Update Felix configuraton files for CE#2507
Merged
ctauchen merged 1 commit intotigera:mainfrom Feb 3, 2026
Merged
Conversation
✅ Deploy Preview for calico-docs-preview-next ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview succeeded!Built without sensitive environment variables
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates versioned Calico Enterprise Felix configuration metadata to align with current Enterprise behavior and new features, including Istio ambient mode, policy activity log file settings, cgroup v2 behavior, and eBPF/Maglev tuning.
Changes:
- Add new Felix configuration options for Istio ambient mode/DSCP marking, policy activity log file output, cgroup v2 path override, egress gateway host interface patterns, and Maglev limits in appropriate Enterprise versions.
- Adjust or remove older/deprecated iptables and eBPF options (e.g., iptables lock handling, BPF kube-proxy endpoint slices) and update defaults/enums for nftables and BPF redirect behavior.
- Simplify Prometheus metrics TLS option descriptions and tweak some Go type annotations in the 3.22-2 Enterprise docs.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 6 comments.
| File | Description |
|---|---|
calico-enterprise_versioned_docs/version-3.23-1/_includes/components/FelixConfig/config-params.json |
Adds Istio ambient/DSCP options, policy activity log file controls, Maglev sizing knobs, and updates iptables lock handling/nftables metadata to reflect current Felix behavior. |
calico-enterprise_versioned_docs/version-3.22-2/_includes/components/FelixConfig/config-params.json |
Backports Istio ambient/DSCP options, refines Prometheus metrics TLS field docs, removes some eBPF options, and extends BPFRedirectToPeer to support L2Only. |
calico-enterprise_versioned_docs/version-3.21-2/_includes/components/FelixConfig/config-params.json |
Introduces CgroupV2Path and EgressIPHostIfacePattern to document Enterprise-specific Felix behavior for cgroup v2 and egress gateways in this older version. |
Comment on lines
+1901
to
+1905
| "YAMLType": "integer", | ||
| "YAMLSchema": "String.", | ||
| "YAMLEnumValues": null, | ||
| "YAMLSchemaHTML": "String.", | ||
| "YAMLDefault": "", |
There was a problem hiding this comment.
For IstioDSCPMark, the YAML metadata is internally inconsistent with the string schema and defaults: YAMLType is set to integer while YAMLSchema/YAMLSchemaHTML say String., and YAMLDefault is empty even though the string/parsed defaults are 23. To avoid confusing users and keep this entry consistent with other DSCP-style fields, please align YAMLType, YAMLSchema/HTML, and YAMLDefault with the actual accepted value formats and the documented default (23).
Suggested change
| "YAMLType": "integer", | |
| "YAMLSchema": "String.", | |
| "YAMLEnumValues": null, | |
| "YAMLSchemaHTML": "String.", | |
| "YAMLDefault": "", | |
| "YAMLType": "string", | |
| "YAMLSchema": "Numeric value: An integer from 0 to 63, representing the 6-bit DSCP code directly; Named value: A case-insensitive string corresponding to a standardized DSCP name (e.g., \"CS0\", \"AF11\", \"AF21\", \"EF\", etc.) as defined in the IANA registry for Differentiated Services Field Codepoints.", | |
| "YAMLEnumValues": null, | |
| "YAMLSchemaHTML": "Numeric value: An integer from 0 to 63, representing the 6-bit DSCP code directly; Named value: A case-insensitive string corresponding to a standardized DSCP name (e.g., \"CS0\", \"AF11\", \"AF21\", \"EF\", etc.) as defined in the IANA registry for Differentiated Services Field Codepoints.", | |
| "YAMLDefault": "23", |
Comment on lines
+1909
to
+1910
| "Description": "Sets the value to use when directing traffic to Istio ZTunnel, when Istio is enabled. The mark is set only on\nSYN packets at the final hop to avoid interference with other protocols. This value is reserved by Calico and must not be used\nwith other Istio installation.", | ||
| "DescriptionHTML": "<p>Sets the value to use when directing traffic to Istio ZTunnel, when Istio is enabled. The mark is set only on\nSYN packets at the final hop to avoid interference with other protocols. This value is reserved by Calico and must not be used\nwith other Istio installation.</p>", |
There was a problem hiding this comment.
