Last updated on

What is Calico

What is Calico?

Calico is an open source networking and network security solution for containers, virtual machines, and native host-based workloads. Calico supports a broad range of platforms including Kubernetes, OpenShift, Mirantis Kubernetes Engine (MKE), OpenStack, and bare metal services.
Calico是面向容器、虚拟机和基于本机主机的工作负载的开源网络和网络安全解决方案。Calico支持广泛的平台，包括Kubernetes，OpenShift，Mirantis Kubernetes引擎 (MKE)，OpenStack和裸机服务。

Whether you opt to use Calico’s eBPF data plane or Linux’s standard networking pipeline, Calico delivers blazing fast performance with true cloud-native scalability. Calico provides developers and cluster operators with a consistent experience and set of capabilities whether running in public cloud or on-prem, on a single node, or across a multi-thousand node cluster.
无论您选择使用Calico的eBPF数据平面还是Linux的标准网络管道，Calico都能提供出色的快速性能以及真正的云原生可扩展性。Calico为开发人员和集群运营商提供了一致的经验和功能集，无论是在公共云还是本地运行，在单个节点上运行，还是在数千个节点集群中运行。

Choice of dataplanes

Calico gives you a choice of dataplanes, including a pure Linux eBPF dataplane, a standard Linux networking dataplane, and a Windows HNS dataplane. Whether you prefer cutting edge features of eBPF, or the familiarity of the standard primitives that existing system administrators already know, Calico has you covered.
Calico为您提供了可供选择的数据平面，包括纯Linux eBPF数据平面，标准Linux网络数据平面和Windows HNS数据平面。无论您是喜欢eBPF的前沿功能，还是熟悉现有系统管理员已经知道的标准原语，Calico都涵盖了您。

Whichever choice is right for you, you’ll get the same, easy to use, base networking, network policy and IP address management capabilities, that have made Calico the most trusted networking and network policy solution for mission-critical cloud-native applications.
无论哪种选择适合您，您都将获得相同的、易于使用的基础网络、网络策略和ip地址管理功能，这些功能使Calico成为关键任务云原生应用程序最受信任的网络和网络策略解决方案。

Best practices for network security

Calico’s rich network policy model makes it easy to lock down communication so the only traffic that flows is the traffic you want to flow. Plus with built in support for Wireguard encryption, securing your pod-to-pod traffic across the network has never been easier.
Calico丰富的网络策略模型使锁定通信变得容易，因此唯一流动的流量就是您想要流动的流量。此外，通过内置支持Wireguard加密，确保网络上的pod到pod流量从未如此简单。

Calico’s policy engine can enforce the same policy model at the host networking layer and (if using Istio & Envoy) at the service mesh layer, protecting your infrastructure from compromised workloads and protecting your workloads from compromised infrastructure.
Calico的策略引擎可以在主机网络层和服务网格层 (如果使用Istio & Envoy) 实施相同的策略模型，从而保护您的基础架构免受受危害的工作负载，并保护您的工作负载免受受危害的基础架构的影响。

Performance

Depending on your preference, Calico uses either Linux eBPF or the Linux kernel’s highly optimized standard networking pipeline to deliver high performance networking. Calico’s networking options are flexible enough to run without using overlays in most environments, avoiding the overheads of packet encap/decap. Calico’s control plane and policy engine has been fine tuned over many years of production use to minimize overall CPU usage and occupancy.
根据您的喜好，Calico使用Linux eBPF或linux内核的高度优化的标准网络管道来提供高性能网络。Calico的网络选项足够灵活，可以在大多数环境中不使用覆盖来运行，从而避免了数据包encap/decap的开销。Calico的控制平面和策略引擎在多年的生产使用中进行了微调，以最大程度地减少整体CPU的使用和占用。

Scalability

Calico’s core design principles leverage best practice cloud-native design patterns combined with proven standards based network protocols trusted worldwide by the largest internet carriers. The result is a solution with exceptional scalability that has been running at scale in production for years. Calico’s development test cycle includes regularly testing multi-thousand node clusters. Whether you are running a 10 node cluster, 100 node cluster, or more, you reap the benefits of the improved performance and scalability characteristics demanded by the largest Kubernetes clusters.
Calico的核心设计原则利用了最佳实践云原生设计模式，并结合了全球最大的互联网运营商所信任的基于标准的网络协议。其结果是一个具有卓越可扩展性的解决方案，多年来一直在生产中大规模运行。Calico的开发测试周期包括定期测试数千个节点集群。无论您运行的是10节点集群、100节点集群或更多节点集群，您都可以从最大的Kubernetes集群所要求的改进的性能和可扩展性特性中获益。

