Configuring Felix

note

The following tables detail the configuration file and environment variable parameters. For FelixConfiguration resource settings, refer to Felix Configuration Resource.

Configuration for Felix is read from one of four possible locations, in order, as follows.

1. Environment variables.
2. The Felix configuration file.
3. Host-specific FelixConfiguration resources (node.<nodename>).
4. The global FelixConfiguration resource (default).

The value of any configuration parameter is the value read from the first location containing a value. For example, if an environment variable contains a value, it takes top precedence.

If not set in any of these locations, most configuration parameters have defaults, and it should be rare to have to explicitly set them.

The full list of parameters which can be set is as follows.

Spec

Datastore connection

DatastoreType

Configuration file

Attribute	Value
Key	DatastoreType
Description	Controls which datastore driver Felix will use. Typically, this is detected from the environment and it does not need to be set manually. (For example, if KUBECONFIG is set, the kubernetes datastore driver will be used by default).
Schema	One of: etcdv3, kubernetes (case insensitive)
Default	etcdv3

Environment variable

Attribute	Value
Key	FELIX_DATASTORETYPE
Description	Controls which datastore driver Felix will use. Typically, this is detected from the environment and it does not need to be set manually. (For example, if KUBECONFIG is set, the kubernetes datastore driver will be used by default).
Schema	One of: etcdv3, kubernetes (case insensitive)
Default	etcdv3

EtcdAddr

Configuration file

Attribute	Value
Key	EtcdAddr
Description	Open source-only parameter; etcdv3 datastore driver is not supported in Calico Enterprise/Cloud. When using the etcdv3 datastore driver, the etcd server and port to connect to. If EtcdEndpoints is also specified, it takes precedence.
Schema	String matching regex ^[^:/]+:\d+$
Default	127.0.0.1:2379

Environment variable

Attribute	Value
Key	FELIX_ETCDADDR
Description	Open source-only parameter; etcdv3 datastore driver is not supported in Calico Enterprise/Cloud. When using the etcdv3 datastore driver, the etcd server and port to connect to. If EtcdEndpoints is also specified, it takes precedence.
Schema	String matching regex ^[^:/]+:\d+$
Default	127.0.0.1:2379

EtcdCaFile

Configuration file

Attribute	Value
Key	EtcdCaFile
Description	Open source-only parameter; etcdv3 datastore driver is not supported in Calico Enterprise/Cloud. When using the etcdv3 datastore driver, path to TLS CA file to use when connecting to etcd. If the CA file is specified, the other TLS parameters are mandatory.
Schema	Path to file, which must exist
Default	none

Environment variable

Attribute	Value
Key	FELIX_ETCDCAFILE
Description	Open source-only parameter; etcdv3 datastore driver is not supported in Calico Enterprise/Cloud. When using the etcdv3 datastore driver, path to TLS CA file to use when connecting to etcd. If the CA file is specified, the other TLS parameters are mandatory.
Schema	Path to file, which must exist
Default	none

EtcdCertFile

Configuration file

Attribute	Value
Key	EtcdCertFile
Description	Open source-only parameter; etcdv3 datastore driver is not supported in Calico Enterprise/Cloud. When using the etcdv3 datastore driver, path to TLS certificate file to use when connecting to etcd. If the certificate file is specified, the other TLS parameters are mandatory.
Schema	Path to file, which must exist
Default	none

Environment variable

Attribute	Value
Key	FELIX_ETCDCERTFILE
Description	Open source-only parameter; etcdv3 datastore driver is not supported in Calico Enterprise/Cloud. When using the etcdv3 datastore driver, path to TLS certificate file to use when connecting to etcd. If the certificate file is specified, the other TLS parameters are mandatory.
Schema	Path to file, which must exist
Default	none

EtcdEndpoints

Configuration file

Attribute	Value
Key	EtcdEndpoints
Description	Open source-only parameter; etcdv3 datastore driver is not supported in Calico Enterprise/Cloud. When using the etcdv3 datastore driver, comma-delimited list of etcd endpoints to connect to, replaces EtcdAddr and EtcdScheme.
Schema	List of HTTP endpoints: comma-delimited list of http(s)://hostname:port
Default	none

Environment variable

Attribute	Value
Key	FELIX_ETCDENDPOINTS
Description	Open source-only parameter; etcdv3 datastore driver is not supported in Calico Enterprise/Cloud. When using the etcdv3 datastore driver, comma-delimited list of etcd endpoints to connect to, replaces EtcdAddr and EtcdScheme.
Schema	List of HTTP endpoints: comma-delimited list of http(s)://hostname:port
Default	none

EtcdKeyFile

Configuration file

Attribute	Value
Key	EtcdKeyFile
Description	Open source-only parameter; etcdv3 datastore driver is not supported in Calico Enterprise/Cloud. When using the etcdv3 datastore driver, path to TLS private key file to use when connecting to etcd. If the key file is specified, the other TLS parameters are mandatory.
Schema	Path to file, which must exist
Default	none

Environment variable

Attribute	Value
Key	FELIX_ETCDKEYFILE
Description	Open source-only parameter; etcdv3 datastore driver is not supported in Calico Enterprise/Cloud. When using the etcdv3 datastore driver, path to TLS private key file to use when connecting to etcd. If the key file is specified, the other TLS parameters are mandatory.
Schema	Path to file, which must exist
Default	none

EtcdScheme

Configuration file

Attribute	Value
Key	EtcdScheme
Description	Open source-only parameter; etcdv3 datastore driver is not supported in Calico Enterprise/Cloud. EtcdAddr: when using the etcdv3 datastore driver, the URL scheme to use. If EtcdEndpoints is also specified, it takes precedence.
Schema	One of: http, https (case insensitive)
Default	http

Environment variable

Attribute	Value
Key	FELIX_ETCDSCHEME
Description	Open source-only parameter; etcdv3 datastore driver is not supported in Calico Enterprise/Cloud. EtcdAddr: when using the etcdv3 datastore driver, the URL scheme to use. If EtcdEndpoints is also specified, it takes precedence.
Schema	One of: http, https (case insensitive)
Default	http

FelixHostname

Configuration file

Attribute	Value
Key	FelixHostname
Description	The name of this node, used to identify resources in the datastore that belong to this node. Auto-detected from the node's hostname if not provided.
Schema	String matching regex ^[a-zA-Z0-9_.-]+$
Default	none

Environment variable

Attribute	Value
Key	FELIX_FELIXHOSTNAME
Description	The name of this node, used to identify resources in the datastore that belong to this node. Auto-detected from the node's hostname if not provided.
Schema	String matching regex ^[a-zA-Z0-9_.-]+$
Default	none

TyphaAddr

Configuration file

Attribute	Value
Key	TyphaAddr
Description	If set, tells Felix to connect to Typha at the given address and port. Overrides TyphaK8sServiceName.
Schema	String matching regex ^[^:/]+:\d+$
Default	none

Environment variable

Attribute	Value
Key	FELIX_TYPHAADDR
Description	If set, tells Felix to connect to Typha at the given address and port. Overrides TyphaK8sServiceName.
Schema	String matching regex ^[^:/]+:\d+$
Default	none

TyphaCAFile

Configuration file

Attribute	Value
Key	TyphaCAFile
Description	Path to the TLS CA file to use when communicating with Typha. If this parameter is specified, the other TLS parameters must also be specified. For non-cluster hosts, the CA file is extracted from the tigera-ca-bundle ConfigMap under the TyphaK8sNamespace namespace.
Schema	Path to file, which must exist
Default	none

Environment variable

Attribute	Value
Key	FELIX_TYPHACAFILE
Description	Path to the TLS CA file to use when communicating with Typha. If this parameter is specified, the other TLS parameters must also be specified. For non-cluster hosts, the CA file is extracted from the tigera-ca-bundle ConfigMap under the TyphaK8sNamespace namespace.
Schema	Path to file, which must exist
Default	none

TyphaCN

Configuration file

Attribute	Value
Key	TyphaCN
Description	Common name to use when authenticating to Typha over TLS. If any TLS parameters are specified then one of TyphaCN and TyphaURISAN must be set.
Schema	String
Default	none

Environment variable

Attribute	Value
Key	FELIX_TYPHACN
Description	Common name to use when authenticating to Typha over TLS. If any TLS parameters are specified then one of TyphaCN and TyphaURISAN must be set.
Schema	String
Default	none

TyphaCertFile

Configuration file

Attribute	Value
Key	TyphaCertFile
Description	Path to the TLS certificate to use when communicating with Typha. If this parameter is specified, the other TLS parameters must also be specified. For non-cluster hosts, the certificate will be signed by the in-cluster Tigera operator signer.
Schema	Path to file, which must exist
Default	none

Environment variable

Attribute	Value
Key	FELIX_TYPHACERTFILE
Description	Path to the TLS certificate to use when communicating with Typha. If this parameter is specified, the other TLS parameters must also be specified. For non-cluster hosts, the certificate will be signed by the in-cluster Tigera operator signer.
Schema	Path to file, which must exist
Default	none

TyphaK8sNamespace

Configuration file

Attribute	Value
Key	TyphaK8sNamespace
Description	Namespace to look in when looking for Typha's service (see TyphaK8sServiceName).
Schema	String
Default	kube-system

Environment variable

Attribute	Value
Key	FELIX_TYPHAK8SNAMESPACE
Description	Namespace to look in when looking for Typha's service (see TyphaK8sServiceName).
Schema	String
Default	kube-system

TyphaK8sServiceName

Configuration file

Attribute	Value
Key	TyphaK8sServiceName
Description	If set, tells Felix to connect to Typha by looking up the Endpoints of the given Kubernetes Service in namespace specified by TyphaK8sNamespace.
Schema	String
Default	none

Environment variable

Attribute	Value
Key	FELIX_TYPHAK8SSERVICENAME
Description	If set, tells Felix to connect to Typha by looking up the Endpoints of the given Kubernetes Service in namespace specified by TyphaK8sNamespace.
Schema	String
Default	none

TyphaKeyFile

Configuration file

Attribute	Value
Key	TyphaKeyFile
Description	Path to the TLS private key to use when communicating with Typha. If this parameter is specified, the other TLS parameters must also be specified. For non-cluster hosts, the private key is generated locally and rotated when the certificate expires.
Schema	Path to file, which must exist
Default	none

Environment variable

Attribute	Value
Key	FELIX_TYPHAKEYFILE
Description	Path to the TLS private key to use when communicating with Typha. If this parameter is specified, the other TLS parameters must also be specified. For non-cluster hosts, the private key is generated locally and rotated when the certificate expires.
Schema	Path to file, which must exist
Default	none

TyphaReadTimeout

Configuration file

Attribute	Value
Key	TyphaReadTimeout
Description	Read timeout when reading from the Typha connection. If typha sends no data for this long, Felix will exit and restart. (Note that Typha sends regular pings so traffic is always expected.)
Schema	Seconds (floating point)
Default	30

Environment variable

Attribute	Value
Key	FELIX_TYPHAREADTIMEOUT
Description	Read timeout when reading from the Typha connection. If typha sends no data for this long, Felix will exit and restart. (Note that Typha sends regular pings so traffic is always expected.)
Schema	Seconds (floating point)
Default	30

TyphaURISAN

Configuration file

Attribute	Value
Key	TyphaURISAN
Description	URI SAN to use when authenticating to Typha over TLS. If any TLS parameters are specified then one of TyphaCN and TyphaURISAN must be set.
Schema	String
Default	none

Environment variable

Attribute	Value
Key	FELIX_TYPHAURISAN
Description	URI SAN to use when authenticating to Typha over TLS. If any TLS parameters are specified then one of TyphaCN and TyphaURISAN must be set.
Schema	String
Default	none

TyphaWriteTimeout

Configuration file

Attribute	Value
Key	TyphaWriteTimeout
Description	Write timeout when writing data to Typha.
Schema	Seconds (floating point)
Default	10

Environment variable

Attribute	Value
Key	FELIX_TYPHAWRITETIMEOUT
Description	Write timeout when writing data to Typha.
Schema	Seconds (floating point)
Default	10

Process: Feature detection/overrides

FeatureDetectOverride

Configuration file

Attribute	Value
Key	FeatureDetectOverride
Description	Used to override feature detection based on auto-detected platform capabilities. Values are specified in a comma separated list with no spaces, example; "SNATFullyRandom=true,MASQFullyRandom=false,RestoreSupportsLock=". A value of "true" or "false" will force enable/disable feature, empty or omitted values fall back to auto-detection.
Schema	Comma-delimited list of key=value pairs
Default	none

Environment variable

Attribute	Value
Key	FELIX_FEATUREDETECTOVERRIDE
Description	Used to override feature detection based on auto-detected platform capabilities. Values are specified in a comma separated list with no spaces, example; "SNATFullyRandom=true,MASQFullyRandom=false,RestoreSupportsLock=". A value of "true" or "false" will force enable/disable feature, empty or omitted values fall back to auto-detection.
Schema	Comma-delimited list of key=value pairs
Default	none

FeatureGates

Configuration file

Attribute	Value
Key	FeatureGates
Description	Used to enable or disable tech-preview Calico features. Values are specified in a comma separated list with no spaces, example; "BPFConnectTimeLoadBalancingWorkaround=enabled,XyZ=false". This is used to enable features that are not fully production ready.
Schema	Comma-delimited list of key=value pairs
Default	none

Environment variable

Attribute	Value
Key	FELIX_FEATUREGATES
Description	Used to enable or disable tech-preview Calico features. Values are specified in a comma separated list with no spaces, example; "BPFConnectTimeLoadBalancingWorkaround=enabled,XyZ=false". This is used to enable features that are not fully production ready.
Schema	Comma-delimited list of key=value pairs
Default	none

