Calico Reference
Look-up facts for Calico Open Source
Versions and support windows, editions, feature status, data plane requirements, ports, Felix configuration keys, operator resources, sizing guidance and benchmark data. Values are for Calico Open Source 3.32 (latest patch v3.32.2, 2026-08-29) unless a row says otherwise. For how things work see Explanation; for procedures see How-to Guides.
Release and Support Matrix
Calico Open Source ships a minor release roughly every six months and patches the two most recent minor lines. When a new minor ships, the oldest supported line goes end-of-life (endoflife.date models this as eol(x) = releaseDate(x+2)).
| Minor |
GA date |
Latest patch (date) |
Tested Kubernetes |
Operator |
Status (2026-09-25) |
| 3.32 |
2026-04-30 |
v3.32.2 (2026-08-29) |
1.34, 1.35, 1.36 |
v1.42.6 |
Supported (current) |
| 3.31 |
2025-10-22 |
v3.31.7 (2026-08-20) |
1.32, 1.33, 1.34 |
v1.40.15 |
Supported |
| 3.30 |
2025-05-05 |
v3.30.7 (2026-03-18) |
1.31, 1.32, 1.33 |
v1.38.13 |
EOL 2026-04-30 |
| 3.29 |
2024-10-29 |
v3.29.7 (2025-11-19) |
TBD, not re-checked |
TBD |
EOL 2025-10-21 |
Date discrepancies
Dates come from the Calico release notes; endoflife.date (git tag dates) lists 3.31.0 as 2025-10-21 and 3.32.2 as 2026-08-30, one day off. The 3.31.4 entry in the official notes is dated "February 20, 2025", which is a typo for 2026 (it sits between December 2025 and April 2026 releases).
Patch history (3.31 and 3.32)
| Version |
Date |
Notable content |
| v3.32.2 |
2026-08-29 |
nftables IP-set fixes, eBPF IPv6 affinity fix, Envoy Gateway 1.8.3, Istio 1.29.6, calicoctl deb/rpm packages, CNI cniVersion 1.0.0, incremental IP-set resync |
| v3.32.1 |
2026-06-24 |
Bug fixes; bundled Envoy Gateway 1.8.0 (needs Gateway API v1.5.1 CRDs) |
| v3.32.0 |
2026-04-30 |
Native v3 CRDs (preview), ClusterNetworkPolicy, Istio ambient (preview), KubeVirt live migration over BGP, Maglev, Kubernetes 1.36 |
| v3.31.7 |
2026-08-20 |
nftables and eBPF fixes, Envoy Gateway 1.8.2 |
| v3.31.6 |
2026-06-18 |
Bug fixes, Envoy Gateway 1.8.0 bump |
| v3.31.5 |
2026-04-14 |
Bug fixes |
| v3.31.4 |
2026-02-20 |
Bug fixes |
| v3.31.3 |
2025-12-19 |
Enhancements and bug fixes |
| v3.31.2 |
2025-11-18 |
Bug fixes |
| v3.31.1 |
2025-11-14 |
Bug fixes |
| v3.31.0 |
2025-10-22 |
nftables GA, Ingress Gateway GA, operator-driven eBPF install, DSCP, eBPF QoS, LRU conntrack |
The next minor (3.33, unreleased as of 2026-09-25) is documented as making native v3 CRDs the default for new installs and moving Calico Ingress Gateway proxies into each Gateway's namespace (breaking change).
Editions
| Edition |
Delivery |
License / price |
What it adds |
| Calico Open Source |
Self-managed; operator, Helm or manifests |
Apache 2.0, free |
Networking, IPAM, BGP, all data planes, Kubernetes + Calico policy, tiers, staged policy, WireGuard, Whisker/Goldmane flow logs, Ingress Gateway, Istio ambient (preview) |
| Calico Cloud Free Tier |
SaaS console connected to one cluster |
Free |
Hosted observability and policy management for a single cluster, fed by Goldmane |
| Calico Cloud |
Fully managed SaaS (docs version "23-2", built on CE 3.23) |
Commercial, subscription |
Multi-cluster management, DNS policy, egress gateways, dashboards, WAF, AI Assistant (Winter 2026) |
| Calico Enterprise |
Self-managed, commercial |
Commercial, contact sales |
Everything in Cloud self-hosted; latest GA 3.23.2 (2026-08-27), 3.24.0-2.0 early preview (2026-09-01) |
Tigera, Inc. creates and maintains all four; Calico is not a CNCF project. Prices for Calico Cloud and Enterprise are not published (TBD, sales-led as of 2026-09).
