Calico Networking

Introduction

Calico is an opensource software networking project suitable for various platforms such as OpenStack, Kubernetes, Mesos, Docker, AWS, GCP etc. This project is developed and maintained by the company Tigera along with 150+ contributors belonging to various companies. Calico comes with a simple networking model and suits well with Cloud based environments. It is implemented with a distributed architecture, i.e. its components could be installed across various nodes, and then interconnected. Calico is one of the favorite Networking solutions used with Kubernetes, the calico project has approx. 1.4K stars on GitHub. It has been field tested by hundereds of users in real world production implementations. Calico is deployed by organizations such as GitHub, SquareSpace, apigee etc. It is also used with popular Kubernetes engines such as GKE, AKS, EKS, IKS etc. Calico supports clusters ranging from a single node to thousands of nodes. For each development release, Calico is tested on clusters with thousands of nodes. Calico is Linux friendly, the Linux tools that it uses is already familiar among the community, which makes administration of Calico controllers easy. Calico uses pluggable software components such as Linux kernel data plane, Windows Host networking service, and Extended Berkely packet filter. As it uses the Linux kernel data plane for data forwarding and access controls, it provides great performace with minimum CPU usage, as that of the Linux kernel.

Routing

Calico supports both IPv4 and IPv6. It uses the Internet’s defacto routing protocol ‘BGP’ to ensure networking with in a Kubernetes Cluster. BGP had no replacement since a long time, and it has been accepted as the best solution for routing the Internet, this proven stability of BGP gives Calico a greater advantage. It doesnt use an overlay connection or protocol unlike other SDN solutions, rather it uses BGP to connect to entities, thus aids performance and avoids complicated troubleshooting, however it gives the flexibility of using a light weight overlay like IP-IP or VXLAN when required such as when crossing zone boundaries in public cloud networks.

Security

It comes with micro segmented network policies that gives the Kubernetes administrator more power in controlling access in and out of the cluster. Calico’s micro firewall policies make use of the NetworkPolicy construct of Kubernetes to secure the cluster. The Network Policy API of Kubernetes was indeed developed with Calico policy engine as the reference. Hence, Calico offers all the possible primitives that the Network Policy object could offer. It offers a zero trust network model with great security, it can be thought of like each workload of the Kubernetes clsuter, protected by it’s own dedicated micro firewall.