Process: Go runtime

GoGCThreshold

Configuration file

Attribute	Value
Key	GoGCThreshold
Description	Sets the Go runtime's garbage collection threshold. I.e. the percentage that the heap is allowed to grow before garbage collection is triggered. In general, doubling the value halves the CPU time spent doing GC, but it also doubles peak GC memory overhead. A special value of -1 can be used to disable GC entirely; this should only be used in conjunction with the GoMemoryLimitMB setting. This setting is overridden by the GOGC environment variable.
Schema	Integer: [-1,263-1]
Default	40

Environment variable

Attribute	Value
Key	FELIX_GOGCTHRESHOLD
Description	Sets the Go runtime's garbage collection threshold. I.e. the percentage that the heap is allowed to grow before garbage collection is triggered. In general, doubling the value halves the CPU time spent doing GC, but it also doubles peak GC memory overhead. A special value of -1 can be used to disable GC entirely; this should only be used in conjunction with the GoMemoryLimitMB setting. This setting is overridden by the GOGC environment variable.
Schema	Integer: [-1,263-1]
Default	40

GoMaxProcs

Configuration file

Attribute	Value
Key	GoMaxProcs
Description	Sets the maximum number of CPUs that the Go runtime will use concurrently. A value of -1 means "use the system default"; typically the number of real CPUs on the system. this setting is overridden by the GOMAXPROCS environment variable.
Schema	Integer: [-1,263-1]
Default	-1

Environment variable

Attribute	Value
Key	FELIX_GOMAXPROCS
Description	Sets the maximum number of CPUs that the Go runtime will use concurrently. A value of -1 means "use the system default"; typically the number of real CPUs on the system. this setting is overridden by the GOMAXPROCS environment variable.
Schema	Integer: [-1,263-1]
Default	-1

GoMemoryLimitMB

Configuration file

Attribute	Value
Key	GoMemoryLimitMB
Description	Sets a (soft) memory limit for the Go runtime in MB. The Go runtime will try to keep its memory usage under the limit by triggering GC as needed. To avoid thrashing, it will exceed the limit if GC starts to take more than 50% of the process's CPU time. A value of -1 disables the memory limit. Note that the memory limit, if used, must be considerably less than any hard resource limit set at the container or pod level. This is because felix is not the only process that must run in the container or pod. This setting is overridden by the GOMEMLIMIT environment variable.
Schema	Integer: [-1,263-1]
Default	-1

Environment variable

Attribute	Value
Key	FELIX_GOMEMORYLIMITMB
Description	Sets a (soft) memory limit for the Go runtime in MB. The Go runtime will try to keep its memory usage under the limit by triggering GC as needed. To avoid thrashing, it will exceed the limit if GC starts to take more than 50% of the process's CPU time. A value of -1 disables the memory limit. Note that the memory limit, if used, must be considerably less than any hard resource limit set at the container or pod level. This is because felix is not the only process that must run in the container or pod. This setting is overridden by the GOMEMLIMIT environment variable.
Schema	Integer: [-1,263-1]
Default	-1

Process: Health port and timeouts

HealthEnabled

Configuration file

Attribute	Value
Key	HealthEnabled
Description	If set to true, enables Felix's health port, which provides readiness and liveness endpoints.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_HEALTHENABLED
Description	If set to true, enables Felix's health port, which provides readiness and liveness endpoints.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

HealthHost

Configuration file

Attribute	Value
Key	HealthHost
Description	The host that the health server should bind to.
Schema	String matching regex ^[a-zA-Z0-9:._+-]{1,64}$
Default	localhost

Environment variable

Attribute	Value
Key	FELIX_HEALTHHOST
Description	The host that the health server should bind to.
Schema	String matching regex ^[a-zA-Z0-9:._+-]{1,64}$
Default	localhost

HealthPort

Configuration file

Attribute	Value
Key	HealthPort
Description	The TCP port that the health server should bind to.
Schema	Integer: [0,65535]
Default	9099

Environment variable

Attribute	Value
Key	FELIX_HEALTHPORT
Description	The TCP port that the health server should bind to.
Schema	Integer: [0,65535]
Default	9099

HealthTimeoutOverrides

Configuration file

Attribute	Value
Key	HealthTimeoutOverrides
Description	Allows the internal watchdog timeouts of individual subcomponents to be overridden. This is useful for working around "false positive" liveness timeouts that can occur in particularly stressful workloads or if CPU is constrained. For a list of active subcomponents, see Felix's logs.
Schema	Comma-delimited list of <key>=<duration> pairs, where durations use Go's standard format (e.g. 1s, 1m, 1h3m2s)
Default	none

Environment variable

Attribute	Value
Key	FELIX_HEALTHTIMEOUTOVERRIDES
Description	Allows the internal watchdog timeouts of individual subcomponents to be overridden. This is useful for working around "false positive" liveness timeouts that can occur in particularly stressful workloads or if CPU is constrained. For a list of active subcomponents, see Felix's logs.
Schema	Comma-delimited list of <key>=<duration> pairs, where durations use Go's standard format (e.g. 1s, 1m, 1h3m2s)
Default	none

Process: Logging

LogDebugFilenameRegex

Configuration file

Attribute	Value
Key	LogDebugFilenameRegex
Description	Controls which source code files have their Debug log output included in the logs. Only logs from files with names that match the given regular expression are included. The filter only applies to Debug level logs.
Schema	Regular expression
Default	none

Environment variable

Attribute	Value
Key	FELIX_LOGDEBUGFILENAMEREGEX
Description	Controls which source code files have their Debug log output included in the logs. Only logs from files with names that match the given regular expression are included. The filter only applies to Debug level logs.
Schema	Regular expression
Default	none

LogDropActionOverride

Configuration file

Attribute	Value
Key	LogDropActionOverride
Description	Specifies whether or not to include the DropActionOverride in the logs when it is triggered.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_LOGDROPACTIONOVERRIDE
Description	Specifies whether or not to include the DropActionOverride in the logs when it is triggered.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

LogFilePath

Configuration file

Attribute	Value
Key	LogFilePath
Description	The full path to the Felix log. Set to none to disable file logging.
Schema	Path to file
Default	/var/log/calico/felix.log

Environment variable

Attribute	Value
Key	FELIX_LOGFILEPATH
Description	The full path to the Felix log. Set to none to disable file logging.
Schema	Path to file
Default	/var/log/calico/felix.log

LogPrefix

Configuration file

Attribute	Value
Key	LogPrefix
Description	The log prefix that Felix uses when rendering LOG rules.
Schema	String
Default	calico-packet

Environment variable

Attribute	Value
Key	FELIX_LOGPREFIX
Description	The log prefix that Felix uses when rendering LOG rules.
Schema	String
Default	calico-packet

LogSeverityFile

Configuration file

Attribute	Value
Key	LogSeverityFile
Description	The log severity above which logs are sent to the log file.
Schema	One of: DEBUG, ERROR, FATAL, INFO, WARNING (case insensitive)
Default	INFO

Environment variable

Attribute	Value
Key	FELIX_LOGSEVERITYFILE
Description	The log severity above which logs are sent to the log file.
Schema	One of: DEBUG, ERROR, FATAL, INFO, WARNING (case insensitive)
Default	INFO

LogSeverityScreen

Configuration file

Attribute	Value
Key	LogSeverityScreen
Description	The log severity above which logs are sent to the stdout.
Schema	One of: DEBUG, ERROR, FATAL, INFO, WARNING (case insensitive)
Default	INFO

Environment variable

Attribute	Value
Key	FELIX_LOGSEVERITYSCREEN
Description	The log severity above which logs are sent to the stdout.
Schema	One of: DEBUG, ERROR, FATAL, INFO, WARNING (case insensitive)
Default	INFO

LogSeveritySys

Configuration file

Attribute	Value
Key	LogSeveritySys
Description	The log severity above which logs are sent to the syslog. Set to None for no logging to syslog.
Schema	One of: DEBUG, ERROR, FATAL, INFO, WARNING (case insensitive)
Default	INFO

Environment variable

Attribute	Value
Key	FELIX_LOGSEVERITYSYS
Description	The log severity above which logs are sent to the syslog. Set to None for no logging to syslog.
Schema	One of: DEBUG, ERROR, FATAL, INFO, WARNING (case insensitive)
Default	INFO

Process: Prometheus metrics

PrometheusGoMetricsEnabled

Configuration file

Attribute	Value
Key	PrometheusGoMetricsEnabled
Description	Disables Go runtime metrics collection, which the Prometheus client does by default, when set to false. This reduces the number of metrics reported, reducing Prometheus load.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

Environment variable

Attribute	Value
Key	FELIX_PROMETHEUSGOMETRICSENABLED
Description	Disables Go runtime metrics collection, which the Prometheus client does by default, when set to false. This reduces the number of metrics reported, reducing Prometheus load.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

PrometheusMetricsCAFile

Configuration file

Attribute	Value
Key	PrometheusMetricsCAFile
Description	The path to the TLS CA file for the Prometheus metrics server.
Schema	Path to file, which must exist
Default	none

Environment variable

Attribute	Value
Key	FELIX_PROMETHEUSMETRICSCAFILE
Description	The path to the TLS CA file for the Prometheus metrics server.
Schema	Path to file, which must exist
Default	none

PrometheusMetricsCertFile

Configuration file

Attribute	Value
Key	PrometheusMetricsCertFile
Description	The path to the TLS certificate file for the Prometheus metrics server.
Schema	Path to file, which must exist
Default	none

Environment variable

Attribute	Value
Key	FELIX_PROMETHEUSMETRICSCERTFILE
Description	The path to the TLS certificate file for the Prometheus metrics server.
Schema	Path to file, which must exist
Default	none

PrometheusMetricsEnabled

Configuration file

Attribute	Value
Key	PrometheusMetricsEnabled
Description	Enables the Prometheus metrics server in Felix if set to true.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_PROMETHEUSMETRICSENABLED
Description	Enables the Prometheus metrics server in Felix if set to true.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

PrometheusMetricsHost

Configuration file

Attribute	Value
Key	PrometheusMetricsHost
Description	The host that the Prometheus metrics server should bind to.
Schema	String matching regex ^[a-zA-Z0-9:._+-]{1,64}$
Default	none

Environment variable

Attribute	Value
Key	FELIX_PROMETHEUSMETRICSHOST
Description	The host that the Prometheus metrics server should bind to.
Schema	String matching regex ^[a-zA-Z0-9:._+-]{1,64}$
Default	none

PrometheusMetricsKeyFile

Configuration file

Attribute	Value
Key	PrometheusMetricsKeyFile
Description	The path to the TLS private key file for the Prometheus metrics server.
Schema	Path to file, which must exist
Default	none

Environment variable

Attribute	Value
Key	FELIX_PROMETHEUSMETRICSKEYFILE
Description	The path to the TLS private key file for the Prometheus metrics server.
Schema	Path to file, which must exist
Default	none

PrometheusMetricsPort

Configuration file

Attribute	Value
Key	PrometheusMetricsPort
Description	The TCP port that the Prometheus metrics server should bind to.
Schema	Integer: [0,65535]
Default	9091

Environment variable

Attribute	Value
Key	FELIX_PROMETHEUSMETRICSPORT
Description	The TCP port that the Prometheus metrics server should bind to.
Schema	Integer: [0,65535]
Default	9091

PrometheusProcessMetricsEnabled

Configuration file

Attribute	Value
Key	PrometheusProcessMetricsEnabled
Description	Disables process metrics collection, which the Prometheus client does by default, when set to false. This reduces the number of metrics reported, reducing Prometheus load.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

Environment variable

Attribute	Value
Key	FELIX_PROMETHEUSPROCESSMETRICSENABLED
Description	Disables process metrics collection, which the Prometheus client does by default, when set to false. This reduces the number of metrics reported, reducing Prometheus load.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

PrometheusWireGuardMetricsEnabled

Configuration file

Attribute	Value
Key	PrometheusWireGuardMetricsEnabled
Description	Disables WireGuard metrics collection, which the Prometheus client does by default, when set to false. This reduces the number of metrics reported, reducing Prometheus load.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

Environment variable

Attribute	Value
Key	FELIX_PROMETHEUSWIREGUARDMETRICSENABLED
Description	Disables WireGuard metrics collection, which the Prometheus client does by default, when set to false. This reduces the number of metrics reported, reducing Prometheus load.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

Data plane: Common

No matching group found for 'Dataplane: Common'.

Data plane: iptables

No matching group found for 'Dataplane: iptables'.

Data plane: nftables

No matching group found for 'Dataplane: nftables'.

Data plane: eBPF

No matching group found for 'Dataplane: eBPF'.

Data plane: Windows

No matching group found for 'Dataplane: Windows'.

Data plane: OpenStack support

No matching group found for 'Dataplane: OpenStack support'.

Data plane: XDP acceleration for iptables data plane

No matching group found for 'Dataplane: XDP acceleration for iptables dataplane'.

