Reconfigure Calico Networking After Deployment

After the system is running, you can reconfigure the Calico network by modifying the Installation CR (or other Calico CRs). The Tigera Operator reconciles the change to the running state.

Important

The operator continuously reconciles the desired state. Changes made directly to operator-managed resources (pods, deployments, daemonsets) are reverted. Always modify configuration through the CRs.

View the Current Configuration

Review the current Installation CR to record the existing values before making changes. The commands below show the full resource and specific fields such as the IP pools and the Linux dataplane mode.

# View the full Installation CR
~(keystone_admin)]$ kubectl get installation default -o yaml

# View specific fields
~(keystone_admin)]$ kubectl get installation default -o jsonpath='{.spec.calicoNetwork.ipPools}'
~(keystone_admin)]$ kubectl get installation default -o jsonpath='{.spec.calicoNetwork.linuxDataplane}'

Modify the Installation CR

Update the Installation CR to apply new Calico network settings.

Use kubectl edit or kubectl patch to modify the Installation CR.

~(keystone_admin)]$ kubectl edit installation default

After modification, confirm the operator reconciles successfully:

~(keystone_admin)]$ kubectl get tigerastatus calico
NAME     AVAILABLE   PROGRESSING   DEGRADED   SINCE   MESSAGE
calico   True        False         False      ...     All objects available

Important

An MTU change (and some other parameter changes) is a disruptive operation. It triggers a rolling restart of the calico-node pods and may cause temporary network connectivity loss. Plan such changes during a maintenance window.

Examples of Post-Deployment Changes

The following examples show common Installation CR modifications.

Patch the MTU

~(keystone_admin)]$ kubectl patch installation default --type=merge -p '{"spec": {"calicoNetwork": {"mtu": 1450}}}'

Set the CNI logging level

Supported levels are Debug, Info, Warning, Error, and Fatal.

~(keystone_admin)]$ kubectl patch installation default --type=merge -p '
spec:
  logging:
    cni:
      logSeverity: Info
'

Set node address autodetection

~(keystone_admin)]$ kubectl patch installation default --type=merge -p '
spec:
  calicoNetwork:
    nodeAddressAutodetectionV4:
      canReach: "192.168.100.1"
'

Verify Changes

After any configuration change, confirm the operator has reconciled successfully and all components are healthy. All components should show AVAILABLE=True, PROGRESSING=False, and DEGRADED=False. For the full set of checks (tigerastatus, calico-system pods, and operator logs), see Monitor Calico Network Operator Status.

To revert a change, see Roll Back a Calico Networking Change.