In the IstioDSCPMark description text, the phrase must not be used with other Istio installation is ungrammatical; it should say any other Istio installation or other Istio installations. Please update both the plain-text and HTML descriptions to use correct grammar so the restriction is clear to readers.
Suggested change
| "Description": "Sets the value to use when directing traffic to Istio ZTunnel, when Istio is enabled. The mark is set only on\nSYN packets at the final hop to avoid interference with other protocols. This value is reserved by Calico and must not be used\nwith other Istio installation.", | |
| "DescriptionHTML": "<p>Sets the value to use when directing traffic to Istio ZTunnel, when Istio is enabled. The mark is set only on\nSYN packets at the final hop to avoid interference with other protocols. This value is reserved by Calico and must not be used\nwith other Istio installation.</p>", | |
| "Description": "Sets the value to use when directing traffic to Istio ZTunnel, when Istio is enabled. The mark is set only on\nSYN packets at the final hop to avoid interference with other protocols. This value is reserved by Calico and must not be used\nwith any other Istio installation.", | |
| "DescriptionHTML": "<p>Sets the value to use when directing traffic to Istio ZTunnel, when Istio is enabled. The mark is set only on\nSYN packets at the final hop to avoid interference with other protocols. This value is reserved by Calico and must not be used\nwith any other Istio installation.</p>", |
Comment on lines
+1874
to
+1878
| "YAMLType": "integer", | ||
| "YAMLSchema": "String.", | ||
| "YAMLEnumValues": null, | ||
| "YAMLSchemaHTML": "String.", | ||
| "YAMLDefault": "", |
There was a problem hiding this comment.
For IstioDSCPMark, the YAML metadata is internally inconsistent with the string schema and defaults: YAMLType is set to integer while YAMLSchema/YAMLSchemaHTML say String., and YAMLDefault is empty even though the string/parsed defaults are 23. To avoid confusing users and keep this entry consistent with other DSCP-style fields, please align YAMLType, YAMLSchema/HTML, and YAMLDefault with the actual accepted value formats and the documented default (23).
Suggested change
| "YAMLType": "integer", | |
| "YAMLSchema": "String.", | |
| "YAMLEnumValues": null, | |
| "YAMLSchemaHTML": "String.", | |
| "YAMLDefault": "", | |
| "YAMLType": "string", | |
| "YAMLSchema": "Numeric value: An integer from 0 to 63, representing the 6-bit DSCP code directly; Named value: A case-insensitive string corresponding to a standardized DSCP name (e.g., \"CS0\", \"AF11\", \"AF21\", \"EF\", etc.) as defined in the IANA registry for Differentiated Services Field Codepoints.", | |
| "YAMLEnumValues": null, | |
| "YAMLSchemaHTML": "Numeric value: An integer from 0 to 63, representing the 6-bit DSCP code directly; Named value: A case-insensitive string corresponding to a standardized DSCP name (e.g., \"CS0\", \"AF11\", \"AF21\", \"EF\", etc.) as defined in the IANA registry for Differentiated Services Field Codepoints.", | |
| "YAMLDefault": "23", |
Comment on lines
+1882
to
+1883
| "Description": "Sets the value to use when directing traffic to Istio ZTunnel, when Istio is enabled. The mark is set only on\nSYN packets at the final hop to avoid interference with other protocols. This value is reserved by Calico and must not be used\nwith other Istio installation.", | ||
| "DescriptionHTML": "<p>Sets the value to use when directing traffic to Istio ZTunnel, when Istio is enabled. The mark is set only on\nSYN packets at the final hop to avoid interference with other protocols. This value is reserved by Calico and must not be used\nwith other Istio installation.</p>", |
There was a problem hiding this comment.