Overlay: VXLAN overlay

VXLANEnabled

Configuration file

Attribute	Value
Key	VXLANEnabled
Description	Overrides whether Felix should create the VXLAN tunnel device for IPv4 VXLAN networking. Optional as Felix determines this based on the existing IP pools.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	none

Environment variable

Attribute	Value
Key	FELIX_VXLANENABLED
Description	Overrides whether Felix should create the VXLAN tunnel device for IPv4 VXLAN networking. Optional as Felix determines this based on the existing IP pools.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	none

VXLANMTU

Configuration file

Attribute	Value
Key	VXLANMTU
Description	The MTU to set on the IPv4 VXLAN tunnel device. Optional as Felix auto-detects the MTU based on the MTU of the host's interfaces.
Schema	Integer
Default	0

Environment variable

Attribute	Value
Key	FELIX_VXLANMTU
Description	The MTU to set on the IPv4 VXLAN tunnel device. Optional as Felix auto-detects the MTU based on the MTU of the host's interfaces.
Schema	Integer
Default	0

VXLANMTUV6

Configuration file

Attribute	Value
Key	VXLANMTUV6
Description	The MTU to set on the IPv6 VXLAN tunnel device. Optional as Felix auto-detects the MTU based on the MTU of the host's interfaces.
Schema	Integer
Default	0

Environment variable

Attribute	Value
Key	FELIX_VXLANMTUV6
Description	The MTU to set on the IPv6 VXLAN tunnel device. Optional as Felix auto-detects the MTU based on the MTU of the host's interfaces.
Schema	Integer
Default	0

VXLANPort

Configuration file

Attribute	Value
Key	VXLANPort
Description	The UDP port number to use for VXLAN traffic.
Schema	Integer
Default	4789

Environment variable

Attribute	Value
Key	FELIX_VXLANPORT
Description	The UDP port number to use for VXLAN traffic.
Schema	Integer
Default	4789

VXLANVNI

Configuration file

Attribute	Value
Key	VXLANVNI
Description	The VXLAN VNI to use for VXLAN traffic. You may need to change this if the default value is in use on your system.
Schema	Integer
Default	4096

Environment variable

Attribute	Value
Key	FELIX_VXLANVNI
Description	The VXLAN VNI to use for VXLAN traffic. You may need to change this if the default value is in use on your system.
Schema	Integer
Default	4096

Overlay: IP-in-IP

IpInIpEnabled

Configuration file

Attribute	Value
Key	IpInIpEnabled
Description	Overrides whether Felix should configure an IPIP interface on the host. Optional as Felix determines this based on the existing IP pools.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	none

Environment variable

Attribute	Value
Key	FELIX_IPINIPENABLED
Description	Overrides whether Felix should configure an IPIP interface on the host. Optional as Felix determines this based on the existing IP pools.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	none

IpInIpMtu

Configuration file

Attribute	Value
Key	IpInIpMtu
Description	Controls the MTU to set on the IPIP tunnel device. Optional as Felix auto-detects the MTU based on the MTU of the host's interfaces.
Schema	Integer
Default	0

Environment variable

Attribute	Value
Key	FELIX_IPINIPMTU
Description	Controls the MTU to set on the IPIP tunnel device. Optional as Felix auto-detects the MTU based on the MTU of the host's interfaces.
Schema	Integer
Default	0

Overlay: WireGuard

WireguardEnabled

Configuration file

Attribute	Value
Key	WireguardEnabled
Description	Controls whether Wireguard is enabled for IPv4 (encapsulating IPv4 traffic over an IPv4 underlay network).
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_WIREGUARDENABLED
Description	Controls whether Wireguard is enabled for IPv4 (encapsulating IPv4 traffic over an IPv4 underlay network).
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

WireguardEnabledV6

Configuration file

Attribute	Value
Key	WireguardEnabledV6
Description	Controls whether Wireguard is enabled for IPv6 (encapsulating IPv6 traffic over an IPv6 underlay network).
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_WIREGUARDENABLEDV6
Description	Controls whether Wireguard is enabled for IPv6 (encapsulating IPv6 traffic over an IPv6 underlay network).
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

WireguardHostEncryptionEnabled

Configuration file

Attribute	Value
Key	WireguardHostEncryptionEnabled
Description	Controls whether Wireguard host-to-host encryption is enabled.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_WIREGUARDHOSTENCRYPTIONENABLED
Description	Controls whether Wireguard host-to-host encryption is enabled.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

WireguardInterfaceName

Configuration file

Attribute	Value
Key	WireguardInterfaceName
Description	Specifies the name to use for the IPv4 Wireguard interface.
Schema	String matching regex ^[a-zA-Z0-9:._+-]{1,15}$
Default	wireguard.cali

Environment variable

Attribute	Value
Key	FELIX_WIREGUARDINTERFACENAME
Description	Specifies the name to use for the IPv4 Wireguard interface.
Schema	String matching regex ^[a-zA-Z0-9:._+-]{1,15}$
Default	wireguard.cali

WireguardInterfaceNameV6

Configuration file

Attribute	Value
Key	WireguardInterfaceNameV6
Description	Specifies the name to use for the IPv6 Wireguard interface.
Schema	String matching regex ^[a-zA-Z0-9:._+-]{1,15}$
Default	wg-v6.cali

Environment variable

Attribute	Value
Key	FELIX_WIREGUARDINTERFACENAMEV6
Description	Specifies the name to use for the IPv6 Wireguard interface.
Schema	String matching regex ^[a-zA-Z0-9:._+-]{1,15}$
Default	wg-v6.cali

WireguardListeningPort

Configuration file

Attribute	Value
Key	WireguardListeningPort
Description	Controls the listening port used by IPv4 Wireguard.
Schema	Integer
Default	51820

Environment variable

Attribute	Value
Key	FELIX_WIREGUARDLISTENINGPORT
Description	Controls the listening port used by IPv4 Wireguard.
Schema	Integer
Default	51820

WireguardListeningPortV6

Configuration file

Attribute	Value
Key	WireguardListeningPortV6
Description	Controls the listening port used by IPv6 Wireguard.
Schema	Integer
Default	51821

Environment variable

Attribute	Value
Key	FELIX_WIREGUARDLISTENINGPORTV6
Description	Controls the listening port used by IPv6 Wireguard.
Schema	Integer
Default	51821

WireguardMTU

Configuration file

Attribute	Value
Key	WireguardMTU
Description	Controls the MTU on the IPv4 Wireguard interface. See Configuring MTU.
Schema	Integer
Default	0

Environment variable

Attribute	Value
Key	FELIX_WIREGUARDMTU
Description	Controls the MTU on the IPv4 Wireguard interface. See Configuring MTU.
Schema	Integer
Default	0

WireguardMTUV6

Configuration file

Attribute	Value
Key	WireguardMTUV6
Description	Controls the MTU on the IPv6 Wireguard interface. See Configuring MTU.
Schema	Integer
Default	0

Environment variable

Attribute	Value
Key	FELIX_WIREGUARDMTUV6
Description	Controls the MTU on the IPv6 Wireguard interface. See Configuring MTU.
Schema	Integer
Default	0

WireguardPersistentKeepAlive

Configuration file

Attribute	Value
Key	WireguardPersistentKeepAlive
Description	Controls Wireguard PersistentKeepalive option. Set 0 to disable.
Schema	Seconds (floating point)
Default	0 (0s)

Environment variable

Attribute	Value
Key	FELIX_WIREGUARDPERSISTENTKEEPALIVE
Description	Controls Wireguard PersistentKeepalive option. Set 0 to disable.
Schema	Seconds (floating point)
Default	0 (0s)

WireguardRoutingRulePriority

Configuration file

Attribute	Value
Key	WireguardRoutingRulePriority
Description	Controls the priority value to use for the Wireguard routing rule.
Schema	Integer
Default	99

Environment variable

Attribute	Value
Key	FELIX_WIREGUARDROUTINGRULEPRIORITY
Description	Controls the priority value to use for the Wireguard routing rule.
Schema	Integer
Default	99

WireguardThreadingEnabled

Configuration file

Attribute	Value
Key	WireguardThreadingEnabled
Description	Controls whether Wireguard has Threaded NAPI enabled. This increases the maximum number of packets a Wireguard interface can process. Consider threaded NAPI only if you have high packets per second workloads that are causing dropping packets due to a saturated softirq CPU core. There is a [known issue](https://lore.kernel.org/netdev/CALrw=nEoT2emQ0OAYCjM1d_6Xe_kNLSZ6dhjb5FxrLFYh4kozA@mail.gmail.com/T/) with this setting that may cause NAPI to get stuck holding the global rtnl_mutex when a peer is removed. Workaround: Make sure your Linux kernel [includes this patch](https://github.com/torvalds/linux/commit/56364c910691f6d10ba88c964c9041b9ab777bd6) to unwedge NAPI.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_WIREGUARDTHREADINGENABLED
Description	Controls whether Wireguard has Threaded NAPI enabled. This increases the maximum number of packets a Wireguard interface can process. Consider threaded NAPI only if you have high packets per second workloads that are causing dropping packets due to a saturated softirq CPU core. There is a [known issue](https://lore.kernel.org/netdev/CALrw=nEoT2emQ0OAYCjM1d_6Xe_kNLSZ6dhjb5FxrLFYh4kozA@mail.gmail.com/T/) with this setting that may cause NAPI to get stuck holding the global rtnl_mutex when a peer is removed. Workaround: Make sure your Linux kernel [includes this patch](https://github.com/torvalds/linux/commit/56364c910691f6d10ba88c964c9041b9ab777bd6) to unwedge NAPI.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Overlay: IPSec

IPSecAllowUnsecuredTraffic

Configuration file

Attribute	Value
Key	IPSecAllowUnsecuredTraffic
Description	Controls whether non-IPsec traffic is allowed in addition to IPsec traffic. Enabling this negates the anti-spoofing protections of IPsec but it is useful when migrating to/from IPsec.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_IPSECALLOWUNSECUREDTRAFFIC
Description	Controls whether non-IPsec traffic is allowed in addition to IPsec traffic. Enabling this negates the anti-spoofing protections of IPsec but it is useful when migrating to/from IPsec.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

IPSecESPAlgorithm

Configuration file

Attribute	Value
Key	IPSecESPAlgorithm
Description	IPSecESAlgorithm sets IPSec ESP algorithm. Default is NIST suite B recommendation.
Schema	String
Default	aes128gcm16-ecp256

Environment variable

Attribute	Value
Key	FELIX_IPSECESPALGORITHM
Description	IPSecESAlgorithm sets IPSec ESP algorithm. Default is NIST suite B recommendation.
Schema	String
Default	aes128gcm16-ecp256

IPSecIKEAlgorithm

Configuration file

Attribute	Value
Key	IPSecIKEAlgorithm
Description	Sets IPSec IKE algorithm. Default is NIST suite B recommendation.
Schema	String
Default	aes128gcm16-prfsha256-ecp256

Environment variable

Attribute	Value
Key	FELIX_IPSECIKEALGORITHM
Description	Sets IPSec IKE algorithm. Default is NIST suite B recommendation.
Schema	String
Default	aes128gcm16-prfsha256-ecp256

IPSecLogLevel

Configuration file

Attribute	Value
Key	IPSecLogLevel
Description	Controls log level for IPSec components. Set to None for no logging. A generic log level terminology is used [None, Notice, Info, Debug, Verbose].
Schema	One of: DEBUG, INFO, NOTICE, VERBOSE (case insensitive)
Default	INFO

Environment variable

Attribute	Value
Key	FELIX_IPSECLOGLEVEL
Description	Controls log level for IPSec components. Set to None for no logging. A generic log level terminology is used [None, Notice, Info, Debug, Verbose].
Schema	One of: DEBUG, INFO, NOTICE, VERBOSE (case insensitive)
Default	INFO

IPSecMode

Configuration file

Attribute	Value
Key	IPSecMode
Description	Controls which mode IPSec is operating on. Default value means IPSec is not enabled.
Schema	String
Default	none

Environment variable

Attribute	Value
Key	FELIX_IPSECMODE
Description	Controls which mode IPSec is operating on. Default value means IPSec is not enabled.
Schema	String
Default	none

IPSecPSKFile

Configuration file

Attribute	Value
Key	IPSecPSKFile
Description	File contains PSK.
Schema	Path to file, which must exist
Default	none

Environment variable

Attribute	Value
Key	FELIX_IPSECPSKFILE
Description	File contains PSK.
Schema	Path to file, which must exist
Default	none

IPSecPolicyRefreshInterval

Configuration file

Attribute	Value
Key	IPSecPolicyRefreshInterval
Description	The interval at which Felix will check the kernel's IPsec policy tables and repair any inconsistencies.
Schema	Seconds (floating point)
Default	600 (10m0s)

Environment variable

Attribute	Value
Key	FELIX_IPSECPOLICYREFRESHINTERVAL
Description	The interval at which Felix will check the kernel's IPsec policy tables and repair any inconsistencies.
Schema	Seconds (floating point)
Default	600 (10m0s)

Flow logs: Prometheus reports

DeletedMetricsRetentionSecs

Configuration file

Attribute	Value
Key	DeletedMetricsRetentionSecs
Description	Controls how long metrics are retianed after the flow is gone.
Schema	Seconds (floating point)
Default	30

Environment variable

Attribute	Value
Key	FELIX_DELETEDMETRICSRETENTIONSECS
Description	Controls how long metrics are retianed after the flow is gone.
Schema	Seconds (floating point)
Default	30

PrometheusReporterCAFile

Configuration file

Attribute	Value
Key	PrometheusReporterCAFile
Description	The path to the TLS CA file for the Prometheus per-flow metrics reporter.
Schema	Path to file, which must exist
Default	none

Environment variable

Attribute	Value
Key	FELIX_PROMETHEUSREPORTERCAFILE
Description	The path to the TLS CA file for the Prometheus per-flow metrics reporter.
Schema	Path to file, which must exist
Default	none

PrometheusReporterCertFile

Configuration file

Attribute	Value
Key	PrometheusReporterCertFile
Description	The path to the TLS certificate file for the Prometheus per-flow metrics reporter.
Schema	Path to file, which must exist
Default	none

Environment variable

Attribute	Value
Key	FELIX_PROMETHEUSREPORTERCERTFILE
Description	The path to the TLS certificate file for the Prometheus per-flow metrics reporter.
Schema	Path to file, which must exist
Default	none

PrometheusReporterEnabled

Configuration file

Attribute	Value
Key	PrometheusReporterEnabled
Description	Controls whether the Prometheus per-flow metrics reporter is enabled. This is used to show real-time flow metrics in the UI.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_PROMETHEUSREPORTERENABLED
Description	Controls whether the Prometheus per-flow metrics reporter is enabled. This is used to show real-time flow metrics in the UI.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

