--- title: "Calico Open Source" source: "https://www.tigera.io/tigera-products/calico/" description: "Calico Open Source is the most widely adopted Kubernetes CNI, delivering high-performance networking and network policy for pods across any cluster." --- Product # Calico Open Source Networking, network security, and observability that works across any Kubernetes distribution [Get Started](https://docs.tigera.io/) [Community](https://www.tigera.io/project-calico/community/) ![Project Calico data planes diagram showcasing eBPF, iptables, nftables, VPP, and HNS options](https://www.tigera.io/app/uploads/2026/01/OSS-data-planes-753x471-03.png) Jump to - Benefits - Architecture - Capabilities - Choice of data plane - Full Kubernetes network policy support - Calico Network Policies - Staged Policies - Observability with Whisker - Workload interoperability - Calico Ingress Gateway - Encryption - Best-in-class performance - Scalable networking - Key Features - How It Works - Resources - Get Started ## Benefits Calico Open Source provides a unified solution for Kubernetes networking, network security, and observability. It works seamlessly across any Kubernetes distribution, ensuring your workloads are truly portable. Beyond containers, Calico extends network security to virtual machines and bare metal servers, offering a single, consistent security policy framework for your entire infrastructure. Trusted and proven in some of the world's largest enterprises and technology environments, Calico is the most widely adopted solution, powering over 1 million clusters globally. ![An outline icon of a plug, socket, and a slotted block.](https://www.tigera.io/app/uploads/2024/06/icon-84x84-plugglable-dataplanes.svg) ### Pluggable data planes: eBPF, nftables, iptables, Windows, and VPP ![A Kubernetes wheel inside a cloud outline.](https://www.tigera.io/app/uploads/2024/06/icon-84x84-Any-kubernetes-distro-any-cloud.svg) ### Any workload, any Kubernetes distro, any deployment environment ![An icon showing a square with four outward arrows.](https://www.tigera.io/app/uploads/2024/06/icon-84x84-Unparallel-scalability-efficient-resource-utilization.svg) ### Unparalleled scalability & efficient resource utilization ![A globe icon surrounded by four corner brackets.](https://www.tigera.io/app/uploads/2024/06/icon-84x84-Real-world-production-hardened.svg) ### Real-world production hardened ## Architecture ![Calico Open Source deployment diagram](https://www.tigera.io/app/uploads/2025/05/Calico-Open-Source-deployment-diagram-1.png) ### Choice of data plane Calico’s pluggable data plane architecture lets you select the best data plane for your needs. Choose from eBPF, Windows, iptables, or nftables. This pluggable architecture ensures it can readily incorporate new networking technologies, making it future-proof. ![Three types of Kubernetes network policies are listed.](https://www.tigera.io/app/uploads/2025/06/K8s-network-policy-support-753x471-1.png) ### Full Kubernetes network policy support Calico Open Source’s network policy engine implements the full set of features defined by the Kubernetes networking API, including the latest release of AdminNetworkPolicy and BaselineAdminNetworkPolicy. This gives you the full power and flexibility that Kubernetes network policy was designed to offer. ### Calico Network Policies Calico Open Source offers advanced Kubernetes-native security policies that simplify the implementation of network security. Calico network policies support policy tiers to precisely define policy evaluation order, leverage “deny and log” actions for enhanced security, and apply more flexible match criteria. Calico network policies support NetworkSets and implement cluster-wide security rules with global policies that extend beyond individual namespaces. ![Staged Policy transitions to Enforced Policy.](https://www.tigera.io/app/uploads/2025/06/Staged-Policies-753x373-1.png) ### Staged Policies Staged Policies in Calico let you test Calico and Kubernetes network policy behaviour without enforcing them. This helps teams safely evaluate the impact of a policy before it goes live, reducing the risk of misconfigurations and service disruptions. By simulating how a policy would behave in production, before actually enforcing it, platform and security teams can iterate quickly and deploy with confidence. ### Observability with Whisker Calico Open Source includes Whisker, a visual UI tool that simplifies access to flow logs. Whisker makes it easier to analyze network communication and debug policies, providing clear visibility into traffic. This helps you quickly pinpoint network communication issues and