In the IstioDSCPMark description text, the phrase must not be used with other Istio installation is ungrammatical; it should say any other Istio installation or other Istio installations. Please update both the plain-text and HTML descriptions to use correct grammar so the restriction is clear to readers.
Suggested change
| "Description": "Sets the value to use when directing traffic to Istio ZTunnel, when Istio is enabled. The mark is set only on\nSYN packets at the final hop to avoid interference with other protocols. This value is reserved by Calico and must not be used\nwith other Istio installation.", | |
| "DescriptionHTML": "<p>Sets the value to use when directing traffic to Istio ZTunnel, when Istio is enabled. The mark is set only on\nSYN packets at the final hop to avoid interference with other protocols. This value is reserved by Calico and must not be used\nwith other Istio installation.</p>", | |
| "Description": "Sets the value to use when directing traffic to Istio ZTunnel, when Istio is enabled. The mark is set only on\nSYN packets at the final hop to avoid interference with other protocols. This value is reserved by Calico and must not be used\nwith any other Istio installation.", | |
| "DescriptionHTML": "<p>Sets the value to use when directing traffic to Istio ZTunnel, when Istio is enabled. The mark is set only on\nSYN packets at the final hop to avoid interference with other protocols. This value is reserved by Calico and must not be used\nwith any other Istio installation.</p>", |
Comment on lines
+4327
to
+4328
| "Description": "Controls which whether it is allowed to forward straight to the\npeer side of the workload devices. It is allowed for any host L2 devices by default\n(L2Only), but it breaks TCP dump on the host side of workload device as it bypasses\nit on ingress. Value of Enabled also allows redirection from L3 host devices like\nIPIP tunnel or Wireguard directly to the peer side of the workload's device. This\nmakes redirection faster, however, it breaks tools like tcpdump on the peer side.\nUse Enabled with caution.", | ||
| "DescriptionHTML": "<p>Controls which whether it is allowed to forward straight to the\npeer side of the workload devices. It is allowed for any host L2 devices by default\n(L2Only), but it breaks TCP dump on the host side of workload device as it bypasses\nit on ingress. Value of Enabled also allows redirection from L3 host devices like\nIPIP tunnel or Wireguard directly to the peer side of the workload's device. This\nmakes redirection faster, however, it breaks tools like tcpdump on the peer side.\nUse Enabled with caution.</p>", |
There was a problem hiding this comment.
For BPFRedirectToPeer, the documented defaults conflict with the prose description: StringDefault/YAMLDefault are "Disabled", but the description states that forwarding from host L2 devices is allowed "by default (L2Only)". Please update either the default fields or the description text so they agree on the actual default behavior for this option.
Suggested change
| "Description": "Controls which whether it is allowed to forward straight to the\npeer side of the workload devices. It is allowed for any host L2 devices by default\n(L2Only), but it breaks TCP dump on the host side of workload device as it bypasses\nit on ingress. Value of Enabled also allows redirection from L3 host devices like\nIPIP tunnel or Wireguard directly to the peer side of the workload's device. This\nmakes redirection faster, however, it breaks tools like tcpdump on the peer side.\nUse Enabled with caution.", | |
| "DescriptionHTML": "<p>Controls which whether it is allowed to forward straight to the\npeer side of the workload devices. It is allowed for any host L2 devices by default\n(L2Only), but it breaks TCP dump on the host side of workload device as it bypasses\nit on ingress. Value of Enabled also allows redirection from L3 host devices like\nIPIP tunnel or Wireguard directly to the peer side of the workload's device. This\nmakes redirection faster, however, it breaks tools like tcpdump on the peer side.\nUse Enabled with caution.</p>", | |
| "Description": "Controls which whether it is allowed to forward straight to the\npeer side of the workload devices. When set to L2Only, it is allowed for any host L2 devices,\nbut it breaks TCP dump on the host side of workload device as it bypasses\nit on ingress. Value of Enabled also allows redirection from L3 host devices like\nIPIP tunnel or Wireguard directly to the peer side of the workload's device. This\nmakes redirection faster, however, it breaks tools like tcpdump on the peer side.\nUse Enabled with caution.", | |