PrometheusReporterKeyFile

Configuration file

Attribute	Value
Key	PrometheusReporterKeyFile
Description	The path to the TLS private key file for the Prometheus per-flow metrics reporter.
Schema	Path to file, which must exist
Default	none

Environment variable

Attribute	Value
Key	FELIX_PROMETHEUSREPORTERKEYFILE
Description	The path to the TLS private key file for the Prometheus per-flow metrics reporter.
Schema	Path to file, which must exist
Default	none

PrometheusReporterPort

Configuration file

Attribute	Value
Key	PrometheusReporterPort
Description	The port that the Prometheus per-flow metrics reporter should bind to.
Schema	Integer: [0,65535]
Default	9092

Environment variable

Attribute	Value
Key	FELIX_PROMETHEUSREPORTERPORT
Description	The port that the Prometheus per-flow metrics reporter should bind to.
Schema	Integer: [0,65535]
Default	9092

Flow logs: Syslog reports

SyslogReporterAddress

Configuration file

Attribute	Value
Key	SyslogReporterAddress
Description	The address to dial to when writing to Syslog. For TCP and UDP networks, the address has the form "host:port". The host must be a literal IP address, or a host name that can be resolved to IP addresses. The port must be a literal port number or a service name. For more, see: https://pkg.go.dev/net#Dial.
Schema	String
Default	none

Environment variable

Attribute	Value
Key	FELIX_SYSLOGREPORTERADDRESS
Description	The address to dial to when writing to Syslog. For TCP and UDP networks, the address has the form "host:port". The host must be a literal IP address, or a host name that can be resolved to IP addresses. The port must be a literal port number or a service name. For more, see: https://pkg.go.dev/net#Dial.
Schema	String
Default	none

SyslogReporterEnabled

Configuration file

Attribute	Value
Key	SyslogReporterEnabled
Description	Turns on the feature to write logs to Syslog. Please note that this can incur significant disk space usage when running felix on non-cluster hosts.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_SYSLOGREPORTERENABLED
Description	Turns on the feature to write logs to Syslog. Please note that this can incur significant disk space usage when running felix on non-cluster hosts.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

SyslogReporterNetwork

Configuration file

Attribute	Value
Key	SyslogReporterNetwork
Description	The network to dial to when writing to Syslog. Known networks are "tcp", "tcp4" (IPv4-only), "tcp6" (IPv6-only), "udp", "udp4" (IPv4-only), "udp6" (IPv6-only), "ip", "ip4" (IPv4-only), "ip6" (IPv6-only), "unix", "unixgram" and "unixpacket". For more, see: https://pkg.go.dev/net#Dial.
Schema	String
Default	none

Environment variable

Attribute	Value
Key	FELIX_SYSLOGREPORTERNETWORK
Description	The network to dial to when writing to Syslog. Known networks are "tcp", "tcp4" (IPv4-only), "tcp6" (IPv6-only), "udp", "udp4" (IPv4-only), "udp6" (IPv6-only), "ip", "ip4" (IPv4-only), "ip6" (IPv6-only), "unix", "unixgram" and "unixpacket". For more, see: https://pkg.go.dev/net#Dial.
Schema	String
Default	none

Flow logs: file reports

FlowLogsAggregationThresholdBytes

Configuration file

Attribute	Value
Key	FlowLogsAggregationThresholdBytes
Description	Used specify how far behind the external pipeline that reads flow logs can be. Default is 8192 bytes. This parameter only takes effect when FlowLogsDynamicAggregationEnabled is set to true.
Schema	Integer
Default	8192

Environment variable

Attribute	Value
Key	FELIX_FLOWLOGSAGGREGATIONTHRESHOLDBYTES
Description	Used specify how far behind the external pipeline that reads flow logs can be. Default is 8192 bytes. This parameter only takes effect when FlowLogsDynamicAggregationEnabled is set to true.
Schema	Integer
Default	8192

FlowLogsCollectProcessInfo

Configuration file

Attribute	Value
Key	FlowLogsCollectProcessInfo
Description	If enabled Felix will load the kprobe BPF programs to collect process info.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_FLOWLOGSCOLLECTPROCESSINFO
Description	If enabled Felix will load the kprobe BPF programs to collect process info.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

FlowLogsCollectProcessPath

Configuration file

Attribute	Value
Key	FlowLogsCollectProcessPath
Description	When FlowLogsCollectProcessPath and FlowLogsCollectProcessInfo are both enabled, each flow log will include information about the process that is sending or receiving the packets in that flow: the process_name field will contain the full path of the process executable, and the process_args field will have the arguments with which the executable was invoked. Process information will not be reported for connections which use raw sockets.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_FLOWLOGSCOLLECTPROCESSPATH
Description	When FlowLogsCollectProcessPath and FlowLogsCollectProcessInfo are both enabled, each flow log will include information about the process that is sending or receiving the packets in that flow: the process_name field will contain the full path of the process executable, and the process_args field will have the arguments with which the executable was invoked. Process information will not be reported for connections which use raw sockets.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

FlowLogsCollectTcpStats

Configuration file

Attribute	Value
Key	FlowLogsCollectTcpStats
Description	Enables flow logs reporting TCP socket stats.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_FLOWLOGSCOLLECTTCPSTATS
Description	Enables flow logs reporting TCP socket stats.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

FlowLogsCollectorDebugTrace

Configuration file

Attribute	Value
Key	FlowLogsCollectorDebugTrace
Description	When FlowLogsCollectorDebugTrace is set to true, enables the logs in the collector to be printed in their entirety.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_FLOWLOGSCOLLECTORDEBUGTRACE
Description	When FlowLogsCollectorDebugTrace is set to true, enables the logs in the collector to be printed in their entirety.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

FlowLogsDestDomainsByClient

Configuration file

Attribute	Value
Key	FlowLogsDestDomainsByClient
Description	Used to configure if the source IP is used in the mapping of top level destination domains.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

Environment variable

Attribute	Value
Key	FELIX_FLOWLOGSDESTDOMAINSBYCLIENT
Description	Used to configure if the source IP is used in the mapping of top level destination domains.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

FlowLogsDynamicAggregationEnabled

Configuration file

Attribute	Value
Key	FlowLogsDynamicAggregationEnabled
Description	Used to enable/disable dynamically changing aggregation levels. Default is true.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_FLOWLOGSDYNAMICAGGREGATIONENABLED
Description	Used to enable/disable dynamically changing aggregation levels. Default is true.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

FlowLogsEnableHostEndpoint

Configuration file

Attribute	Value
Key	FlowLogsEnableHostEndpoint
Description	Enables Flow logs reporting for HostEndpoints.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_FLOWLOGSENABLEHOSTENDPOINT
Description	Enables Flow logs reporting for HostEndpoints.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

FlowLogsEnableNetworkSets

Configuration file

Attribute	Value
Key	FlowLogsEnableNetworkSets
Description	Enables Flow logs reporting for GlobalNetworkSets.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_FLOWLOGSENABLENETWORKSETS
Description	Enables Flow logs reporting for GlobalNetworkSets.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

FlowLogsFileAggregationKindForAllowed

Configuration file

Attribute	Value
Key	FlowLogsFileAggregationKindForAllowed
Description	Used to choose the type of aggregation for flow log entries created for allowed connections. . Accepted values are 0, 1 and 2. 0 - No aggregation. 1 - Source port based aggregation. 2 - Pod prefix name based aggreagation.
Schema	Integer: [0,3]
Default	2

Environment variable

Attribute	Value
Key	FELIX_FLOWLOGSFILEAGGREGATIONKINDFORALLOWED
Description	Used to choose the type of aggregation for flow log entries created for allowed connections. . Accepted values are 0, 1 and 2. 0 - No aggregation. 1 - Source port based aggregation. 2 - Pod prefix name based aggreagation.
Schema	Integer: [0,3]
Default	2

FlowLogsFileAggregationKindForDenied

Configuration file

Attribute	Value
Key	FlowLogsFileAggregationKindForDenied
Description	Used to choose the type of aggregation for flow log entries created for denied connections. . Accepted values are 0, 1 and 2. 0 - No aggregation. 1 - Source port based aggregation. 2 - Pod prefix name based aggregation. 3 - No destination ports based aggregation.
Schema	Integer: [0,3]
Default	1

Environment variable

Attribute	Value
Key	FELIX_FLOWLOGSFILEAGGREGATIONKINDFORDENIED
Description	Used to choose the type of aggregation for flow log entries created for denied connections. . Accepted values are 0, 1 and 2. 0 - No aggregation. 1 - Source port based aggregation. 2 - Pod prefix name based aggregation. 3 - No destination ports based aggregation.
Schema	Integer: [0,3]
Default	1

FlowLogsFileDirectory

Configuration file

Attribute	Value
Key	FlowLogsFileDirectory
Description	Sets the directory where flow logs files are stored.
Schema	String
Default	/var/log/calico/flowlogs

Environment variable

Attribute	Value
Key	FELIX_FLOWLOGSFILEDIRECTORY
Description	Sets the directory where flow logs files are stored.
Schema	String
Default	/var/log/calico/flowlogs

FlowLogsFileDomainsLimit

Configuration file

Attribute	Value
Key	FlowLogsFileDomainsLimit
Description	Used to configure the number of (destination) domains to include in the flow log. These are not included for workload or host endpoint destinations.
Schema	Integer
Default	5

Environment variable

Attribute	Value
Key	FELIX_FLOWLOGSFILEDOMAINSLIMIT
Description	Used to configure the number of (destination) domains to include in the flow log. These are not included for workload or host endpoint destinations.
Schema	Integer
Default	5

FlowLogsFileEnabled

Configuration file

Attribute	Value
Key	FlowLogsFileEnabled
Description	When set to true, enables logging flow logs to a file. If false no flow logging to file will occur.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_FLOWLOGSFILEENABLED
Description	When set to true, enables logging flow logs to a file. If false no flow logging to file will occur.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

FlowLogsFileEnabledForAllowed

Configuration file

Attribute	Value
Key	FlowLogsFileEnabledForAllowed
Description	Used to enable/disable flow logs entries created for allowed connections. Default is true. This parameter only takes effect when FlowLogsFileReporterEnabled is set to true.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

Environment variable

Attribute	Value
Key	FELIX_FLOWLOGSFILEENABLEDFORALLOWED
Description	Used to enable/disable flow logs entries created for allowed connections. Default is true. This parameter only takes effect when FlowLogsFileReporterEnabled is set to true.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

FlowLogsFileEnabledForDenied

Configuration file

Attribute	Value
Key	FlowLogsFileEnabledForDenied
Description	Used to enable/disable flow logs entries created for denied flows. Default is true. This parameter only takes effect when FlowLogsFileReporterEnabled is set to true.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

Environment variable

Attribute	Value
Key	FELIX_FLOWLOGSFILEENABLEDFORDENIED
Description	Used to enable/disable flow logs entries created for denied flows. Default is true. This parameter only takes effect when FlowLogsFileReporterEnabled is set to true.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

FlowLogsFileIncludeLabels

Configuration file

Attribute	Value
Key	FlowLogsFileIncludeLabels
Description	Used to configure if endpoint labels are included in a Flow log entry written to file.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_FLOWLOGSFILEINCLUDELABELS
Description	Used to configure if endpoint labels are included in a Flow log entry written to file.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

FlowLogsFileIncludePolicies

Configuration file

Attribute	Value
Key	FlowLogsFileIncludePolicies
Description	Used to configure if policy information are included in a Flow log entry written to file.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_FLOWLOGSFILEINCLUDEPOLICIES
Description	Used to configure if policy information are included in a Flow log entry written to file.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

FlowLogsFileIncludeService

Configuration file

Attribute	Value
Key	FlowLogsFileIncludeService
Description	Used to configure if the destination service is included in a Flow log entry written to file. The service information can only be included if the flow was explicitly determined to be directed at the service (e.g. when the pre-DNAT destination corresponds to the service ClusterIP and port).
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_FLOWLOGSFILEINCLUDESERVICE
Description	Used to configure if the destination service is included in a Flow log entry written to file. The service information can only be included if the flow was explicitly determined to be directed at the service (e.g. when the pre-DNAT destination corresponds to the service ClusterIP and port).
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

FlowLogsFileMaxFileSizeMB

Configuration file

Attribute	Value
Key	FlowLogsFileMaxFileSizeMB
Description	Sets the max size in MB of flow logs files before rotation.
Schema	Integer
Default	100

Environment variable

Attribute	Value
Key	FELIX_FLOWLOGSFILEMAXFILESIZEMB
Description	Sets the max size in MB of flow logs files before rotation.
Schema	Integer
Default	100

FlowLogsFileMaxFiles

Configuration file

Attribute	Value
Key	FlowLogsFileMaxFiles
Description	Sets the number of log files to keep.
Schema	Integer
Default	5

Environment variable

Attribute	Value
Key	FELIX_FLOWLOGSFILEMAXFILES
Description	Sets the number of log files to keep.
Schema	Integer
Default	5

FlowLogsFileNatOutgoingPortLimit

Configuration file

Attribute	Value
Key	FlowLogsFileNatOutgoingPortLimit
Description	Used to specify the maximum number of distinct post SNAT ports that will appear in the flowLogs. Default value is 3.
Schema	Integer
Default	3

Environment variable

Attribute	Value
Key	FELIX_FLOWLOGSFILENATOUTGOINGPORTLIMIT
Description	Used to specify the maximum number of distinct post SNAT ports that will appear in the flowLogs. Default value is 3.
Schema	Integer
Default	3

