Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion calico-cloud/_includes/content/_rule.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@
| ipVersion | Positive IP version match. | `4`, `6` | integer | |
| source | Source match parameters. | | [EntityRule](#entityrule) | |
| destination | Destination match parameters. | | [EntityRule](#entityrule) | |
| http | Match HTTP request parameters. Application layer policy must be enabled to use this field. | | [HTTPMatch](#httpmatch) | |
| http | Match HTTP request parameters. Application layer policy must be enabled to use this field. | | HTTPMatch | |

Check warning on line 15 in calico-cloud/_includes/content/_rule.mdx

View workflow job for this annotation

GitHub Actions / runner / vale

[vale] reported by reviewdog 🐶 [Vale.Terms] Use 'HTTP' instead of 'http'. Raw Output: {"message": "[Vale.Terms] Use 'HTTP' instead of 'http'.", "location": {"path": "calico-cloud/_includes/content/_rule.mdx", "range": {"start": {"line": 15, "column": 3}}}, "severity": "WARNING"}

After a `Log` action, processing continues with the next rule; `Allow` and `Deny` are immediate
and final and no further rules are processed.
Expand Down
2 changes: 1 addition & 1 deletion calico-cloud/get-started/operator-checklist.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ If you have issues getting your cluster up and running, use this checklist.
- [Check logs for fatal errors](#check-logs-for-fatal-errors)
- [Check custom resources](#check-custom-resources)
- [Check pod capacity](#check-pod-capacity)
- [Check the web console dashboard for traffic](#check-manager-ui-dashboard-for-traffic)
- [Check the web console dashboard for traffic](#check-the-web-console-dashboard-for-traffic)

## Check installation start errors

Expand Down
4 changes: 2 additions & 2 deletions calico-cloud/multicluster/kubeconfig.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -275,7 +275,7 @@ A cluster in the mesh can write policy rules that select pods from other cluster
### Switch to multi-cluster networking
The steps above assume that you are configuring both federated endpoint identity and multi-cluster networking for the first time. If you already have federated endpoint identity, and want to use multi-cluster networking, follow these steps:

1. Validate that all [requirements](#calico-enterprise-multi-cluster-networking) for multi-cluster networking have been met.
1. Validate that all [requirements](#prerequisites-for-calico-cloud-multi-cluster-networking) for multi-cluster networking have been met.
2. Update the ClusterRole in each cluster in the cluster mesh using the RBAC manifest found in [Generate credentials for cross-cluster authentication](#generate-credentials-for-cross-cluster-resource-synchronization)
3. In all RemoteClusterConfigurations, set `Spec.OverlayRoutingMode` to `Enabled`.
4. Verify that all RemoteClusterConfigurations are bidirectional (in both directions for each cluster pair) using these [instructions](#establish-cross-cluster-resource-synchronization).
Expand Down Expand Up @@ -371,7 +371,7 @@ If the Typha logs do not yield the expected result, review the warning or error-
#### Troubleshoot multi-cluster networking
##### Basic validation
* Ensure that RemoteClusterConfiguration and federated endpoint identity are [functioning correctly](#validate-federated-endpoint-identity--multi-cluster-networking)
* Verify that you have met the [prerequisites](#calico-enterprise-multi-cluster-networking) for multi-cluster networking
* Verify that you have met the [prerequisites](#prerequisites-for-calico-cloud-multi-cluster-networking) for multi-cluster networking
* If you had previously set up RemoteClusterConfigurations without multi-cluster networking, and are upgrading to use the feature, review the [switching considerations](#switch-to-multi-cluster-networking)
* Verify that traffic between clusters is not being denied by network policy

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -35,8 +35,8 @@ For other endpoint types (VMs, host interfaces), the default behavior is to deny

## How to

- [Create a default deny network policy](#crate-a-default-deny-network-policy)
- [Create a global default deny network policy](#create-a-global-default-deny-network-policy)
- [Create a default deny network policy](#create-a-default-deny-network-policy)
- [Create a global default deny network policy](#create-a-global-default-deny-policy)

