Calico is an open-source Kubernetes CNI plugin and network security platform that handles pod-to-pod networking and network policy enforcement in a single solution. Created and maintained by Tigera, it is the most widely adopted Kubernetes networking solution, powering over 8 million nodes daily across 166 countries. 7.1k GitHub stars, latest version v3.31.4 (February 2026).
Unlike tools that only scan images or check configurations, Calico operates at the network layer — controlling which pods can talk to each other, encrypting traffic between nodes with WireGuard, and enforcing microsegmentation policies that follow workloads across clusters.
Overview
Calico provides two core capabilities in one platform: Kubernetes networking (routing pod traffic) and network security (controlling what traffic is allowed). This dual role sets Calico apart from pure security tools — it is both the network fabric and the policy enforcement engine.
The project offers a pluggable data plane architecture. Teams can choose between:
| Data Plane | Best For |
|---|---|
| eBPF | High-performance environments, source IP preservation |
| Standard Linux (nftables/iptables) | Maximum compatibility, proven stability |
| Windows HNS | Mixed Linux/Windows Kubernetes clusters |
| VPP | Telco and high-throughput edge workloads |
This flexibility lets Calico run everywhere from single-node development clusters to production environments at companies like AT&T, Discover, Merck, and ServiceNow.
| Feature | Details |
|---|---|
| Deployment model | Self-managed (Open Source, Enterprise) or SaaS (Calico Cloud) |
| Data planes | eBPF, standard Linux (nftables/iptables), Windows HNS, VPP |
| Encryption | WireGuard (pod-to-pod), ~73% throughput on 5Gbps with eBPF |
| Policy types | Kubernetes NetworkPolicy, GlobalNetworkPolicy, tiered policies |
| Routing | BGP peering, VXLAN, IP-in-IP, cross-subnet optimization |
| IP support | Dual-stack IPv4/IPv6 |
| OS support | Linux, Windows |
| Compliance | PCI DSS, SOC 2, GDPR, HIPAA (Enterprise/Cloud) |
| Adoption | 8M+ nodes daily, 1M+ clusters, 166 countries |
| GitHub | 7.1k stars, Apache 2.0 |
Key Features
Microsegmentation and Zero Trust
Calico’s network policies enable microsegmentation at the pod level. Instead of broad subnet-based firewall rules, I can define policies that specify exactly which pods, namespaces, and services are allowed to communicate. Labels and selectors keep policies dynamic: they follow workloads as pods scale up, restart, or move across nodes.
For Zero Trust implementations, Calico supports deny-by-default policies combined with explicit allow rules. Tiered policies (available in Enterprise/Cloud editions) let security teams set non-negotiable baseline policies while giving development teams freedom within those guardrails.
BGP and Non-Overlay Networking
Calico is one of few CNI plugins that supports native BGP peering, which eliminates the overhead of overlay networks like VXLAN. In environments where BGP is available (on-premises data centers, bare-metal clusters), this gives pods routable IP addresses directly on the infrastructure network — reducing latency and simplifying troubleshooting.
For environments that need overlays, Calico supports both VXLAN and IP-in-IP encapsulation with cross-subnet optimization.
Multi-Cluster and Hybrid Support
Calico works across EKS, GKE, AKS, OpenShift, RKE, k3s, and self-managed Kubernetes clusters. It runs on Linux and Windows nodes, and supports dual-stack IPv4/IPv6 networking. The commercial editions add multi-cluster management for federated policy enforcement across environments.
Use Cases
Platform engineering teams use Calico as the default CNI across all Kubernetes clusters, standardizing on one networking and security solution rather than managing separate tools for routing and policy.
Security teams implement microsegmentation and Zero Trust networking through Calico’s tiered policies, enforcing baseline security rules across all namespaces without requiring changes from application developers.
Compliance-driven organizations use Calico Enterprise or Calico Cloud for continuous compliance monitoring against PCI DSS, SOC 2, GDPR, and HIPAA frameworks, with audit trails and reporting built into the platform.
Hybrid and multi-cloud deployments rely on Calico’s consistent networking model across cloud providers and on-premises infrastructure, using BGP peering to connect environments without overlay overhead.
Integrations
Kubernetes
Amazon EKS
Google GKE
Azure AKS
OpenShift
k3s
RKE
Elasticsearch
Prometheus
Grafana
Fluentd
FalcoPricing
Calico is available in three tiers:
| Tier | Model | Key Additions |
|---|---|---|
| Calico Open Source | Free (Apache 2.0) | Networking, network policy, eBPF, WireGuard, BGP |
| Calico Enterprise | Commercial (self-managed) | Dynamic Service Graph, compliance reporting, tiered policies, threat feeds, egress controls |
| Calico Cloud | SaaS (starts at $0.05/node-hour) | Fully managed, AI assistant, multi-cluster management |
Calico Cloud also offers a free tier for single-cluster environments, providing observability dashboards, policy recommendations, and staged policy previews at no cost. Enterprise pricing requires contacting Tigera directly.
Getting Started
Install Calico as your CNI plugin. Deploy using the Tigera operator via Helm chart or kubectl manifest. Works with new or existing Kubernetes clusters on any distribution.
Configure your data plane. Choose between eBPF (for performance), standard Linux (for compatibility), or Windows HNS (for mixed-OS clusters). Enable WireGuard encryption if you need on-the-wire pod traffic security.
Define network policies. Start with Calico’s Kubernetes NetworkPolicy support, then extend with GlobalNetworkPolicy CRDs for cluster-wide rules. Use label selectors to target workloads dynamically.
Visualize traffic (commercial). Calico Enterprise and Calico Cloud provide Dynamic Service Graph to visualize actual traffic flows between workloads, identify unprotected communication paths, and get policy recommendations.
Strengths & Limitations
Strengths:
- Most widely deployed Kubernetes CNI — 8M+ nodes, 1M+ clusters globally
- Multiple data plane options (eBPF, Linux, Windows, VPP) for different requirements
- Native BGP support eliminates overlay overhead in data center environments
- WireGuard encryption adds transport-layer security with minimal performance cost
- Tiered policies enable centralized security governance without blocking developer autonomy
- Free tier of Calico Cloud provides observability without commercial commitment
Limitations:
- eBPF dataplane was added after initial design (unlike Cilium’s eBPF-first architecture) — some eBPF features lag behind Cilium
- Layer 7 (application-layer) policy enforcement is limited compared to Cilium’s HTTP/gRPC-aware policies
- No built-in observability tool equivalent to Cilium’s Hubble (commercial Service Graph fills this gap)
- Calico Open Source lacks compliance reporting, threat feeds, and centralized multi-cluster management
- Windows support covers networking but not all security features available on Linux
For a broader view of Kubernetes and container security options, see the container security tools category page. Calico pairs well with runtime security tools like Falco for kernel-level threat detection and image scanners like Trivy for pre-deployment vulnerability scanning.
