Calico

Calico is a popular CNI plugin that provides networking and network policy enforcement for Kubernetes. It’s known for its robust Network Policy support, BGP routing capabilities, and flexibility in deployment models. Calico is widely used in production environments that need advanced networking features and security policies.

What is Calico?

Calico provides:

• Pod networking - IP address assignment and routing
• Network Policies - Full Network Policy support
• BGP routing - Direct routing with BGP (optional)
• IP-in-IP or VXLAN - Encapsulation options
• Cross-cluster networking - Connect multiple clusters

Calico Architecture

Calico consists of several components:

Calico Node

Runs on each Kubernetes node:

• Felix - Policy enforcement agent
• BIRD - BGP routing daemon (if BGP enabled)
• CNI plugin - Network interface configuration

Calico API Server

Manages Calico resources (Network Policies, IP pools, etc.)

etcd or Kubernetes API

Stores Calico configuration and state

Key Features

Network Policies

Calico provides full Network Policy support:

• Ingress rules - Control incoming traffic
• Egress rules - Control outgoing traffic
• Advanced selectors - Complex matching rules
• Performance - Efficient policy enforcement

BGP Routing

Calico can use BGP for routing:

• Direct routing - No encapsulation overhead
• BGP peering - Integrate with network infrastructure
• Route distribution - Share routes via BGP
• Optional - Can use overlay instead

Encapsulation Options

Calico supports multiple encapsulation methods:

IP-in-IP:

• Lower overhead
• Requires IP-in-IP support in network
• Better performance

VXLAN:

• Works in more environments
• Higher overhead
• More compatible

No encapsulation (BGP):

• Best performance
• Requires BGP support
• Direct routing

Installation

Quick Install

# Install Calico operator
kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.26.1/manifests/tigera-operator.yaml

# Install Calico
kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.26.1/manifests/custom-resources.yaml

Configuration

Calico can be configured via CustomResourceDefinitions:

apiVersion: operator.tigera.io/v1
kind: Installation
metadata:
  name: default
spec:
  calicoNetwork:
    ipPools:
    - cidr: 192.168.0.0/16
      encapsulation: VXLAN
      natOutgoing: true

IP Pool Configuration

Calico uses IP pools for pod IP assignment:

apiVersion: crd.projectcalico.org/v1
kind: IPPool
metadata:
  name: default-ipv4-ippool
spec:
  cidr: 192.168.0.0/16
  blockSize: 26
  ipipMode: Never
  vxlanMode: Always
  natOutgoing: true

Key settings:

• cidr - IP range for pods
• blockSize - Size of IP blocks per node
• ipipMode - IP-in-IP encapsulation
• vxlanMode - VXLAN encapsulation
• natOutgoing - NAT for external traffic

Network Policies

Calico supports standard Kubernetes Network Policies plus Calico-specific policies:

Kubernetes Network Policy

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: example-policy
spec:
  podSelector:
    matchLabels:
      app: web
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: api
    ports:
    - protocol: TCP
      port: 80

Calico Network Policy

Calico also supports extended Network Policies with additional features:

apiVersion: projectcalico.org/v3
kind: NetworkPolicy
metadata:
  name: calico-policy
spec:
  selector: app == 'web'
  ingress:
  - action: Allow
    source:
      selector: app == 'api'
    destination:
      ports:
      - 80

BGP Configuration

Enable BGP for direct routing:

apiVersion: projectcalico.org/v3
kind: BGPConfiguration
metadata:
  name: default
spec:
  logSeverityScreen: Info
  nodeToNodeMeshEnabled: true
  asNumber: 64512

BGP modes:

• Node-to-node mesh - All nodes peer with each other
• Route reflectors - Centralized route distribution
• External BGP - Peer with external routers

Use Cases

Production Clusters

Calico is ideal for production:

• Robust Network Policy support
• High performance
• Enterprise features
• Active development

Multi-Cluster

Calico can connect multiple clusters:

• Cross-cluster networking
• Shared network policies
• Unified management

BGP Integration

When you need BGP:

• Integration with network infrastructure
• Direct routing without encapsulation
• Route distribution

Best Practices

1. Plan IP pools - Ensure IP pool size is adequate
2. Choose encapsulation - Select IP-in-IP or VXLAN based on network
3. Enable BGP if needed - Use BGP for better performance
4. Monitor Calico - Monitor Calico component health
5. Keep updated - Update Calico regularly
6. Test Network Policies - Verify Network Policy enforcement
7. Document configuration - Document Calico configuration
8. Use IP pools wisely - Plan IP pool allocation
9. Monitor performance - Track network performance
10. Backup configuration - Backup Calico resources

Troubleshooting

Pods Not Getting IPs

1. Check Calico pods: kubectl get pods -n calico-system
2. Verify IP pools: calicoctl get ippools
3. Check node status: calicoctl node status
4. Review logs: kubectl logs -n calico-system -l k8s-app=calico-node
5. Verify CNI config: Check /etc/cni/net.d/ and /opt/cni/bin/

Network Policies Not Working

1. Verify Calico version: Ensure version supports Network Policies
2. Check Felix logs: kubectl logs -n calico-system -l k8s-app=calico-node | grep felix
3. Test simple policy: Create a basic policy to test
4. Check policy status: calicoctl get networkpolicies
5. Review configuration: Verify Calico is configured correctly

BGP Issues

1. Check BGP status: calicoctl node status
2. Verify BGP config: calicoctl get bgpconfig
3. Check BIRD logs: Review BIRD daemon logs
4. Test BGP peers: Verify BGP peering is working
5. Review network: Ensure network supports BGP

See Also

• CNI Plugins Overview - CNI plugin comparison
• Network Policies - Network isolation
• CNI Basics - Understanding CNI