Calico
By Tigera
Calico is a networking and network policy engine for Kubernetes and other container platforms that provides pod-to-pod connectivity and fine-grained, identity-based security rules across a cluster. It implements the Kubernetes networking…
Definition
Calico is a networking and network policy engine for Kubernetes and other container platforms that provides pod-to-pod connectivity and fine-grained, identity-based security rules across a cluster. It implements the Kubernetes networking model using either a pure layer-three routing approach or an eBPF-based data plane, and enforces network policies that control precisely which workloads can communicate with which others across nodes.
Overview
Calico was created to solve two related problems in container orchestration: how pods across many nodes get IP addresses and routes that let them communicate, and how administrators enforce which workloads are allowed to talk to which others in an environment where services are created and destroyed constantly. Early container networking solutions often relied on overlay networks that encapsulated traffic in additional protocol headers, adding overhead; Calico instead popularized a routing-based approach that treats each pod as a fully routable endpoint on the underlying network where possible. Mechanically, Calico assigns IP addresses to pods and programs routing tables on each node so that traffic between pods can be forwarded directly using standard IP routing, using BGP to distribute routes between nodes in many deployments, avoiding the overhead of tunnel encapsulation when the underlying network topology allows it. For networks where direct routing is not feasible, Calico can also operate in an overlay mode using VXLAN. On top of connectivity, Calico's network policy engine reads Kubernetes NetworkPolicy resources and its own extended policy custom resources to compile firewall-like rules that are enforced either through Linux's iptables or through an eBPF-based data plane that can bypass much of the traditional kernel networking stack for better performance. Compared to Flannel, which focuses primarily on simple overlay connectivity between pods without native network policy enforcement, Calico provides a more complete solution that combines connectivity with fine-grained, identity-aware security policy. Compared to Cilium, another eBPF-capable Kubernetes networking project, Calico offers a comparable BGP-routing heritage and policy model, while Cilium has emphasized deep eBPF integration and additional observability features from its inception; the two projects have converged somewhat over time, with Calico also adopting eBPF as a data plane option. In practice, Calico is deployed as the container network interface plugin in Kubernetes clusters across cloud, on-premises, and hybrid environments, particularly where administrators need explicit control over which services can communicate, such as isolating tenants in a multi-tenant cluster or enforcing compliance boundaries between application tiers. Its BGP-based routing model also makes it a common choice for on-premises clusters that want pod networking to integrate cleanly with existing physical network infrastructure. The trade-offs involve operational complexity: BGP-based routing requires network infrastructure and administrators comfortable with routing protocols, and choosing between iptables and eBPF data planes involves understanding kernel version requirements and performance characteristics. Teams wanting the simplest possible pod networking with no policy requirements often choose lighter-weight options like Flannel, while those needing deep network observability alongside policy sometimes evaluate Cilium as an alternative.
Key Features
- Implements pod networking using BGP-based layer-three routing
- Supports VXLAN overlay mode where direct routing is not possible
- Enforces Kubernetes NetworkPolicy resources and extended custom policies
- Offers both iptables and eBPF-based data plane options
- Provides identity-aware, fine-grained security rules between workloads
- Scales to large multi-node Kubernetes clusters across environments
- Integrates with existing physical network infrastructure via BGP
- Supports multi-tenant network isolation within a shared cluster