Felix 구성 파트 5
이 문서는 Felix 구성 레퍼런스의 다섯 번째 파트로, NFTablesFlowTableOffload부터 IptablesLockProbeIntervalMillis까지의 설정 항목을 다뤄요. nftables 데이터 플레인 설정과 iptables 데이터 플레인 설정이 이어져 나오는 구간이에요. 각 설정은 구성 파일 키와 환경 변수 두 탭으로 설명하고, 키 이름과 기본값은 원문 그대로 유지했어요.
출처: 문서
본문
Tab: Configuration file
| Attribute | Value |
|---|---|
| Key | NFTablesFlowTableOffload |
| Description | Controls which traffic nftables flowtable offload is enabled for, for improved forwarding performance. When set to "All", established connections accepted by Calico policy are offloaded to the kernel's flowtable fast path. Only applies when nftables mode is active. |
| Schema | One of: All, Disabled |
| Default | Disabled |
Tab: Environment variable
| Attribute | Value |
|---|---|
| Key | FELIX_NFTABLESFLOWTABLEOFFLOAD |
| Description | Controls which traffic nftables flowtable offload is enabled for, for improved forwarding performance. When set to "All", established connections accepted by Calico policy are offloaded to the kernel's flowtable fast path. Only applies when nftables mode is active. |
| Schema | One of: All, Disabled |
| Default | Disabled |
NFTablesMode
Tab: Configuration file
| Attribute | Value |
|---|---|
| Key | NFTablesMode |
| Description | Configures nftables support in Felix. In Auto mode, Felix uses the nftables dataplane if kube-proxy is detected to be running in nftables mode. |
| Schema | One of: Auto, Disabled, Enabled |
| Default | Auto |
Tab: Environment variable
| Attribute | Value |
|---|---|
| Key | FELIX_NFTABLESMODE |
| Description | Configures nftables support in Felix. In Auto mode, Felix uses the nftables dataplane if kube-proxy is detected to be running in nftables mode. |
| Schema | One of: Auto, Disabled, Enabled |
| Default | Auto |
NetlinkTimeoutSecs
Tab: Configuration file
| Attribute | Value |
|---|---|
| Key | NetlinkTimeoutSecs |
| Description | The timeout when talking to the kernel over the netlink protocol, used for programming routes, rules, and other kernel objects. |
| Schema | Seconds (floating point) |
| Default | 10 (10s) |
Tab: Environment variable
| Attribute | Value |
|---|---|
| Key | FELIX_NETLINKTIMEOUTSECS |
| Description | The timeout when talking to the kernel over the netlink protocol, used for programming routes, rules, and other kernel objects. |
| Schema | Seconds (floating point) |
| Default | 10 (10s) |
PolicySyncPathPrefix
Tab: Configuration file
| Attribute | Value |
|---|---|
| Key | PolicySyncPathPrefix |
| Description | Used to by Felix to communicate policy changes to external services, like Application layer policy. |
| Schema | Path to file |
| Default | none |
Tab: Environment variable
| Attribute | Value |
|---|---|
| Key | FELIX_POLICYSYNCPATHPREFIX |
| Description | Used to by Felix to communicate policy changes to external services, like Application layer policy. |
| Schema | Path to file |
| Default | none |
ProgramClusterRoutes
Tab: Configuration file
| Attribute | Value |
|---|---|
| Key | ProgramClusterRoutes |
| Description | Controls which "cluster routes" Felix programs, i.e. the routes that a node needs in order to reach workloads on other nodes. It only applies to IP Pools with vxlanMode: Never; Felix always programs the cluster routes for IP Pools with vxlanMode: Always or vxlanMode: CrossSubnet. The routes that Felix does not program here are expected to be programmed by Calico's BGP stack instead. Below, an IPIP IP Pool is one with ipipMode: Always or CrossSubnet, and an unencapsulated one has ipipMode and vxlanMode both Never.- Disabled: Felix programs no cluster routes. - EnabledIPIPOnly: Felix programs them for IPIP IP Pools. - EnabledNoEncapOnly: Felix programs them for unencapsulated IP Pools. - Enabled: Felix programs them for both.This field must be kept consistent with BGPConfiguration.ProgramClusterRoutes, which makes the same choice from BIRD's side. If both Felix and BIRD are enabled for the same kind of IP Pool they will fight over the routes; if neither is, there will be no cluster routes at all.Note: leaving the IPIP cluster routes to BGP, which the Disabled and EnabledNoEncapOnly values do, is deprecated as of v3.33 and will be removed in v3.35. |
| Schema | One of: Disabled, EnabledIPIPOnly, EnabledNoEncapOnly, Enabled |
| Default | EnabledIPIPOnly |
Tab: Environment variable
| Attribute | Value |
|---|---|
