projectcalico/calico
Calico
Calico is a cloud-native networking and security solution designed to connect containerized workloads across virtual machines, bare metal, and multi-cloud environments. It provides a routing solution based on the Border Gateway Protocol to manage cluster traffic and implement the Container Network Interface for pod connectivity and IP address management.
The project distinguishes itself through a security layer that enforces network policies based on identities and labels rather than static addresses. It includes a policy engine for controlling traffic flow, a cluster network encryptor for securing data in transit between nodes, and an identity-based enforcement system that maps security rules to cryptographic identities.
Broadly, the system covers connectivity management, network state synchronization, and observability. Its capabilities include network flow aggregation, automated certificate request issuance, and the use of specialized data planes to optimize packet processing efficiency.
Deployment is supported through the generation of manifests and the retrieval of custom resource definitions.
Features
- CNI Implementations - Implements the Container Network Interface specification to configure network interfaces for containerized workloads.
- Network Routing and Traffic Management - Manages network paths and IP address allocation across bare metal and multi-cloud deployments for consistent connectivity.
- CNI Plugins - Implements the Container Network Interface (CNI) for managing pod connectivity and IP address management.
- Cluster State Synchronization - Monitors a centralized resource store and automatically updates local node configurations in response to state changes.
- Cloud Native Networking - Connects containerized workloads across virtual machines and cloud environments using standardized routing protocols and network plugins.
- Container Networking Configurations - Establishes and maintains network routing paths for workloads across diverse cloud native environments.
- Policy Engines - Provides a tool for defining and applying security rules to control traffic flow between containers based on identity and labels.
- Cross-Environment Connectivity - Establishes communication across cloud environments and virtual machines using routing protocols and data plane options.
- Configuration - Synchronizes network and policy settings using a client to manage resource definitions and configuration state.
- Border Gateway Protocol Configurations - Provides a routing system that uses the Border Gateway Protocol to route traffic across bare metal, virtual machines, and multiple clouds.
- Network Policy Enforcement - Controls network traffic by mapping security rules to cryptographic identities and application labels.
- BGP Route Distribution - Uses the Border Gateway Protocol to propagate network routes across bare metal and virtual machine environments.
- Layer 7 Authorization Policies - Restricts network traffic based on cryptographic identities and application attributes via proxy-integrated authorization policies.
- Secure Node Networking - Encrypts data in transit between nodes and implements authorization policies to secure communication between workloads.
- Traffic Encryption - Secures data in transit between nodes using encryption to ensure private communication across the cluster.
- Container Orchestration Integrations - Integrates networking and IP address management for any container orchestrator implementing the standard networking specification.
- Data Plane Optimizations - Improves packet processing efficiency using specialized drivers to balance network speed and CPU overhead.
- Kernel Networking Hooks - Processes network packets using specialized kernel drivers to maximize throughput and minimize latency for container traffic.
- Automated Template Generation - Automatically produces routing templates by monitoring a datastore to maintain network consistency.
- Ephemeral Certificate Issuance - Automates the procurement of security certificates by creating signing requests within init containers.
- Cluster Communication Security - Encrypts data in transit between nodes to ensure private communication across a cluster.
- Private Network Security - Enforces network policies and traffic filtering for containerized workloads across diverse environments.
- Container Orchestration - Provides networking and security policies for container environments.
- Networking - Networking and security solution for containerized workloads.
- Kubernetes Security - Network security and policy enforcement for containers.
Star history
How this analysis was created: This summary and feature list were written by an AI model that read the project's README and public documentation pages. Each feature links to the documentation it came from; stars, license and language come straight from the GitHub API. The model does not read the source code, and the analysis is refreshed when the project is re-analysed. Learn more on our About page.