### Create a default deny network policy

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -44,13 +44,13 @@ Creating and managing policy recommendations is available only in the web consol

## How to

- [Enable policy recommendations](#enable-policy-recommendations)
- Enable policy recommendations
- [Activate and review policy recommendations](#activate-and-review-policy-recommendations)
- [Review global settings for workloads](#review-global-settings-for-workloads)
- [Update policy recommendations](#update-policy-recommendations)
- [Private network recommendations](#private-network-recommendations)
- [Troubleshoot policy recommendations](#troubleshoot-policy-recommendations)
- [Disable the policy recommendations feature](#disable-the-policy-recommendations-feature)
- [Disable the policy recommendations feature](#disable-policy-recommendations)

### Enable policy recommendations **using the web console**

Expand All @@ -63,7 +63,7 @@ The **Policy Recommendations** board is automatically displayed.

**Notes**:

- A policy recommendation is generated for every namespace in your cluster (unless namespaces are filtered out by an Admin using the [selector](../../reference/resources/policyrecommendations.mdx#namespaceSpec#selector) in the PolicyRecommendationScope resource).
- A policy recommendation is generated for every namespace in your cluster (unless namespaces are filtered out by an Admin using the [selector](../../reference/resources/policyrecommendations.mdx#namespacespec) in the PolicyRecommendationScope resource).
- Flow logs are continuously monitored for policy recommendations.
- Recommended policies are continuously updated until you **Add to policy board** or **Dismiss policy** using the Actions menu.
- Policy recommendations are created as **staged network policies** so you can safely observe the traffic before enforcing them.
Expand Down
2 changes: 1 addition & 1 deletion calico-cloud/network-policy/staged-network-policies.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -178,4 +178,4 @@ spec:
- For details on how to configure RBAC for staged policy resources, see [Configuring RBAC for tiered policy](policy-tiers/rbac-tiered-policies.mdx)
- For details on staged policy metrics, see
- [Flow logs](../observability/elastic/flow/datatypes.mdx)
- [Prometheus metrics](../operations/monitor/metrics/index.mdx#content-main)
- [Prometheus metrics](../operations/monitor/metrics/index.mdx)
2 changes: 1 addition & 1 deletion calico-cloud/networking/configuring/bgp-to-workload.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,7 @@ source traffic.
## How to

- [Configure global BGP settings](#configure-global-bgp-settings)
- [Create BGPFilter resources](#configure-bgpfilter-resources)
- [Create BGPFilter resources](#create-bgpfilter-resources)
- [Configure parent cluster BGP topology](#configure-parent-cluster-bgp-topology)
- [Configure BGP peering with workloads](#configure-bgp-peering-with-workloads)
- [Configure more than one nested cluster](#configure-more-than-one-nested-cluster)
Expand Down
2 changes: 1 addition & 1 deletion calico-cloud/networking/configuring/dual-tor.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -208,7 +208,7 @@ For a dual ToR setup, LLGR is helpful, as explained in more detail by [this blog
- [Prepare YAML resources describing the layout of your cluster](#prepare-yaml-resources-describing-the-layout-of-your-cluster)
- [Arrange for dual-homed nodes to run $[nodecontainer] on each boot](#arrange-for-dual-homed-nodes-to-run-cnx-node-on-each-boot)
- [Configure your ToR routers and infrastructure](#configure-your-tor-routers-and-infrastructure)
- [Install Kubernetes and $[prodname]](#install-kubernetes-and-calico-enterprise)
- [Install Kubernetes and $[prodname]](#install-kubernetes-and-calico-cloud)
- [Verify the deployment](#verify-the-deployment)

