--- title: "Host paths used by Calico Enterprise components" description: "Host paths that each Calico Enterprise 3.23 component mounts, with access mode, the condition for each path, and the release that added it." product: "Calico Enterprise" version: "3.23 (latest)" section: "Reference" canonical_url: "https://docs.tigera.io/calico-enterprise/latest/reference/installation/host-paths" --- # Host paths used by Calico Enterprise components Several Calico Enterprise components mount directories or files from the host node. If an admission policy, such as Kyverno or OPA Gatekeeper, limits the host paths that pods can use, it must allow these paths, or the components fail to start. Use this page to build or check your allow-list before you install or upgrade. Each table lists the host paths for one component: - **Volume** is the volume name in the pod spec. - **Access** is read-only or read-write. "Not mounted" means the volume is declared in the pod spec but no container mounts it. Policies that inspect pod volumes still see it. - **When present** says whether the path is always there or depends on your configuration. - **Added in** shows the 3.23 patch release that added the path. It is blank for paths that were present in 3.23.0. ## Host paths added in 3.23 | Host path | Component | Added in | | ---------------------- | ----------- | ---------- | | `/sys/kernel/security` | calico-node | **3.23.2** | For upgrade guidance, see the [3.23.2 release notes](https://docs.tigera.io/calico-enterprise/latest/release-notes.md). ## calico-node The `calico-node` DaemonSet runs on every Linux node, in the `calico-system` namespace. | Host path | Volume | Access | When present | Added in | | ------------------------------------------ | --------------------- | ----------- | --------------------------------- | ---------- | | `/lib/modules` | `lib-modules` | Read-only | Always | | | `/run/xtables.lock` | `xtables-lock` | Read-write | Always | | | `/var/run/nodeagent` | `policysync` | Read-write | Always | | | `/var/run/calico` | `var-run-calico` | Read-write | Always | | | `/var/lib/calico` | `var-lib-calico` | Read-write | Always | | | `/var/log/calico` | `var-log-calico` | Read-write | Always | | | `/sys/fs` | `sys-fs` | Read-write | Always, for the init container | | | `/sys/fs/bpf` | `bpffs` | Read-write | Always | | | `/proc` | `nodeproc` | Read-only | Always, for the init container | | | `/sys/kernel/security` | `sys-kernel-security` | Read-only | Always | **3.23.2** | | CNI binary directory | `cni-bin-dir` | Read-write | When the CNI plugin is Calico | | | CNI configuration directory | `cni-net-dir` | Read-write | When the CNI plugin is Calico | | | `/var/log/calico/cni` | `cni-log-dir` | Not mounted | When the CNI plugin is Calico | | | FlexVolume directory, plus `nodeagent~uds` | `flexvol-driver-host` | Read-write | Unless `flexVolumePath` is `None` | | | `/var/lib/calico/felix-plugins` | `felix-plugins` | Read-only | When the Linux data plane is VPP | | The CNI and FlexVolume directories depend on your platform. See [Default CNI and FlexVolume directories](#default-cni-and-flexvolume-directories). ## calico-node for Windows The `calico-node-windows` DaemonSet runs on Windows nodes, in the `calico-system` namespace, when the Windows data plane is enabled. | Host path | Volume | Access | When present | Added in | | ----------------------------------- | ---------------- | ----------- | ----------------------------- | -------- | | `/var/run/calico` | `var-run-calico` | Read-write | Always | | | `/var/lib/calico` | `var-lib-calico` | Read-write | Always | | | `/var/log/calico` | `var-log-calico` | Read-write | Always | | | Windows CNI binary directory | `cni-bin-dir` | Read-write | When the CNI plugin is Calico | | | Windows CNI configuration directory | `cni-net-dir` | Read-write | When the CNI plugin is Calico | | | Windows CNI log directory | `cni-log-dir` | Not mounted | When the CNI plugin is Calico | | | `/lib/modules` | `lib-modules` | Not mounted | Always | | | `/run/xtables.lock` | `xtables-lock` | Not mounted | Always | | | `/var/run/nodeagent` | `policysync` | Not mounted | Always | | ## CSI node driver The `csi-node-driver` DaemonSet runs on every Linux node, in the `calico-system` namespace, unless `kubeletVolumePluginPath` is `None`. The kubelet directory defaults to `/var/lib/kubelet`, and you can change it with `kubeletVolumePluginPath` in the [Installation resource](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api.md#installationspec). | Host path | Volume | Access | When present | Added in | | ------------------------------------------------ | ------------------ | ---------- | ------------ | -------- | | `/var/run` | `varrun` | Read-write | Always | | | Kubelet directory | `kubelet-dir` | Read-write | Always | | | Kubelet directory, plus `/plugins/csi.tigera.io` | `socket-dir` | Read-write | Always | | | Kubelet directory, plus `/plugins_registry` | `registration-dir` | Read-write | Always | | ## Log collector The `fluentd-node` DaemonSet runs in the `tigera-fluentd` namespace when the LogCollector resource exists. | Host