Repository navigation
Conversation
✅ Deploy Preview for calico-docs-preview-next ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview succeeded!Built without sensitive environment variables
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The troubleshooting guidance contradicts the documented interface-selection rule and should be corrected to account for later interfaces with global unicast addresses.
1 open issue
What changed in this PR
Documents eBPF data plane support for multi-VRF networks in Calico Enterprise, including prerequisites, NodePort behavior, verification, troubleshooting, and release-note coverage.
Changes:
- Adds eBPF configuration and operational guidance to the Multi-VRF how-to.
- Updates the
Networkresource reference with data-plane requirements and limitations. - Adds a Calico Enterprise 3.24 release-note entry.
This pull request is ready to be approved.
| File | Description |
|---|---|
calico-enterprise/release-notes/index.mdx |
Announces eBPF support for Multi-VRF networking. |
calico-enterprise/reference/resources/network.mdx |
Documents supported data planes, NodePort constraints, and kernel requirements. |
calico-enterprise/networking/configuring/multi-vrf.mdx |
Adds eBPF setup, behavior, verification, limitations, and troubleshooting guidance. |
Review effort: Lite
| | `kube-dns` lookups fail from a VRF pod. | Pod has no flat-network interface. VRF-only pods can't reach in-cluster DNS unless an external router bridges the VRF to the flat network. | Use a Multus secondary interface for the VRF and keep the primary interface on the flat network. Use exec probes if needed. | | ||
| | `vrf` module not loaded; Felix logs complain about VRF setup. | The kernel `vrf` module is not loaded on the node. | `sudo modprobe vrf && lsmod \| grep '^vrf '`. Install `linux-modules-extra-$(uname -r)` if missing. | | ||
| | eBPF data plane: a NodePort whose backend is on another node drops traffic, and on the node where the NodePort traffic arrives `calico-node -bpf counters dump --iface=<VRF host interface>` shows `failed encapsulation` increasing. | This counter can point to a backend node that has no published address in this VRF, so there is no tunnel endpoint for it. Its VRF host interface may have no IP, or the node does not publish interface addresses (`CALICO_NETWORKING_BACKEND=none`, IP autodetection disabled, or an excluded interface). | On the backend node, check that `ip addr show <VRF host interface>` shows a global unicast address. Check the calico-node `CALICO_NETWORKING_BACKEND` setting, and that `nodeAddressAutodetectionV4` (or `V6`) in the Installation resource is set. Wait 60 seconds after an address change. | | ||
| | eBPF data plane: NodePort traffic is dropped, and on the node where the NodePort traffic arrives `calico-node -bpf counters dump --iface=<VRF host interface>` shows `VXLAN encap when host IP unknown` increasing. | The node where the NodePort traffic arrives has no address in the VRF to use as its own tunnel endpoint. The first interface in `hostConfig.hostInterfaces` has no global unicast address. | On that node: `ip addr show <VRF host interface>`. Give the interface an address, or use `externalTrafficPolicy: Local` so no tunnel is needed. | |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documents eBPF data plane support for multi-VRF networks, which landed on release-calient-v3.24 in calico-private#14970: data plane and kernel requirements on both pages, a new eBPF section in the how-to, verification and troubleshooting steps, and a release note.
Jira: https://tigera.atlassian.net/browse/DOCS-3161
Preview
To do
Flags