### Prepare YAML resources describing the layout of your cluster
Expand Down
6 changes: 3 additions & 3 deletions calico-cloud/networking/egress/egress-gateway-azure.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -98,13 +98,13 @@ $[prodname] CNI and IPAM are required. The ability to control the egress gateway
- [Disable the default BGP node-to-node mesh](#disable-the-default-bgp-node-to-node-mesh)
- [Enable BGP](#enable-bgp)
- [Provision an egress IP pool](#provision-an-egress-ip-pool)
- [(Optional) Limit number of route advertisement](#limit-number-of-route-advertisement)
- [Configure route reflector](#configure-route-reflector)
- [(Optional) Limit number of route advertisement](#optional-limit-number-of-route-advertisements)
- [Configure route reflector](#configure-route-reflectors)
- [Enable egress gateway support](#enable-egress-gateway-support)
- [Deploy a group of egress gateways](#deploy-a-group-of-egress-gateways)
- [Configure iptables backend for egress gateways](#configure-iptables-backend-for-egress-gateways)
- [Configure namespaces and pods to use egress gateways](#configure-namespaces-and-pods-to-use-egress-gateways)
- [(Optional) Enable ECMP load balancing](#optionally-enable-ecmp-load-balancing)
- [(Optional) Enable ECMP load balancing](#optional-enable-ecmp-load-balancing)
- [Verify the feature operation](#verify-the-feature-operation)
- [Control the use of egress gateways](#control-the-use-of-egress-gateways)
- [Policy enforcement for flows via an egress gateway](#policy-enforcement-for-flows-via-an-egress-gateway)
Expand Down
2 changes: 1 addition & 1 deletion calico-cloud/observability/alerts.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ To turn down aggregation on flow logs, go to [FelixConfiguration](../reference/r

## How to

- [Manage alerts in the web console](#manage-alerts-in-manager-ui)
- [Manage alerts in the web console](#manage-alerts-in-the-web-console)
- [Manage alerts using CLI](#manage-alerts-using-cli)

### Manage alerts in the web console
Expand Down
2 changes: 1 addition & 1 deletion calico-cloud/observability/elastic/l7/configure.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,7 @@ L7 logs require a minimum of 1 additional GB of log storage per node, per one-da

1. Configure L7 log aggregation, retention, and reporting.

For help, see [Felix Configuration documentation](../../../reference/component-resources/node/felix/configuration.mdx#calico-enterprise-specific-configuration).
For help, see [Felix Configuration documentation](../../../reference/component-resources/node/felix/configuration.mdx).

## Configure L7 logs

Expand Down
2 changes: 1 addition & 1 deletion calico-cloud/observability/iptables.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ $[prodname] adds a Felix option `DropActionOverride` that configures how the
It can add logs for denied packets, or even allow the traffic through.

See the
[Felix configuration reference](../reference/component-resources/node/felix/configuration.mdx#calico-cloud-specific-configuration) for
[Felix configuration reference](../reference/component-resources/node/felix/configuration.mdx) for
information on how to configure this option.

`DropActionOverride` controls what happens to each packet that is denied by
Expand Down
2 changes: 1 addition & 1 deletion calico-cloud/operations/ebpf/troubleshoot-ebpf.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -202,7 +202,7 @@ Enabling logs in this way has a significant impact on eBPF program performance.

To reduce the performance impact in production clusters, you can target logging
to specific traffic and/or specific interfaces using the
[bpfLogFilters](../../reference/component-resources/node/felix/configuration.mdx#BPFLogFilters) Felix
[bpfLogFilters](../../reference/component-resources/node/felix/configuration.mdx) Felix
configuration setting. Filters are pcap expressions.

