● Beta — KubeEra is in active development. Profiles are live; AI-perception measurement is rolling out.
KubeEra
P

Project Calico

Runtime
Open source · Apache-2.0

Calico is a networking and network security solution for Kubernetes, providing CNI-compliant pod networking plus a policy engine for enforcing network segmentation at L3/L4 (and L7 with the enterprise add-on).

updated 2026-07-01

What it is

Calico is a networking and network security solution for Kubernetes, providing CNI-compliant pod networking plus a policy engine for enforcing network segmentation at L3/L4 (and L7 with the enterprise add-on). It supports multiple dataplanes — standard Linux iptables, eBPF, Windows HNS, and VPP — which is somewhat unusual; most CNI plugins commit to a single dataplane. Calico also implements the Kubernetes NetworkPolicy API and extends it with its own CRDs (GlobalNetworkPolicy, tiered policies, host endpoint protection) for cases where namespace-scoped NetworkPolicy isn't expressive enough.

Full project description not publicly available from the data provided, but the above reflects what's documented in the project's own materials.

Who builds it and why

Calico is maintained by Tigera, a company that sells a commercial security/observability platform (Calico Enterprise/Cloud) built on top of the open-source project. This is a fairly common OSS-core-plus-commercial-layer model — Tigera funds most of the full-time engineering on the open-source project because it's the funnel for their paid product. CNCF maturity level is not publicly available in the data given, so treat any assumptions about graduated/incubating status with caution and verify directly against the CNCF landscape before citing it in a decision doc.

Production readiness signal

811 contributors and a commit as recent as 2026-07-01 indicate the project is actively maintained, not abandoned or coasting on legacy adoption. 7,268 GitHub stars is modest compared to some CNCF projects but stars are a weak proxy for production usage in infrastructure tooling — Calico is one of the most widely deployed CNI plugins in the ecosystem regardless of star count, used by default in several managed Kubernetes distributions (EKS, AKS network policy layer, OpenShift SDN alternative). Latest release v3.32.1 suggests a mature, well-versioned release cadence rather than a project still finding its API surface. License is Apache-2.0, which is the least restrictive of the common OSS licenses and imposes no copyleft obligations on downstream users.

Who should use this

  • Teams that need enforceable NetworkPolicy beyond what the default Kubernetes API provides (global policies, host-level firewalling, policy tiers for platform vs. app teams).
  • Multi-cloud or hybrid clusters where dataplane flexibility (iptables vs eBPF vs Windows) matters — Calico is one of the few CNIs with real Windows node support.
  • Organizations already considering Tigera's commercial tier for compliance reporting, WAF-style L7 policy, or multi-cluster federation, since the OSS and paid tiers share the same policy model.
  • Platform teams comfortable operating and troubleshooting a CNI directly — Calico's BGP-based routing mode requires real networking literacy to debug when things break.

Who should NOT use this

  • Small teams running a handful of clusters with basic policy needs — Cilium or the built-in CNI of a managed service (e.g., VPC CNI on EKS with basic policy support) will be less operational overhead.
  • Teams wanting deep eBPF-native observability (flow logs, L7 visibility, Hubble-style UI) out of the box without paying for an enterprise tier — Cilium ships more of that in open source.
  • Anyone expecting turnkey managed support without a contract — the free tier is community-supported only; production incident response requires a Tigera subscription.
  • Environments where BGP peering with existing network infrastructure isn't feasible or desired and overlay networking is preferred with minimal operator involvement — Flannel or a simpler overlay-only CNI may fit better.

Alternatives

  • Cilium — eBPF-native from the ground up, richer built-in observability (Hubble), stronger L7 policy in OSS.
  • Flannel — much simpler overlay networking, no built-in NetworkPolicy enforcement (typically paired with Calico's policy engine only, "Canal").
  • Weave Net — simpler setup and encryption-by-default, but development pace has slowed considerably compared to Calico and Cilium.

Pricing

The core project (Calico Open Source) is Apache-2.0 licensed and free. Tigera sells Calico Cloud and Calico Enterprise on top of it for commercial features (SaaS management, compliance reporting, WAF, extended observability, vendor support SLAs). Specific pricing for the commercial tiers is not publicly available — it's quote-based through Tigera sales.

Frequently asked

What is Project Calico?+
Calico is a networking and network security solution for Kubernetes, providing CNI-compliant pod networking plus a policy engine for enforcing network segmentation at L3/L4 (and L7 with the enterprise add-on).
Who builds Project Calico?+
Calico is maintained by Tigera, a company that sells a commercial security/observability platform (Calico Enterprise/Cloud) built on top of the open-source project.
Is Project Calico production ready?+
811 contributors and a commit as recent as 2026-07-01 indicate the project is actively maintained, not abandoned or coasting on legacy adoption.
Who should use Project Calico?+
Teams that need enforceable NetworkPolicy beyond what the default Kubernetes API provides (global policies, host-level firewalling, policy tiers for platform vs. app teams).
Who should not use Project Calico?+
Small teams running a handful of clusters with basic policy needs — Cilium or the built-in CNI of a managed service (e.g., VPC CNI on EKS with basic policy support) will be less operational overhead.
What are the alternatives to Project Calico?+
Cilium — eBPF-native from the ground up, richer built-in observability (Hubble), stronger L7 policy in OSS. Flannel — much simpler overlay networking, no built-in NetworkPolicy enforcement (typically paired with Calico's policy engine only, "Canal").
How much does Project Calico cost?+
The core project (Calico Open Source) is Apache-2.0 licensed and free. Tigera sells Calico Cloud and Calico Enterprise on top of it for commercial features (SaaS management, compliance reporting, WAF, extended observability, vendor support SLAs).