Reference | Calico Documentation

Calico Open Source Go client library reference for working with resources such as network policies programmatically against the Calico Open Source API.

Helm chart values reference for installing Calico Open Source covering supported overrides and operator configuration knobs.

Installation API reference for Calico Open Source listing the operator-managed custom resources used to configure cluster installation.

Reference overview of the calicoctl command-line tool for managing Calico Open Source network policy, BGP, IP address management, and node operations.

Reference for the calicoctl create command in Calico Open Source, used to create resources from a manifest file.

Reference for the calicoctl replace command in Calico Open Source, used to replace an existing resource with one defined in a manifest.

Reference for the calicoctl apply command in Calico Open Source, used to create or update resources from a manifest file.

Reference for the calicoctl delete command in Calico Open Source, used to remove resources by name or from a manifest file.

Reference for the calicoctl get command in Calico Open Source, used to list resources in plain, YAML, JSON, or wide output formats.

Reference for the calicoctl patch command in Calico Open Source, used to apply a partial update to a resource.

Reference for the calicoctl label command in Calico Open Source, used to add, change, or remove labels on workload endpoints and nodes.

Reference overview of the calicoctl cluster subcommands in Calico Open Source for cluster-wide operations such as diagnostics collection.

Reference for the calicoctl cluster diags command in Calico Open Source, used to collect diagnostics from all nodes in a cluster.

Reference for the calicoctl convert command in Calico Open Source, used to convert v1 resource manifests into v3 format.

Reference overview of the calicoctl IPAM subcommands in Calico Open Source for IP address management operations.

Reference for the calicoctl IPAM check command in Calico Open Source, used to audit IP address allocation consistency across the cluster.

Reference for the calicoctl IPAM release command in Calico Open Source, used to release a leaked or stale IP address back to the pool.

Reference for the calicoctl IPAM show command in Calico Open Source, used to display the owner and details of an allocated IP address.

Reference for the calicoctl IPAM configure command in Calico Open Source, used to set IP address management options such as strict affinity.

Reference for the calicoctl IPAM split command in Calico Open Source, used to split an existing IP pool into smaller pools.

Reference overview of the calicoctl node subcommands in Calico Open Source for managing the calico/node container.

Reference for the calicoctl node run command in Calico Open Source, used to start a calico/node instance with the supplied options.

Reference for the calicoctl node status command in Calico Open Source, used to display BGP peer state and node liveness.

Reference for the calicoctl node diags command in Calico Open Source, used to collect diagnostics from a single Calico node.

Reference for the calicoctl node check-system command in Calico Open Source, used to verify host kernel support for Calico features.

Reference overview of the calicoctl datastore subcommands in Calico Open Source for migrating between etcdv3 and Kubernetes datastores.

Reference overview of the calicoctl datastore migrate subcommands in Calico Open Source for performing safe datastore migrations.

Reference for the calicoctl datastore migrate export command in Calico Open Source, used to export resources from an etcdv3 datastore.

Reference for the calicoctl datastore migrate import command in Calico Open Source, used to import resources into a Kubernetes datastore.

Reference for the calicoctl datastore migrate lock command in Calico Open Source, used to lock a datastore during migration.

Reference for the calicoctl datastore migrate unlock command in Calico Open Source, used to unlock a datastore after migration completes.

Reference for the calicoctl version command in Calico Open Source, used to display client and cluster version information.

Reference overview of the Calico Open Source API resources, including the manifest format and how calicoctl manages them.

Reference for the BGPConfiguration resource in Calico Open Source that sets cluster-wide BGP options including the autonomous system number and route reflectors.

Reference for the BGPPeer resource in Calico Open Source that defines a BGP neighbor relationship between Calico nodes and external routers.

Reference for the BGPFilter resource in Calico Open Source that filters routes imported from or exported to BGP peers.

Reference for the BlockAffinity resource in Calico Open Source that records which node owns each IP address management block.

Reference for the CalicoNodeStatus resource in Calico Open Source that exposes per-node agent, BGP, and routing state.

Reference for the FelixConfiguration resource in Calico Open Source that controls Felix data plane behavior across the cluster.

Reference for the GlobalNetworkPolicy resource in Calico Open Source, a cluster-scoped policy that selects endpoints across all namespaces.

Reference for the GlobalNetworkSet resource in Calico Open Source that defines a cluster-scoped set of CIDRs referenced by network policy.

Reference for the HostEndpoint resource in Calico Open Source that represents a host network interface for policy enforcement.

Reference for the IPPool resource in Calico Open Source that defines CIDRs available for pod IP address allocation.

Reference for the IPReservation resource in Calico Open Source that excludes specific addresses or ranges from automatic allocation.

Reference for the IP address management configuration resource in Calico Open Source that sets cluster-wide options such as strict affinity.

Reference for the KubeControllersConfiguration resource in Calico Open Source that controls behavior of the kube-controllers component.

Reference for the NetworkPolicy resource in Calico Open Source, a namespaced policy that selects pods within a single namespace.

Reference for the NetworkSet resource in Calico Open Source that defines a namespaced set of CIDRs referenced by network policy.

Reference for the Node resource in Calico Open Source that represents a host running the calico/node agent.

Reference for the Profile resource in Calico Open Source that groups labels and rules applied to endpoints.

Reference for the WorkloadEndpoint resource in Calico Open Source that represents a pod or VM interface for policy and IPAM.

Reference overview of role-based access control for the etcdv3 datastore used by Calico Open Source covering users, roles, and permission scopes.

