1. Environment Preparation
1.1 Calico eBPF Requirements
System requirements
- Ubuntu 18.04.4+
- Red Hat v8.2
- Linux kernel v5.3+
If Calico does not detect a compatible kernel, it falls back to standard mode.
Every node needs a BPF filesystem mounted at /sys/fs/bpf
Calico version no lower than 3.13
1.2 Upgrading the Kernel
This uses CentOS 7:
1
2
3
| uname -rv
3.10.0-957.el7.x86_64 #1 SMP Thu Nov 8 23:39:32 UTC 2018
|
The kernel version does not meet the requirement, so the kernel needs to be upgraded. Kernel point releases change quickly, so you can look one up yourself at http://ftp.sjtu.edu.cn/sites/elrepo.org/linux/kernel/el7/x86_64/RPMS/.
1
2
3
4
5
6
7
| wget https://mirrors.nju.edu.cn/elrepo/kernel/el7/x86_64/RPMS/kernel-lt-5.4.146-1.el7.elrepo.x86_64.rpm
rpm -ivh kernel-lt-5.4.146-1.el7.elrepo.x86_64.rpm
cat /boot/grub2/grub.cfg | grep menuentry
grub2-set-default 'CentOS Linux (5.4.146-1.el7.elrepo.x86_64) 7 (Core)'
grub2-editenv list
grub2-mkconfig -o /boot/grub2/grub.cfg
reboot
|
1.3 Checking the BPF Filesystem
Check the mount:
1
2
3
| mount | grep "/sys/fs/bpf"
none on /sys/fs/bpf type bpf (rw,relatime)
|
If the result above is empty, you need to mount the BPF filesystem by running:
1
| mount bpffs -t bpf /sys/fs/bpf
|
1.4 Checking the Calico Version
Run:
1
2
3
| kubectl -n kube-system get deploy calico-kube-controllers -o yaml |grep image
image: calico/kube-controllers:v3.16.3
|
Just confirm the Calico version is no lower than 3.13.
2. Switching the Calico Data Plane to eBPF
2.1 Disabling kube-proxy
1
2
3
| kubectl patch ds -n kube-system kube-proxy -p '{"spec":{"template":{"spec":{"nodeSelector":{"non-calico": "true"}}}}}'
daemonset.apps/kube-proxy patched
|
2.2 Enabling eBPF Mode
calicoctl is a CLI tool provided by Calico.
1
2
3
| wget https://github.com/projectcalico/calico/releases/download/v3.25.1/calicoctl-linux-amd64
mv calicoctl-linux-amd64 /usr/local/bin/calicoctl
chmod +x /usr/local/bin/calicoctl
|
1
2
3
| calicoctl patch felixconfiguration default --patch='{"spec": {"bpfKubeProxyIptablesCleanupEnabled": false}}'
calicoctl patch felixconfiguration default --patch='{"spec": {"bpfEnabled": true}}'
calicoctl patch felixconfiguration default --patch='{"spec": {"bpfExternalServiceMode": "DSR"}}'
|
3. References