optimize your network security policies. ![Workload types: Containers, VMs, and Bare Metal.](https://www.tigera.io/app/uploads/2025/06/Workload-interoperability-753x389-1.png) ### Workload interoperability Calico Open Source enables seamless and secure communication between Kubernetes containers and traditional host-based workloads (such as virtual machines and bare metal servers). Its architecture easily applies security policies to these workloads, regardless of the environment, alongside your Kubernetes deployments. This ensures consistent network and security enforcement for all traffic, both within the cluster and externally. ![Calico Ingress Gateway Examples Diagram](https://www.tigera.io/app/uploads/2025/02/diagram-Calico-Ingress-Gateway-Examples.png) ### Calico Ingress Gateway Calico Ingress Gateway is a 100% upstream distribution of Envoy Gateway that provides a standardized way to manage Kubernetes ingress traffic. It offers advanced traffic control, integrated load balancing, and seamless ingress traffic policy enforcement. This simplifies traffic management, strengthens security, and optimizes resource utilization across the cluster. ![Digital padlock with glowing circuit lines.](https://www.tigera.io/app/uploads/2025/06/Encryption-753x411-1.png) ### Encryption Calico Open Source implements transport-level security for in-cluster Kubernetes pod traffic by automatically creating and managing WireGuard tunnels between nodes. This encrypts on-the-wire communication, leveraging WireGuard’s formally verified and performant security features. ![A rocket launches above a glowing, ascending bar graph.](https://www.tigera.io/app/uploads/2025/06/Performance-753x471-1.png) ### Best-in-class performance Calico Open Source achieves high-performance Linux networking by using the Linux kernel’s built-in, optimized forwarding and access control. This usually eliminates the performance impact of encapsulation and decapsulation. Additionally, Calico’s control plane and policy engine are designed to minimize CPU usage and resource demands, resulting in better performance and lower costs. ![Kubernetes logo on a globe within a global network.](https://www.tigera.io/app/uploads/2025/06/Scalable-networking-753x471-2.png) ### Scalable networking Built on cloud-native best practices and trusted network standards used by the largest internet carriers, Calico Open Source delivers exceptional scalability proven in large-scale production environments for years. Our rigorous development testing includes multi-thousand-node clusters, ensuring that whether you have 10 nodes or 10,000+, you benefit from the performance and scalability demanded by the largest Kubernetes deployments. ## Key Features ### CNI Data Planes ![Icon of a connected plug, socket, and rectangular elements.](https://www.tigera.io/app/uploads/2024/07/icon-data-plane-60x45-3.svg) #### Linux eBPF Leverage eBPF for fast, scalable Kubernetes networking, deep observability, and reduced CPU overhead. + More ![Icon of a connected plug, socket, and rectangular elements.](https://www.tigera.io/app/uploads/2024/07/icon-data-plane-60x45-3.svg) #### Linux iptables Use iptables for proven, flexible Kubernetes networking that is well known throughout the industry for its compatibility and reliability. + More ![Icon of a connected plug, socket, and rectangular elements.](https://www.tigera.io/app/uploads/2024/07/icon-data-plane-60x45-3.svg) #### Linux nftables Modernize Kubernetes networking with nftables, a flexible, extensible, and more performant alternative to iptables. + More ![Windows icon with three connected boxes.](https://www.tigera.io/app/uploads/2024/07/icon-Windows-60x45-2.svg) #### Windows Run Calico on Windows workloads with full network policy enforcement and support for hybrid Kubernetes clusters. + More ![Stylized VPP icon.](https://www.tigera.io/app/uploads/2024/07/icon-VPP-60x45-2.svg) #### VPP Achieve ultra-fast Kubernetes networking with Calico’s VPP data plane, optimized for high-throughput, low-latency workloads. + More ### Networking ![Kubernetes network policy icon.](https://www.tigera.io/app/uploads/2024/07/icon-Kubernetes-network-policy-60x45-2.svg) #### Kubernetes network policy Define and enforce traffic rules to control communication between Kubernetes pods, namespaces, and services. + More ![Kubernetes security policy icon.](https://www.tigera.io/app/uploads/2024/07/icon-security-policy-for-Kubernetes-services-60x45-2.svg) #### Network security policy for Kubernetes services Secure access to Kubernetes services with fine-grained, identity-aware network policies at the service level. + More ![Document with bar chart and