Master Flannel and Calico CNI Deployment on Kubernetes: A Step‑by‑Step Guide

Flanneld [Systemd Deployment Mode]

Flannel is relatively simple and low‑risk; the article provides the systemd unit file and the etcd backend configuration for both host‑gw and VXLAN backends.

[Unit]
Description=Flanneld overlay address etcd agent
After=network.target network-online.target
Wants=network-online.target
Before=docker.service

[Service]
Type=notify
ExecStart=/usr/local/bin/flanneld \
  -etcd-cafile=/etc/kubernetes/ssl/ca.pem \
  -etcd-certfile=/etc/kubernetes/ssl/kubernetes.pem \
  -etcd-keyfile=/etc/kubernetes/ssl/kubernetes-key.pem \
  -etcd-endpoints=https://{Etcd IP}:2379 \
  -iface=ens3 \
  --ip-masq
Restart=on-failure

[Install]
WantedBy=multi-user.target
RequiredBy=docker.service

Remember to write your backend information into etcd beforehand.

etcdctl \
  --endpoints=https://{Etcd-IP}:2379 \
  --ca-file=/etc/kubernetes/ssl/ca.pem \
  --cert-file=/etc/kubernetes/ssl/kubernetes.pem \
  --key-file=/etc/kubernetes/ssl/kubernetes-key.pem \
  set /coreos.com/network/config '{"Network":"10.200.0.0/16", "SubnetLen":24, "Backend":{"Type":"host-gw"}}'

For VXLAN backend, change the "Type" to "vxlan" in the JSON payload.

etcdctl \
  --endpoints=https://{Etcd-IP}:2379 \
  --ca-file=/etc/kubernetes/ssl/ca.pem \
  --cert-file=/etc/kubernetes/ssl/kubernetes.pem \
  --key-file=/etc/kubernetes/ssl/kubernetes-key.pem \
  set /coreos.com/network/config '{"Network":"10.200.0.0/16", "SubnetLen":24, "Backend":{"Type":"vxlan"}}'

After deployment, ensure forwarding is allowed: iptables -P FORWARD ACCEPT Kubernetes Docker versions ≥1.13 may set a DROP policy; override it if needed: iptables -P FORWARD DROP Create a CNI configuration file (e.g., 10-flanneld-cni.conf) under /etc/cni/net.d:

{
  "name": "cbr0",
  "type": "flannel",
  "delegate": {"isDefaultGateway": true}
}

Calico [Systemd Deployment Mode]

Calico is more widely used in Kubernetes for its scalability and IP‑IP mode, though it incurs a slight performance penalty compared to Flannel's host‑gw.

First, define an IP pool (Calico allocates /26 subnets by default):

calicoctl apply -f - <<EOF
apiVersion: v1
kind: ipPool
metadata:
  cidr: 10.200.0.0/16
spec:
  ipip:
    enabled: true
    mode: cross-subnet
  nat-outgoing: true
EOF

Next, create calico.env with etcd credentials and node settings:

ETCD_ENDPOINTS="https://{ETCD1}:2379,https://{ETCD2}:2379"
ETCD_CA_FILE="/etc/kubernetes/ssl/ca.pem"
ETCD_CERT_FILE="/etc/kubernetes/ssl/kubernetes.pem"
ETCD_KEY_FILE="/etc/kubernetes/ssl/kubernetes-key.pem"
CALICO_NODENAME="node46"
CALICO_NO_DEFAULT_POOLS=""
CALICO_IP="{HOST-IP}"
CALICO_IP6=""
CALICO_AS=""
CALICO_LIBNETWORK_ENABLED=true
CALICO_NETWORKING_BACKEND=bird

Systemd service for the Calico node:

[Unit]
Description=calico-node
After=docker.service
Requires=docker.service

[Service]
EnvironmentFile=/etc/calico/calico.env
ExecStartPre=-/usr/bin/docker rm -f calico-node
ExecStart=/usr/bin/docker run --net=host --privileged \
  --name=calico-node \
  -e NODENAME=${CALICO_NODENAME} \
  -e IP=${CALICO_IP} \
  -e IP6=${CALICO_IP6} \
  -e CALICO_NETWORKING_BACKEND=${CALICO_NETWORKING_BACKEND} \
  -e CALICO_STARTUP_LOGLEVEL=DEBUG \
  -e NO_DEFAULT_POOLS=${CALICO_NO_DEFAULT_POOLS} \
  -e FELIX_DEFAULTENDPOINTTOHOSTACTION=ACCEPT \
  -e CALICO_LIBNETWORK_ENABLED=${CALICO_LIBNETWORK_ENABLED} \
  -e ETCD_ENDPOINTS=${ETCD_ENDPOINTS} \
  -e ETCD_CA_CERT_FILE=/etc/kubernetes/ssl/ca.pem \
  -e ETCD_CERT_FILE=/etc/kubernetes/ssl/kubernetes.pem \
  -e ETCD_KEY_FILE=/etc/kubernetes/ssl/kubernetes-key.pem \
  -v /var/log/calico:/var/log/calico \
  -v /run/docker/plugins:/run/docker/plugins \
  -v /lib/modules:/lib/modules \
  -v /var/run/calico:/var/run/calico \
  -v /etc/kubernetes/ssl/:/etc/kubernetes/ssl/:ro \
  quay.io/calico/node:v2.4.0

ExecStop=-/usr/bin/docker stop calico-node

[Install]
WantedBy=multi-user.target

Calico CNI configuration ( calico.conf) placed under /etc/cni/net.d:

{
  "name": "k8s-pod-network",
  "cniVersion": "0.1.0",
  "type": "calico",
  "etcd_endpoints": "https://{ETCD1},https://{ETCD2}:2379",
  "etcd_key_file": "/etc/kubernetes/ssl/kubernetes-key.pem",
  "etcd_cert_file": "/etc/kubernetes/ssl/kubernetes.pem",
  "etcd_ca_cert_file": "/etc/kubernetes/ssl/ca.pem",
  "log_level": "info",
  "ipam": {"type": "calico-ipam"},
  "kubernetes": {"kubeconfig": "/etc/kubernetes/kube-proxy.kubeconfig"}
}

Optionally deploy a Route‑Reflector (RR) container on top of the Calico setup:

docker run --privileged --net=host -d \
  -e IP={HOST-IP} \
  -e ETCD_ENDPOINTS=https://{ETCD}:2379 \
  -e ETCD_CA_CERT_FILE=/etc/kubernetes/ssl/ca.pem \
  -e ETCD_CERT_FILE=/etc/kubernetes/ssl/kubernetes.pem \
  -e ETCD_KEY_FILE=/etc/kubernetes/ssl/kubernetes-key.pem \
  -v /etc/kubernetes/ssl:/etc/kubernetes/ssl:ro \
  calico/routereflector:0.4.0

Register the RR IP in etcd:

curl --cacert /etc/kubernetes/ssl/ca.pem \
  --cert /etc/kubernetes/ssl/kubernetes.pem \
  --key /etc/kubernetes/ssl/kubernetes-key.pem \
  -L https://{ETCD}:2379/v2/keys/calico/bgp/v1/rr_v4/{HOST-IP} \
  -XPUT -d value='{"ip":"{HOST-IP}","cluster_id":"1.0.0.2"}'

Create a global BGP peer:

cat <<EOF | calicoctl delete -f -
apiVersion: v1
kind: bgpPeer
metadata:
peerIP: {HOST-IP}
scope: global
spec:
  asNumber: 64567
EOF

Disable the node‑to‑node mesh: calicoctl config set nodeToNodeMesh off Restart all calico-node services after the changes.

Example calicoctl.cfg (placed under /etc/calico) for reference:

apiVersion: v1
kind: calicoApiConfig
metadata:
spec:
  etcdEndpoints: https://{ETCD}:2379
  etcdKeyFile: /etc/kubernetes/ssl/kubernetes-key.pem
  etcdCertFile: /etc/kubernetes/ssl/kubernetes.pem
  etcdCACertFile: /etc/kubernetes/ssl/ca.pem