{"action":"created","comment":{"url":"https://api.github.com/repos/projectcalico/calico/pulls/comments/90760454","pull_request_review_id":11279942,"id":90760454,"diff_hunk":"@@ -0,0 +1,115 @@\n+---\n+title: AWS\n+---\n+\n+Calico is designed to provide high performance massively scalable virtual\n+networking for containers in public cloud environments such as\n+Amazon Web Services (AWS).\n+\n+## Why Use Calico in AWS\n+\n+#### Container Policy\n+\n+While AWS Security Groups control network traffic sent to ec2 instances, it\n+does not cover containers running on hosts. Calico implements fine-grain policy\n+for containers which dynamically applies to containers as they dynamically\n+move around the cluster.\n+\n+#### No Overlays\n+\n+Calico minimizes the need for overlays by assigning each container\n+its own IP and allowing containers to talk to one another in a pure IP network.\n+\n+#### Break Through the '50  Route Limit'\n+\n+[AWS VPC Routing tables are limited to 50 programmable routes](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_Limits.html#vpc-limits-route-tables).\n+While this might limit other networking plugins, Calico supports\n+ip-over-ip encapsulation to circumvent manually programming container routes in\n+the VPC routing table altogether.\n+\n+## How to Run Calico in AWS\n+\n+Depending on the architecture of your AWS deployment, some of the following\n+modifications may need to be made to a stock calico cluster in order for\n+it to function properly.\n+\n+#### Allow BGP Peering in Security Groups\n+\n+To allow Calico containers to communicate across hosts on AWS, each host\n+should have IP connectivity with one another and be able to BGP peer.\n+\n+To allow this BGP peering, ensure your security group settings for each\n+calico host allows incoming tcp connections to port 179.\n+\n+You can check if your hosts have successfully established BGP sessions with\n+one another using `calicoctl node status`.\n+\n+#### Allow Traffic Within a Single VPC Subnet\n+\n+By default, each EC2 instance performs source/destination checks on inbound\n+and outbound traffic. This ensures that the instance is the source or\n+destination of any traffic it sends or receives.\n+\n+Since Calico allocates a unique IP to each container using pools AWS is not aware\n+of, container traffic will have an \"unrecognized\" source address and will be\n+dropped as it passes through the ec2 hosts to the container.\n+\n+This reverse-path filtering is enabled by default, but can be disabled on each\n+host, allowing calico traffic to pass through unaffected.\n+**Ensure you follow\n+[AWS documentation on disabling source/destination checks](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_NAT_Instance.html#EIP_Disable_SrcDestCheck).**\n+\n+#### Allow Traffic Across Different Subnets\n+\n+Container traffic that traverses different subnets will past through\n+a VPC routing table. If this VPC routing table does not know how to route\n+Calico IPs, it will drop traffic. There are two ways two prevent this from\n+happening:\n+\n+1. Masquerade Container Traffic\n+\n+   Container traffic can be masqueraded with its host IP so that the VPC\n+   never sees the container IPs, allowing standard ec2 routing to take over.\n+\n+   Turn on traffic masquerading in pool settings by enabling:\n+\n+   - `ipip` for container-to-container traffic.\n+   - `nat-outgoing` for container-to-ec2-instancce traffic.\n+\n+   See [pool configuration](todo) for information on how to enable this for pools.\n+\n+2. Configure the VPC Routing Table\n+\n+   Alternatively, the VPC routing table can be programmed with calico IP routes\n+   so that it can route container traffic natively. This can be accomplished in two\n+   ways.\n+\n+   1. Deploy [canal][canal] and select the [aws-vpc backend][aws-vpc-backend],\n+      which interacts with AWS api's to automatically program the routing table.\n+\n+      >Note: Doing so will limit you to just 50 routes.\n+\n+   2. Manually program the routing table (not recommended).\n+\n+#### Allow Traffic Across Different VPCs","path":"master/reference/public-cloud/aws.md","position":94,"original_position":94,"commit_id":"ba2ffed87446567495f0d32eca95cf440e27f104","original_commit_id":"ba2ffed87446567495f0d32eca95cf440e27f104","user":{"login":"caseydavenport","id":1944093,"avatar_url":"https://avatars.githubusercontent.com/u/1944093?v=3","gravatar_id":"","url":"https://api.github.com/users/caseydavenport","html_url":"https://github.com/caseydavenport","followers_url":"https://api.github.com/users/caseydavenport/followers","following_url":"https://api.github.com/users/caseydavenport/following{/other_user}","gists_url":"https://api.github.com/users/caseydavenport/gists{/gist_id}","starred_url":"https://api.github.com/users/caseydavenport/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/caseydavenport/subscriptions","organizations_url":"https://api.github.com/users/caseydavenport/orgs","repos_url":"https://api.github.com/users/caseydavenport/repos","events_url":"https://api.github.com/users/caseydavenport/events{/privacy}","received_events_url":"https://api.github.com/users/caseydavenport/received_events","type":"User","site_admin":false},"body":"Maybe we should say \"Peered VPCs\" instead of different, to make it clear that this is traffic between two VPCs which have been peered? And then maybe in the body include a link to VPC peering?","created_at":"2016-12-03T16:39:29Z","updated_at":"2016-12-03T16:39:29Z","html_url":"https://github.com/projectcalico/calico/pull/258#discussion_r90760454","pull_request_url":"https://api.github.com/repos/projectcalico/calico/pulls/258","_links":{"self":{"href":"https://api.github.com/repos/projectcalico/calico/pulls/comments/90760454"},"html":{"href":"https://github.com/projectcalico/calico/pull/258#discussion_r90760454"},"pull_request":{"href":"https://api.github.com/repos/projectcalico/calico/pulls/258"}}},"pull_request":{"url":"https://api.github.com/repos/projectcalico/calico/pulls/258","id":95031332,"html_url":"https://github.com/projectcalico/calico/pull/258","diff_url":"https://github.com/projectcalico/calico/pull/258.diff","patch_url":"https://github.com/projectcalico/calico/pull/258.patch","issue_url":"https://api.github.com/repos/projectcalico/calico/issues/258","number":258,"state":"open","locked":false,"title":"Add AWS guide","user":{"login":"djosborne","id":3444362,"avatar_url":"https://avatars.githubusercontent.com/u/3444362?v=3","gravatar_id":"","url":"https://api.github.com/users/djosborne","html_url":"https://github.com/djosborne","followers_url":"https://api.github.com/users/djosborne/followers","following_url":"https://api.github.com/users/djosborne/following{/other_user}","gists_url":"https://api.github.com/users/djosborne/gists{/gist_id}","starred_url":"https://api.github.com/users/djosborne/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/djosborne/subscriptions","organizations_url":"https://api.github.com/users/djosborne/orgs","repos_url":"https://api.github.com/users/djosborne/repos","events_url":"https://api.github.com/users/djosborne/events{/privacy}","received_events_url":"https://api.github.com/users/djosborne/received_events","type":"User","site_admin":false},"body":"Add a new AWS guide that covers all the \"gotchas\" of running Calico in AWS","created_at":"2016-11-23T16:02:23Z","updated_at":"2016-12-03T16:39:29Z","closed_at":null,"merged_at":null,"merge_commit_sha":"57dad3bad4d98eb9b29957c601b6f930435ee004","assignee":{"login":"caseydavenport","id":1944093,"avatar_url":"https://avatars.githubusercontent.com/u/1944093?v=3","gravatar_id":"","url":"https://api.github.com/users/caseydavenport","html_url":"https://github.com/caseydavenport","followers_url":"https://api.github.com/users/caseydavenport/followers","following_url":"https://api.github.com/users/caseydavenport/following{/other_user}","gists_url":"https://api.github.com/users/caseydavenport/gists{/gist_id}","starred_url":"https://api.github.com/users/caseydavenport/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/caseydavenport/subscriptions","organizations_url":"https://api.github.com/users/caseydavenport/orgs","repos_url":"https://api.github.com/users/caseydavenport/repos","events_url":"https://api.github.com/users/caseydavenport/events{/privacy}","received_events_url":"https://api.github.com/users/caseydavenport/received_events","type":"User","site_admin":false},"assignees":[{"login":"caseydavenport","id":1944093,"avatar_url":"https://avatars.githubusercontent.com/u/1944093?v=3","gravatar_id":"","url":"https://api.github.com/users/caseydavenport","html_url":"https://github.com/caseydavenport","followers_url":"https://api.github.com/users/caseydavenport/followers","following_url":"https://api.github.com/users/caseydavenport/following{/other_user}","gists_url":"https://api.github.com/users/caseydavenport/gists{/gist_id}","starred_url":"https://api.github.com/users/caseydavenport/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/caseydavenport/subscriptions","organizations_url":"https://api.github.com/users/caseydavenport/orgs","repos_url":"https://api.github.com/users/caseydavenport/repos","events_url":"https://api.github.com/users/caseydavenport/events{/privacy}","received_events_url":"https://api.github.com/users/caseydavenport/received_events","type":"User","site_admin":false}],"milestone":null,"commits_url":"https://api.github.com/repos/projectcalico/calico/pulls/258/commits","review_comments_url":"https://api.github.com/repos/projectcalico/calico/pulls/258/comments","review_comment_url":"https://api.github.com/repos/projectcalico/calico/pulls/comments{/number}","comments_url":"https://api.github.com/repos/projectcalico/calico/issues/258/comments","statuses_url":"https://api.github.com/repos/projectcalico/calico/statuses/ba2ffed87446567495f0d32eca95cf440e27f104","head":{"label":"djosborne:cloud-providers","ref":"cloud-providers","sha":"ba2ffed87446567495f0d32eca95cf440e27f104","user":{"login":"djosborne","id":3444362,"avatar_url":"https://avatars.githubusercontent.com/u/3444362?v=3","gravatar_id":"","url":"https://api.github.com/users/djosborne","html_url":"https://github.com/djosborne","followers_url":"https://api.github.com/users/djosborne/followers","following_url":"https://api.github.com/users/djosborne/following{/other_user}","gists_url":"https://api.github.com/users/djosborne/gists{/gist_id}","starred_url":"https://api.github.com/users/djosborne/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/djosborne/subscriptions","organizations_url":"https://api.github.com/users/djosborne/orgs","repos_url":"https://api.github.com/users/djosborne/repos","events_url":"https://api.github.com/users/djosborne/events{/privacy}","received_events_url":"https://api.github.com/users/djosborne/received_events","type":"User","site_admin":false},"repo":{"id":70282217,"name":"calico","full_name":"djosborne/calico","owner":{"login":"djosborne","id":3444362,"avatar_url":"https://avatars.githubusercontent.com/u/3444362?v=3","gravatar_id":"","url":"https://api.github.com/users/djosborne","html_url":"https://github.com/djosborne","followers_url":"https://api.github.com/users/djosborne/followers","following_url":"https://api.github.com/users/djosborne/following{/other_user}","gists_url":"https://api.github.com/users/djosborne/gists{/gist_id}","starred_url":"https://api.github.com/users/djosborne/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/djosborne/subscriptions","organizations_url":"https://api.github.com/users/djosborne/orgs","repos_url":"https://api.github.com/users/djosborne/repos","events_url":"https://api.github.com/users/djosborne/events{/privacy}","received_events_url":"https://api.github.com/users/djosborne/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/djosborne/calico","description":"Documentation and guides for Calico","fork":true,"url":"https://api.github.com/repos/djosborne/calico","forks_url":"https://api.github.com/repos/djosborne/calico/forks","keys_url":"https://api.github.com/repos/djosborne/calico/keys{/key_id}","collaborators_url":"https://api.github.com/repos/djosborne/calico/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/djosborne/calico/teams","hooks_url":"https://api.github.com/repos/djosborne/calico/hooks","issue_events_url":"https://api.github.com/repos/djosborne/calico/issues/events{/number}","events_url":"https://api.github.com/repos/djosborne/calico/events","assignees_url":"https://api.github.com/repos/djosborne/calico/assignees{/user}","branches_url":"https://api.github.com/repos/djosborne/calico/branches{/branch}","tags_url":"https://api.github.com/repos/djosborne/calico/tags","blobs_url":"https://api.github.com/repos/djosborne/calico/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/djosborne/calico/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/djosborne/calico/git/refs{/sha}","trees_url":"https://api.github.com/repos/djosborne/calico/git/trees{/sha}","statuses_url":"https://api.github.com/repos/djosborne/calico/statuses/{sha}","languages_url":"https://api.github.com/repos/djosborne/calico/languages","stargazers_url":"https://api.github.com/repos/djosborne/calico/stargazers","contributors_url":"https://api.github.com/repos/djosborne/calico/contributors","subscribers_url":"https://api.github.com/repos/djosborne/calico/subscribers","subscription_url":"https://api.github.com/repos/djosborne/calico/subscription","commits_url":"https://api.github.com/repos/djosborne/calico/commits{/sha}","git_commits_url":"https://api.github.com/repos/djosborne/calico/git/commits{/sha}","comments_url":"https://api.github.com/repos/djosborne/calico/comments{/number}","issue_comment_url":"https://api.github.com/repos/djosborne/calico/issues/comments{/number}","contents_url":"https://api.github.com/repos/djosborne/calico/contents/{+path}","compare_url":"https://api.github.com/repos/djosborne/calico/compare/{base}...{head}","merges_url":"https://api.github.com/repos/djosborne/calico/merges","archive_url":"https://api.github.com/repos/djosborne/calico/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/djosborne/calico/downloads","issues_url":"https://api.github.com/repos/djosborne/calico/issues{/number}","pulls_url":"https://api.github.com/repos/djosborne/calico/pulls{/number}","milestones_url":"https://api.github.com/repos/djosborne/calico/milestones{/number}","notifications_url":"https://api.github.com/repos/djosborne/calico/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/djosborne/calico/labels{/name}","releases_url":"https://api.github.com/repos/djosborne/calico/releases{/id}","deployments_url":"https://api.github.com/repos/djosborne/calico/deployments","created_at":"2016-10-07T20:55:33Z","updated_at":"2016-10-07T20:55:34Z","pushed_at":"2016-12-02T21:33:33Z","git_url":"git://github.com/djosborne/calico.git","ssh_url":"git@github.com:djosborne/calico.git","clone_url":"https://github.com/djosborne/calico.git","svn_url":"https://github.com/djosborne/calico","homepage":null,"size":23362,"stargazers_count":0,"watchers_count":0,"language":"CSS","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"projectcalico:master","ref":"master","sha":"fe5d3e601d3e398ef8ff7512561e0237a4e21bb9","user":{"login":"projectcalico","id":12304728,"avatar_url":"https://avatars.githubusercontent.com/u/12304728?v=3","gravatar_id":"","url":"https://api.github.com/users/projectcalico","html_url":"https://github.com/projectcalico","followers_url":"https://api.github.com/users/projectcalico/followers","following_url":"https://api.github.com/users/projectcalico/following{/other_user}","gists_url":"https://api.github.com/users/projectcalico/gists{/gist_id}","starred_url":"https://api.github.com/users/projectcalico/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/projectcalico/subscriptions","organizations_url":"https://api.github.com/users/projectcalico/orgs","repos_url":"https://api.github.com/users/projectcalico/repos","events_url":"https://api.github.com/users/projectcalico/events{/privacy}","received_events_url":"https://api.github.com/users/projectcalico/received_events","type":"Organization","site_admin":false},"repo":{"id":63882194,"name":"calico","full_name":"projectcalico/calico","owner":{"login":"projectcalico","id":12304728,"avatar_url":"https://avatars.githubusercontent.com/u/12304728?v=3","gravatar_id":"","url":"https://api.github.com/users/projectcalico","html_url":"https://github.com/projectcalico","followers_url":"https://api.github.com/users/projectcalico/followers","following_url":"https://api.github.com/users/projectcalico/following{/other_user}","gists_url":"https://api.github.com/users/projectcalico/gists{/gist_id}","starred_url":"https://api.github.com/users/projectcalico/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/projectcalico/subscriptions","organizations_url":"https://api.github.com/users/projectcalico/orgs","repos_url":"https://api.github.com/users/projectcalico/repos","events_url":"https://api.github.com/users/projectcalico/events{/privacy}","received_events_url":"https://api.github.com/users/projectcalico/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/projectcalico/calico","description":"Documentation and guides for Calico","fork":false,"url":"https://api.github.com/repos/projectcalico/calico","forks_url":"https://api.github.com/repos/projectcalico/calico/forks","keys_url":"https://api.github.com/repos/projectcalico/calico/keys{/key_id}","collaborators_url":"https://api.github.com/repos/projectcalico/calico/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/projectcalico/calico/teams","hooks_url":"https://api.github.com/repos/projectcalico/calico/hooks","issue_events_url":"https://api.github.com/repos/projectcalico/calico/issues/events{/number}","events_url":"https://api.github.com/repos/projectcalico/calico/events","assignees_url":"https://api.github.com/repos/projectcalico/calico/assignees{/user}","branches_url":"https://api.github.com/repos/projectcalico/calico/branches{/branch}","tags_url":"https://api.github.com/repos/projectcalico/calico/tags","blobs_url":"https://api.github.com/repos/projectcalico/calico/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/projectcalico/calico/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/projectcalico/calico/git/refs{/sha}","trees_url":"https://api.github.com/repos/projectcalico/calico/git/trees{/sha}","statuses_url":"https://api.github.com/repos/projectcalico/calico/statuses/{sha}","languages_url":"https://api.github.com/repos/projectcalico/calico/languages","stargazers_url":"https://api.github.com/repos/projectcalico/calico/stargazers","contributors_url":"https://api.github.com/repos/projectcalico/calico/contributors","subscribers_url":"https://api.github.com/repos/projectcalico/calico/subscribers","subscription_url":"https://api.github.com/repos/projectcalico/calico/subscription","commits_url":"https://api.github.com/repos/projectcalico/calico/commits{/sha}","git_commits_url":"https://api.github.com/repos/projectcalico/calico/git/commits{/sha}","comments_url":"https://api.github.com/repos/projectcalico/calico/comments{/number}","issue_comment_url":"https://api.github.com/repos/projectcalico/calico/issues/comments{/number}","contents_url":"https://api.github.com/repos/projectcalico/calico/contents/{+path}","compare_url":"https://api.github.com/repos/projectcalico/calico/compare/{base}...{head}","merges_url":"https://api.github.com/repos/projectcalico/calico/merges","archive_url":"https://api.github.com/repos/projectcalico/calico/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/projectcalico/calico/downloads","issues_url":"https://api.github.com/repos/projectcalico/calico/issues{/number}","pulls_url":"https://api.github.com/repos/projectcalico/calico/pulls{/number}","milestones_url":"https://api.github.com/repos/projectcalico/calico/milestones{/number}","notifications_url":"https://api.github.com/repos/projectcalico/calico/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/projectcalico/calico/labels{/name}","releases_url":"https://api.github.com/repos/projectcalico/calico/releases{/id}","deployments_url":"https://api.github.com/repos/projectcalico/calico/deployments","created_at":"2016-07-21T15:45:54Z","updated_at":"2016-12-03T13:22:51Z","pushed_at":"2016-12-02T23:51:24Z","git_url":"git://github.com/projectcalico/calico.git","ssh_url":"git@github.com:projectcalico/calico.git","clone_url":"https://github.com/projectcalico/calico.git","svn_url":"https://github.com/projectcalico/calico","homepage":null,"size":23462,"stargazers_count":38,"watchers_count":38,"language":"Ruby","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":19,"mirror_url":null,"open_issues_count":89,"forks":19,"open_issues":89,"watchers":38,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/projectcalico/calico/pulls/258"},"html":{"href":"https://github.com/projectcalico/calico/pull/258"},"issue":{"href":"https://api.github.com/repos/projectcalico/calico/issues/258"},"comments":{"href":"https://api.github.com/repos/projectcalico/calico/issues/258/comments"},"review_comments":{"href":"https://api.github.com/repos/projectcalico/calico/pulls/258/comments"},"review_comment":{"href":"https://api.github.com/repos/projectcalico/calico/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/projectcalico/calico/pulls/258/commits"},"statuses":{"href":"https://api.github.com/repos/projectcalico/calico/statuses/ba2ffed87446567495f0d32eca95cf440e27f104"}}}}
{"actor":{"display_login":"caseydavenport"}}