FlowLogsFilePerFlowProcessArgsLimit

Configuration file

Attribute	Value
Key	FlowLogsFilePerFlowProcessArgsLimit
Description	Used to specify the maximum number of distinct process args that will appear in the flowLogs. Default value is 5.
Schema	Integer
Default	5

Environment variable

Attribute	Value
Key	FELIX_FLOWLOGSFILEPERFLOWPROCESSARGSLIMIT
Description	Used to specify the maximum number of distinct process args that will appear in the flowLogs. Default value is 5.
Schema	Integer
Default	5

FlowLogsFilePerFlowProcessLimit

Configuration file

Attribute	Value
Key	FlowLogsFilePerFlowProcessLimit
Description	Used to specify the maximum number of flow log entries with distinct process information beyond which process information will be aggregated.
Schema	Integer
Default	2

Environment variable

Attribute	Value
Key	FELIX_FLOWLOGSFILEPERFLOWPROCESSLIMIT
Description	Used to specify the maximum number of flow log entries with distinct process information beyond which process information will be aggregated.
Schema	Integer
Default	2

FlowLogsFlushInterval

Configuration file

Attribute	Value
Key	FlowLogsFlushInterval
Description	Configures the interval at which Felix exports flow logs.
Schema	Seconds (floating point)
Default	300 (5m0s)

Environment variable

Attribute	Value
Key	FELIX_FLOWLOGSFLUSHINTERVAL
Description	Configures the interval at which Felix exports flow logs.
Schema	Seconds (floating point)
Default	300 (5m0s)

FlowLogsGoldmaneServer

Configuration file

Attribute	Value
Key	FlowLogsGoldmaneServer
Description	FlowLogGoldmaneServer is the flow server endpoint to which flow data should be published.
Schema	String
Default	none

Environment variable

Attribute	Value
Key	FELIX_FLOWLOGSGOLDMANESERVER
Description	FlowLogGoldmaneServer is the flow server endpoint to which flow data should be published.
Schema	String
Default	none

FlowLogsMaxOriginalIPsIncluded

Configuration file

Attribute	Value
Key	FlowLogsMaxOriginalIPsIncluded
Description	Specifies the number of unique IP addresses (if relevant) that should be included in Flow logs.
Schema	Integer
Default	50

Environment variable

Attribute	Value
Key	FELIX_FLOWLOGSMAXORIGINALIPSINCLUDED
Description	Specifies the number of unique IP addresses (if relevant) that should be included in Flow logs.
Schema	Integer
Default	50

FlowLogsPolicyEvaluationMode

Configuration file

Attribute	Value
Key	FlowLogsPolicyEvaluationMode
Description	Defines how policies are evaluated and reflected in flow logs. OnNewConnection - In this mode, staged policies are only evaluated when new connections are made in the dataplane. Staged/active policy changes will not be reflected in the pending_policies field of flow logs for long lived connections. Continuous - Felix evaluates active flows on a regular basis to determine the rule traces in the flow logs. Any policy updates that impact a flow will be reflected in the pending_policies field, offering a near-real-time view of policy changes across flows.
Schema	One of: Continuous, OnNewConnection (case insensitive)
Default	Continuous

Environment variable

Attribute	Value
Key	FELIX_FLOWLOGSPOLICYEVALUATIONMODE
Description	Defines how policies are evaluated and reflected in flow logs. OnNewConnection - In this mode, staged policies are only evaluated when new connections are made in the dataplane. Staged/active policy changes will not be reflected in the pending_policies field of flow logs for long lived connections. Continuous - Felix evaluates active flows on a regular basis to determine the rule traces in the flow logs. Any policy updates that impact a flow will be reflected in the pending_policies field, offering a near-real-time view of policy changes across flows.
Schema	One of: Continuous, OnNewConnection (case insensitive)
Default	Continuous

FlowLogsPolicyScope

Configuration file

Attribute	Value
Key	FlowLogsPolicyScope
Description	Controls which policies are included in flow logs. AllPolicies - Processes both transit policies for the local node and endpoint policies derived from packet source/destination IPs. Provides comprehensive visibility into all policy evaluations but increases log volume. EndpointPolicies - Processes only policies for endpoints identified as the source or destination of the packet (whether workload or host endpoints).
Schema	One of: AllPolicies, EndpointPolicies (case insensitive)
Default	EndpointPolicies

Environment variable

Attribute	Value
Key	FELIX_FLOWLOGSPOLICYSCOPE
Description	Controls which policies are included in flow logs. AllPolicies - Processes both transit policies for the local node and endpoint policies derived from packet source/destination IPs. Provides comprehensive visibility into all policy evaluations but increases log volume. EndpointPolicies - Processes only policies for endpoints identified as the source or destination of the packet (whether workload or host endpoints).
Schema	One of: AllPolicies, EndpointPolicies (case insensitive)
Default	EndpointPolicies

FlowLogsPositionFilePath

Configuration file

Attribute	Value
Key	FlowLogsPositionFilePath
Description	Used specify the position of the external pipeline that reads flow logs. Default is /var/log/calico/flows.log.pos. This parameter only takes effect when FlowLogsDynamicAggregationEnabled is set to true.
Schema	String
Default	/var/log/calico/flows.log.pos

Environment variable

Attribute	Value
Key	FELIX_FLOWLOGSPOSITIONFILEPATH
Description	Used specify the position of the external pipeline that reads flow logs. Default is /var/log/calico/flows.log.pos. This parameter only takes effect when FlowLogsDynamicAggregationEnabled is set to true.
Schema	String
Default	/var/log/calico/flows.log.pos

DNS logs / policy

DNSCacheEpoch

Configuration file

Attribute	Value
Key	DNSCacheEpoch
Description	An arbitrary number that can be changed, at runtime, to tell Felix to discard all its learnt DNS information. .
Schema	Integer
Default	0

Environment variable

Attribute	Value
Key	FELIX_DNSCACHEEPOCH
Description	An arbitrary number that can be changed, at runtime, to tell Felix to discard all its learnt DNS information. .
Schema	Integer
Default	0

DNSCacheFile

Configuration file

Attribute	Value
Key	DNSCacheFile
Description	The name of the file that Felix uses to preserve learnt DNS information when restarting. .
Schema	Path to file
Default	/var/run/calico/felix-dns-cache.txt

Environment variable

Attribute	Value
Key	FELIX_DNSCACHEFILE
Description	The name of the file that Felix uses to preserve learnt DNS information when restarting. .
Schema	Path to file
Default	/var/run/calico/felix-dns-cache.txt

DNSCacheSaveInterval

Configuration file

Attribute	Value
Key	DNSCacheSaveInterval
Description	The periodic interval at which Felix saves learnt DNS information to the cache file. .
Schema	Seconds (floating point)
Default	60 (1m0s)

Environment variable

Attribute	Value
Key	FELIX_DNSCACHESAVEINTERVAL
Description	The periodic interval at which Felix saves learnt DNS information to the cache file. .
Schema	Seconds (floating point)
Default	60 (1m0s)

DNSExtraTTL

Configuration file

Attribute	Value
Key	DNSExtraTTL
Description	Extra time to keep IPs and alias names that are learnt from DNS, in addition to each name or IP's advertised TTL. .
Schema	Seconds (floating point)
Default	0 (0s)

Environment variable

Attribute	Value
Key	FELIX_DNSEXTRATTL
Description	Extra time to keep IPs and alias names that are learnt from DNS, in addition to each name or IP's advertised TTL. .
Schema	Seconds (floating point)
Default	0 (0s)

DNSLogsFileAggregationKind

Configuration file

Attribute	Value
Key	DNSLogsFileAggregationKind
Description	Used to choose the type of aggregation for DNS log entries. . Accepted values are 0 and 1. 0 - No aggregation. 1 - Aggregate over clients with the same name prefix.
Schema	Integer: [0,1]
Default	1

Environment variable

Attribute	Value
Key	FELIX_DNSLOGSFILEAGGREGATIONKIND
Description	Used to choose the type of aggregation for DNS log entries. . Accepted values are 0 and 1. 0 - No aggregation. 1 - Aggregate over clients with the same name prefix.
Schema	Integer: [0,1]
Default	1

DNSLogsFileDirectory

Configuration file

Attribute	Value
Key	DNSLogsFileDirectory
Description	Sets the directory where DNS log files are stored.
Schema	String
Default	/var/log/calico/dnslogs

Environment variable

Attribute	Value
Key	FELIX_DNSLOGSFILEDIRECTORY
Description	Sets the directory where DNS log files are stored.
Schema	String
Default	/var/log/calico/dnslogs

DNSLogsFileEnabled

Configuration file

Attribute	Value
Key	DNSLogsFileEnabled
Description	Controls logging DNS logs to a file. If false no DNS logging to file will occur.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_DNSLOGSFILEENABLED
Description	Controls logging DNS logs to a file. If false no DNS logging to file will occur.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

DNSLogsFileIncludeLabels

Configuration file

Attribute	Value
Key	DNSLogsFileIncludeLabels
Description	Used to configure if endpoint labels are included in a DNS log entry written to file.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

Environment variable

Attribute	Value
Key	FELIX_DNSLOGSFILEINCLUDELABELS
Description	Used to configure if endpoint labels are included in a DNS log entry written to file.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

DNSLogsFileMaxFileSizeMB

Configuration file

Attribute	Value
Key	DNSLogsFileMaxFileSizeMB
Description	Sets the max size in MB of DNS log files before rotation.
Schema	Integer
Default	100

Environment variable

Attribute	Value
Key	FELIX_DNSLOGSFILEMAXFILESIZEMB
Description	Sets the max size in MB of DNS log files before rotation.
Schema	Integer
Default	100

DNSLogsFileMaxFiles

Configuration file

Attribute	Value
Key	DNSLogsFileMaxFiles
Description	Sets the number of DNS log files to keep.
Schema	Integer
Default	5

Environment variable

Attribute	Value
Key	FELIX_DNSLOGSFILEMAXFILES
Description	Sets the number of DNS log files to keep.
Schema	Integer
Default	5

DNSLogsFilePerNodeLimit

Configuration file

Attribute	Value
Key	DNSLogsFilePerNodeLimit
Description	Limit on the number of DNS logs that can be emitted within each flush interval. When this limit has been reached, Felix counts the number of unloggable DNS responses within the flush interval, and emits a WARNING log with that count at the same time as it flushes the buffered DNS logs.
Schema	Integer
Default	0

Environment variable

Attribute	Value
Key	FELIX_DNSLOGSFILEPERNODELIMIT
Description	Limit on the number of DNS logs that can be emitted within each flush interval. When this limit has been reached, Felix counts the number of unloggable DNS responses within the flush interval, and emits a WARNING log with that count at the same time as it flushes the buffered DNS logs.
Schema	Integer
Default	0

DNSLogsFlushInterval

Configuration file

Attribute	Value
Key	DNSLogsFlushInterval
Description	Configures the interval at which Felix exports DNS logs.
Schema	Seconds (floating point)
Default	300 (5m0s)

Environment variable

Attribute	Value
Key	FELIX_DNSLOGSFLUSHINTERVAL
Description	Configures the interval at which Felix exports DNS logs.
Schema	Seconds (floating point)
Default	300 (5m0s)

DNSLogsLatency

Configuration file

Attribute	Value
Key	DNSLogsLatency
Description	Indicates to include measurements of DNS request/response latency in each DNS log.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

Environment variable

Attribute	Value
Key	FELIX_DNSLOGSLATENCY
Description	Indicates to include measurements of DNS request/response latency in each DNS log.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

DNSPacketsNfqueueID

Configuration file

Attribute	Value
Key	DNSPacketsNfqueueID
Description	The NFQUEUE ID to use for capturing DNS packets to ensure programming IPSets occurs before the response is released. Used when DNSPolicyMode is DelayDNSResponse.
Schema	Integer
Default	101

Environment variable

Attribute	Value
Key	FELIX_DNSPACKETSNFQUEUEID
Description	The NFQUEUE ID to use for capturing DNS packets to ensure programming IPSets occurs before the response is released. Used when DNSPolicyMode is DelayDNSResponse.
Schema	Integer
Default	101

DNSPacketsNfqueueMaxHoldDuration

Configuration file

Attribute	Value
Key	DNSPacketsNfqueueMaxHoldDuration
Description	The max length of time to hold on to a DNS response while waiting for the the dataplane to be programmed. Used when DNSPolicyMode is DelayDNSResponse.
Schema	Milliseconds (floating point)
Default	3000 (3s)

Environment variable

Attribute	Value
Key	FELIX_DNSPACKETSNFQUEUEMAXHOLDDURATION
Description	The max length of time to hold on to a DNS response while waiting for the the dataplane to be programmed. Used when DNSPolicyMode is DelayDNSResponse.
Schema	Milliseconds (floating point)
Default	3000 (3s)

DNSPacketsNfqueueSize

Configuration file

Attribute	Value
Key	DNSPacketsNfqueueSize
Description	The size of the NFQUEUE for captured DNS packets. This is the maximum number of DNS packets that may be queued awaiting programming in the dataplane. Used when DNSPolicyMode is DelayDNSResponse.
Schema	Integer
Default	100

Environment variable

Attribute	Value
Key	FELIX_DNSPACKETSNFQUEUESIZE
Description	The size of the NFQUEUE for captured DNS packets. This is the maximum number of DNS packets that may be queued awaiting programming in the dataplane. Used when DNSPolicyMode is DelayDNSResponse.
Schema	Integer
Default	100

