--- title: "How 1&1 Mail & Media Scaled Kubernetes Networking with eBPF and Calico" source: "https://www.tigera.io/blog/how-11-mail-media-scaled-kubernetes-networking-with-ebpf-and-calico/" --- [Company Blog](https://www.tigera.io/category/company-blog/) [Technical Blog](https://www.tigera.io/category/technical-blog/) # How 1&1 Mail & Media Scaled Kubernetes Networking with eBPF and Calico By [Reza Ramezanpour](https://www.tigera.io/blog/author/rezar/) on Aug 05, 2025 • 3 min read “We started in 2017 with Calico and never regretted it!” —Stephan Fudeus, Product Owner/Lead Architect, 1&1 Mail & Media ## Challenge 1&1 Mail & Media, part of the United Internet, powers popular European internet brands including GMX and Web.de, serving more than 50% of Germany’s population with critical identity and email infrastructure. With roughly 45 to 50 million users, network reliability is non-negotiable. Any downtime could affect millions. By 2022, the company had containerized 80% of its workloads on Kubernetes across three self-managed data centers. While the platform, backed by bare metal nodes and custom network layers, was highly scalable, network throughput bottlenecks began to emerge. Pods were limited to 2.5 Gbps of bandwidth due to IP encapsulation overhead, despite 10 Gbps network interfaces. The team needed a solution that: - Improved pod-to-pod network performance - Maintained strong network policy isolation across up to 40 tenants per cluster - Scaled to millions of network connections and 1.4 million HTTP requests per second ## Solution 1&1 Mail & Media had adopted Calico back in 2017, largely for its unique Kubernetes NetworkPolicy standard support. As their Kubernetes platform evolved, with clusters scaling to 300 bare metal nodes, 16,000 pods, and over 4 million conntrack entries, the team turned to [Calico’s eBPF data plane](https://docs.tigera.io/calico/latest/about/kubernetes-training/about-ebpf) to unlock performance gains. Following successful initial trials of [eBPF](https://www.tigera.io/learn/guides/ebpf/) in development and integration environments, the team moved forward with production migrations in 2023. While early versions of Calico on older Linux kernel versions presented some limitations, these challenges were quickly addressed with proactive collaboration between the Calico maintainers and the team. The Calico team introduced key improvements such as auto-scaling of connection tracking tables, which enhanced resilience under load. Packet loss was effectively mitigated, enabling the team to successfully migrate production workloads to the eBPF mode. To support their rigorous deployment and security requirements, the 1&1 Mail & Media team also: - Deployed Calico with soft multi-tenancy isolation using namespaces and strict network policies - Ran clusters entirely on bare metal in their own data centers, avoiding cloud lock-in ## Results Today, one full data center at 1&1 Mail & Media runs entirely on the Calico eBPF data plane, with two more scheduled to follow. Early production results include: - **Improved pod-to-pod throughput**, approaching line-rate performance on 25 Gbps interfaces - **Stable operation under extreme load**, with over 4 million conntrack entries and 600+ Gbps aggregate network traffic - **Policy-driven traffic isolation** across up to 200 namespaces and 40 tenants per cluster - **Full support for Kubernetes-standard network policies**, avoiding vendor-specific CRDs ## What’s Next 1&1 Mail & Media continues to push the limits of open source [Kubernetes networking](https://www.tigera.io/learn/guides/kubernetes-networking/) at scale. With the eBPF data plane, they are exploring: - Fine-grained bandwidth QoS enforcement per tenant (available in iptables, and queued for eBPF in Calico 3.31.0 and above) - Enhanced observability with [Calico Whisker](https://www.tigera.io/blog/calico-whisker-your-new-ally-in-network-observability/), tailored for large-scale deployments - Adoption of Kubernetes admin network policy tiers to enable multi-level network policy governance [Watch the whole interview here.](https://youtu.be/FDKL7jNuNds) Do you have a Calico story to tell? [Let us know via this form](https://forms.gle/Wsee8JB3CKz9G7Vj9). [How-To](https://www.tigera.io/tags/how-to/)[Open Source](https://www.tigera.io/tags/open-source/)[Products](https://www.tigera.io/tags/products/) ## Related posts [![Meet Mylo: An AI-native way to work with Calico](https://www.tigera.io/app/uploads/2026/09/Meet-Mylo-An-AI-native-way-to-work-with-Calico.png)](https://www.tigera.io/blog/meet-mylo-an-ai-native-way-to-work-with-calico/) #### [Meet Mylo: An AI-native way to work with Calico](https://www.tigera.io/blog/meet-mylo-an-ai-native-way-to-work-with-calico/) By [Phil DiCorpo](https://www.tigera.io/blog/author/phil-dicorpo/) on Sep 3, 2026 A library of Calico tools and skills — delivered through the Calico MCP Server What if your hardest network question took ten minutes instead of ten days? Anyone who has operated Kubernetes networking at scale... [Read more](https://www.tigera.io/blog/meet-mylo-an-ai-native-way-to-work-with-calico/) [![The Safest Place to Run an AI Agent Is On a Cluster That Doesn’t Trust It](https://www.tigera.io/app/uploads/2026/08/The-Safest-Place-to-Run-an-AI-Agent-Is-On-a-Cluster-That-Doesnt-Trust-It.png)](https://www.tigera.io/blog/the-safest-place-to-run-an-ai-agent-is-on-a-cluster-that-doesnt-trust-it/) #### [The Safest Place to Run an AI Agent Is On a Cluster That Doesn’t Trust It](https://www.tigera.io/blog/the-safest-place-to-run-an-ai-agent-is-on-a-cluster-that-doesnt-trust-it/) By [Alister Baroi](https://www.tigera.io/blog/author/alister-baroi/) on Aug 27, 2026 Every organization running AI agents has already made a hosting decision. Most made it by accident. The sales team switched on the agent built into their CRM. Engineering is piloting a coding agent in a... [Read more](https://www.tigera.io/blog/the-safest-place-to-run-an-ai-agent-is-on-a-cluster-that-doesnt-trust-it/) [![AI Red Team Agents Automate Attacks on your AI Agents. Runtime Policies Automate their Defense.](https://www.tigera.io/app/uploads/2026/08/AI-Red-Team-Agents-Automate-Attacks-on-your-AI-Agents.-Runtime-Policies-Automate-their-Defense.png)](https://www.tigera.io/blog/ai-red-team-agents-automate-attacks-on-your-ai-agents-runtime-policies-automate-their-defense/) #### [AI Red Team Agents Automate Attacks on your AI Agents. Runtime Policies Automate their Defense.](https://www.tigera.io/blog/ai-red-team-agents-automate-attacks-on-your-ai-agents-runtime-policies-automate-their-defense/) By [Alister Baroi](https://www.tigera.io/blog/author/alister-baroi/) on Aug 24, 2026 The AI red teaming market grew up fast this year. OpenAI bought Promptfoo, Cisco and Microsoft shipped automated attack suites, and a seed-stage startup publicly compromised 50 of 55 live customer service bots. These platforms... [Read more](https://www.tigera.io/blog/ai-red-team-agents-automate-attacks-on-your-ai-agents-runtime-policies-automate-their-defense/)