path | Volume | Access | When present | Added in | | ----------------- | ---------------- | ---------- | ------------------------------------------------------------- | -------- | | `/var/log/calico` | `var-log-calico` | Read-write | Always | | | `c:/TigeraCalico` | `var-log-calico` | Read-write | On `fluentd-node-windows`, when the cluster has Windows nodes | | ## L7 log collector The `l7-log-collector` DaemonSet runs in the `calico-system` namespace when the ApplicationLayer resource exists. | Host path | Volume | Access | When present | Added in | | ----------------------- | -------------------- | ---------- | -------------------------------------------------------------------------------------------- | -------- | | `/var/run/l7-collector` | `l7-collector-socks` | Read-write | When L7 log collection or sidecar injection is enabled | | | `/var/run/dikastes` | `dikastes-sync` | Read-write | When the web application firewall, application layer policy, or sidecar injection is enabled | | | `/var/log/calico` | `var-log-calico` | Read-write | When the web application firewall or sidecar injection is enabled | | ## Deep packet inspection The `tigera-dpi` DaemonSet runs in the `tigera-dpi` namespace when at least one DeepPacketInspection resource exists. | Host path | Volume | Access | When present | Added in | | ------------------------------ | ------------------ | ---------- | ------------ | -------- | | `/var/log/calico/snort-alerts` | `log-snort-alters` | Read-write | Always | | ## Intrusion detection The `intrusion-detection-controller` Deployment runs in the `tigera-intrusion-detection` namespace. | Host path | Volume | Access | When present | Added in | | ----------------- | ---------------- | ---------- | --------------------------------------------------- | -------- | | `/var/log/calico` | `var-log-calico` | Read-write | When the LogCollector forwards IDS events to syslog | | ## API server audit logs One of these workloads runs in the `calico-system` namespace, depending on how the Calico Enterprise API is served. | Host path | Volume | Access | When present | Added in | | ----------------------- | ------------------- | ---------- | ---------------------------------------------------------------------------- | -------- | | `/var/log/calico/audit` | `calico-audit-logs` | Read-write | On `calico-apiserver`, when the API server runs as an aggregation API server | | | `/var/log/calico/audit` | `audit-logs` | Read-write | On `calico-webhooks`, when the cluster uses projectcalico.org/v3 CRDs | | ## Compliance The compliance workloads run in the `tigera-compliance` namespace when the Compliance resource exists. | Host path | Volume | Access | When present | Added in | | ------------------ | ----------------- | ---------- | ----------------------------------- | -------- | | `/var/lib/etcd` | `var-lib-etcd` | Read-only | On `compliance-benchmarker` | | | `/var/lib/kubelet` | `var-lib-kubelet` | Read-only | On `compliance-benchmarker` | | | `/etc/systemd` | `etc-systemd` | Read-only | On `compliance-benchmarker` | | | `/etc/kubernetes` | `etc-kubernetes` | Read-only | On `compliance-benchmarker` | | | `/usr/bin` | `usr-bin` | Read-only | On `compliance-benchmarker` | | | `/home/kubernetes` | `home-kubernetes` | Read-only | On `compliance-benchmarker`, on GKE | | | `/var/log/calico` | `var-log-calico` | Read-write | On compliance reporter pods | | ## Default CNI and FlexVolume directories The operator sets these directories when the Installation resource does not. You can set the CNI directories with `cni.binDir` and `cni.confDir`, the Windows CNI directories with `windowsNodes`, and the FlexVolume directory with `flexVolumePath`. For details, see the [Installation resource reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api.md#installationspec). | Platform | CNI binary directory | CNI configuration directory | FlexVolume directory | | ---------- | ---------------------- | --------------------------- | ------------------------------------------------------ | | OpenShift | `/var/lib/cni/bin` | `/var/run/multus/cni/net.d` | `/etc/kubernetes/kubelet-plugins/volume/exec/` | | GKE | `/home/kubernetes/bin` | `/etc/cni/net.d` | `/home/kubernetes/flexvolume/` | | AKS | `/opt/cni/bin` | `/etc/cni/net.d` | `/etc/kubernetes/volumeplugins/` | | RKE2 | `/opt/cni/bin` | `/etc/cni/net.d` | `/var/lib/kubelet/volumeplugins/` | | All others | `/opt/cni/bin` | `/etc/cni/net.d` | `/usr/libexec/kubernetes/kubelet-plugins/volume/exec/` | On Windows nodes, the CNI binary and configuration directories default to `/k/azurecni/bin` and `/k/azurecni/netconf` on AKS, `/Program Files/Amazon/EKS/cni` and `/Program Files/Amazon/EKS/cni/config` on EKS, and `/opt/cni/bin` and `/etc/cni/net.d` elsewhere. The Windows CNI log directory is `/var/log/calico/cni`. ## Additional resources - [Release notes](https://docs.tigera.io/calico-enterprise/latest/release-notes.md) - [Upgrade Calico Enterprise](https://docs.tigera.io/calico-enterprise/latest/getting-started/upgrading.md) - [Installation resource reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api.md#installationspec)