security shield icon.](https://www.tigera.io/app/uploads/2024/07/icon-security-policy-high-connection-workloads-60x45-2.svg) #### Security policy for high-connection workloads Apply performant, scalable security policies for workloads with high connection rates or long-lived connections. + More ![Checklist icon with a checkmark.](https://www.tigera.io/app/uploads/2024/07/icon-compliance-and-audit-60x45-2.svg) #### Policy for hosts, VMs, and bare metal Enforce consistent network security policies across Kubernetes container, virtual machine, and bare-metal workloads. + More #### High-performance scalable pod networking Deliver fast, reliable, and scalable networking for Kubernetes workloads. + More #### Direct infrastructure peering without the overlay Calico supports direct, high-performance pod-to-pod communication without VXLAN or IP-in-IP overlays using native routing. + More #### Advanced IP address Management Control IP address allocation with flexible, efficient IPAM for Kubernetes. + More #### Data-in-transit encryption Encrypt Kubernetes pod-to-pod traffic using high-performance WireGuard for strong in-transit data protection. + More ### Observability #### Calico Whisker for observability Track, analyze, and troubleshoot Kubernetes network behavior with Calico Whisker’s easy-to-use observability UI tool. + More ### Platforms and Environments #### Multi and hybrid cloud Networking, network security, and observability of workloads across on-prem, public cloud, and hybrid environments. + More #### On Premises Networking, network security, and observability of workloads across on-premise environments. + More Select a card to see detailed content. Select a card Select a card to see detailed content. [Learn More](https://docs.tigera.io/calico/latest/about) ## How It Works Get started with Calico Open Source [Quickstart Guide](https://docs.tigera.io/calico/latest/getting-started/kubernetes/quickstart) ## Featured Resources Developer-created resources to help you secure your Kubernetes deployment ![Calico Documentation](https://www.tigera.io/app/uploads/2024/06/Featured-resources-documentation.png) Documentation ### Calico Documentation Get started with Calico Open Source for your networking and network policy needs. [Read More](https://docs.tigera.io/calico/latest/getting-started/) ![Calico GitHub](https://www.tigera.io/app/uploads/2024/06/GitHub-1200x628-1.png) GitHub ### Calico GitHub Get hands-on experience in your labs to evaluate Calico Open Source for your particular use cases. [Read More](https://github.com/projectcalico/calico) ![Calico Certifications](https://www.tigera.io/app/uploads/2024/06/Featured-resources-Calico-certification.png) Certification ### Calico Certifications Take self-paced certification exams to become container networking and security expert. [Read More](https://www.tigera.io/lp/calico-certification/) ![Introducing the Calico eBPF data plane](https://www.tigera.io/app/uploads/2022/06/Calico-eBPF-data-plane-02.png) Blog ### Introducing the Calico eBPF data plane Learn more about Calico’s eBPF dataplane for faster, leaner Kubernetes networking. [Read More](https://www.tigera.io/blog/introducing-the-calico-ebpf-dataplane/) ![How Network Security Policies can Protect Your Environment](https://www.tigera.io/app/uploads/2021/12/cloud-malware-Log4j.png) Blog ### How Network Security Policies can Protect Your Environment Find out how network security policies defend against future threats like Log4j. [Read More](https://www.tigera.io/blog/how-network-security-policies-can-protect-your-environment-from-future-vulnerabilities-like-log4j/) ![8 Best Practices to Secure Your Cluster](https://www.tigera.io/app/uploads/2025/04/Kubernetes-Security-8-Best-Practices-to-Secure-Your-Cluster-Blue-380x200.png) Learn Guide ### 8 Best Practices to Secure Your Cluster Learn to implement Kubernetes Security best practices with policies, RBAC, and more for stronger defense. [Read More](https://www.tigera.io/learn/guides/kubernetes-security/) ![Kubernetes Networking: The Complete Guide](https://www.tigera.io/app/uploads/2021/08/Kubernetes-Networking-The-Complete-Guide-Blue.png) Learn Guide ### Kubernetes Networking: The Complete Guide Learn to understand the Kubernetes networking model, services, DNS, and how to implement network policies. [Read More](https://www.tigera.io/learn/guides/kubernetes-networking/) ![Calico Logo](https://www.tigera.io/app/uploads/2026/01/Calico-logo-2026-black-text.svg) ## If you like Calico, you will love Calico Cloud Get started for free or request a demo to see Calico in action [Start Free](https://www.calicocloud.io/) [Get a Demo](https://www.tigera.io/demo/)