From 68cba2ecdcccd92860cf88090bf3fb71e3734820 Mon Sep 17 00:00:00 2001 From: Christopher Tauchen Date: Fri, 3 Jul 2026 17:04:24 +0100 Subject: [PATCH] DOCS-2971: Add missing DNSPolicyMode "Inline" value to Calico Cloud FelixConfig The Calico Cloud FelixConfiguration reference dropped the `Inline` value from the DNSPolicyMode table when the CE 3.22 content was copied over, and also lost the `(default)` marker on `DelayDeniedPacket`. Inline is supported in Calico Cloud (CC 22.4.0 is based on CE 3.22.4), so restore both to match the CE 3.22 source. Applied to the current and version-22-2 copies. Co-Authored-By: Claude Opus 4.8 (1M context) --- calico-cloud/reference/resources/felixconfig.mdx | 3 ++- .../version-22-2/reference/resources/felixconfig.mdx | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/calico-cloud/reference/resources/felixconfig.mdx b/calico-cloud/reference/resources/felixconfig.mdx index af70188971..e13a70328c 100644 --- a/calico-cloud/reference/resources/felixconfig.mdx +++ b/calico-cloud/reference/resources/felixconfig.mdx @@ -318,8 +318,9 @@ failsafeOutboundHostPorts: | Value | Description | | ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -| DelayDeniedPacket | Felix delays any denied packet that traversed a policy that included egress domain matches, but did not match. The packet is released after a fixed time, or after the destination IP address was programmed. | +| DelayDeniedPacket (default) | Felix delays any denied packet that traversed a policy that included egress domain matches, but did not match. The packet is released after a fixed time, or after the destination IP address was programmed. | | DelayDNSResponse | Felix delays any DNS response until related IPSets are programmed. This introduces some latency to all DNS packets (even when no IPSet programming is required), but it ensures policy hit statistics are accurate. This is the recommended setting when you are making use of staged policies or policy rule hit statistics. A Linux kernel version of 3.13 or greater is required to use `DelayDNSResponse`. For earlier kernel versions, this value is modified to `DelayDeniedPacket`. | +| Inline | Parses DNS response inline with DNS response packet processing within iptables. This guarantees the DNS rules reflect any change immediately. This mode works for iptables only and matches the same mode for `BPFDNSPolicyMode`. This setting is ignored on Windows and `NoDelay` is always used. | | NoDelay | Felix does not introduce any delay to the packets. DNS rules may not have been programmed by the time the first packet traverses the policy rules. Client applications need to handle reconnection attempts if initial connection attempts fail. This may be problematic for some applications or for very low DNS TTLs. | On Windows, or when using the eBPF dataplane, this setting is ignored. Windows always uses `NoDelay` while eBPF has its own [BPFDNSPolicyMode](#bpfdnspolicymode) option. diff --git a/calico-cloud_versioned_docs/version-22-2/reference/resources/felixconfig.mdx b/calico-cloud_versioned_docs/version-22-2/reference/resources/felixconfig.mdx index af70188971..e13a70328c 100644 --- a/calico-cloud_versioned_docs/version-22-2/reference/resources/felixconfig.mdx +++ b/calico-cloud_versioned_docs/version-22-2/reference/resources/felixconfig.mdx @@ -318,8 +318,9 @@ failsafeOutboundHostPorts: | Value | Description | | ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -| DelayDeniedPacket | Felix delays any denied packet that traversed a policy that included egress domain matches, but did not match. The packet is released after a fixed time, or after the destination IP address was programmed. | +| DelayDeniedPacket (default) | Felix delays any denied packet that traversed a policy that included egress domain matches, but did not match. The packet is released after a fixed time, or after the destination IP address was programmed. | | DelayDNSResponse | Felix delays any DNS response until related IPSets are programmed. This introduces some latency to all DNS packets (even when no IPSet programming is required), but it ensures policy hit statistics are accurate. This is the recommended setting when you are making use of staged policies or policy rule hit statistics. A Linux kernel version of 3.13 or greater is required to use `DelayDNSResponse`. For earlier kernel versions, this value is modified to `DelayDeniedPacket`. | +| Inline | Parses DNS response inline with DNS response packet processing within iptables. This guarantees the DNS rules reflect any change immediately. This mode works for iptables only and matches the same mode for `BPFDNSPolicyMode`. This setting is ignored on Windows and `NoDelay` is always used. | | NoDelay | Felix does not introduce any delay to the packets. DNS rules may not have been programmed by the time the first packet traverses the policy rules. Client applications need to handle reconnection attempts if initial connection attempts fail. This may be problematic for some applications or for very low DNS TTLs. | On Windows, or when using the eBPF dataplane, this setting is ignored. Windows always uses `NoDelay` while eBPF has its own [BPFDNSPolicyMode](#bpfdnspolicymode) option.