DNSPolicyMode

Configuration file

Attribute	Value
Key	DNSPolicyMode
Description	Specifies how DNS policy programming will be handled. DelayDeniedPacket - Felix delays any denied packet that traversed a policy that included egress domain matches, but did not match. The packet is released after a fixed time, or after the destination IP address was programmed. DelayDNSResponse - Felix delays any DNS response until related IPSets are programmed. This introduces some latency to all DNS packets (even when no IPSet programming is required), but it ensures policy hit statistics are accurate. This is the recommended setting when you are making use of staged policies or policy rule hit statistics. NoDelay - Felix does not introduce any delay to the packets. DNS rules may not have been programmed by the time the first packet traverses the policy rules. Client applications need to handle reconnection attempts if initial connection attempts fail. This may be problematic for some applications or for very low DNS TTLs. Inline - Parses DNS response inline with DNS response packet processing within IPTables. This guarantees the DNS rules reflect any change immediately. This mode works for iptables only and matches the same mode for BPFDNSPolicyMode. This setting is ignored on Windows and "NoDelay" is always used. This setting is ignored by eBPF and BPFDNSPolicyMode is used instead. This field has no effect in NFTables mode. Please use NFTablesDNSPolicyMode instead.
Schema	One of: DelayDNSResponse, DelayDeniedPacket, Inline, NoDelay (case insensitive)
Default	DelayDeniedPacket

Environment variable

Attribute	Value
Key	FELIX_DNSPOLICYMODE
Description	Specifies how DNS policy programming will be handled. DelayDeniedPacket - Felix delays any denied packet that traversed a policy that included egress domain matches, but did not match. The packet is released after a fixed time, or after the destination IP address was programmed. DelayDNSResponse - Felix delays any DNS response until related IPSets are programmed. This introduces some latency to all DNS packets (even when no IPSet programming is required), but it ensures policy hit statistics are accurate. This is the recommended setting when you are making use of staged policies or policy rule hit statistics. NoDelay - Felix does not introduce any delay to the packets. DNS rules may not have been programmed by the time the first packet traverses the policy rules. Client applications need to handle reconnection attempts if initial connection attempts fail. This may be problematic for some applications or for very low DNS TTLs. Inline - Parses DNS response inline with DNS response packet processing within IPTables. This guarantees the DNS rules reflect any change immediately. This mode works for iptables only and matches the same mode for BPFDNSPolicyMode. This setting is ignored on Windows and "NoDelay" is always used. This setting is ignored by eBPF and BPFDNSPolicyMode is used instead. This field has no effect in NFTables mode. Please use NFTablesDNSPolicyMode instead.
Schema	One of: DelayDNSResponse, DelayDeniedPacket, Inline, NoDelay (case insensitive)
Default	DelayDeniedPacket

DNSPolicyNfqueueID

Configuration file

Attribute	Value
Key	DNSPolicyNfqueueID
Description	The NFQUEUE ID to use for DNS Policy re-evaluation when the domains IP hasn't been programmed to ipsets yet. Used when DNSPolicyMode is DelayDeniedPacket.
Schema	Integer
Default	100

Environment variable

Attribute	Value
Key	FELIX_DNSPOLICYNFQUEUEID
Description	The NFQUEUE ID to use for DNS Policy re-evaluation when the domains IP hasn't been programmed to ipsets yet. Used when DNSPolicyMode is DelayDeniedPacket.
Schema	Integer
Default	100

DNSPolicyNfqueueSize

Configuration file

Attribute	Value
Key	DNSPolicyNfqueueSize
Description	DNSPolicyNfqueueID is the size of the NFQUEUE for DNS policy re-evaluation. This is the maximum number of denied packets that may be queued up pending re-evaluation. Used when DNSPolicyMode is DelayDeniedPacket.
Schema	Integer
Default	255

Environment variable

Attribute	Value
Key	FELIX_DNSPOLICYNFQUEUESIZE
Description	DNSPolicyNfqueueID is the size of the NFQUEUE for DNS policy re-evaluation. This is the maximum number of denied packets that may be queued up pending re-evaluation. Used when DNSPolicyMode is DelayDeniedPacket.
Schema	Integer
Default	255

DNSTrustedServers

Configuration file

Attribute	Value
Key	DNSTrustedServers
Description	The DNS servers that Felix should trust. Each entry here must be <ip>[:<port>] - indicating an explicit DNS server IP - or k8s-service:[<namespace>/]<name>[:port] - indicating a Kubernetes DNS service. <port> defaults to the first service port, or 53 for an IP, and <namespace> to kube-system. An IPv6 address with a port must use the square brackets convention, for example [fd00:83a6::12]:5353.Note that Felix (calico-node) will need RBAC permission to read the details of each service specified by a k8s-service:... form. .
Schema	Comma-delimited list of DNS servers. Each entry can be: <IP address>, an <IP address>:<port> (IPv6 addresses must be wrapped in square brackets), or, a Kubernetes service name k8s-service:(namespace/)service-name.
Default	k8s-service:kube-dns

Environment variable

Attribute	Value
Key	FELIX_DNSTRUSTEDSERVERS
Description	The DNS servers that Felix should trust. Each entry here must be <ip>[:<port>] - indicating an explicit DNS server IP - or k8s-service:[<namespace>/]<name>[:port] - indicating a Kubernetes DNS service. <port> defaults to the first service port, or 53 for an IP, and <namespace> to kube-system. An IPv6 address with a port must use the square brackets convention, for example [fd00:83a6::12]:5353.Note that Felix (calico-node) will need RBAC permission to read the details of each service specified by a k8s-service:... form. .
Schema	Comma-delimited list of DNS servers. Each entry can be: <IP address>, an <IP address>:<port> (IPv6 addresses must be wrapped in square brackets), or, a Kubernetes service name k8s-service:(namespace/)service-name.
Default	k8s-service:kube-dns

L7 logs

L7LogsFileAggregationDestinationInfo

Configuration file

Attribute	Value
Key	L7LogsFileAggregationDestinationInfo
Description	Used to choose the type of aggregation for the destination metadata on L7 log entries. . Accepted values are IncludeL7DestinationInfo and ExcludeL7DestinationInfo. IncludeL7DestinationInfo - Include destination metadata in the logs. ExcludeL7DestinationInfo - Aggregate over all other fields ignoring the destination aggregated name, namespace, and type.
Schema	String
Default	IncludeL7DestinationInfo

Environment variable

Attribute	Value
Key	FELIX_L7LOGSFILEAGGREGATIONDESTINATIONINFO
Description	Used to choose the type of aggregation for the destination metadata on L7 log entries. . Accepted values are IncludeL7DestinationInfo and ExcludeL7DestinationInfo. IncludeL7DestinationInfo - Include destination metadata in the logs. ExcludeL7DestinationInfo - Aggregate over all other fields ignoring the destination aggregated name, namespace, and type.
Schema	String
Default	IncludeL7DestinationInfo

L7LogsFileAggregationHTTPHeaderInfo

Configuration file

Attribute	Value
Key	L7LogsFileAggregationHTTPHeaderInfo
Description	Used to choose the type of aggregation for HTTP header data on L7 log entries. . Accepted values are IncludeL7HTTPHeaderInfo and ExcludeL7HTTPHeaderInfo. IncludeL7HTTPHeaderInfo - Include HTTP header data in the logs. ExcludeL7HTTPHeaderInfo - Aggregate over all other fields ignoring the user agent and log type.
Schema	String
Default	ExcludeL7HTTPHeaderInfo

Environment variable

Attribute	Value
Key	FELIX_L7LOGSFILEAGGREGATIONHTTPHEADERINFO
Description	Used to choose the type of aggregation for HTTP header data on L7 log entries. . Accepted values are IncludeL7HTTPHeaderInfo and ExcludeL7HTTPHeaderInfo. IncludeL7HTTPHeaderInfo - Include HTTP header data in the logs. ExcludeL7HTTPHeaderInfo - Aggregate over all other fields ignoring the user agent and log type.
Schema	String
Default	ExcludeL7HTTPHeaderInfo

L7LogsFileAggregationHTTPMethod

Configuration file

Attribute	Value
Key	L7LogsFileAggregationHTTPMethod
Description	Used to choose the type of aggregation for the HTTP request method on L7 log entries. . Accepted values are IncludeL7HTTPMethod and ExcludeL7HTTPMethod. IncludeL7HTTPMethod - Include HTTP method in the logs. ExcludeL7HTTPMethod - Aggregate over all other fields ignoring the HTTP method.
Schema	String
Default	IncludeL7HTTPMethod

Environment variable

Attribute	Value
Key	FELIX_L7LOGSFILEAGGREGATIONHTTPMETHOD
Description	Used to choose the type of aggregation for the HTTP request method on L7 log entries. . Accepted values are IncludeL7HTTPMethod and ExcludeL7HTTPMethod. IncludeL7HTTPMethod - Include HTTP method in the logs. ExcludeL7HTTPMethod - Aggregate over all other fields ignoring the HTTP method.
Schema	String
Default	IncludeL7HTTPMethod

L7LogsFileAggregationNumURLPath

Configuration file

Attribute	Value
Key	L7LogsFileAggregationNumURLPath
Description	Used to choose the number of components in the url path to display. This allows for the url to be truncated in case parts of the path provide no value. Setting this value to negative will allow all parts of the path to be displayed. .
Schema	Integer
Default	5

Environment variable

Attribute	Value
Key	FELIX_L7LOGSFILEAGGREGATIONNUMURLPATH
Description	Used to choose the number of components in the url path to display. This allows for the url to be truncated in case parts of the path provide no value. Setting this value to negative will allow all parts of the path to be displayed. .
Schema	Integer
Default	5

L7LogsFileAggregationResponseCode

Configuration file

Attribute	Value
Key	L7LogsFileAggregationResponseCode
Description	Used to choose the type of aggregation for the response code on L7 log entries. . Accepted values are IncludeL7ResponseCode and ExcludeL7ResponseCode. IncludeL7ResponseCode - Include the response code in the logs. ExcludeL7ResponseCode - Aggregate over all other fields ignoring the response code.
Schema	String
Default	IncludeL7ResponseCode

Environment variable

Attribute	Value
Key	FELIX_L7LOGSFILEAGGREGATIONRESPONSECODE
Description	Used to choose the type of aggregation for the response code on L7 log entries. . Accepted values are IncludeL7ResponseCode and ExcludeL7ResponseCode. IncludeL7ResponseCode - Include the response code in the logs. ExcludeL7ResponseCode - Aggregate over all other fields ignoring the response code.
Schema	String
Default	IncludeL7ResponseCode

L7LogsFileAggregationServiceInfo

Configuration file

Attribute	Value
Key	L7LogsFileAggregationServiceInfo
Description	Used to choose the type of aggregation for the service data on L7 log entries. . Accepted values are IncludeL7ServiceInfo and ExcludeL7ServiceInfo. IncludeL7ServiceInfo - Include service data in the logs. ExcludeL7ServiceInfo - Aggregate over all other fields ignoring the service name, namespace, and port.
Schema	String
Default	IncludeL7ServiceInfo

Environment variable

Attribute	Value
Key	FELIX_L7LOGSFILEAGGREGATIONSERVICEINFO
Description	Used to choose the type of aggregation for the service data on L7 log entries. . Accepted values are IncludeL7ServiceInfo and ExcludeL7ServiceInfo. IncludeL7ServiceInfo - Include service data in the logs. ExcludeL7ServiceInfo - Aggregate over all other fields ignoring the service name, namespace, and port.
Schema	String
Default	IncludeL7ServiceInfo

L7LogsFileAggregationSourceInfo

Configuration file

Attribute	Value
Key	L7LogsFileAggregationSourceInfo
Description	L7LogsFileAggregationExcludeSourceInfo is used to choose the type of aggregation for the source metadata on L7 log entries. . Accepted values are IncludeL7SourceInfo, IncludeL7SourceInfoNoPort, and ExcludeL7SourceInfo. IncludeL7SourceInfo - Include source metadata in the logs. IncludeL7SourceInfoNoPort - Include source metadata in the logs excluding the source port. ExcludeL7SourceInfo - Aggregate over all other fields ignoring the source aggregated name, namespace, and type.
Schema	String
Default	IncludeL7SourceInfoNoPort

Environment variable

Attribute	Value
Key	FELIX_L7LOGSFILEAGGREGATIONSOURCEINFO
Description	L7LogsFileAggregationExcludeSourceInfo is used to choose the type of aggregation for the source metadata on L7 log entries. . Accepted values are IncludeL7SourceInfo, IncludeL7SourceInfoNoPort, and ExcludeL7SourceInfo. IncludeL7SourceInfo - Include source metadata in the logs. IncludeL7SourceInfoNoPort - Include source metadata in the logs excluding the source port. ExcludeL7SourceInfo - Aggregate over all other fields ignoring the source aggregated name, namespace, and type.
Schema	String
Default	IncludeL7SourceInfoNoPort

L7LogsFileAggregationTrimURL

Configuration file

Attribute	Value
Key	L7LogsFileAggregationTrimURL
Description	Used to choose the type of aggregation for the url on L7 log entries. . Accepted values: IncludeL7FullURL - Include the full URL up to however many path components are allowed by L7LogsFileAggregationNumURLPath. TrimURLQuery - Aggregate over all other fields ignoring the query parameters on the URL. TrimURLQueryAndPath - Aggregate over all other fields and the base URL only. ExcludeL7URL - Aggregate over all other fields ignoring the URL entirely.
Schema	String
Default	IncludeL7FullURL

Environment variable

Attribute	Value
Key	FELIX_L7LOGSFILEAGGREGATIONTRIMURL
Description	Used to choose the type of aggregation for the url on L7 log entries. . Accepted values: IncludeL7FullURL - Include the full URL up to however many path components are allowed by L7LogsFileAggregationNumURLPath. TrimURLQuery - Aggregate over all other fields ignoring the query parameters on the URL. TrimURLQueryAndPath - Aggregate over all other fields and the base URL only. ExcludeL7URL - Aggregate over all other fields ignoring the URL entirely.
Schema	String
Default	IncludeL7FullURL