Feature Status (Calico Open Source)
From the docs' feature-status data, which records only status changes.
| Feature |
Tech preview |
GA |
Deprecated / removed |
| nftables data plane |
3.29 |
3.31 |
|
| Flow logs API (Goldmane) and Whisker |
3.30 |
not yet (still preview in 3.32) |
|
| Calico Ingress Gateway |
3.30 |
3.31 |
|
| Staged network policies |
|
3.30 |
|
| Native v3 CRDs |
3.32 |
|
|
| Istio ambient mode |
3.32 |
|
|
Selector-scoped FelixConfiguration (nodeSelector) |
3.32 |
|
|
Aggregation API server (calico-apiserver) |
|
3.28 |
Deprecated 3.32 |
| FIPS mode |
|
3.28 |
Deprecated 3.30 |
| AdminNetworkPolicy / BaselineAdminNetworkPolicy |
|
|
Removed 3.32 (use ClusterNetworkPolicy) |
| Non-privileged mode (operator) |
|
|
Removed 3.30.7 (Installation.spec.nonPrivileged deprecated) |
iptablesLockTimeout Felix option |
|
|
Removed 3.32 |
BPFRedirectToPeer: L2Only |
|
|
Deprecated 3.32 |
Data Plane Matrix
| Data plane |
Select with |
Kernel / platform |
Replaces kube-proxy |
Notes |
| iptables |
Default (linuxDataplane: Iptables) |
Linux 5.10+ (Calico baseline); legacy and nft iptables backends |
No |
QoS bandwidth/packet-rate/connection limits (3.30+) |
| nftables |
linuxDataplane: Nftables |
Linux 5.13+, nft 1.0.1+; kube-proxy must be in nftables mode (Kubernetes 1.31+) |
No |
GA 3.31 |
| eBPF |
linuxDataplane: BPF (+ bpfNetworkBootstrap, kubeProxyManagement) |
Linux 5.10+ or RHEL 8.4 kernel 4.18.0-305+; x86-64 and arm64 |
Yes |
No etcd datastore, no GKE, no IP-in-IP, no SCTP, no floating IPs, no mixed eBPF and iptables or Windows nodes |
| VPP |
VPP manifests from projectcalico/vpp-dataplane |
Hugepages recommended; optional DPDK |
Yes |
Operator installs only; upstream README says "incubation" |
| Windows HNS |
Windows node install |
Windows Server (Nano Server LTSC 2019 images since 3.32) |
Windows kube-proxy |
BGP or VXLAN |
| Item |
Requirement (3.32) |
| CPU architectures |
x86-64, arm64, ppc64le, s390x (eBPF: x86-64 and arm64 only) |
| Linux kernel |
5.10 or later |
| Known-good distributions |
Ubuntu 20.04+, RHEL 8+, Debian 10+, Bottlerocket 1.47+, Talos 1.6+ |
| Interfaces Calico must manage |
cali*, tunl* (IP-in-IP), vxlan.calico (VXLAN); exclude them from NetworkManager |
| Privileges |
CAP_SYS_ADMIN (privileged calico-node) |
| kube-proxy modes supported |
iptables (default), ipvs, nftables (Kubernetes 1.31+) |
| CNI directories |
/etc/cni/net.d and /opt/cni/bin |
| WireGuard |
Linux 5.6+ or backported module |
| Native v3 CRDs |
Kubernetes with the MutatingAdmissionPolicy API (beta, feature gate off by default in 3.32's docs); 1.32+ for the next release's default mode |
| Container images |
Published on quay.io/calico/*; operator at quay.io/tigera/operator |
Network Ports
| Purpose |
Hosts |
Direction |
Port / protocol |
| BGP |
All nodes |
Bidirectional |
TCP 179 |
| IP-in-IP encapsulation |
All nodes |
Bidirectional |
IP protocol 4 |
| VXLAN encapsulation |
All nodes |
Bidirectional |
UDP 4789 (vxlanPort), VNI 4096 (vxlanVNI) |
| Typha |
Typha hosts |
Incoming |
TCP 5473 |
| WireGuard IPv4 |
All nodes |
Bidirectional |
UDP 51820 (wireguardListeningPort) |
| WireGuard IPv6 |
All nodes |
Bidirectional |
UDP 51821 (wireguardListeningPortV6) |
| Kubernetes API |
kube-apiserver |
Incoming |
TCP 443 or 6443 (the --secure-port) |
| etcd datastore |
etcd hosts |
Incoming |
TCP 2379 (varies) |
| Felix health |
Each node, local |
Local |
TCP 9099 (healthPort) |
| Felix Prometheus metrics |
Each node |
Incoming from scraper |
TCP 9091 (prometheusMetricsPort, disabled by default) |
| eBPF kube-proxy health check |
Each node |
Incoming from external LBs |
TCP 10256 (bpfKubeProxyHealthzPort) |
| Goldmane gRPC (mTLS) |
calico-system/goldmane Service |
In-cluster |
TCP 7443 |
| Whisker UI |
calico-system/whisker Service |
Port-forward |
TCP 8081 |
Felix Configuration Keys
Selected FelixConfiguration fields with their v3.32.2 defaults (from felix/docs/config-params.json). Set them on the default resource for the cluster, node.<nodename> for one node, or (3.32 preview) a resource with nodeSelector for a node group.