Reference for generating Certificate Authority and client certificates that authenticate Calico Open Source components against the etcdv3 datastore.

Reference for defining etcdv3 users and roles that grant scoped access to Calico Open Source components.

Reference for restricting user access to Kubernetes and Calico Open Source resources using role-based access control.

Advanced reference for restricting user access to Calico Open Source components and calicoctl through Kubernetes role-based access control.

Reference listing the etcdv3 key prefixes used by each Calico Open Source component for role-based access control configuration.

Reference for Felix configuration parameters in Calico Open Source covering environment variables, FelixConfiguration fields, and per-node overrides.

Prometheus metrics reference for Felix in Calico Open Source covering counters and gauges exposed for data plane health and policy evaluation.

Reference overview of the Typha daemon in Calico Open Source explaining how it reduces datastore load and scales Felix to large clusters.

Reference for Typha configuration parameters in Calico Open Source covering environment variables and config file options for scaling the Kubernetes datastore.

Prometheus metrics reference for Typha in Calico Open Source covering connection counts, cache health, and fan-out metrics.

Reference for running Calico Open Source on Amazon Web Services covering supported networking modes, source/destination check requirements, and AWS-specific notes.

Reference for running Calico Open Source on Microsoft Azure covering supported networking modes, user-defined routes, and Azure platform notes.

Reference for running Calico Open Source on Google Compute Engine covering supported networking modes and platform-specific routing requirements.

Reference for running Calico Open Source on IBM Cloud covering supported networking modes and platform integration notes.

Reference overview of host endpoint protection in Calico Open Source covering the model for securing host network interfaces with policy.

Reference for the Calico Open Source failsafe policy that protects host endpoints from being cut off when host network policy is misconfigured.

Reference for the HostEndpoint object in Calico Open Source describing how to represent a host network interface so policy can select it.

Reference for ordered host endpoint policies in Calico Open Source that match interfaces using label selectors.

Reference for the Calico Open Source failsafe inbound and outbound port lists that prevent host network policy from cutting off control-plane connectivity.

Reference for pre-DNAT host endpoint policy in Calico Open Source that applies rules to ingress traffic before destination NAT rewrites the address.

Reference for the applyOnForward field on Calico Open Source host endpoint policy that determines how rules apply to forwarded traffic versus local processes.

Reference summary describing how the different Calico Open Source host endpoint policy types interact and affect packet flows.

Reference covering Linux conntrack workarounds for Calico Open Source host endpoint policy when stateful tracking interferes with expected packet flow.

Architectural overview reference of the Calico Open Source components including Felix, BIRD, confd, Typha, and the kube-controllers.

Reference covering the Calico Open Source data path explaining how packets flow between workloads and to external destinations across networking modes.

Reference for primary interface configuration parameters in the Calico Open Source VPP data plane.

Technical reference for the Calico Open Source VPP data plane integration covering packet processing, kernel offload, and graph nodes.

Reference covering the host network configuration applied by the Calico Open Source VPP data plane during initialization.

Component version reference listing the upstream container images and binaries shipped with each Calico Open Source release.

Frequently asked questions about Calico Open Source covering networking modes, IP address management, BGP, policy behavior, and platform support.

Reference for getting involved with the Calico Open Source upstream project including source repositories, mailing lists, Slack, and contribution channels.

Reference for configuring the calico/node container in Calico Open Source through environment variables that control Felix, BIRD, and confd.

Reference for setting Kubernetes resource requests and limits on Calico Open Source components managed by the Tigera Operator.

Reference for configuring the Calico Open Source CNI plugin and IPAM plugin through CNI network configuration files.

API and installation references​

Calico Client library

Helm installation reference

Installation reference

calicoctl reference​

calicoctl user reference

calicoctl create

calicoctl replace

calicoctl apply

calicoctl delete

calicoctl get

calicoctl patch

calicoctl label

calicoctl cluster

calicoctl cluster diags

calicoctl convert

calicoctl ipam

calicoctl ipam check

calicoctl ipam release

calicoctl ipam show

calicoctl ipam configure

calicoctl ipam split

calicoctl node

calicoctl node run

calicoctl node status

calicoctl node diags

calicoctl node checksystem

calicoctl datastore

calicoctl datastore migrate

calicoctl datastore migrate export

calicoctl datastore migrate import

calicoctl datastore migrate lock

calicoctl datastore migrate unlock

calicoctl version

Resource definitions​

Resource definitions

BGP configuration

BGP peer

BGP Filter

Block affinity

Calico node status

Felix configuration

Global network policy

Global network set

Host endpoint

IP pool

IP reservation

IPAM configuration

Kubernetes controllers configuration

Network policy

Network set

Node

Profile

Workload endpoint

Configuring etcd RBAC​

Setting up etcd certificates for RBAC

Generating certificates

Creating users and roles

Segmenting etcd on Kubernetes (basic)

Segmenting etcd on Kubernetes (advanced)

Calico key and path prefixes

Felix​

Configuring Felix

Monitoring Felix with Prometheus

Typha​

Typha overview

Configuring Typha

Monitoring Typha with Prometheus

Configuration on public clouds​

Amazon Web Services

Azure

Google Compute Engine

IBM Cloud

Host endpoints​

Host endpoints

Creating policy for basic connectivity

Creating host endpoint objects

Selector-based policies

Failsafe rules

Pre-DNAT policy

API and installation references

calicoctl reference

Resource definitions

Configuring etcd RBAC

Felix

Typha

Configuration on public clouds

Host endpoints

Architecture

VPP data plane

Other reference topics