Calico Open Source

Delivers Kubernetes networking and security for cloud-native applications


Calico Open Source is a Kubernetes networking and security solution for containers, virtual machines, and native host-based workloads. It supports a broad range of platforms including Kubernetes, OpenShift, Docker EE, OpenStack, and bare metal services.

Calico Open Source combines flexible networking capabilities with run-anywhere security policy enforcement to provide a solution with native Linux kernel performance and cloud-native scalability. Calico provides developers, devops, SREs, and platform operators with a consistent experience and set of capabilities whether running in the public cloud or on-premises, on a single node, or across a multi-node cluster.


Pluggable dataplanes includes eBPF, Windows and Linux

Any Kubernetes distro, any Cloud

Unparalleled scalability & efficient resource utilization

Real-world production hardened



Choice of data planes

Calico Open Source offers a choice of data planes, including a pure Linux eBPF data plane, a standard Linux networking data plane, and a Windows HNS data plane. Calico combines cutting-edge features with standard primitives system administrators are already familiar with, to provide Kubernetes networking and security for cloud-native applications.

Full Kubernetes network policy support

Calico Open Source’s network policy engine is the original reference implementation of Kubernetes network policy. It implements the full set of features defined by the Kubernetes networking API, giving users all of the capabilities and flexibility envisaged when the API was originally defined.

Kubernetes-native Security Policy Model

Calico Open Source translates networking and security best practices into a rich networking and security policy model for Kubernetes-native environments. Calico makes it easy for DevOps, SRE, platform architect, security, and compliance teams to allow or deny access to traffic. The solution comes with built-in support for WireGuard encryption, with higher performance and lower CPU consumption.

Calico’s policy engine enforces the same policy model at the host networking layer and at the application layer. Thus, it protects infrastructure from compromised workloads, and vice-versa.

Best-in-class Performance

Calico Open Source uses the Linux kernel’s built-in, highly optimized forwarding and access control capabilities to deliver native Linux networking data plane performance, typically without requiring any of the encap/decap overheads. Calico’s control plane and policy engine are optimized to minimize overall CPU usage and occupancy, leading to higher performance and lower monthly bills.

Workload interoperability

Calico Open Source enables Kubernetes workloads and non-Kubernetes or legacy workloads to communicate seamlessly and securely. Calico can easily extend to secure existing host-based workloads (whether in the public cloud, or on-premises on VMs or bare metal servers) alongside Kubernetes. All workloads are subject to the same network and security policy model for consistent enforcement of traffic flow externally and internally.

Scalable Networking

Calico’s core design principles leverage best practice cloud-native design patterns combined with proven standards based network protocols trusted worldwide by the largest internet carriers. The result is a solution with exceptional scalability that has been running at scale in production for years. Calico’s development test cycle includes regularly testing multi-thousand node clusters. Whether you are running a 10 node cluster, 100 node cluster, or more, you reap the benefits of the improved performance and scalability characteristics demanded by the largest Kubernetes clusters.


Calico enables WireGuard to secure on-the-wire, in-cluster pod traffic in a Kubernetes cluster. Calico automatically creates and manages WireGuard tunnels between nodes providing transport-level security for on- the-wire, in-cluster pod traffic. WireGuard provides formally verified secure and performant tunnels without any specialized hardware.

How It Works


Learn about Kubernetes-native networking and security with calico on a single-host Kubernetes cluster within 15 mins.

If you like Calico, you will love Calico Cloud



Learn more


Get Started

Latest Content

A Sneak Peek at the “Calico Certified Operator: AWS Expert” Course

A Sneak Peek at the "Calico Certified Operator: AWS Expert" Course

By Chris Tomkins on Jul 29, 2021

This One’s All About You Recently, we released our new “Calico Certified Operator: AWS Expert” course. You can read more about why we created this course and how it can

Read more >
Solving PCI Compliance Challenges in Dynamic Kubernetes Environments

Solving PCI Compliance Challenges in Dynamic Kubernetes Environments

By Neeraj Shahdadpuri on Jul 27, 2021

Increased adoption of containers and cloud platforms has resulted in a proliferation of new security risks. The dynamic nature of Kubernetes can create challenges for organizations with PCI-DSS regulatory compliance...

Register here >
Hands-on workshop: Kubernetes observability design and implementation for any distro, any cloud and any application

Hands-on workshop: Kubernetes observability design and implementation for any distro, any cloud and any application

By Neeraj Shahdadpuri on Jul 23, 2021

Deep dive hands-on workshop with a Calico expert to design and implement Kubernetes observability 90-mins interactive lab with your own provisioned Calico Cloud environment is designed to provide more complete...

Watch here >