Calico Open Source

Networking and security for containers and Kubernetes

Overview

Calico Open Source is a networking and security solution for containers, virtual machines, and native host-based workloads. It supports a broad range of platforms including Kubernetes, OpenShift, Docker EE, OpenStack, and bare metal services.

Whether you opt to use Calico’s eBPF data plane, Linux’s standard networking pipeline, or the Windows data plane, Calico delivers blazing-fast performance with true cloud-native scalability. Calico provides developers and cluster operators with a consistent experience and set of capabilities whether running in public cloud or on-premises, or on a single node or across a multi-thousand node cluster.

Benefits

Pluggable data planes includes eBPF, Windows, VPP, and Linux

Any container, any Kubernetes distro, any cloud

Unparalleled scalability & efficient resource utilization

Real-world production hardened

Architecture

Capabilities

Choice of data planes

Calico Open Source offers a choice of data planes, including a pure Linux eBPF data plane, a standard Linux networking data plane, and a Windows HNS data plane. Calico combines cutting-edge features with standard primitives system administrators are already familiar with, to provide networking and security for containers and Kubernetes.

Full Kubernetes network policy support

Calico Open Source’s network policy engine is the original reference implementation of Kubernetes network policy. It implements the full set of features defined by the Kubernetes networking API, giving users all of the capabilities and flexibility envisaged when the API was originally defined.

Kubernetes-native Security Policy Model

Calico Open Source translates networking and security best practices into a rich networking and security policy model for Kubernetes-native environments. Calico makes it easy for DevOps, SRE, platform architect, security, and compliance teams to allow or deny access to traffic. The solution comes with built-in support for WireGuard encryption, with higher performance and lower CPU consumption.

Calico’s policy engine enforces the same policy model at the host networking layer and at the application layer. Thus, it protects infrastructure from compromised workloads, and vice-versa.

Best-in-class Performance

Calico Open Source uses the Linux kernel’s built-in, highly optimized forwarding and access control capabilities to deliver native Linux networking data plane performance, typically without requiring any of the encap/decap overheads. Calico’s control plane and policy engine are optimized to minimize overall CPU usage and occupancy, leading to higher performance and lower monthly bills.

Workload interoperability

Calico Open Source enables Kubernetes workloads and non-Kubernetes or legacy workloads to communicate seamlessly and securely. Calico can easily extend to secure existing host-based workloads (whether in the public cloud, or on-premises on VMs or bare metal servers) alongside Kubernetes. All workloads are subject to the same network and security policy model for consistent enforcement of traffic flow externally and internally.

Scalable Networking

Calico’s core design principles leverage best practice cloud-native design patterns combined with proven standards based network protocols trusted worldwide by the largest internet carriers. The result is a solution with exceptional scalability that has been running at scale in production for years. Calico’s development test cycle includes regularly testing multi-thousand node clusters. Whether you are running a 10 node cluster, 100 node cluster, or more, you reap the benefits of the improved performance and scalability characteristics demanded by the largest Kubernetes clusters.

Encryption

Calico uses WireGuard to encrypt on-the-wire, in-cluster pod traffic in a Kubernetes cluster for additional security. Calico automatically creates and manages WireGuard tunnels between nodes providing transport-level security for on-the-wire, in-cluster pod traffic. WireGuard provides formally verified secure and performant tunnels without any specialized hardware.

Key Features

How It Works

Calico-logo-badge
Quickstart Guide

Learn about Kubernetes-native networking and security with Calico on a single-host Kubernetes cluster within 15 mins.

Learn more

If you like Calico, you will love Calico Cloud

Resources

Documentation

Learn more

GitHub

GitHub

Latest Content

Quick and easy vulnerability management with Calico Cloud

Quick and easy vulnerability management with Calico Cloud

By Dhiraj Sehgal on Aug 9, 2022

As more enterprises adopt containers, microservices, and Kubernetes for their cloud-native applications, they need to be aware of the vulnerabilities in container images during build and runtime that can be...

Read more >
Microsegmentation for Containers and Microservices: Best Practices

Microsegmentation for Containers and Microservices: Best Practices

By Neeraj Shahdadpuri on Aug 1, 2022

There is a reason why traditional network-based segmentation solutions will not work in cloud-native environments – they are not built for it! A Kubernetes-native approach is required to isolate containzerized...

Watch here >
Microsoft Azure: Hands-on AKS workshop: Implementing Zero-Trust Security for Containers

Microsoft Azure: Hands-on AKS workshop: Implementing Zero-Trust Security for Containers

By Neeraj Shahdadpuri on Jul 5, 2022

In this AKS-focused workshop, you will work with a Calico and Microsoft Azure expert to learn how to implement Zero-Trust security for workloads running on AKS. This 90-minute hands-on lab...

Register here >