Learn Calico (Project Calico) as a CNI and network security engine in Kubernetes from the basics to production-grade: prerequisite skills & environment setup, background history & why you need Calico, core concepts & main architecture, setup & installation, IPAM & basic networking, basic network policy, GlobalNetworkPolicy & tiers, basic observability, BGP peering & routing, encapsulation & overlay options, egress access control, DNS & FQDN policy, service mesh & app layer, zero trust security & microsegmentation, host endpoint & node security, encryption & advanced network security, multi-cluster & federation, advanced eBPF dataplane, GitOps & policy as code, performance & troubleshooting, the latest stable features v3.31 & v3.32, production-ready architecture, and alternative ecosystem & final reflection, with a total of 23 episodes.
Before you touch Calico, you need to master the basics of Kubernetes, Linux networking, and the CLI. In this episode you set up a test cluster, install Calico Open Source via the Tigera Operator, and verify the installation with calicoctl.

This episode traces Calico's origins at Metaswitch Networks, the wire-rate routing mission without overlay, the problems it solves, and its position as one of the most widely adopted CNIs in the Kubernetes ecosystem up to v3.32.x.

This episode dissects Calico's architecture: the role of the Tigera Operator, calico-node, Felix as the programmable dataplane, BIRD for BGP, Typha which scales communication, kube-controllers, and the pod-to-pod packet path behind the scenes.

This episode provides a thorough Calico installation guide: installing the Tigera Operator via Helm and manifests, custom Installation configuration, verification with calicoctl, and a comparison of the iptables versus eBPF dataplane modes with their kernel prerequisites.

This episode dissects Calico IPAM: IPPools, per-node block allocation, IPIP/VXLAN encapsulation modes versus direct routing, and how pod-to-pod connectivity, pod-to-service, and the interaction with kube-proxy work.

This episode dissects Calico's namespaced NetworkPolicy: selector structure, ingress and egress, ports and protocols, the default deny principle, and the order of policy evaluation using tiers.

This episode covers GlobalNetworkPolicy and GlobalNetworkSet, the concept of policy tiers with a security, platform, and application hierarchy, and the practice of building a cluster-wide default-deny baseline and per-team policies.

This episode covers basic Calico observability: debugging with calicoctl, flow logs, Prometheus metrics from Felix and Typha, and techniques for inspecting the dataplane status, endpoints, and policies applied on nodes.

This episode dissects Calico BGP: the default node-to-node mesh, route reflectors for large clusters, BGPConfiguration, BGPPeer, peering with external routers, advertising pod CIDRs, and the MetalLB integration.

This episode covers Calico's encapsulation modes: IPIP and VXLAN, a comparison of tunnel overhead, direct routing without overlay for on-prem and cloud-native, and changing the IPPool and FelixConfiguration to match your network needs.
