--- title: "Host endpoint" description: "Reference for the HostEndpoint resource in Calico Open Source that represents a host network interface for policy enforcement." product: "Calico Open Source" version: "3.32 (latest)" section: "Reference" canonical_url: "https://docs.tigera.io/calico/latest/reference/resources/hostendpoint" --- # Host endpoint A host endpoint resource (`HostEndpoint`) represents one or more real or virtual interfaces attached to a host that is running Calico. It enforces Calico policy on the traffic that is entering or leaving the host's default network namespace through those interfaces. - A host endpoint with `interfaceName: *` represents *all* of a host's real or virtual interfaces. - A host endpoint for one specific real interface is configured by `interfaceName: `, for example `interfaceName: eth0`, or by leaving `interfaceName` empty and including one of the interface's IPs in `expectedIPs`. Each host endpoint may include a set of labels and list of profiles that Calico will use to apply [policy](https://docs.tigera.io/calico/latest/reference/resources/networkpolicy.md) to the interface. **Default behavior of external traffic to/from host** If a host endpoint is created and network policy is not in place, the Calico default is to deny traffic to/from that endpoint (except for traffic allowed by failsafe rules). For a named host endpoint (i.e. a host endpoint representing a specific interface), Calico blocks traffic only to/from the interface specified in the host endpoint. Traffic to/from other interfaces is ignored. > **SECONDARY:** Host endpoints with `interfaceName: *` do not support [untracked policy](https://docs.tigera.io/calico/latest/network-policy/extreme-traffic/high-connection-workloads.md). For a wildcard host endpoint (i.e. a host endpoint representing all of a host's interfaces), Calico blocks traffic to/from *all* interfaces on the host (except for traffic allowed by failsafe rules). However, profiles can be used in conjunction with host endpoints to modify default behavior of external traffic to/from the host in the absence of network policy. Calico provides a default profile resource named `projectcalico-default-allow` that consists of allow-all ingress and egress rules. Host endpoints with the `projectcalico-default-allow` profile attached will have "allow-all" semantics instead of "deny-all" in the absence of policy. Note: If you have custom iptables rules, using host endpoints with allow-all rules (with no policies) will accept all traffic and therefore bypass those custom rules. > **SECONDARY:** Auto host endpoints specify the `projectcalico-default-allow` profile so they behave similarly to pod workload endpoints. > **SECONDARY:** When rendering security rules on other hosts, Calico uses the `expectedIPs` field to resolve label selectors to IP addresses. If the `expectedIPs` field is omitted then security rules that use labels will fail to match this endpoint. **Host to local workload traffic**: Traffic from a host to its workload endpoints (e.g. Kubernetes pods) is always allowed, despite any policy in place. This ensures that `kubelet` liveness and readiness probes always work. ## Sample YAML ```yaml apiVersion: projectcalico.org/v3 kind: HostEndpoint metadata: name: some.name labels: type: production spec: interfaceName: eth0 node: myhost expectedIPs: - 192.168.0.1 - 192.168.0.2 profiles: - profile1 - profile2 ports: - name: some-port port: 1234 protocol: TCP - name: another-port port: 5432 protocol: UDP ``` ## Host endpoint definition ### Metadata | Field | Description | Accepted Values | Schema | | ------ | ------------------------------------------ | --------------------------------------------------- | ------ | | name | The name of this hostEndpoint. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | | labels | A set of labels to apply to this endpoint. | | map | ### Spec | Field | Description | Accepted Values | Schema | Default | | ------------- | -------------------------------------------------------------------------- | -------------------------- | -------------------------------------- | ------- | | node | The name of the node where this HostEndpoint resides. | | string | | | interfaceName | Either `*` or the name of the specific interface on which to apply policy. | | string | | | expectedIPs | The expected IP addresses associated with the interface. | Valid IPv4 or IPv6 address | list | | | profiles | The list of profiles to apply to the endpoint. | | list | | | ports | List of named ports that this workload exposes. | | List of [EndpointPorts](#endpointport) | | ### EndpointPort An EndpointPort associates a name with a particular TCP/UDP/SCTP port of the endpoint, allowing it to be referenced as a named port in [policy rules](https://docs.tigera.io/calico/latest/reference/resources/networkpolicy.md#entityrule). | Field | Description | Accepted Values | Schema | Default | | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------- | ------ | ------- | | name | The name to attach to this port, allowing it to be referred to in [policy rules](https://docs.tigera.io/calico/latest/reference/resources/networkpolicy.md#entityrule). Names must be unique within an endpoint. | | string | | | protocol | The protocol of this named port. | `TCP`, `UDP`, `SCTP` | string | | | port | The workload port number. | `1`-`65535` | int | | > **SECONDARY:** On their own, EndpointPort entries don't result in any change to the connectivity of the port. They only have an effect if they are referred to in policy.