Connecting workloads across networks that you do not control
Enable inter workload communication across networks that are not aware of workload IPs.
In general, we recommend running Calico without network overlay/encapsulation. This gives you the highest performance and simplest network; the packet that leaves your workload is the packet that goes on the wire.
However, selectively using overlays/encapsulation can be useful when running on top of an underlying network that cannot easily be made aware of workload IPs. A common example is if you are using Calico networking in AWS across multiple VPCs/subnets. In this case, Calico can selectively encapsulate only the traffic that is routed between the VPCs/subnets, and run without encapsulation within each VPC/subnet. You might also decide to run your entire Calico network with encapsulation as an overlay network – as a quick way to get started without setting up BGP peering or other routing information in your underlying network.
This how-to guide uses the following features:
IPPool resource with:
- ipipMode field (IP in IP encapsulation)
- vxlanMode field (VXLAN encapsulation)
Routing workload IP addresses
Networks become aware of workload IP addresses through layer 3 routing techniques like static routes or BGP route distribution, or layer 2 address learning. As such, they can route unencapsulated traffic to the right host for the endpoint that is the ultimate destination. However, not all networks are able to route workload IP addresses. For example, public cloud environments where you don’t own the hardware, AWS across VPC subnet boundaries, and other scenarios where you cannot peer Calico over BGP to the underlay, or easily configure static routes. This is why Calico supports encapsulation, so you can send traffic between workloads without requiring the underlying network to be aware of workload IP addresses.
Calico supports two types of encapsulation: VXLAN and IP in IP. VXLAN is supported in some environments where IP in IP is not (for example, Azure). However, VXLAN has a slightly higher per-packet overhead because the header is larger.
Encapsulation of workload traffic is typically required only when traffic crosses a router that is unable to route workload IP addresses on its own. For IP in IP, Calico can perform encapsulation on: all traffic, no traffic, or only on traffic that crosses a subnet boundary.
You can configure each IP pool with different encapsulation configurations. However, you cannot mix encapsulation types within an IP pool.
- Configure IP in IP encapsulation for only cross subnet traffic
- Configure IP in IP encapsulation for all inter workload traffic
- Configure VXLAN encapsulation for all inter workload traffic
IPv4/6 address support
IP in IP and VXLAN support only IPv4 addresses.
For IP in IP, Calico has an option to selectively encapsulate only traffic that crosses subnet boundaries. We recommend using the cross subnet option for IP in IP to minimize encapsulation overhead. Cross subnet mode provides better performance in AWS multi-AZ deployments, and on networks where routers are used to connect pools of nodes with L2 connectivity.
Be aware that switching encapsulation modes can cause disruption to in-progress connections. Plan accordingly.
Configure IP in IP encapsulation for only cross subnet traffic
IP in IP encapsulation can be performed selectively, and only for traffic crossing subnet boundaries.
To enable this feature, set
apiVersion: projectcalico.org/v3 kind: IPPool metadata: name: ippool-cross-subnet-1 spec: cidr: 192.168.0.0/16 ipipMode: CrossSubnet natOutgoing: true
Configure IP in IP encapsulation for all inter workload traffic
ipipMode set to
Always, Calico routes traffic using IP in IP for all traffic originating from a Calico enabled-host, to all Calico networked containers and VMs within the IP pool.
apiVersion: projectcalico.org/v3 kind: IPPool metadata: name: ippool-ipip-1 spec: cidr: 192.168.0.0/16 ipipMode: Always natOutgoing: true
Configure VXLAN encapsulation for all inter workload traffic
vxlanMode set to
Always, Calico routes traffic using VXLAN for all traffic originating from a Calico enabled host, to all Calico networked containers and VMs within the IP pool.
apiVersion: projectcalico.org/v3 kind: IPPool metadata: name: ippool-vxlan-1 spec: cidr: 192.168.0.0/16 vxlanMode: Always natOutgoing: true
If you use only VXLAN pools, BGP networking is not required. You can disable BGP to reduce the moving parts in your cluster by Customizing the manifests. Set the
calico_backend setting to
vxlan, and disable the BGP readiness check.
Above and beyond
For details on IP pool resource options, see IP pool.