Calico. ```bash kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/v1_crd_projectcalico_org.yaml kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/tigera-operator.yaml ``` -------------------------------- ### Kubernetes Network Policy Example Source: https://docs.tigera.io/calico/latest/about/kubernetes-training/about-network-policy Defines ingress and egress rules for a 'front-end' application in the 'staging' namespace. ```yaml kind: NetworkPolicy apiVersion: networking.k8s.io/v1 metadata: name: front-end namespace: staging spec: podSelector: matchLabels: app: back-end ingress: - from: - podSelector: matchLabels: app: front-end ports: - protocol: TCP port: 443 egress: - to: - podSelector: matchLabels: app: database ports: - protocol: TCP port: 27017 ``` -------------------------------- ### List Pods in Namespace Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/windows-calico/demo Retrieves and displays the status of pods within the 'calico-demo' namespace. Use this command to monitor pod creation progress. ```bash kubectl get pods --namespace calico-demo ``` -------------------------------- ### Configure Calico Felix Datastore Source: https://docs.tigera.io/calico/latest/getting-started/openstack/installation/ubuntu Create /etc/calico/felix.cfg to configure the Calico Felix agent to use etcdv3. Replace `` with the etcd server IP. ```text [global] DatastoreType = etcdv3 EtcdAddr = :2379 EndpointStatusPathPrefix = none ``` -------------------------------- ### Install etcd3gw Python Package Source: https://docs.tigera.io/calico/latest/getting-started/openstack/installation/redhat Install the `etcd3gw` Python package using pip. This is a requirement for Calico's OpenStack driver and DHCP agent. ```bash yum install python3-pip pip3 install etcd3gw==2.4.0 ``` -------------------------------- ### Configure BIRD Graceful Restart Source: https://docs.tigera.io/calico/latest/getting-started/openstack/installation/ubuntu Add '-R' to BIRD_ARGS in /etc/bird/envvars and include the pre-stop script in upstart jobs for graceful restart. ```text pre-stop script PID=`status bird | egrep -oi '([0-9]+)$' | head -n1` kill -9 $PID end script ``` -------------------------------- ### Configure Pod IP Range with Operator Source: https://docs.tigera.io/calico/latest/getting-started/kubernetes/self-managed-onprem/config-options Set a specific pod IP range by modifying the `spec.calicoNetwork.ipPools` in the Installation API resource for operator installations. ```yaml kind: Installation apiVersion: operator.tigera.io/v1 metadata: name: default spec: calicoNetwork: ipPools: - cidr: 198.51.100.0/24 ```