When we first launched Project Calico in 2016, we set out to make Kubernetes networking easy, reliable, and scalable for all organizations. Our goal was to abstract away the complexity and performance overheads of other CNI plugins while simultaneously extending Kubernetes network policy to make it easier to secure your Kubernetes workloads.
Over the last 9 years, we’ve seen our community grow alongside Calico Open Source, which has become the most widely adopted Kubernetes networking tool that now powers over 8 million nodes across more than 166 countries. We’ve seen the challenges our community has faced as more organizations adopt Kubernetes, and as the scale and complexity of these Kubernetes deployments has increased. Through our commercial offerings, we’ve helped solve networking and network security challenges for some of the world’s largest Kubernetes deployments, from financial institutions to telcos.
Calico OSS 3.30
With the release of Calico OSS 3.30 in May, we are open sourcing our battle-tested observability and security tools from our commercial editions. This includes the following key features:
- Goldmane – A gRPC-based API for accessing and capturing flow logs and policy evaluation metrics
- Whisker – A web-based tool for viewing and filtering flow logs to troubleshoot connectivity issues and author and maintain Calico network security policies
- GlobalStagedNetworkPolicy and StagedNetworkPolicy – New custom resources that allow you to audit the behavior of a new policy before you actively enforce it
- Calico Ingress Gateway – Our 100% upstream, enterprise-ready implementation of the Gateway API that is based on Envoy Gateway
- Calico Cloud ready – Every OSS cluster includes the required components to connect to a stateless, read-only, and free version of Calico Cloud
With these new features, it is easier than ever for all organizations to get visibility into and secure their service-to-service communications and extend Calico deployments to manage ingress for their clusters
We truly mean every organization: it doesn’t matter if you are running ten or ten thousand nodes, we are the only solution to offer data plane support for eBPF, iptables, nftables, Windows, or VPP. Calico provides unparalleled flexibility across three critical dimensions:
- Multi-Distribution Compatibility – Supports any Kubernetes distribution including upstream Kubernetes, Red Hat OpenShift, SUSE Rancher, Mirantis, AKS, EKS, GKE & many more
- Choice of infrastructure – Deploy efficiently across diverse environments—from data centers to public clouds and edge locations
- Pluggable Data Plane Support – Leverage your choice of networking technologies including eBPF, nftables, iptables, Windows, VPP, and future innovations
By decoupling networking from infrastructure constraints, Calico enables enterprise teams to design more resilient, future-proof Kubernetes architectures. Our approach avoids vendor lock-in, minimizes migration complexity, and maximizes architectural choice, ensuring your networking strategy remains as dynamic as your business.
We celebrate the diversity of our community and their Kubernetes deployments, and we are committed to providing you with the same reliability and scalability regardless of your size or technology stack.
Visibility into workload communications with Calico’s flow logs, metrics, and Whisker
Troubleshooting applications running in Kubernetes is a major pain for DevOps teams and developers. Because of the dynamic and ephemeral nature of Kubernetes workloads, it is extremely difficult to make sense of network traffic inside the cluster as well as to resources outside the cluster.
Goldmane is a new gRPC-based API endpoint that can be used to access Calico’s flow logs and metrics. This makes it easier and more efficient for DevOps teams to troubleshoot their clusters by providing increased visibility into service-to-service communications alongside workload-specific context. Further, flow logs and metrics makes it easier for DevOps teams to collaborate with developers and security teams to share logs and visibility into application traffic flows.
When used alongside Calico network sets, flow logs become a powerful tool for getting visibility into where traffic is going across public and private IP spaces. The user-defined network sets appear as additional metadata in flow logs, cutting down the time spent troubleshooting during an incident from days to minutes.
Calico also includes Whisker, a simple web-based tool that connects to Goldmane so you can get immediate access to the flow logs generated by Calico. It includes filtering capabilities and the ability to view all flow log metadata so you can easily troubleshoot connectivity issues and author new policies.
We’ve spent years iterating and improving upon flow logs in real-world, large-scale deployments. Starting today, OSS users can benefit from the same visibility that the world’s largest banks and telcos rely on to troubleshoot their Kubernetes deployments. You can check out the Calico documentation to learn more about flow logs and how to get started with them.
Microsegmentation made easier with staged policies
We’ve seen some of the largest Kubernetes deployments in the world use Calico to improve the security posture of their clusters by explicitly authorizing workload communication with network policies. However, it can be a challenging process to get started given the power of these policies—one misstep and you could easily break your cluster.
Calico now includes support for GlobalStagedNetworkPolicy and StagedNetworkPolicy, two APIs from our commercial editions that have been invaluable tools to aid the process of implementing namespace isolation and other forms of microsegmentation. Staged policies enable you to test and audit the behavior of a Calico policy before you actively enforce it. They appear in flow logs and generate metrics just like any other policy, and can easily be converted to a CalicoNetworkPolicy by simply changing the resource type.
Calico and the Kubernetes Gateway API
Last but not least, Calico OSS 3.30 includes Calico Ingress Gateway, our 100% upstream, enterprise-ready implementation of the Kubernetes Gateway API based on Envoy Gateway, an open source project that uses the Envoy Proxy for flexible, high-performance ingress control.
The Kubernetes Gateway API has generated a lot of excitement in the Kubernetes community for providing a comprehensive set of APIs that establishes a portable solution to manage ingress for your cluster, for everything from load balancing, failover strategies, to rate limiting. Its hierarchical and role-oriented set of resources also enables teams to delegate the management of routes to development teams and reduce the operational overhead of managing ingress.
Summary
We’re excited to share this landmark release of Calico and we’re looking forward to seeing how our community leverages these new capabilities to improve the network security and observability of their Kubernetes environments. You can learn more about these features in our docs and release notes once the release comes out in May, along with other capabilities such as more granular controls for defining automatic HostEndpoints, quality-of-service (QoS) policies, and IP Address Management (IPAM) for load balancers.
Looking for more information on Calico features and capabilities? Check out the Calico documentation to learn more.
