---
title: "Remote cluster configuration"
description: "Reference for the RemoteClusterConfiguration resource in Calico Enterprise that federates resources between clusters for shared identity."
product: "Calico Enterprise"
version: "3.23 (latest)"
section: "Reference"
canonical_url: "https://docs.tigera.io/calico-enterprise/latest/reference/resources/remoteclusterconfiguration"
---

# Remote cluster configuration

A remote cluster configuration resource (RemoteClusterConfiguration) represents a cluster in a federation of clusters. Each remote cluster needs a configuration to be specified to allow the local cluster to access resources on the remote cluster. The connection is one-way: the information flows only from the remote to the local cluster. To share information from the local cluster to the remote one a remote cluster configuration resource must be created on the remote cluster.

A remote cluster configuration causes Typha and `calicoq` to retrieve the following resources from a remote cluster:

- [Workload endpoints](https://docs.tigera.io/calico-enterprise/latest/reference/resources/workloadendpoint.md)
- [Host endpoints](https://docs.tigera.io/calico-enterprise/latest/reference/resources/hostendpoint.md)
- [Profiles](https://docs.tigera.io/calico-enterprise/latest/reference/resources/profile.md) (rules are not retrieved from remote profiles, only the `LabelsToApply` field is used)

When using the Kubernetes API datastore with RBAC enabled on the remote cluster, the RBAC rules must be configured to allow access to these resources.

For more details on the federation feature refer to the [Overview](https://docs.tigera.io/calico-enterprise/latest/multicluster/federation/overview.md).

For the meaning of the fields matches the configuration used for configuring `calicoctl`, see [Kubernetes datastore](https://docs.tigera.io/calico-enterprise/latest/operations/clis/calicoctl/configure/datastore.md) instructions for more details.

This resource is not supported in `kubectl`.

## Sample YAML

For a remote Kubernetes datastore cluster:

```yaml
apiVersion: projectcalico.org/v3
kind: RemoteClusterConfiguration
metadata:
  name: cluster1
spec:
  datastoreType: kubernetes
  kubeconfig: /etc/tigera-federation-remotecluster/kubeconfig-rem-cluster-1
```

For a remote etcdv3 cluster:

```yaml
apiVersion: projectcalico.org/v3
kind: RemoteClusterConfiguration
metadata:
  name: cluster1
spec:
  datastoreType: etcdv3
  etcdEndpoints: 'https://10.0.0.1:2379,https://10.0.0.2:2379'
```

## RemoteClusterConfiguration Definition

### Metadata

| Field | Description                                    | Accepted Values                           | Schema |
| ----- | ---------------------------------------------- | ----------------------------------------- | ------ |
| name  | The name of this remote cluster configuration. | Lower-case alphanumeric with optional `-` | string |

### Spec

| Field               | Secret key    | Description                                                        | Accepted Values       | Schema                     | Default |
| ------------------- | ------------- | ------------------------------------------------------------------ | --------------------- | -------------------------- | ------- |
| clusterAccessSecret |               | Reference to a Secret that contains connection information         |                       | Kubernetes ObjectReference | none    |
| datastoreType       | datastoreType | The datastore type of the remote cluster.                          | `etcdv3` `kubernetes` | string                     | none    |
| etcdEndpoints       | etcdEndpoints | A comma separated list of etcd endpoints.                          |                       | string                     | none    |
| etcdUsername        | etcdUsername  | Username for RBAC.                                                 |                       | string                     | none    |
| etcdPassword        | etcdPassword  | Password for the given username.                                   |                       | string                     | none    |
| etcdKeyFile         | etcdKey       | Path to the etcd key file.                                         |                       | string                     | none    |
| etcdCertFile        | etcdCert      | Path to the etcd certificate file.                                 |                       | string                     | none    |
| etcdCACertFile      | etcdCACert    | Path to the etcd CA certificate file.                              |                       | string                     | none    |
| kubeconfig          | kubeconfig    | Location of the `kubeconfig` file.                                 |                       | string                     | none    |
| k8sAPIEndpoint      |               | Location of the kubernetes API server.                             |                       | string                     | none    |
| k8sKeyFile          |               | Location of a client key for accessing the Kubernetes API.         |                       | string                     | none    |
| k8sCertFile         |               | Location of a client certificate for accessing the Kubernetes API. |                       | string                     | none    |
| k8sCAFile           |               | Location of a CA certificate.                                      |                       | string                     | none    |
| k8sAPIToken         |               | Token to be used for accessing the Kubernetes API.                 |                       | string                     | none    |

When using the `clusterAccessSecret` field, all other fields in the RemoteClusterconfiguration resource must be empty. When the `clusterAccessSecret` reference is used, all datastore configuration will be read from the referenced Secret using the "Secret key" fields named in the above table as the data key in the Secret. The fields read from a Secret that were file path or locations in a RemoteClusterConfiguration will be expected to be the file contents when read from a Secret.

All of the fields that start with `etcd` are only valid when the DatastoreType is etcdv3 and the fields that start with `k8s` or `kube` are only valid when the datastore type is kubernetes. The `kubeconfig` field and the fields that end with `File` must be accessible to Typha and `calicoq`, this does not apply when the data is coming from a Secret referenced by `clusterAccessSecret`.

When the DatastoreType is `kubernetes`, the `kubeconfig` file is optional but since it can contain all of the authentication information needed to access the Kubernetes API server it is generally easier to use than setting all the individual `k8s` fields. The other kubernetes fields can be used by themselves though or to override specific kubeconfig values.

## Supported operations

| Datastore type        | Create/Delete | Update | Get/List | Notes |
| --------------------- | ------------- | ------ | -------- | ----- |
| etcdv3                | Yes           | Yes    | Yes      |       |
| Kubernetes API server | Yes           | Yes    | Yes      |       |