Calico Open Source

Networking and security for containers and Kubernetes

Overview

Calico Open Source is a networking and security solution for containers, virtual machines, and native host-based workloads. It supports a broad range of platforms including Kubernetes, OpenShift, Docker EE, OpenStack, and bare metal services.

Whether you opt to use Calico’s eBPF data plane, Linux’s standard networking pipeline, or the Windows data plane, Calico delivers blazing-fast performance with true cloud-native scalability. Calico provides developers and cluster operators with a consistent experience and set of capabilities whether running in public cloud or on-premises, or on a single node or across a multi-thousand node cluster.

Benefits

Pluggable data planes includes eBPF, Windows, VPP, and Linux

Any container, any Kubernetes distro, any cloud

Unparalleled scalability & efficient resource utilization

Real-world production hardened

Architecture

Capabilities

Choice of data planes

Calico Open Source offers a choice of data planes, including a pure Linux eBPF data plane, a standard Linux networking data plane, and a Windows HNS data plane. Calico combines cutting-edge features with standard primitives system administrators are already familiar with, to provide networking and security for containers and Kubernetes.

Full Kubernetes network policy support

Calico Open Source’s network policy engine is the original reference implementation of Kubernetes network policy. It implements the full set of features defined by the Kubernetes networking API, giving users all of the capabilities and flexibility envisaged when the API was originally defined.

Kubernetes-native Security Policy Model

Calico Open Source translates networking and security best practices into a rich networking and security policy model for Kubernetes-native environments. Calico makes it easy for DevOps, SRE, platform architect, security, and compliance teams to allow or deny access to traffic. The solution comes with built-in support for WireGuard encryption, with higher performance and lower CPU consumption.

Calico’s policy engine enforces the same policy model at the host networking layer and at the application layer. Thus, it protects infrastructure from compromised workloads, and vice-versa.

Best-in-class Performance

Calico Open Source uses the Linux kernel’s built-in, highly optimized forwarding and access control capabilities to deliver native Linux networking data plane performance, typically without requiring any of the encap/decap overheads. Calico’s control plane and policy engine are optimized to minimize overall CPU usage and occupancy, leading to higher performance and lower monthly bills.

Workload interoperability

Calico Open Source enables Kubernetes workloads and non-Kubernetes or legacy workloads to communicate seamlessly and securely. Calico can easily extend to secure existing host-based workloads (whether in the public cloud, or on-premises on VMs or bare metal servers) alongside Kubernetes. All workloads are subject to the same network and security policy model for consistent enforcement of traffic flow externally and internally.

Scalable Networking

Calico’s core design principles leverage best practice cloud-native design patterns combined with proven standards based network protocols trusted worldwide by the largest internet carriers. The result is a solution with exceptional scalability that has been running at scale in production for years. Calico’s development test cycle includes regularly testing multi-thousand node clusters. Whether you are running a 10 node cluster, 100 node cluster, or more, you reap the benefits of the improved performance and scalability characteristics demanded by the largest Kubernetes clusters.

Encryption

Calico uses WireGuard to encrypt on-the-wire, in-cluster pod traffic in a Kubernetes cluster for additional security. Calico automatically creates and manages WireGuard tunnels between nodes providing transport-level security for on-the-wire, in-cluster pod traffic. WireGuard provides formally verified secure and performant tunnels without any specialized hardware.

Key Features

How It Works

Calico-logo-badge
Quickstart Guide

Learn about Kubernetes-native networking and security with Calico on a single-host Kubernetes cluster within 15 mins.

Learn more

If you like Calico, you will love Calico Cloud

Resources

Documentation

Learn more

GitHub

GitHub

Latest Content

What’s new in Calico – Spring 2024

What’s new in Calico – Spring 2024

By Giri Radhakrishnan on Mar 7, 2024

Last quarter we announced Calico Cloud’s ‘Cluster Security Score’ feature as part of cluster security posture management. Today, we are excited to announce product and user experience improvements and better...

Read more >
Advancing Container Security: Key Insights and Solutions from 451 Research

Advancing Container Security: Key Insights and Solutions from 451 Research

By Eunice Cao on Feb 23, 2024

Join Mark Ehr, Principal Research Analyst, S&P Global Market Intelligence 451 Research, and Dhiraj Sehgal, Tigera Director of Product Marketing, for an exclusive webinar as they dive into key findings...

Watch here >
Amazon EKS Blueprint Workshop

Amazon EKS Blueprint Workshop

By Neeraj Shahdadpuri on Feb 5, 2024

Join us in this monthly EKS Workshop series to learn how the EKS Blueprints can accelerate your adoption of Amazon EKS. The EKS Blueprints project is an open-source development framework...

Register here >