|
| 1 | +--- |
| 2 | +description: Install Calico in eBPF mode. |
| 3 | +--- |
| 4 | + |
| 5 | +# Install in eBPF mode |
| 6 | + |
| 7 | +import EbpfValue from '@site/calico/_includes/content/_ebpf-value.mdx'; |
| 8 | + |
| 9 | +import Tabs from '@theme/Tabs'; |
| 10 | +import TabItem from '@theme/TabItem'; |
| 11 | + |
| 12 | +## Big picture |
| 13 | + |
| 14 | +Install the eBPF data plane during the initial installation of $[prodname]. |
| 15 | + |
| 16 | +## Value |
| 17 | + |
| 18 | +<EbpfValue /> |
| 19 | + |
| 20 | +## Concepts |
| 21 | + |
| 22 | +### eBPF |
| 23 | + |
| 24 | +eBPF (or "extended Berkeley Packet Filter"), is a technology that allows safe mini programs to be attached to various |
| 25 | +low-level hooks in the Linux kernel. eBPF has a wide variety of uses, including networking, security, and tracing. |
| 26 | +You’ll see a lot of non-networking projects leveraging eBPF, but for $[prodname] our focus is on networking, |
| 27 | +and in particular, pushing the networking capabilities of the latest Linux kernels to the limit. |
| 28 | + |
| 29 | +## Before you begin |
| 30 | + |
| 31 | +### Supported |
| 32 | + |
| 33 | +- x86-64 |
| 34 | +- arm64 (little-endian) |
| 35 | + |
| 36 | +- Kubernetes datastore driver. |
| 37 | + |
| 38 | +- Distributions: |
| 39 | + |
| 40 | + - Generic or kubeadm |
| 41 | + - kOps |
| 42 | + - OpenShift |
| 43 | + - EKS |
| 44 | + - AKS |
| 45 | + - MKE |
| 46 | + |
| 47 | +- Linux distribution/kernel: |
| 48 | + |
| 49 | + - Ubuntu 20.04. |
| 50 | + - Red Hat v8.2 with Linux kernel v4.18.0-193 or above (Red Hat have backported the required features to that build). |
| 51 | + - Another [supported distribution](../../getting-started/kubernetes/requirements.mdx) with Linux kernel v5.3 or above. |
| 52 | + |
| 53 | +- An underlying network fabric that allows VXLAN traffic between hosts. In eBPF mode, VXLAN is used to forward Kubernetes NodePort traffic. |
| 54 | + |
| 55 | +- IPv6 |
| 56 | + |
| 57 | +Limitations: |
| 58 | + |
| 59 | + - IPIP is not supported ($[prodname] iptables does not support it either). VXLAN is the recommended overlay for eBPF mode. |
| 60 | + |
| 61 | +To enable IPv6 in eBPF mode, see [Configure dual stack or IPv6 only](../../networking/ipam/ipv6.mdx). You may be able to run with non-Calico IPAM. eks-cni is known to work. |
| 62 | + |
| 63 | +### Not supported |
| 64 | + |
| 65 | +- Other processor architectures. |
| 66 | + |
| 67 | +- etcd datastore driver. The etcd datastore driver doesn't support watching Kubernetes services, which is required for some features in eBPF mode. |
| 68 | + |
| 69 | +- Distributions: |
| 70 | + |
| 71 | + - GKE. This is because of an incompatibility with the GKE CNI plugin. |
| 72 | + |
| 73 | + - RKE: eBPF mode cannot be enabled at install time because RKE doesn't provide |
| 74 | + a stable address for the API server. However, by following [these instructions](enabling-ebpf.mdx), |
| 75 | + it can be enabled as a post-install step. |
| 76 | + |
| 77 | +- Clusters with some eBPF nodes and some standard data plane and/or Windows nodes. |
| 78 | +- Floating IPs. |
| 79 | +- SCTP (either for policy or services). |
| 80 | +- Tagged VLAN devices. |
| 81 | + |
| 82 | +### Performance |
| 83 | + |
| 84 | +For best pod-to-pod performance, we recommend using an underlying network that doesn't require Calico to use an overlay. For example: |
| 85 | + |
| 86 | +- A cluster within a single AWS subnet. |
| 87 | +- A cluster using a compatible cloud provider's CNI (such as the AWS VPC CNI plugin). |
| 88 | +- An on-prem cluster with BGP peering configured. |
| 89 | + |
| 90 | +If you must use an overlay, we recommend that you use VXLAN, not IPIP. VXLAN has better performance than IPIP in |
| 91 | +eBPF mode due to various kernel optimisations. |
| 92 | + |
| 93 | +## How to |
| 94 | + |
| 95 | +To install in eBPF mode, we recommend using the Tigera Operator to install $[prodname] so these instructions |
| 96 | +use the operator. Installing $[prodname] normally consists of the following stages, which are covered by the |
| 97 | +main installation guides: |
| 98 | + |
| 99 | +- Create a cluster suitable to run $[prodname]. |
| 100 | +- Install the Tigera Operator (possibly via a Helm chart), and the associated Custom Resource Definitions. |
| 101 | +- Apply a set of Custom Resources to tell the operator what to install. |
| 102 | +- Wait for the operator to provision all the associated resources and report back via its status resource. |
| 103 | + |
| 104 | +There are two ways to install in eBPF mode with Operator: Auto and Manual configuration. |
| 105 | + |
| 106 | +import DocCardList from '@theme/DocCardList'; |
| 107 | +import { useCurrentSidebarCategory } from '@docusaurus/theme-common'; |
| 108 | + |
| 109 | +<DocCardList items={useCurrentSidebarCategory().items} /> |
| 110 | + |
| 111 | +## Next steps |
| 112 | + |
| 113 | +**Recommended** |
| 114 | + |
| 115 | +- [Learn more about eBPF](use-cases-ebpf.mdx) |
| 116 | +- [Debug eBPF policies](../../network-policy/policy-rules/log-rules.mdx) |
0 commit comments