how to use kubeprism with the calico CNI and the tigera operator

[antoniojesusmartinjimenez]

I am implementing calico as my CNI without kubeproxy, I have it configured in eBPF mode and with the corresponding configmap for the connection to the API, this works perfectly, the problem occurs when I decide to use kubeprism instead of VIP, in that case I always get the same error:

Version:      v3.29.1
Build date:   2024-11-20T21:57:49+0000
Git tag ref:  v3.29.1
Git commit:   ddfc3b1ea
F0205 16:11:32.819785       1 server.go:93] error running server (unable to load configmap based request-header-client-ca-file: Get "https://127.0.0.1:7445/api/v1/namespaces/kube-system/configmaps/extension-apiserver-authentication": dial tcp 127.0.0.1:7445: connect: connection refused)

Does anyone know why this happens?

[smira]

Probably because you're configuring that on a pod which doesn't run with host-level networking. The KubePrism is only available for host networking pods, pod networking pods should use kubernetes service (10.96.0.1 by default).

[antoniojesusmartinjimenez]

That's exactly the problem.
Thank you very much everything is clear