L7LogsFileAggregationURLCharLimit

Configuration file

Attribute	Value
Key	L7LogsFileAggregationURLCharLimit
Description	Limit on the length of the URL collected in L7 logs. When a URL length reaches this limit it is sliced off, and the sliced URL is sent to log storage.
Schema	Integer
Default	250

Environment variable

Attribute	Value
Key	FELIX_L7LOGSFILEAGGREGATIONURLCHARLIMIT
Description	Limit on the length of the URL collected in L7 logs. When a URL length reaches this limit it is sliced off, and the sliced URL is sent to log storage.
Schema	Integer
Default	250

L7LogsFileDirectory

Configuration file

Attribute	Value
Key	L7LogsFileDirectory
Description	Sets the directory where L7 log files are stored.
Schema	String
Default	/var/log/calico/l7logs

Environment variable

Attribute	Value
Key	FELIX_L7LOGSFILEDIRECTORY
Description	Sets the directory where L7 log files are stored.
Schema	String
Default	/var/log/calico/l7logs

L7LogsFileEnabled

Configuration file

Attribute	Value
Key	L7LogsFileEnabled
Description	Controls logging L7 logs to a file. If false no L7 logging to file will occur.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

Environment variable

Attribute	Value
Key	FELIX_L7LOGSFILEENABLED
Description	Controls logging L7 logs to a file. If false no L7 logging to file will occur.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

L7LogsFileMaxFileSizeMB

Configuration file

Attribute	Value
Key	L7LogsFileMaxFileSizeMB
Description	Sets the max size in MB of L7 log files before rotation.
Schema	Integer
Default	100

Environment variable

Attribute	Value
Key	FELIX_L7LOGSFILEMAXFILESIZEMB
Description	Sets the max size in MB of L7 log files before rotation.
Schema	Integer
Default	100

L7LogsFileMaxFiles

Configuration file

Attribute	Value
Key	L7LogsFileMaxFiles
Description	Sets the number of L7 log files to keep.
Schema	Integer
Default	5

Environment variable

Attribute	Value
Key	FELIX_L7LOGSFILEMAXFILES
Description	Sets the number of L7 log files to keep.
Schema	Integer
Default	5

L7LogsFilePerNodeLimit

Configuration file

Attribute	Value
Key	L7LogsFilePerNodeLimit
Description	Limit on the number of L7 logs that can be emitted within each flush interval. When this limit has been reached, Felix counts the number of unloggable L7 responses within the flush interval, and emits a WARNING log with that count at the same time as it flushes the buffered L7 logs. A value of 0 means no limit.
Schema	Integer
Default	1500

Environment variable

Attribute	Value
Key	FELIX_L7LOGSFILEPERNODELIMIT
Description	Limit on the number of L7 logs that can be emitted within each flush interval. When this limit has been reached, Felix counts the number of unloggable L7 responses within the flush interval, and emits a WARNING log with that count at the same time as it flushes the buffered L7 logs. A value of 0 means no limit.
Schema	Integer
Default	1500

L7LogsFlushInterval

Configuration file

Attribute	Value
Key	L7LogsFlushInterval
Description	Configures the interval at which Felix exports L7 logs.
Schema	Seconds (floating point)
Default	300 (5m0s)

Environment variable

Attribute	Value
Key	FELIX_L7LOGSFLUSHINTERVAL
Description	Configures the interval at which Felix exports L7 logs.
Schema	Seconds (floating point)
Default	300 (5m0s)

AWS integration

AWSRequestTimeout

Configuration file

Attribute	Value
Key	AWSRequestTimeout
Description	The timeout on AWS API requests.
Schema	Seconds (floating point)
Default	30 (30s)

Environment variable

Attribute	Value
Key	FELIX_AWSREQUESTTIMEOUT
Description	The timeout on AWS API requests.
Schema	Seconds (floating point)
Default	30 (30s)

AWSSecondaryIPRoutingRulePriority

Configuration file

Attribute	Value
Key	AWSSecondaryIPRoutingRulePriority
Description	Controls the priority that Felix will use for routing rules when programming them for AWS Secondary IP support.
Schema	Integer: [0,4294967295]
Default	101

Environment variable

Attribute	Value
Key	FELIX_AWSSECONDARYIPROUTINGRULEPRIORITY
Description	Controls the priority that Felix will use for routing rules when programming them for AWS Secondary IP support.
Schema	Integer: [0,4294967295]
Default	101

AWSSecondaryIPSupport

Configuration file

Attribute	Value
Key	AWSSecondaryIPSupport
Description	Controls whether Felix will try to provision AWS secondary ENIs for workloads that have IPs from IP pools that are configured with an AWS subnet ID. If the field is set to "EnabledENIPerWorkload" then each workload with an AWS-backed IP will be assigned its own secondary ENI. If set to "Enabled" then each workload with an AWS-backed IP pool will be allocated a secondary IP address on a secondary ENI; this mode requires additional IP pools to be provisioned for the host to claim IPs for the primary IP of the secondary ENIs. Accepted value must be one of "Enabled", "EnabledENIPerWorkload" or "Disabled".
Schema	One of: Disabled, EnabledENIPerWorkload, Enabled (case insensitive)
Default	Disabled

Environment variable

Attribute	Value
Key	FELIX_AWSSECONDARYIPSUPPORT
Description	Controls whether Felix will try to provision AWS secondary ENIs for workloads that have IPs from IP pools that are configured with an AWS subnet ID. If the field is set to "EnabledENIPerWorkload" then each workload with an AWS-backed IP will be assigned its own secondary ENI. If set to "Enabled" then each workload with an AWS-backed IP pool will be allocated a secondary IP address on a secondary ENI; this mode requires additional IP pools to be provisioned for the host to claim IPs for the primary IP of the secondary ENIs. Accepted value must be one of "Enabled", "EnabledENIPerWorkload" or "Disabled".
Schema	One of: Disabled, EnabledENIPerWorkload, Enabled (case insensitive)
Default	Disabled

AWSSrcDstCheck

Configuration file

Attribute	Value
Key	AWSSrcDstCheck
Description	Controls whether Felix will try to change the "source/dest check" setting on the EC2 instance on which it is running. A value of "Disable" will try to disable the source/dest check. Disabling the check allows for sending workload traffic without encapsulation within the same AWS subnet.
Schema	One of: Disable, DoNothing, Enable (case insensitive)
Default	DoNothing

Environment variable

Attribute	Value
Key	FELIX_AWSSRCDSTCHECK
Description	Controls whether Felix will try to change the "source/dest check" setting on the EC2 instance on which it is running. A value of "Disable" will try to disable the source/dest check. Disabling the check allows for sending workload traffic without encapsulation within the same AWS subnet.
Schema	One of: Disable, DoNothing, Enable (case insensitive)
Default	DoNothing

Egress gateway

EgressGatewayPollFailureCount

Configuration file

Attribute	Value
Key	EgressGatewayPollFailureCount
Description	The minimum number of poll failures before a remote Egress Gateway is considered to have failed.
Schema	Integer
Default	3

Environment variable

Attribute	Value
Key	FELIX_EGRESSGATEWAYPOLLFAILURECOUNT
Description	The minimum number of poll failures before a remote Egress Gateway is considered to have failed.
Schema	Integer
Default	3

EgressGatewayPollInterval

Configuration file

Attribute	Value
Key	EgressGatewayPollInterval
Description	The interval at which Felix will poll remote egress gateways to check their health. Only Egress Gateways with a named "health" port will be polled in this way. Egress Gateways that fail the health check will be taken our of use as if they have been deleted.
Schema	Seconds (floating point)
Default	10 (10s)

Environment variable

Attribute	Value
Key	FELIX_EGRESSGATEWAYPOLLINTERVAL
Description	The interval at which Felix will poll remote egress gateways to check their health. Only Egress Gateways with a named "health" port will be polled in this way. Egress Gateways that fail the health check will be taken our of use as if they have been deleted.
Schema	Seconds (floating point)
Default	10 (10s)

EgressIPHostIfacePattern

Configuration file

Attribute	Value
Key	EgressIPHostIfacePattern
Description	A comma-separated list of interface names which might send and receive egress traffic across the cluster boundary, after it has left an Egress Gateway pod. Felix will ensure src_valid_mark sysctl flags are set correctly for matching interfaces. To target multiple interfaces with a single string, the list supports regular expressions. For regular expressions, wrap the value with /. Example: /^bond/,eth0 will match all interfaces that begin with bond and also the interface eth0.
Schema	Comma-delimited list of Linux interface names/regex patterns. Regex patterns must start/end with /.
Default	none

Environment variable

Attribute	Value
Key	FELIX_EGRESSIPHOSTIFACEPATTERN
Description	A comma-separated list of interface names which might send and receive egress traffic across the cluster boundary, after it has left an Egress Gateway pod. Felix will ensure src_valid_mark sysctl flags are set correctly for matching interfaces. To target multiple interfaces with a single string, the list supports regular expressions. For regular expressions, wrap the value with /. Example: /^bond/,eth0 will match all interfaces that begin with bond and also the interface eth0.
Schema	Comma-delimited list of Linux interface names/regex patterns. Regex patterns must start/end with /.
Default	none

EgressIPRoutingRulePriority

Configuration file

Attribute	Value
Key	EgressIPRoutingRulePriority
Description	Controls the priority value to use for the egress IP routing rule.
Schema	Integer
Default	100

Environment variable

Attribute	Value
Key	FELIX_EGRESSIPROUTINGRULEPRIORITY
Description	Controls the priority value to use for the egress IP routing rule.
Schema	Integer
Default	100

EgressIPSupport

Configuration file

Attribute	Value
Key	EgressIPSupport
Description	Defines three different support modes for egress IP function. - Disabled: Egress IP function is disabled. - EnabledPerNamespace: Egress IP function is enabled and can be configured on a per-namespace basis; per-pod egress annotations are ignored. - EnabledPerNamespaceOrPerPod: Egress IP function is enabled and can be configured per-namespace or per-pod, with per-pod egress annotations overriding namespace annotations.
Schema	One of: Disabled, EnabledPerNamespaceOrPerPod, EnabledPerNamespace (case insensitive)
Default	Disabled

Environment variable

Attribute	Value
Key	FELIX_EGRESSIPSUPPORT
Description	Defines three different support modes for egress IP function. - Disabled: Egress IP function is disabled. - EnabledPerNamespace: Egress IP function is enabled and can be configured on a per-namespace basis; per-pod egress annotations are ignored. - EnabledPerNamespaceOrPerPod: Egress IP function is enabled and can be configured per-namespace or per-pod, with per-pod egress annotations overriding namespace annotations.
Schema	One of: Disabled, EnabledPerNamespaceOrPerPod, EnabledPerNamespace (case insensitive)
Default	Disabled

EgressIPVXLANPort

Configuration file

Attribute	Value
Key	EgressIPVXLANPort
Description	The port number of vxlan tunnel device for egress traffic.
Schema	Integer
Default	4790

Environment variable

Attribute	Value
Key	FELIX_EGRESSIPVXLANPORT
Description	The port number of vxlan tunnel device for egress traffic.
Schema	Integer
Default	4790

EgressIPVXLANVNI

Configuration file

Attribute	Value
Key	EgressIPVXLANVNI
Description	The VNI ID of vxlan tunnel device for egress traffic.
Schema	Integer
Default	4097

Environment variable

Attribute	Value
Key	FELIX_EGRESSIPVXLANVNI
Description	The VNI ID of vxlan tunnel device for egress traffic.
Schema	Integer
Default	4097

External network support

ExternalNetworkRoutingRulePriority

Configuration file

Attribute	Value
Key	ExternalNetworkRoutingRulePriority
Description	Controls the priority value to use for the external network routing rule.
Schema	Integer
Default	102

Environment variable

Attribute	Value
Key	FELIX_EXTERNALNETWORKROUTINGRULEPRIORITY
Description	Controls the priority value to use for the external network routing rule.
Schema	Integer
Default	102

ExternalNetworkSupport

Configuration file

Attribute	Value
Key	ExternalNetworkSupport
Description	Defines two different support modes for external network function. - Disabled: External network function is disabled. - Enabled: External network function is enabled.
Schema	One of: Disabled, Enabled (case insensitive)
Default	Disabled

Environment variable

Attribute	Value
Key	FELIX_EXTERNALNETWORKSUPPORT
Description	Defines two different support modes for external network function. - Disabled: External network function is disabled. - Enabled: External network function is enabled.
Schema	One of: Disabled, Enabled (case insensitive)
Default	Disabled

Packet capture

CaptureDir

Configuration file

Attribute	Value
Key	CaptureDir
Description	Controls directory to store file capture.
Schema	String
Default	/var/log/calico/pcap

Environment variable

Attribute	Value
Key	FELIX_CAPTUREDIR
Description	Controls directory to store file capture.
Schema	String
Default	/var/log/calico/pcap

CaptureMaxFiles

Configuration file

Attribute	Value
Key	CaptureMaxFiles
Description	Controls number of rotated capture file to keep.
Schema	Integer
Default	2

Environment variable

Attribute	Value
Key	FELIX_CAPTUREMAXFILES
Description	Controls number of rotated capture file to keep.
Schema	Integer
Default	2

CaptureMaxSizeBytes

Configuration file

Attribute	Value
Key	CaptureMaxSizeBytes
Description	Controls the max size of a file capture.
Schema	Integer
Default	10000000

Environment variable

Attribute	Value
Key	FELIX_CAPTUREMAXSIZEBYTES
Description	Controls the max size of a file capture.
Schema	Integer
Default	10000000

CaptureRotationSeconds

Configuration file

Attribute	Value
Key	CaptureRotationSeconds
Description	Controls the time rotation of a packet capture.
Schema	Integer
Default	3600

