From f6d332af349a554b73258e29005955c4d290c514 Mon Sep 17 00:00:00 2001 From: Tomas Hruby Date: Fri, 14 Aug 2026 15:47:42 -0700 Subject: [PATCH 1/2] Document the netkit attach mechanism and the downgrade path The netkit section covered how to get netkit interfaces but not how the eBPF data plane attaches to them, so there was no documented way off netkit attachment. A release that predates it cannot remove netkit programs, so downgrading a node directly leaves the old programs attached and enforcing a stale policy alongside the downgraded Felix. Describe the bpfAttachType values and note that TCX or TC also migrates existing netkit interfaces, then give the downgrade procedure and the way back to the default. Also correct the revert paragraph: reverting linuxPodInterfaceType to Veth only changes what the CNI plugin creates for new pods. Attachment follows each interface's own type, so existing netkit interfaces keep netkit attachment. Co-Authored-By: Claude Opus 5 (1M context) --- calico/operations/ebpf/enabling-ebpf.mdx | 33 +++++++++++++++++++++++- 1 file changed, 32 insertions(+), 1 deletion(-) diff --git a/calico/operations/ebpf/enabling-ebpf.mdx b/calico/operations/ebpf/enabling-ebpf.mdx index 8f1efdad7c..e85b359ad6 100644 --- a/calico/operations/ebpf/enabling-ebpf.mdx +++ b/calico/operations/ebpf/enabling-ebpf.mdx @@ -458,9 +458,40 @@ To revert to veth, set the field back to `Veth` (or remove it): kubectl patch installation.operator.tigera.io default --type merge -p '{"spec":{"calicoNetwork":{"linuxPodInterfaceType":"Veth"}}}' ``` -Existing pods keep their netkit interfaces, but the eBPF data plane treats those as veth (programs attach via TC/TCX, the same path used for actual veth interfaces). +Existing pods keep their netkit interfaces, and the eBPF data plane keeps driving those through netkit attachment unless `bpfAttachType` says otherwise (see below). Only newly created pods get veth interfaces. +***Attach mechanism*** + +The `bpfAttachType` field of the `FelixConfiguration` selects how the eBPF data plane attaches its programs: + +* `Netkit` (default) — netkit attachment on netkit interfaces, TCX on every other interface. +* `TCX` — TCX on every interface, including netkit interfaces. +* `TC` — the legacy qdisc-based attachment on every interface. Pod bandwidth QoS annotations are not supported with `TC`. + +Setting `TCX` or `TC` also moves existing netkit interfaces onto that mechanism. +The interfaces stay netkit and no pod is recreated; only the attachment changes. +Changing the field restarts Felix on every node. + +***Downgrading to a release without netkit support*** + +A release that has no concept of netkit attachment cannot remove netkit programs. +If you downgrade such a node directly, its pods keep the netkit programs attached — still enforcing the policy that was in force at downgrade time — while the downgraded Felix programs the same interfaces through TC/TCX, leaving two data planes on one interface. + +Move the interfaces off netkit attachment before you downgrade: + +```bash +kubectl patch felixconfiguration default --type merge -p '{"spec":{"bpfAttachType":"TCX"}}' +``` + +Felix restarts on each node and re-attaches its programs, removing the netkit links. + +After upgrading again, remove the field to return to the default: + +```bash +kubectl patch felixconfiguration default --type json -p '[{"op":"remove","path":"/spec/bpfAttachType"}]' +``` + ## Reversing the process To revert to standard Linux networking: From 905a87c3bcfaab5df25ac66992b7d4048698229f Mon Sep 17 00:00:00 2001 From: Tomas Hruby Date: Fri, 14 Aug 2026 16:01:12 -0700 Subject: [PATCH 2/2] Accept 'netkit' in the Vale vocabulary netkit is the kernel's device type name, so it is spelled lowercase in prose and Vale.Spelling flags every occurrence. The existing netkit section predates the check running over it; only changed lines are linted, so the term first shows up as an error when that section is edited. Co-Authored-By: Claude Opus 5 (1M context) --- .github/styles/config/vocabularies/CalicoTerminology/accept.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/styles/config/vocabularies/CalicoTerminology/accept.txt b/.github/styles/config/vocabularies/CalicoTerminology/accept.txt index 5625ab0a05..da458feea5 100644 --- a/.github/styles/config/vocabularies/CalicoTerminology/accept.txt +++ b/.github/styles/config/vocabularies/CalicoTerminology/accept.txt @@ -67,6 +67,7 @@ adjacencies [mM]ultitenant navbar [nN]amespace[ds]? +[nN]etkit [nN]etmask [nN]etwork[Pp]olic(y|ies) [nN]etwork[Ss]et[s]?