| YAML field |
Default |
Meaning |
bpfEnabled |
false |
Use the eBPF data plane (the operator sets this from linuxDataplane) |
nftablesMode |
Auto |
Auto, Enabled or Disabled nftables support |
iptablesBackend |
Auto |
Auto, Legacy or NFT iptables backend |
bpfExternalServiceMode |
Tunnel |
Tunnel or DSR for external traffic to Services |
bpfConnectTimeLoadBalancing |
TCP |
Enabled, TCP or Disabled connect-time load balancer |
bpfAttachType |
TCX |
Attach eBPF programs with TCX where available, else TC |
bpfDataIfacePattern |
Regex matching en*/wl*/ww*/sl*/ib* predictable names plus eth*, wlan*, wwan*, bond* |
Host interfaces that get eBPF programs |
bpfMapSizeConntrack |
512000 |
Conntrack map entries |
bpfMapSizeConntrackScaling |
DoubleIfFull |
Grow the conntrack map when full |
bpfMapSizeNATFrontend |
65536 |
Service frontend entries |
bpfMapSizeNATBackend |
262144 |
Service backend entries |
bpfMapSizeIPSets |
1048576 |
IP-set member entries |
bpfMapSizeRoute |
262144 |
Route map entries |
bpfJITHardening |
Auto |
Lowers kernel JIT hardening from 2 to 1 for Felix's programs (3.32) |
bpfRedirectToPeer |
Enabled |
Redirect directly to the workload peer device |
bpfLogLevel |
Off |
Off, Info or Debug BPF trace logs |
bpfKubeProxyIptablesCleanupEnabled |
true |
Remove kube-proxy's iptables chains in eBPF mode |
wireguardEnabled / wireguardEnabledV6 |
false |
WireGuard for IPv4 / IPv6 |
wireguardHostEncryptionEnabled |
false |
Also encrypt host-network traffic (EKS and AKS only) |
defaultEndpointToHostAction |
Drop |
Workload-to-host traffic after egress policy |
routeRefreshInterval |
1m30s |
Route resync period |
flowLogsFlushInterval |
5m0s |
Flow-log export interval |
flowLogsGoldmaneServer |
empty (operator sets it) |
Goldmane endpoint for flow data |
prometheusMetricsEnabled |
false |
Felix Prometheus endpoint |
healthPort |
9099 |
Felix health server |
logSeverityScreen |
Info |
Log level to stdout |
floatingIPs |
Disabled |
Program non-OpenStack floating IPs |
Operator Custom Resources
Kind (operator.tigera.io/v1) |
Name |
Purpose |
Installation |
default |
Core install: calicoNetwork (IP pools, linuxDataplane, bgp, bpfNetworkBootstrap, kubeProxyManagement), kubernetesProvider, registry, component resources |
APIServer |
default |
Deploys the aggregated calico-apiserver (deprecated in 3.32) |
Goldmane |
default |
Deploys the flow-log aggregator (3.30+) |
Whisker |
default |
Deploys the Whisker UI (3.30+) |
GatewayAPI |
default |
Deploys Calico Ingress Gateway (Envoy Gateway) and tigera-gateway-class; crdManagement: Reconcile lets the operator upgrade Gateway API CRDs |
TigeraStatus |
per component |
Read-only health: AVAILABLE, PROGRESSING, DEGRADED |
Calico API Resources
Main projectcalico.org/v3 kinds:
| Kind |
Scope |
Purpose |
NetworkPolicy / GlobalNetworkPolicy |
Namespaced / cluster |
Calico policy with order, tiers, Deny/Log/Pass |
StagedNetworkPolicy, StagedGlobalNetworkPolicy, StagedKubernetesNetworkPolicy |
Namespaced / cluster |
Preview policy without enforcing (3.30+) |
Tier |
Cluster |
Policy tier with order and defaultAction |
NetworkSet / GlobalNetworkSet |
Namespaced / cluster |
Named CIDR groups |
HostEndpoint |
Cluster |
Host interface protected by policy |
IPPool, IPReservation, IPAMConfiguration |
Cluster |
Address pools, reserved ranges, IPAM settings |
BGPConfiguration, BGPPeer, BGPFilter |
Cluster |
AS numbers, mesh, peers (localASNumber 3.31+), route filters |
FelixConfiguration |
Cluster |
Felix data plane settings |
KubeControllersConfiguration |
Cluster |
Controllers, HostEndpointTemplate, LoadBalancer IPAM |
ClusterNetworkPolicy (policy.networking.k8s.io/v1alpha2) |
Cluster |
Upstream Admin/Baseline policy (3.32+) |
Tier RBAC Resource Names
| resourceName pattern |
Scope |
| (blank) |
Any policy across all tiers |
tiername.* |
Any policy within the named tier |
tiername.policyname |
A specific policy |
Since 3.32, policies in non-default tiers no longer need the tiername. prefix in their own names; existing policies are migrated on upgrade.