| "DescriptionHTML": "<p>Controls which whether it is allowed to forward straight to the\npeer side of the workload devices. When set to L2Only, it is allowed for any host L2 devices,\nbut it breaks TCP dump on the host side of workload device as it bypasses\nit on ingress. Value of Enabled also allows redirection from L3 host devices like\nIPIP tunnel or Wireguard directly to the peer side of the workload's device. This\nmakes redirection faster, however, it breaks tools like tcpdump on the peer side.\nUse Enabled with caution.</p>", |
Comment on lines
+4327
to
+4328
| "Description": "Controls which whether it is allowed to forward straight to the\npeer side of the workload devices. It is allowed for any host L2 devices by default\n(L2Only), but it breaks TCP dump on the host side of workload device as it bypasses\nit on ingress. Value of Enabled also allows redirection from L3 host devices like\nIPIP tunnel or Wireguard directly to the peer side of the workload's device. This\nmakes redirection faster, however, it breaks tools like tcpdump on the peer side.\nUse Enabled with caution.", | ||
| "DescriptionHTML": "<p>Controls which whether it is allowed to forward straight to the\npeer side of the workload devices. It is allowed for any host L2 devices by default\n(L2Only), but it breaks TCP dump on the host side of workload device as it bypasses\nit on ingress. Value of Enabled also allows redirection from L3 host devices like\nIPIP tunnel or Wireguard directly to the peer side of the workload's device. This\nmakes redirection faster, however, it breaks tools like tcpdump on the peer side.\nUse Enabled with caution.</p>", |
There was a problem hiding this comment.
The BPFRedirectToPeer description contains a few wording issues that make it harder to read: Controls which whether it is allowed is grammatically incorrect, TCP dump should be tcpdump (or at least be consistent with other docs), and Wireguard should be WireGuard. Please tidy up the text (and matching HTML) to fix these typos while keeping the semantics the same.
Suggested change
| "Description": "Controls which whether it is allowed to forward straight to the\npeer side of the workload devices. It is allowed for any host L2 devices by default\n(L2Only), but it breaks TCP dump on the host side of workload device as it bypasses\nit on ingress. Value of Enabled also allows redirection from L3 host devices like\nIPIP tunnel or Wireguard directly to the peer side of the workload's device. This\nmakes redirection faster, however, it breaks tools like tcpdump on the peer side.\nUse Enabled with caution.", | |
| "DescriptionHTML": "<p>Controls which whether it is allowed to forward straight to the\npeer side of the workload devices. It is allowed for any host L2 devices by default\n(L2Only), but it breaks TCP dump on the host side of workload device as it bypasses\nit on ingress. Value of Enabled also allows redirection from L3 host devices like\nIPIP tunnel or Wireguard directly to the peer side of the workload's device. This\nmakes redirection faster, however, it breaks tools like tcpdump on the peer side.\nUse Enabled with caution.</p>", | |
| "Description": "Controls whether it is allowed to forward straight to the\npeer side of the workload devices. It is allowed for any host L2 devices by default\n(L2Only), but it breaks tcpdump on the host side of workload device as it bypasses\nit on ingress. Value of Enabled also allows redirection from L3 host devices like\nIPIP tunnel or WireGuard directly to the peer side of the workload's device. This\nmakes redirection faster, however, it breaks tools like tcpdump on the peer side.\nUse Enabled with caution.", | |
| "DescriptionHTML": "<p>Controls whether it is allowed to forward straight to the\npeer side of the workload devices. It is allowed for any host L2 devices by default\n(L2Only), but it breaks tcpdump on the host side of workload device as it bypasses\nit on ingress. Value of Enabled also allows redirection from L3 host devices like\nIPIP tunnel or WireGuard directly to the peer side of the workload's device. This\nmakes redirection faster, however, it breaks tools like tcpdump on the peer side.\nUse Enabled with caution.</p>", |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Product Version(s):
Issue:
Link to docs preview:
SME review:
DOCS review:
Additional information:
Merge checklist: