<p>I discovered that, until a few months ago, <a href="https://github.com/kubernetes/kubernetes/issues/23920" rel="nofollow noreferrer">the "hostPort" configuration for Pods was not going to work with CNI based integrations</a>. This meant that, for any Kubernetes cluster using Calico, it was not possible to directly expose a Pod's port directly on a certain Node's port, without using a Service or flagging <code>hostNetwork=true</code> (which is a little bit extreme).</p>

<p>Starting from Kubernetes 1.7.0 it is possible but it is necessary to change Calico configuration in order to let <a href="https://github.com/containernetworking/plugins/pull/1" rel="nofollow noreferrer">the new "portmap" CNI plugin</a> in, which is what I'm trying to do, without success. I am starting from a new IBM Bluemix Container Service cluster.</p>

<p>My calico-node DaemonSet has the following CNI_NETWORK_CONFIG environmental variable:</p>

<pre><code>{
  "name": "k8s-pod-network",
  "cniVersion": "0.3.1",
  "type": "calico",
  "etcd_endpoints": "__ETCD_ENDPOINTS__",
  "etcd_key_file": "__ETCD_KEY_FILE__",
  "etcd_cert_file": "__ETCD_CERT_FILE__",
  "etcd_ca_cert_file": "__ETCD_CA_CERT_FILE__",
  "log_level": "info",
  "mtu": 1480,
  "ipam": {
    "type": "calico-ipam"
  },
  "policy": {
    "type": "k8s",
    "k8s_api_root": "https://__KUBERNETES_SERVICE_HOST__:__KUBERNETES_SERVICE_PORT__",
    "k8s_auth_token": "__SERVICEACCOUNT_TOKEN__"
  },
  "kubernetes": {
    "kubeconfig": "__KUBECONFIG_FILEPATH__"
  }
}
</code></pre>

<p>What I did here was just trying to replace it with the following configuration:</p>

<pre><code>{
  "name": "k8s-pod-network",
  "cniVersion": "0.3.1",
  "plugins": [{
    "type": "calico",
    "etcd_endpoints": "__ETCD_ENDPOINTS__",
    "etcd_key_file": "__ETCD_KEY_FILE__",
    "etcd_cert_file": "__ETCD_CERT_FILE__",
    "etcd_ca_cert_file": "__ETCD_CA_CERT_FILE__",
    "log_level": "info",
    "mtu": 1480,
    "ipam": {
      "type": "calico-ipam"
    },
    "policy": {
      "type": "k8s",
      "k8s_api_root": "https://__KUBERNETES_SERVICE_HOST__:__KUBERNETES_SERVICE_PORT__",
      "k8s_auth_token": "__SERVICEACCOUNT_TOKEN__"
    },
    "kubernetes": {
      "kubeconfig": "__KUBECONFIG_FILEPATH__"
    }
  },
    {
      "type": "portmap",
      "snat": true,
      "capabilities": {
        "portMappings": true
      }
    }
  ]
}
</code></pre>

<p><code>calico-node</code> pods were running successfully after a forced reboot, but my own Pods keep getting stuck in "Pending" status during initialization, with the event "Error syncing pod" from "kubelet NODE_IP".</p>

<p>I'd appreciate some help on this issue. Thanks in advance.</p>

<p>What you have looks reasonable as far as the contents, I think the problem may be that you need to change the name of the config file from ending in <code>.conf</code> to <code>.conflist</code>. There is a PR up with some WIP changes <a href="https://github.com/projectcalico/calico/pull/903" rel="nofollow noreferrer">https://github.com/projectcalico/calico/pull/903</a> for enabling hostport in the calico manifests, you can compare it with what you have done.</p>

<p>If you set the filename through the daemonset you should remove the previous config file on the hosts because the released install-cni container does not clean up the previous config and I am not sure which config file the kubelet would use.</p>