| Key | FELIX_PROGRAMCLUSTERROUTES |
| Description | Controls which "cluster routes" Felix programs, i.e. the routes that a node needs in order to reach workloads on other nodes. It only applies to IP Pools with vxlanMode: Never; Felix always programs the cluster routes for IP Pools with vxlanMode: Always or vxlanMode: CrossSubnet. The routes that Felix does not program here are expected to be programmed by Calico's BGP stack instead. Below, an IPIP IP Pool is one with ipipMode: Always or CrossSubnet, and an unencapsulated one has ipipMode and vxlanMode both Never.- Disabled: Felix programs no cluster routes. - EnabledIPIPOnly: Felix programs them for IPIP IP Pools. - EnabledNoEncapOnly: Felix programs them for unencapsulated IP Pools. - Enabled: Felix programs them for both.This field must be kept consistent with BGPConfiguration.ProgramClusterRoutes, which makes the same choice from BIRD's side. If both Felix and BIRD are enabled for the same kind of IP Pool they will fight over the routes; if neither is, there will be no cluster routes at all.Note: leaving the IPIP cluster routes to BGP, which the Disabled and EnabledNoEncapOnly values do, is deprecated as of v3.33 and will be removed in v3.35. |
| Schema | One of: Disabled, EnabledIPIPOnly, EnabledNoEncapOnly, Enabled |
| Default | EnabledIPIPOnly |
RemoveExternalRoutes
Tab: Configuration file
| Attribute | Value |
|---|---|
| Key | RemoveExternalRoutes |
| Description | Controls whether Felix will remove unexpected routes to workload interfaces. Felix will always clean up expected routes that use the configured DeviceRouteProtocol. To add your own routes, you must use a distinct protocol (in addition to setting this field to false). |
| Schema | Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False. |
| Default | true |
Tab: Environment variable
| Attribute | Value |
|---|---|
| Key | FELIX_REMOVEEXTERNALROUTES |
| Description | Controls whether Felix will remove unexpected routes to workload interfaces. Felix will always clean up expected routes that use the configured DeviceRouteProtocol. To add your own routes, you must use a distinct protocol (in addition to setting this field to false). |
| Schema | Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False. |
| Default | true |
RequireMTUFile
Tab: Configuration file
| Attribute | Value |
|---|---|
| Key | RequireMTUFile |
| Description | Specifies whether mtu file is required to start the felix. Optional as to keep the same as previous behavior. |
| Schema | Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False. |
| Default | false |
Tab: Environment variable
| Attribute | Value |
|---|---|
| Key | FELIX_REQUIREMTUFILE |
| Description | Specifies whether mtu file is required to start the felix. Optional as to keep the same as previous behavior. |
| Schema | Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False. |
| Default | false |
RouteRefreshInterval
Tab: Configuration file
| Attribute | Value |
|---|---|
| Key | RouteRefreshInterval |
| Description | The period at which Felix re-checks the routes in the dataplane to ensure that no other process has accidentally broken Calico's rules. Set to 0 to disable route refresh. |
| Schema | Seconds (floating point) |
| Default | 90 (1m30s) |
Tab: Environment variable
| Attribute | Value |
|---|---|
| Key | FELIX_ROUTEREFRESHINTERVAL |
| Description | The period at which Felix re-checks the routes in the dataplane to ensure that no other process has accidentally broken Calico's rules. Set to 0 to disable route refresh. |
| Schema | Seconds (floating point) |
| Default | 90 (1m30s) |
RouteSource
Tab: Configuration file
| Attribute | Value |
|---|---|
| Key | RouteSource |
| Description | Configures where Felix gets its routing information. - WorkloadIPs: use workload endpoints to construct routes. - CalicoIPAM: the default - use IPAM data to construct routes. |
| Schema | One of: CalicoIPAM, WorkloadIPs |
| Default | CalicoIPAM |
Tab: Environment variable
| Attribute | Value |
|---|---|
| Key | FELIX_ROUTESOURCE |
| Description | Configures where Felix gets its routing information. - WorkloadIPs: use workload endpoints to construct routes. - CalicoIPAM: the default - use IPAM data to construct routes. |
| Schema | One of: CalicoIPAM, WorkloadIPs |
| Default | CalicoIPAM |
RouteSyncDisabled