Interoperability

Calico enables Kubernetes workloads and non-Kubernetes or legacy workloads to communicate seamlessly and securely. Kubernetes pods are first class citizens on your network and able to communicate with any other workload on your network. In addition Calico can seamlessly extend to secure your existing host based workloads (whether in public cloud or on-prem on VMs or bare metal servers) alongside Kubernetes. All workloads are subject to the same network policy model so the only traffic that is allowed to flow is the traffic you expect to flow.
Calico使Kubernetes工作负载和非Kubernetes或遗留工作负载能够无缝安全地通信。Kubernetes pod是您网络上的一流公民，并且能够与网络上的任何其他工作负载进行通信。此外，Calico可以无缝扩展以保护您现有的基于主机的工作负载 (无论是在公共云还是虚拟机或裸机服务器上) 以及Kubernetes。所有工作负载都受制于相同的网络策略模型，因此唯一允许流动的流量是您期望流动的流量。

Real world production hardened

Calico is trusted and running in production at large enterprises including SaaS providers, financial services companies, and manufacturers. The largest public cloud providers have selected Calico to provide network security for their hosted Kubernetes services (Amazon EKS, Azure AKS, Google GKE, and IBM IKS) running across tens of thousands of clusters.
Calico值得信赖，并在大型企业 (包括SaaS提供商，金融服务公司和制造商) 中进行生产。最大的公共云提供商已选择Calico为其托管的Kubernetes服务 (Amazon EKS，Azure AKS，Google GKE和IBM IKS) 提供网络安全性，这些服务在成千上万个集群中运行。

Full Kubernetes network policy support

Calico’s network policy engine formed the original reference implementation of Kubernetes network policy during the development of the API. Calico is distinguished in that it implements the full set of features defined by the API giving users all the capabilities and flexibility envisaged when the API was defined. And for users that require even more power, Calico supports an extended set of network policy capabilities that work seamlessly alongside the Kubernetes API giving users even more flexibility in how they define their network policies.
Calico的网络策略引擎在API开发过程中形成了Kubernetes网络策略的原始参考实现。Calico的杰出之处在于，它实现了API定义的全部功能集，为用户提供了定义API时设想的所有功能和灵活性。对于需要更大功能的用户，Calico支持一组扩展的网络策略功能，这些功能与Kubernetes API无缝配合，为用户定义网络策略提供了更大的灵活性。

Contributor community

The Calico open source project is what it is today thanks to 200+ contributors across a broad range of companies. In addition Calico is backed by Tigera, founded by the original Calico engineering team, and committed to maintaining Calico as the leading standard for Kubernetes network security.
Calico开源项目就是今天的样子，这要归功于广泛公司的200贡献者。此外，Calico由Tigera支持，由原始Calico工程团队创立，并致力于将Calico保持为Kubernetes网络安全的领先标准。

Calico Cloud compatible

Calico Cloud builds on top of open source Calico to provide Kubernetes security and observability features and capabilities:
Calico Cloud建立在开源Calico之上，提供Kubernetes安全性和可观察性特性和能力:

  • Egress access controls (DNS policies, egress gateways) 出口访问控制 (DNS策略，出口网关)

  • Extend firewall to Kubernetes 将防火墙扩展到Kubernetes

  • Hierarchical tiers 分层层

  • FQDN / DNS based policy 基于FQDN/DNS的策略

  • Micro-segmentation across host/VMs/containers 跨主机/虚拟机/容器的微分割

  • Security policy preview, staging, and recommendation 安全策略预览、暂存和建议

  • Compliance reporting and alerts 合规性报告和警报

  • Intrusion detection & prevention (IDS / IPS) for Kubernetes Kubernetes的入侵检测与预防 (IDS / IPS)

  • SIEM Integrations SIEM集成

  • Application Layer (L7) observability 应用层 (L7) 可观察性

  • Dynamic packet capture 动态数据包捕获

  • DNS dashboards DNS仪表板