Calico Kubernetes Hosted Install
Calico can be installed on a Kubernetes cluster with a single command.
kubectl apply -f calico.yaml
We maintain several manifests. Which one you use depends on the specific requirements of your Calico installation:
This manifest installs Calico for use with an existing etcd cluster. This is the recommended hosted approach for deploying Calico in production.
This manifest installs Calico as well as a single node etcd cluster. This is the recommended hosted approach for getting started quickly with Calico in conjunction with tools like kubeadm.
This manifest installs Calico in a mode where it does not require its own etcd cluster.
How it works
Each manifest contains all the necessary resources for installing Calico on each node in your Kubernetes cluster.
It installs the following Kubernetes resources:
calico-configConfigMap, which contains parameters for configuring the install.
- Installs the
calico/nodecontainer on each host using a daemon set.
- Installs the Calico CNI binaries and network config on each host using a daemon set.
calico/kube-controllersas a deployment.
calico-etcd-secretssecret, which optionally allows for providing etcd TLS assets.
The ConfigMap in
calico.yaml provides a way to configure a Calico self-hosted installation. It exposes
the following configuration parameters:
Configuring the pod IP range
Calico IPAM assigns IP addresses from IP pools.
To change the default IP range used for pods, modify the
CALICO_IPV4POOL_CIDR section of the calico.yaml manifest. For more
information, see Configuring calico/node.
By default, the self-hosted manifests enable IP-in-IP encapsulation across subnets. Many users may want to disable IP-in-IP encapsulation, for example if:
- Their cluster is running in a properly configured AWS VPC.
- All their Kubernetes nodes are connected to the same L2 network.
- They intend to use BGP peering to make their underlying infrastructure aware of Pod IP addresses.
To disable IP-in-IP encapsulation, modify the
CALICO_IPV4POOL_IPIP section of the manifest. For more
information, see Configuring calico/node.
By default, these manifests do not configure secure access to etcd and assume an etcd proxy is running on each host. The following configuration options let you specify custom etcd cluster endpoints as well as TLS.
The following table outlines the supported ConfigMap options for etcd:
|etcd_endpoints||A comma separated list of etcd nodes.||http://127.0.0.1:2379|
|etcd_ca||The location of the CA mounted in the pods deployed by the DaemonSet.||None|
|etcd_key||The location of the client cert mounted in the pods deployed by the DaemonSet.||None|
|etcd_cert||The location of the client key mounted in the pods deployed by the DaemonSet.||None|
To use these manifests with a TLS enabled etcd cluster you must do the following:
- Populate the
calico-etcd-secretsSecret with the contents of the following files:
- Populate the following options in the ConfigMap which will trigger the various services to expect the provided TLS assets:
Calico’s manifests assign its components one of two service accounts. Depending on your cluster’s authorization mode, you’ll want to back these ServiceAccounts with the neccessary permissions.
Other Configuration Options
The following table outlines the remaining supported ConfigMap options:
|calico_backend||The backend to use.||bird|
|cni_network_config||The CNI Network config to install on each node. Supports templating as described below.|
CNI Network Config Template Support
cni_network_config configuration option supports the following template fields, which will
be filled in automatically by the
||The Kubernetes Service ClusterIP. e.g 10.0.0.1|
||The Kubernetes Service port. e.g 443|
||The serviceaccount token for the namespace, if one exists.|
||The etcd endpoints specified in etcd_endpoints.|
||The path to the automatically generated kubeconfig file in the same directory as the CNI network config file.|
||The path to the etcd key file installed to the host, empty if no key present.|
||The path to the etcd cert file installed to the host, empty if no cert present.|
||The path to the etcd CA file installed to the host, empty if no CA present.|