Tab: Configuration file
| Attribute | Value |
|---|---|
| Key | RouteSyncDisabled |
| Description | Will disable all operations performed on the route table. Set to true to run in network-policy mode only. |
| Schema | Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False. |
| Default | false |
Tab: Environment variable
| Attribute | Value |
|---|---|
| Key | FELIX_ROUTESYNCDISABLED |
| Description | Will disable all operations performed on the route table. Set to true to run in network-policy mode only. |
| Schema | Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False. |
| Default | false |
RouteTableRange
Tab: Configuration file
| Attribute | Value |
|---|---|
| Key | RouteTableRange |
| Description | Deprecated in favor of RouteTableRanges. Calico programs additional Linux route tables for various purposes. RouteTableRange specifies the indices of the route tables that Calico should use. |
| Schema | Range of route table indices n-m, where n and m are integers in [0,250]. |
| Default | none |
Tab: Environment variable
| Attribute | Value |
|---|---|
| Key | FELIX_ROUTETABLERANGE |
| Description | Deprecated in favor of RouteTableRanges. Calico programs additional Linux route tables for various purposes. RouteTableRange specifies the indices of the route tables that Calico should use. |
| Schema | Range of route table indices n-m, where n and m are integers in [0,250]. |
| Default | none |
RouteTableRanges
Tab: Configuration file
| Attribute | Value |
|---|---|
| Key | RouteTableRanges |
| Description | Calico programs additional Linux route tables for various purposes. RouteTableRanges specifies a set of table index ranges that Calico should use. DeprecatesRouteTableRange, overrides RouteTableRange. |
| Schema | Comma or space-delimited list of route table ranges of the form n-m where n and m are integers in [0,4294967295]. The sum of the sizes of all ranges may not exceed 65535. |
| Default | none |
Tab: Environment variable
| Attribute | Value |
|---|---|
| Key | FELIX_ROUTETABLERANGES |
| Description | Calico programs additional Linux route tables for various purposes. RouteTableRanges specifies a set of table index ranges that Calico should use. DeprecatesRouteTableRange, overrides RouteTableRange. |
| Schema | Comma or space-delimited list of route table ranges of the form n-m where n and m are integers in [0,4294967295]. The sum of the sizes of all ranges may not exceed 65535. |
| Default | none |
ServiceLoopPrevention
Tab: Configuration file
| Attribute | Value |
|---|---|
| Key | ServiceLoopPrevention |
| Description | When service IP advertisement is enabled, prevent routing loops to service IPs that are not in use, by dropping or rejecting packets that do not get DNAT'd by kube-proxy. Unless set to "Disabled", in which case such routing loops continue to be allowed. |
| Schema | One of: Disabled, Drop, Reject |
| Default | Drop |
Tab: Environment variable
| Attribute | Value |
|---|---|
| Key | FELIX_SERVICELOOPPREVENTION |
| Description | When service IP advertisement is enabled, prevent routing loops to service IPs that are not in use, by dropping or rejecting packets that do not get DNAT'd by kube-proxy. Unless set to "Disabled", in which case such routing loops continue to be allowed. |
| Schema | One of: Disabled, Drop, Reject |
| Default | Drop |
SidecarAccelerationEnabled
Tab: Configuration file
| Attribute | Value |
|---|---|
| Key | SidecarAccelerationEnabled |
| Description | Enables experimental sidecar acceleration. |
| Schema | Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False. |
| Default | false |
Tab: Environment variable
| Attribute | Value |
|---|---|
| Key | FELIX_SIDECARACCELERATIONENABLED |
| Description | Enables experimental sidecar acceleration. |
| Schema | Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False. |
| Default | false |
UseInternalDataplaneDriver
Tab: Configuration file
| Attribute | Value |
|---|---|
| Key | UseInternalDataplaneDriver |
| Description | If true, Felix will use its internal dataplane programming logic. If false, it will launch an external dataplane driver and communicate with it over protobuf. |
| Schema | Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False. |
| Default | true |
Tab: Environment variable
| Attribute | Value |
|---|---|
| Key | FELIX_USEINTERNALDATAPLANEDRIVER |