Built-in Tiers
| Tier |
Order |
Default action |
kube-admin |
1,000 (fixed) |
Pass |
default |
1,000,000 (fixed) |
Deny |
kube-baseline |
10,000,000 (fixed) |
Pass |
calico-system (was allow-tigera before 3.32) |
set by the operator |
Protects Calico components |
Networking Modes
| Mode |
Inter-node transport |
Requires BGP |
Encapsulation |
Use case |
| BGP (no overlay) |
Direct routing via BGP |
Yes |
None |
Bare metal, on-prem fabrics that peer with nodes, one L2 domain |
| VXLAN overlay |
Kernel VXLAN tunnels (vxlan.calico) |
No |
VXLAN (UDP 4789) |
Cloud VPCs without BGP support |
| VXLANCrossSubnet |
Direct within a subnet, VXLAN across subnets |
No |
VXLAN across subnets only |
Multi-AZ clouds; default in operator custom-resources.yaml |
| IP-in-IP overlay |
IP-in-IP tunnels (tunl0) |
Yes |
IP-in-IP (protocol 4) |
Legacy environments; not supported with eBPF |
| IPIPCrossSubnet |
Direct within a subnet, IP-in-IP across |
Yes |
IP-in-IP across subnets only |
Legacy multi-subnet |
Datastore Options
| Datastore |
Description |
When to use |
| Kubernetes API |
Stores Calico state as CRDs (via kube-apiserver) |
Default for Kubernetes; required for operator installs and the eBPF data plane; use with Typha |
| etcd v3 |
Direct etcd connection, bypasses kube-apiserver |
OpenStack, non-cluster hosts, legacy large deployments; Typha not recommended |
Sizing and Scalability
| Dimension |
Guidance |
Source |
| Typha replicas (manifest installs) |
At least 1 per 200 nodes, at most 20; 3 minimum in production |
Calico on-prem install docs |
| Typha (operator installs) |
Always installed and autoscaled by the operator |
Typha overview |
| Typha threshold (manifest installs) |
Add Typha above 50 nodes |
Calico on-prem install docs |
| BGP full mesh |
Works well up to about 100 nodes; use route reflectors beyond that |
Calico BGP docs |
| Route reflectors |
Each node typically peers with 2 reflectors; reflectors carry control-plane traffic only |
Calico BGP docs |
| IPAM block size |
/26 (64 addresses) default, tunable per IPPool (blockSize) |
Operator custom-resources.yaml |
| Felix CPU |
Scales with endpoint and policy churn; eBPF usually uses less CPU than iptables |
Calico docs (qualitative) |
Benchmarks
Unsourced Performance Data
The three tables below were carried over from an earlier version of this page. Do not plan capacity from these numbers. They were estimated from vendor documentation, community benchmarks and engineering judgment. They are not controlled benchmarks: hardware, software versions and test methods were not recorded, and Calico's documentation publishes no hard limits on policy or endpoint counts. Use them as rough guidance only and run your own benchmarks for production planning.
| Dataplane |
Throughput |
Latency |
CPU Overhead |
| iptables |
8-9 Gbps |
100us |
High (10k+ rules) |
| eBPF |
9.5+ Gbps |
50us |
Low |
| Windows HNS |
5-7 Gbps |
200us |
Medium |
Scaling Limits
| Dimension |
iptables |
eBPF |
| Network policies |
1,000 |
10,000+ |
| Endpoints per node |
200 |
500+ |
| Total policies cluster-wide |
5,000 |
50,000+ |
| Policy evaluation time |
1-10ms |
< 1ms |
| Policies |
Felix Sync Time |
Memory Usage |
| 100 |
< 1s |
100MB |
| 1,000 |
2-5s |
300MB |
| 10,000 |
10-30s |
1GB+ |
| Release |
Change (from release notes) |
| 3.32 |
Felix caches interned label maps and defers selector label restrictions, reducing memory in large clusters |
| 3.32 |
bpfJITHardening: Auto avoids 10 to 20 times slower large-policy programming where strict JIT hardening is forced (for example Bottlerocket) |
| 3.32.2 |
User-mode policy engine (Felix/Dikastes) about 4 times less CPU and GC load for large policy sets; incremental IP-set resyncs |
| 3.31 |
eBPF conntrack uses an LRU hash map, evicting old entries instead of failing new connections |
Sources