Calico — Kubernetes Networking and Network Security

What it is

Calico is a networking and network security solution for Kubernetes that provides pod-to-pod networking and fine-grained network policy enforcement. It supports multiple data planes including standard Linux networking, eBPF for higher throughput, and WireGuard for workload-level encryption. Calico is maintained by Tigera and is the most widely adopted CNI plugin in the Kubernetes ecosystem.

Calico targets platform engineers and DevOps teams running Kubernetes clusters from single-node labs to large production environments. It handles both Kubernetes-native NetworkPolicy and its own richer GlobalNetworkPolicy for microsegmentation across namespaces and clusters.

How it saves time or tokens

Calico eliminates manual iptables rule management by translating declarative YAML policies into kernel-level enforcement automatically. The eBPF data plane bypasses iptables entirely, reducing per-packet overhead and improving throughput for high-traffic services. WireGuard encryption is enabled with a single configuration flag, removing the need to set up separate VPN tunnels between nodes.

How to use

1. Install Calico on your cluster by applying the manifest: kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.28.0/manifests/calico.yaml.
2. Verify that calico-node pods are running: kubectl get pods -n kube-system -l k8s-app=calico-node.
3. Apply network policies using standard Kubernetes NetworkPolicy resources or Calico-specific GlobalNetworkPolicy CRDs.

Example

# Deny all ingress traffic to pods in default namespace
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all-ingress
spec:
  podSelector: {}
  policyTypes:
  - Ingress
---
# Allow only port 80 from frontend pods
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend
spec:
  podSelector:
    matchLabels:
      app: backend
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - port: 80

Related on TokRepo

• AI Tools for DevOps -- explore AI-powered infrastructure tools that complement Kubernetes networking
• AI Tools for Security -- discover security-focused workflows for cluster hardening

Common pitfalls

• Calico's BGP mode requires network infrastructure that supports BGP peering; cloud environments often need VXLAN or IP-in-IP encapsulation instead.
• Enabling the eBPF data plane requires kernel 5.3 or later and disables kube-proxy, which may break existing monitoring that relies on iptables rules.
• WireGuard encryption adds CPU overhead on nodes without hardware acceleration; benchmark before enabling on latency-sensitive workloads.