> Note that the filters are applied to the original packet, before any NAT or
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -135,7 +135,7 @@ sum(irate(cnx_policy_rule_packets[30s])) without (instance,rule_index,rule_direc
```

See the
[Felix configuration reference](../../../reference/component-resources/node/felix/configuration.mdx#calico-cloud-specific-configuration) for
[Felix configuration reference](../../../reference/component-resources/node/felix/configuration.mdx) for
the settings that control the reporting of these metrics. $[prodname] manifests
normally set `PrometheusReporterEnabled=true` and
`PrometheusReporterPort=9081`, so these metrics are available on each compute
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ For the supported version of Prometheus in this release, see the [Release Notes]
### Scrape all enabled metrics

In this section we create a service monitor that scrapes all enabled metrics. To enable metrics that
are not enabled by default, please consult the [next section](#scrape-metrics-from-specific-components).
are not enabled by default, please consult the [next section](#scrape-metrics-from-specific-components-directly).

The following example shows a Prometheus server installed in namespace "external-prometheus" with a `serviceMonitorSelector` that selects all service monitors with the label `k8s-app=tigera-external-prometheus`.

Expand Down Expand Up @@ -369,7 +369,7 @@ The .yamls have no namespace defined so when you apply `kubectl`, it is applied

### Troubleshooting

This section is applicable only if you experience issues with mTLS after following the [Scrape metrics from specific components directly](#scrape-metrics-from-specific-components)
This section is applicable only if you experience issues with mTLS after following the [Scrape metrics from specific components directly](#scrape-metrics-from-specific-components-directly)
section.

1. Extract the TLS credentials and CA bundle from the cluster.
Expand Down
4 changes: 2 additions & 2 deletions calico-cloud/reference/resources/bgpfilter.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -77,7 +77,7 @@
| Field | Description | Accepted Values | Schema | Default |
| ------------- | ------------------------------------------ | ------------------------------------------------------------------- | ------ | ------- |
| cidr | IPv6 range | A valid IPv6 CIDR | string | |
| prefixLength | [PrefixLength](#bgp-filter-prefix-length) | Valid integers between 0 and ipv4/6 max (32, 128) | | |
| prefixLength | PrefixLength | Valid integers between 0 and ipv4/6 max (32, 128) | | |

Check failure on line 80 in calico-cloud/reference/resources/bgpfilter.mdx

View workflow job for this annotation

GitHub Actions / runner / vale

[vale] reported by reviewdog 🐶 [Vale.Spelling] Did you really mean 'prefixLength'? Raw Output: {"message": "[Vale.Spelling] Did you really mean 'prefixLength'?", "location": {"path": "calico-cloud/reference/resources/bgpfilter.mdx", "range": {"start": {"line": 80, "column": 3}}}, "severity": "ERROR"}
| matchOperator | Method by which to match candidate routes | `In`, `NotIn`, `Equal`, `NotEqual` | string | |
| source | Indicator of the source of route | `RemotePeers` means any route learned from other BGP peers | string | |
| interface | String to match interface names | A valid pattern to match interfaces. "*" can be used as a wildcard. | string | |
Expand All @@ -88,7 +88,7 @@
| Field | Description | Accepted Values | Schema | Default |
| ------------- | ------------------------------------------ | ------------------------------------------------------------------- | ------ | ------- |
| cidr | IPv6 range | A valid IPv6 CIDR | string | |
| prefixLength | [PrefixLength](#bgp-filter-prefix-length) | Valid integers between 0 and ipv4/6 max (32, 128) | | |
| prefixLength | PrefixLength | Valid integers between 0 and ipv4/6 max (32, 128) | | |

Check failure on line 91 in calico-cloud/reference/resources/bgpfilter.mdx

View workflow job for this annotation

GitHub Actions / runner / vale

[vale] reported by reviewdog 🐶 [Vale.Spelling] Did you really mean 'prefixLength'? Raw Output: {"message": "[Vale.Spelling] Did you really mean 'prefixLength'?", "location": {"path": "calico-cloud/reference/resources/bgpfilter.mdx", "range": {"start": {"line": 91, "column": 3}}}, "severity": "ERROR"}
| matchOperator | Method by which to match candidate routes | `In`, `NotIn`, `Equal`, `NotEqual` | string | |
| source | Indicator of the source of route | `RemotePeers` means any route learned from other BGP peers | string | |
| interface | String to match interface names | A valid pattern to match interfaces. "*" can be used as a wildcard. | string | |
Expand Down
Loading
Loading