| Description | If true, Felix will use its internal dataplane programming logic. If false, it will launch an external dataplane driver and communicate with it over protobuf. |
| Schema | Boolean: true, 1, yes, y, t accepted as True; false, 0, no, n, f accepted (case insensitively) as False. |
| Default | true |
WorkloadSourceSpoofing
Tab: Configuration file
| Attribute | Value |
|---|---|
| Key | WorkloadSourceSpoofing |
| Description | Controls whether pods can use the allowedSourcePrefixes annotation to send traffic with a source IP address that is not theirs. This is disabled by default. When set to "Any", pods can request any prefix. |
| Schema | One of: Any, Disabled |
| Default | Disabled |
Tab: Environment variable
| Attribute | Value |
|---|---|
| Key | FELIX_WORKLOADSOURCESPOOFING |
| Description | Controls whether pods can use the allowedSourcePrefixes annotation to send traffic with a source IP address that is not theirs. This is disabled by default. When set to "Any", pods can request any prefix. |
| Schema | One of: Any, Disabled |
| Default | Disabled |
데이터 플레인: iptables
IpsetsRefreshInterval
Tab: Configuration file
| Attribute | Value |
|---|---|
| Key | IpsetsRefreshInterval |
| Description | Controls the period at which Felix re-checks all IP sets to look for discrepancies. Set to 0 to disable the periodic refresh. |
| Schema | Seconds (floating point) |
| Default | 90 (1m30s) |
Tab: Environment variable
| Attribute | Value |
|---|---|
| Key | FELIX_IPSETSREFRESHINTERVAL |
| Description | Controls the period at which Felix re-checks all IP sets to look for discrepancies. Set to 0 to disable the periodic refresh. |
| Schema | Seconds (floating point) |
| Default | 90 (1m30s) |
IptablesBackend
Tab: Configuration file
| Attribute | Value |
|---|---|
| Key | IptablesBackend |
| Description | Controls which backend of iptables will be used. The default is Auto.Warning: changing this on a running system can leave "orphaned" rules in the "other" backend. These should be cleaned up to avoid confusing interactions. |
| Schema | One of: auto, legacy, nft |
| Default | auto |
Tab: Environment variable
| Attribute | Value |
|---|---|
| Key | FELIX_IPTABLESBACKEND |
| Description | Controls which backend of iptables will be used. The default is Auto.Warning: changing this on a running system can leave "orphaned" rules in the "other" backend. These should be cleaned up to avoid confusing interactions. |
| Schema | One of: auto, legacy, nft |
| Default | auto |
IptablesFilterAllowAction
Tab: Configuration file
| Attribute | Value |
|---|---|
| Key | IptablesFilterAllowAction |
| Description | Controls what happens to traffic that is accepted by a Felix policy chain in the iptables filter table (which is used for "normal" policy). The default will immediately Accept the traffic. Use Return to send the traffic back up to the system chains for further processing. |
| Schema | One of: ACCEPT, RETURN |
| Default | ACCEPT |
Tab: Environment variable
| Attribute | Value |
|---|---|
| Key | FELIX_IPTABLESFILTERALLOWACTION |
| Description | Controls what happens to traffic that is accepted by a Felix policy chain in the iptables filter table (which is used for "normal" policy). The default will immediately Accept the traffic. Use Return to send the traffic back up to the system chains for further processing. |
| Schema | One of: ACCEPT, RETURN |
| Default | ACCEPT |
IptablesFilterDenyAction
Tab: Configuration file
| Attribute | Value |
|---|---|
| Key | IptablesFilterDenyAction |
| Description | Controls what happens to traffic that is denied by network policy. By default Calico blocks traffic with an iptables "DROP" action. If you want to use "REJECT" action instead you can configure it in here. |
| Schema | One of: DROP, REJECT |
| Default | DROP |
Tab: Environment variable
| Attribute | Value |
|---|---|
| Key | FELIX_IPTABLESFILTERDENYACTION |
| Description | Controls what happens to traffic that is denied by network policy. By default Calico blocks traffic with an iptables "DROP" action. If you want to use "REJECT" action instead you can configure it in here. |
| Schema | One of: DROP, REJECT |
| Default | DROP |
IptablesLockProbeIntervalMillis
더 알아보기 (Learn more)
Felix 구성의 다른 항목들은 이 레퍼런스의 앞뒤 파트에서 이어서 설명해요. 설정을 바꾼 뒤에는 Felix가 정상적으로 반영하는지 노드 로그로 확인해 보세요.