Open-Source Observability · projectcalico

calico

Calico is an open-source Kubernetes networking and security platform that provides Container Network Interface (CNI) functionality across multiple environments. It supports multiple data planes (eBPF, standard Linux, Windows, VPP) and enforces network policies with granular access controls and encryption.

Talk to DEV.co Discuss Implementation

Source: GitHub — github.com/projectcalico/calico

7.3k

GitHub stars

1.6k

Forks

Primary language

Apache-2.0

License (OSI-approved)

Key facts

Objective fields from the source. Values we can't verify are shown as “Unknown” rather than guessed.

Field	Value
Repository	projectcalico/calico
Owner	projectcalico
Primary language	Go
License	Apache-2.0 — OSI-approved
Stars	7.3k
Forks	1.6k
Open issues	230
Latest release	v3.32.1 (2026-06-26)
Last updated	2026-07-08
Source	https://github.com/projectcalico/calico

What calico is

Calico implements Kubernetes NetworkPolicy standards via a modular architecture supporting eBPF, XDP, and traditional Linux kernel networking. It provides BGP-based routing, VXLAN overlay options, and identity-aware policy enforcement across bare metal, VMs, and cloud environments.

Quickstart

Get the calico source

Clone the repository and explore it locally.

terminalbash

1git clone https://github.com/projectcalico/calico.git2cd calico3# follow the project's README for install & configuration

Need it deployed, integrated, or customized instead? DEV.co ships production installs.

Best use cases

Multi-cloud Kubernetes clusters requiring consistent networking

Calico's support for multiple distros, cloud providers, bare metal, and VMs makes it suitable for organizations managing heterogeneous infrastructure while maintaining unified network policy enforcement.

High-performance, low-latency container networking

eBPF and XDP data plane options optimize for throughput and CPU efficiency, addressing requirements in latency-sensitive workloads and large-scale clusters.

Zero-trust network security with encrypted inter-pod communication

WireGuard encryption and identity-aware network policies enable fine-grained access control and encrypted communication without external service mesh overhead.

Implementation considerations

Choose data plane (eBPF recommended for modern kernels, standard Linux for compatibility, Windows for Windows nodes) based on infrastructure and performance requirements.
Plan network policy migration; audit existing policies and test in staging to avoid unintended traffic blocking.
Size etcd backend appropriately; Calico stores policy state in Kubernetes etcd; scale with cluster size.
Monitor and tune BGP convergence times and VXLAN performance in multi-node environments to meet latency SLAs.
Establish backup and disaster recovery for NetworkPolicy resources and Calico operator state.

When to avoid it — and what to weigh

Requirement for proprietary vendor lock-in or simplified managed SaaS model — Calico is open-source and community-driven; users must manage deployment, upgrades, and operational responsibility themselves.
Project cannot tolerate active community maintenance dependency — While well-maintained, Calico relies on an open-source development model. Critical bug fixes or features depend on community or commercial support contracts.
Operating environment is entirely cloud-managed (e.g., AWS EKS managed networking only) — Some managed Kubernetes services have restricted CNI options; verify Calico compatibility before committing.
Team lacks networking and Kubernetes expertise — Calico requires understanding of BGP, network policies, data plane options, and Kubernetes networking; misconfiguration can cause cluster isolation.

License & commercial use

Apache License 2.0 (Apache-2.0). Permissive OSI-approved license allowing commercial use, modification, and distribution with attribution and liability disclaimers.

Apache-2.0 permits commercial use without explicit permission requirement. However, verify compliance with any modified derivatives or bundled components. Commercial support and managed offerings available from Tigera (project creator); review support SLAs separately.

DEV.co evaluation signals

Editorial assessment — not user reviews. Directional, with an explicit confidence level.

Signal	Assessment
Maintenance	Active
Documentation	Strong
License clarity	Clear
Deployment complexity	Moderate
DEV.co fit	Strong
Assessment confidence	High

Security considerations

Calico provides network segmentation and encryption mechanisms (WireGuard). Security posture depends on correct policy configuration, etcd security, and regular updates. No known vulnerabilities asserted in provided data; review CVE history and security advisories independently. Audit network policy rules carefully to avoid unintended exposure. CII Best Practices badge suggests adherence to security practices.

Alternatives to consider

Cilium

eBPF-native CNI with advanced observability (Hubble) and service mesh integration; better for teams already invested in eBPF ecosystem or requiring service mesh features without sidecar overhead.

Flannel

Simpler, lightweight CNI for basic overlay networking; suitable for small clusters or edge environments where performance overhead and feature complexity are less critical.

AWS VPC CNI (or cloud-native variants)

Optimized for cloud-native deployments (e.g., EKS); better for teams fully committed to a single cloud provider and willing to accept vendor integration.

Software development agency

Build on calico with DEV.co software developers

Our DevOps and cloud deployment teams can guide you through architecture planning, data plane selection, network policy design, and production deployment. Contact us to assess your infrastructure and build a secure, scalable networking strategy.

Talk to DEV.co

Related open-source tools

Surfaced by semantic similarity across the DEV.co open-source index.

pixie cilium kubesec

Related on DEV.co

Explore the category and the services that help you build with it.

Open-Source Observability DevOps & Infrastructure Cloud Deployment Talk to DEV.co

calico FAQ

Do I need to run BGP for Calico to work?

No. BGP is one option for routing; Calico also supports VXLAN overlays for environments where BGP is not available or desired.

Is Calico suitable for Windows Kubernetes clusters?

Yes, Calico supports Windows nodes, but feature parity and data plane options differ from Linux; review Windows-specific documentation before committing.

How does Calico handle multi-cluster networking?

Not clearly stated in provided data. Multi-cluster scenarios require separate design and may involve Calico federation or external tooling; requires review of current documentation.

What is the performance impact of eBPF vs. standard Linux data plane?

README claims eBPF offers optimized performance and low CPU usage; exact benchmarks not provided. Test in staging with representative workload to validate against SLAs.

Custom software development services

From first prototype to production, DEV.co delivers software development services around tools like calico. Our software development agency staffs experienced software developers and web developers for custom software development, web development, integrations, and ongoing support across open-source observability and beyond.

Ready to implement Calico for your Kubernetes clusters?

Talk to DEV.co Schedule a Consultation