Environment variable

Attribute	Value
Key	FELIX_CAPTUREROTATIONSECONDS
Description	Controls the time rotation of a packet capture.
Schema	Integer
Default	3600

L7 proxy

TPROXYMode

Configuration file

Attribute	Value
Key	TPROXYMode
Description	Sets whether traffic is directed through a transparent proxy for further processing or not and how is the proxying done.
Schema	One of: Disabled, EnabledAllServices, Enabled (case insensitive)
Default	Disabled

Environment variable

Attribute	Value
Key	FELIX_TPROXYMODE
Description	Sets whether traffic is directed through a transparent proxy for further processing or not and how is the proxying done.
Schema	One of: Disabled, EnabledAllServices, Enabled (case insensitive)
Default	Disabled

TPROXYPort

Configuration file

Attribute	Value
Key	TPROXYPort
Description	Sets to which port proxied traffic should be redirected.
Schema	Integer
Default	16001

Environment variable

Attribute	Value
Key	FELIX_TPROXYPORT
Description	Sets to which port proxied traffic should be redirected.
Schema	Integer
Default	16001

TPROXYUpstreamConnMark

Configuration file

Attribute	Value
Key	TPROXYUpstreamConnMark
Description	Tells Felix which mark is used by the proxy for its upstream connections so that Felix can program the dataplane correctly.
Schema	32-bit bitmask (hex or deccimal allowed) with at least 2 bits set, example: 0xffff0000
Default	0x17

Environment variable

Attribute	Value
Key	FELIX_TPROXYUPSTREAMCONNMARK
Description	Tells Felix which mark is used by the proxy for its upstream connections so that Felix can program the dataplane correctly.
Schema	32-bit bitmask (hex or deccimal allowed) with at least 2 bits set, example: 0xffff0000
Default	0x17

Debug/test-only (generally unsupported)

DebugBPFCgroupV2

Configuration file

Attribute	Value
Key	DebugBPFCgroupV2
Description	Controls the cgroup v2 path that we apply the connect-time load balancer to. Most distros are configured for cgroup v1, which prevents all but the root cgroup v2 from working so this is only useful for development right now.
Schema	String
Default	none

Environment variable

Attribute	Value
Key	FELIX_DEBUGBPFCGROUPV2
Description	Controls the cgroup v2 path that we apply the connect-time load balancer to. Most distros are configured for cgroup v1, which prevents all but the root cgroup v2 from working so this is only useful for development right now.
Schema	String
Default	none

DebugBPFMapRepinEnabled

Configuration file

Attribute	Value
Key	DebugBPFMapRepinEnabled
Description	Can be used to prevent Felix from repinning its BPF maps at startup. This is useful for testing with multiple Felix instances running on one host.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_DEBUGBPFMAPREPINENABLED
Description	Can be used to prevent Felix from repinning its BPF maps at startup. This is useful for testing with multiple Felix instances running on one host.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

DebugCPUProfilePath

Configuration file

Attribute	Value
Key	DebugCPUProfilePath
Description	Unsupported diagnostic setting, used when testing Felix. Not exposed in FelixConfiguration.
Schema	Path to file
Default	/tmp/felix-cpu-<timestamp>.pprof

Environment variable

Attribute	Value
Key	FELIX_DEBUGCPUPROFILEPATH
Description	Unsupported diagnostic setting, used when testing Felix. Not exposed in FelixConfiguration.
Schema	Path to file
Default	/tmp/felix-cpu-<timestamp>.pprof

DebugCloudWatchLogsFile

Configuration file

Attribute	Value
Key	DebugCloudWatchLogsFile
Description	Unsupported diagnostic setting, used when testing Felix. Not exposed in FelixConfiguration.
Schema	Path to file
Default	none

Environment variable

Attribute	Value
Key	FELIX_DEBUGCLOUDWATCHLOGSFILE
Description	Unsupported diagnostic setting, used when testing Felix. Not exposed in FelixConfiguration.
Schema	Path to file
Default	none

DebugConsoleEnabled

Configuration file

Attribute	Value
Key	DebugConsoleEnabled
Description	Unsupported diagnostic setting, used when testing Felix. Not exposed in FelixConfiguration.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_DEBUGCONSOLEENABLED
Description	Unsupported diagnostic setting, used when testing Felix. Not exposed in FelixConfiguration.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

DebugDNSDoNotWriteIPSets

Configuration file

Attribute	Value
Key	DebugDNSDoNotWriteIPSets
Description	Unsupported diagnostic setting, used when testing Felix. Not exposed in FelixConfiguration.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_DEBUGDNSDONOTWRITEIPSETS
Description	Unsupported diagnostic setting, used when testing Felix. Not exposed in FelixConfiguration.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

DebugDNSResponseDelay

Configuration file

Attribute	Value
Key	DebugDNSResponseDelay
Description	Unsupported diagnostic setting, used when testing Felix. Not exposed in FelixConfiguration.
Schema	Milliseconds (floating point)
Default	0

Environment variable

Attribute	Value
Key	FELIX_DEBUGDNSRESPONSEDELAY
Description	Unsupported diagnostic setting, used when testing Felix. Not exposed in FelixConfiguration.
Schema	Milliseconds (floating point)
Default	0

DebugDisableLogDropping

Configuration file

Attribute	Value
Key	DebugDisableLogDropping
Description	Disables the dropping of log messages when the log buffer is full. This can significantly impact performance if log write-out is a bottleneck.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_DEBUGDISABLELOGDROPPING
Description	Disables the dropping of log messages when the log buffer is full. This can significantly impact performance if log write-out is a bottleneck.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

DebugHost

Configuration file

Attribute	Value
Key	DebugHost
Description	The host IP or hostname to bind the debug port to. Only used if DebugPort is set.
Schema	String matching regex ^[a-zA-Z0-9:._+-]{1,64}$
Default	localhost

Environment variable

Attribute	Value
Key	FELIX_DEBUGHOST
Description	The host IP or hostname to bind the debug port to. Only used if DebugPort is set.
Schema	String matching regex ^[a-zA-Z0-9:._+-]{1,64}$
Default	localhost

DebugMemoryProfilePath

Configuration file

Attribute	Value
Key	DebugMemoryProfilePath
Description	The path to write the memory profile to when triggered by signal.
Schema	Path to file
Default	none

Environment variable

Attribute	Value
Key	FELIX_DEBUGMEMORYPROFILEPATH
Description	The path to write the memory profile to when triggered by signal.
Schema	Path to file
Default	none

DebugPanicAfter

Configuration file

Attribute	Value
Key	DebugPanicAfter
Description	Unsupported diagnostic setting, used when testing Felix. Not exposed in FelixConfiguration.
Schema	Seconds (floating point)
Default	0

Environment variable

Attribute	Value
Key	FELIX_DEBUGPANICAFTER
Description	Unsupported diagnostic setting, used when testing Felix. Not exposed in FelixConfiguration.
Schema	Seconds (floating point)
Default	0

DebugPort

Configuration file

Attribute	Value
Key	DebugPort
Description	If set, enables Felix's debug HTTP port, which allows memory and CPU profiles to be retrieved. The debug port is not secure, it should not be exposed to the internet.
Schema	Integer: [0,65535]
Default	none

Environment variable

Attribute	Value
Key	FELIX_DEBUGPORT
Description	If set, enables Felix's debug HTTP port, which allows memory and CPU profiles to be retrieved. The debug port is not secure, it should not be exposed to the internet.
Schema	Integer: [0,65535]
Default	none

DebugSimulateCalcGraphHangAfter

Configuration file

Attribute	Value
Key	DebugSimulateCalcGraphHangAfter
Description	Used to simulate a hang in the calculation graph after the specified duration. This is useful in tests of the watchdog system only!
Schema	Seconds (floating point)
Default	0 (0s)

Environment variable

Attribute	Value
Key	FELIX_DEBUGSIMULATECALCGRAPHHANGAFTER
Description	Used to simulate a hang in the calculation graph after the specified duration. This is useful in tests of the watchdog system only!
Schema	Seconds (floating point)
Default	0 (0s)

DebugSimulateDataRace

Configuration file

Attribute	Value
Key	DebugSimulateDataRace
Description	Unsupported diagnostic setting, used when testing Felix. Not exposed in FelixConfiguration.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_DEBUGSIMULATEDATARACE
Description	Unsupported diagnostic setting, used when testing Felix. Not exposed in FelixConfiguration.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

DebugSimulateDataplaneApplyDelay

Configuration file

Attribute	Value
Key	DebugSimulateDataplaneApplyDelay
Description	Adds an artificial delay to every dataplane operation. This is useful for simulating a heavily loaded system for test purposes only.
Schema	Seconds (floating point)
Default	0 (0s)

Environment variable

Attribute	Value
Key	FELIX_DEBUGSIMULATEDATAPLANEAPPLYDELAY
Description	Adds an artificial delay to every dataplane operation. This is useful for simulating a heavily loaded system for test purposes only.
Schema	Seconds (floating point)
Default	0 (0s)

DebugSimulateDataplaneHangAfter

Configuration file

Attribute	Value
Key	DebugSimulateDataplaneHangAfter
Description	Used to simulate a hang in the dataplane after the specified duration. This is useful in tests of the watchdog system only!
Schema	Seconds (floating point)
Default	0 (0s)

Environment variable

Attribute	Value
Key	FELIX_DEBUGSIMULATEDATAPLANEHANGAFTER
Description	Used to simulate a hang in the dataplane after the specified duration. This is useful in tests of the watchdog system only!
Schema	Seconds (floating point)
Default	0 (0s)

DebugUseShortPollIntervals

Configuration file

Attribute	Value
Key	DebugUseShortPollIntervals
Description	Unsupported diagnostic setting, used when testing Felix. Not exposed in FelixConfiguration.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

Environment variable

Attribute	Value
Key	FELIX_DEBUGUSESHORTPOLLINTERVALS
Description	Unsupported diagnostic setting, used when testing Felix. Not exposed in FelixConfiguration.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	false

DebugWindowsPktMonStartArgs

Configuration file

Attribute	Value
Key	DebugWindowsPktMonStartArgs
Description	Unsupported diagnostic setting, used when testing Felix. Not exposed in FelixConfiguration.
Schema	String
Default	none

Environment variable

Attribute	Value
Key	FELIX_DEBUGWINDOWSPKTMONSTARTARGS
Description	Unsupported diagnostic setting, used when testing Felix. Not exposed in FelixConfiguration.
Schema	String
Default	none

StatsDumpFilePath

Configuration file

Attribute	Value
Key	StatsDumpFilePath
Description	The path to write a diagnostic flow logs statistics dump to when triggered by signal.
Schema	Path to file
Default	/var/log/calico/stats/dump

Environment variable

Attribute	Value
Key	FELIX_STATSDUMPFILEPATH
Description	The path to write a diagnostic flow logs statistics dump to when triggered by signal.
Schema	Path to file
Default	/var/log/calico/stats/dump

Usage reporting

UsageReportingEnabled

Configuration file

Attribute	Value
Key	UsageReportingEnabled
Description	Unused in Calico Enterprise, usage reporting is permanently disabled.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

Environment variable

Attribute	Value
Key	FELIX_USAGEREPORTINGENABLED
Description	Unused in Calico Enterprise, usage reporting is permanently disabled.
Schema	Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False.
Default	true

UsageReportingInitialDelaySecs

Configuration file

Attribute	Value
Key	UsageReportingInitialDelaySecs
Description	Unused in Calico Enterprise, usage reporting is permanently disabled.
Schema	Seconds (floating point)
Default	300 (5m0s)

Environment variable

Attribute	Value
Key	FELIX_USAGEREPORTINGINITIALDELAYSECS
Description	Unused in Calico Enterprise, usage reporting is permanently disabled.
Schema	Seconds (floating point)
Default	300 (5m0s)

UsageReportingIntervalSecs

Configuration file

Attribute	Value
Key	UsageReportingIntervalSecs
Description	Unused in Calico Enterprise, usage reporting is permanently disabled.
Schema	Seconds (floating point)
Default	86400 (24h0m0s)

Environment variable

Attribute	Value
Key	FELIX_USAGEREPORTINGINTERVALSECS
Description	Unused in Calico Enterprise, usage reporting is permanently disabled.
Schema	Seconds (floating point)
Default	86400 (24h0m0s)

Environment variables

The highest priority of configuration is that read from environment variables. To set a configuration parameter via an environment variable, set the environment variable formed by taking FELIX_ and appending the uppercase form of the variable name. For example, to set the etcd address, set the environment variable FELIX_ETCDADDR. Other examples include FELIX_ETCDSCHEME, FELIX_ETCDKEYFILE, FELIX_ETCDCERTFILE, FELIX_ETCDCAFILE, FELIX_FELIXHOSTNAME, FELIX_LOGFILEPATH and FELIX_METADATAADDR.

Configuration file

On startup, Felix reads an ini-style configuration file. The path to this file defaults to /etc/calico/felix.cfg but can be overridden using the -c or --config-file options on the command line. If the file exists, then it is read (ignoring section names) and all parameters are set from it.

In OpenStack, we recommend putting all configuration into configuration files, since the etcd database is transient (and may be recreated by the OpenStack plugin in certain error cases). However, in a Docker environment the use of environment variables or etcd is often more convenient.

Datastore

Felix also reads configuration parameters from the datastore. It supports a global setting and a per-host override.

1. Get the current felixconfig settings.

   kubectl get felixconfiguration.projectcalico.org default -o yaml --export > felix.yaml

2. Modify logFilePath to your intended path, e.g. "/tmp/felix.log"

   vim felix.yaml

   tip

   For a global change set name to "default". For a node-specific change: set name to node.<nodename>, e.g. "node.Calico Enterprise-node-1"

3. Replace the current felixconfig settings

   kubectl replace -f felix.yaml

For more information, see Felix Configuration Resource.