--- title: "Kubespray 2.17 released with Calico eBPF and WireGuard support" source: "https://www.tigera.io/blog/kubespray-2-17-released-with-calico-ebpf-and-wireguard-support/" --- [Technical Blog](https://www.tigera.io/category/technical-blog/) # Kubespray 2.17 released with Calico eBPF and WireGuard support By [Noah Crowley](https://www.tigera.io/blog/author/noah/) on Oct 12, 2021 • 4 min read Congratulations to the Kubespray team on the release of 2.17! This release brings support for two of the newer features in Calico: support for the eBPF data plane, and also for WireGuard encryption. Let’s dive into configuring Kubespray to enable these new features. ***If you’re interested in getting started with Kubespray and Calico, you can refer to [Using Calico with Kubespray](https://www.tigera.io/blog/using-calico-with-kubespray/), which covers some of the settings you might want to use, as well as how to enable Calico in several of the quick start guides.*** To configure Calico options when using Kubespray to deploy a cluster, you’ll need to configure some variables. If you’re using the examples in the [Kubespray repository](https://github.com/kubernetes-sigs/kubespray/), those files are under `inventory/…/group_vars/k8s_cluster/`, with the Calico options residing in `k8s-net-calico.yml`. ## eBPF data plane Calico offers several different data planes, ensuring that end users can choose the technology that’s right for their particular use case. eBPF is a relatively new set of facilities in the Linux kernel that lets developers write code to modify its functionality at runtime in a way that is safe and efficient. Calico’s eBPF data plane offers increased efficiency, as well as functionality like providing source IP preservation for increased visibility of traffic. Reza Ramezanpour has a great [post](https://thenewstack.io/turbocharging-aks-networking-with-calico-ebpf/) that goes into more detail about the eBPF data plane with some examples using AKS, and there’s more information about [eBPF and how it’s used](https://docs.projectcalico.org/about/about-ebpf) in the Calico documentation. ### Enable the data plane The eBPF data plane has a number of significant differences in the way that it operates compared to the standard iptables data plane, and a few limitations as well. For complete details, refer to [Enable the eBPF data plane](https://docs.projectcalico.org/maintenance/ebpf/enabling-bpf) in the Calico documentation. If you want to enable the data plane, you can set: ``` calico_bpf_enabled: true ``` One difference is that Kubernetes’s built-in proxy, kube-proxy, relies on iptables to function. Because Calico’s eBPF data plane bypasses iptables, we need to remove kube-proxy, which we can do as follows: ``` kube_proxy_remove: true ``` ### Configure Calico to connect to the Kubernetes API Without kube-proxy, we need some way for Calico to communicate with the Kubernetes API. This is how the Kubespray docs describe how they’ve dealt with this issue: “Kubespray sets up the kubernetes-services-endpoint configmap based on the contents of the loadbalancer_apiserver inventory variable documented in HA Mode.” If no external load balancer is used, Calico eBPF can also use the localhost load balancer option. In this case, Calico automatic host endpoints need to be enabled to allow services like coredns and metrics-server to communicate with the Kubernetes host endpoint. The following variables are used: ``` loadbalancer_apiserver_localhost: true use_localhost_as_kubeapi_loadbalancer: true ``` You can also have a look at the [Configure Calico to talk directly to the API server](https://docs.projectcalico.org/maintenance/ebpf/enabling-bpf#configure-calico-to-talk-directly-to-the-api-server) section of the Calico docs. ### Direct Server Return This feature skips a network hop for traffic to services from outside the cluster, reducing latency and CPU usage, but requires that the underlying network allows one node to respond on behalf of another. There are some details about specific environments in the [Calico documentation](https://docs.projectcalico.org/maintenance/troubleshoot/troubleshoot-ebpf). You can enable this feature with: ``` calico_bpf_service_mode: "DSR" ``` ### eBPF troubleshooting To enable better debugging, you might want to turn on the Calico eBPF logs, which need to be examined using the tc program. The Calico documentation goes into more detail in the [Troubleshooting eBPF mode](https://docs.projectcalico.org/maintenance/troubleshoot/troubleshoot-ebpf#ebpf-program-debug-logs) section. You can turn on the logs by setting the following variable: ``` calico_bpf_log_level: "Debug" ``` ## WireGuard Calico released a [tech preview for WireGuard support in v3.14](https://www.tigera.io/blog/introducing-wireguard-encryption-with-calico/), with the feature becoming generally available in v3.15. When enabled, Calico will automatically set up WireGuard tunnels between each of your nodes, encrypting all pod traffic that goes “over the wire” between those nodes, securing your workload traffic at the cost of a small performance penalty. You can read more about this feature in [Introducing WireGuard Encryption with Calico](https://www.tigera.io/blog/introducing-wireguard-encryption-with-calico/), and find more details about [enabling encryption](https://docs.projectcalico.org/security/encrypt-cluster-pod-traffic) in the Calico documentation. To configure Kubespray to turn on WireGuard support when installing Calico, edit the following setting in `k8s-net-calico.yml`: ``` calico_wireguard_enabled: true ``` The Kubespray docs also mention that for certain operating systems, like CentOS 7 & 8, AlmaLinux, and Amazon Linux 2, you will also need the EPEL repo, which you can install using the following variable: ``` epel_enabled: true ``` ### Next steps If you enjoyed this blog, you might also like: - [Free, self-paced Calico certification course](https://academy.tigera.io/course/certified-calico-operator-level-1/) - Blog: [Introducing the Calico eBPF data plane](https://www.projectcalico.org/introducing-the-calico-ebpf-dataplane/) - [Getting started with Calico network policy](https://docs.projectcalico.org/security/calico-network-policy) - Free, online [webinars, workshops, and resources](https://www.tigera.io/events/) - Learn about [Calico Cloud](https://www.tigera.io/tigera-products/calico-commercial-editions/)   [eBPF](https://www.tigera.io/tags/ebpf/)[Open Source](https://www.tigera.io/tags/open-source/)[Project Calico](https://www.tigera.io/tags/project-calico/) ## Related posts [![What’s new in Calico: Spring 2026 Release](https://www.tigera.io/app/uploads/2026/06/Whats-New-in-Calico-NEW-TEMPLATE-2026.png)](https://www.tigera.io/blog/whats-new-in-calico-spring-2026-release/) [Company Blog](https://www.tigera.io/category/company-blog/) #### [What’s new in Calico: Spring 2026 Release](https://www.tigera.io/blog/whats-new-in-calico-spring-2026-release/) By [Veronika Smolik](https://www.tigera.io/blog/author/veronika-smolik/) on Jun 2, 2026 Kubernetes has come a long way since its debut in 2014. It’s gone from running a couple of containerized microservices to orchestrating fleets of production workloads spanning everything from AI agents to full scale VMs... [Read more](https://www.tigera.io/blog/whats-new-in-calico-spring-2026-release/) [![Kubernetes Operational Maturity: Secure and Resilient Cluster Federation with Cluster Mesh](https://www.tigera.io/app/uploads/2026/05/Kubernetes-Operational-Maturity-Secure-and-Resilient-Cluster-Federation-with-Cluster-Mesh.png)](https://www.tigera.io/blog/kubernetes-operational-maturity-secure-and-resilient-cluster-federation-with-cluster-mesh/) #### [Kubernetes Operational Maturity: Secure and Resilient Cluster Federation with Cluster Mesh](https://www.tigera.io/blog/kubernetes-operational-maturity-secure-and-resilient-cluster-federation-with-cluster-mesh/) By [Veronika Smolik](https://www.tigera.io/blog/author/veronika-smolik/) on May 25, 2026 Practically no one runs a single Kubernetes cluster in production these days. Maybe that’s how it started but data sovereignty requirements, acquisitions, AI initiatives and the need for edge servers, among other considerations, have pulled... [Read more](https://www.tigera.io/blog/kubernetes-operational-maturity-secure-and-resilient-cluster-federation-with-cluster-mesh/) [![What’s New in Calico v3.32](https://www.tigera.io/app/uploads/2026/05/Green-Please-use-a-different-background-color-alternately-1.png)](https://www.tigera.io/blog/whats-new-in-calico-v3-32/) #### [What’s New in Calico v3.32](https://www.tigera.io/blog/whats-new-in-calico-v3-32/) By [Reza Ramezanpour](https://www.tigera.io/blog/author/rezar/) on May 13, 2026 We’re excited to announce the release of Calico Open Source v3.32! 🎉 This release corresponds with Kubernetes v1.36 (Codename Haru) and it goes beyond just sharing a cat as the mascot of the release, it... [Read more](https://www.tigera.io/blog/whats-new-in-calico-v3-32/)