Flannel may be paired with several different backends. Once set, the backend should not be changed at runtime.
VXLAN is the recommended choice. host-gw is recommended for more experienced users who want the performance improvement and whose infrastructure support it (typically it can't be used in cloud environments). UDP is suggested for debugging only or for very old kernels that don't support VXLAN.
AWS, GCE, and AliVPC are experimental and unsupported. Proceed at your own risk.
For more information on configuration options for cloud components, see:
Use in-kernel VXLAN to encapsulate the packets.
Type and options:
Type(string):vxlanVNI(number): VXLAN Identifier (VNI) to be used. Defaults to 1.Port(number): UDP port to use for sending encapsulated packets. Defaults to kernel default, currently 8472.GBP(Boolean): Enable VXLAN Group Based Policy. Defaults tofalse.
Use host-gw to create IP routes to subnets via remote machine IPs. Requires direct layer2 connectivity between hosts running flannel.
host-gw provides good performance, with few dependencies, and easy set up.
Type:
Type(string):host-gw
Use UDP only for debugging if your network and kernel prevent you from using VXLAN or host-gw.
Type and options:
Type(string):udpPort(number): UDP port to use for sending encapsulated packets. Defaults to 8285.
The following options are experimental and unsupported at this time.
Use AliVPC to create IP routes in a alicloud VPC route table when running in an AliCloud VPC. This mitigates the need to create a separate flannel interface.
Requirements:
- Running on an ECS instance that is in an AliCloud VPC.
- Permission require
accessidandkeysecret.Type(string):ali-vpcAccessKeyID(string): API access key ID. Can also be configured with environment ACCESS_KEY_ID.AccessKeySecret(string): API access key secret. Can also be configured with environment ACCESS_KEY_SECRET.
Route Limits: AliCloud VPC limits the number of entries per route table to 50.
Alloc performs subnet allocation with no forwarding of data packets.
Type:
Type(string):alloc
Recommended when running within an Amazon VPC, AWS VPC creates IP routes in an Amazon VPC route table. Because AWS knows about the IP, it is possible to set up ELB to route directly to that container.
Requirements:
- Running on an EC2 instance that is in an Amazon VPC.
- Permissions required:
CreateRoute,DeleteRoute,DescribeRouteTables,ModifyInstanceAttribute,DescribeInstances(optional)
Type and options:
Type(string):aws-vpcRouteTableID(string): [optional] The ID of the VPC route table to add routes to.- The route table must be in the same region as the EC2 instance that flannel is running on.
- Flannel can automatically detect the ID of the route table if the optional
DescribeInstancesis granted to the EC2 instance.
Authentication is handled via either environment variables or the node's IAM role. If the node has insufficient privileges to modify the VPC routing table specified, ensure that appropriate AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and optionally AWS_SECURITY_TOKEN environment variables are set when running the flanneld process.
Route Limits: AWS limits the number of entries per route table to 50.
Use the GCE backend When running on Google Compute Engine Network. Instead of using encapsulation, GCE manipulates IP routes to achieve maximum performance. Because of this, a separate flannel interface is not created.
Requirements:
- Enable IP forwarding for the instances.
- Instance service account with read-write compute permissions.
Type:
Type(string):gce
Command to create a compute instance with the correct permissions and IP forwarding enabled:
$ gcloud compute instances create INSTANCE --can-ip-forward --scopes compute-rwRoute Limits: GCE limits the number of routes for every project to 100.