Learn Calico - Production-Ready Architecture

#Introduction

All previous episodes are building blocks. Episode 21 assembles them into one whole: a production-ready Calico architecture. This isn't about a single command, but a set of interconnected decisions — IPAM, BGP, dataplane, policy, upgrades, observability, and operations — that have to be designed together.

You'll come out of this episode with a checklist of decisions you can tick off one by one, plus a runbook for responding to incidents without panicking. This is the last chapter before we look at the big ecosystem map in episode 22.

#Network Planning

#IPAM and CIDR

The first decision is address space. Choose a CIDR that is unique per cluster (important for multi-cluster, episode 16), with headroom for growth. Example planning:

pod CIDR       192.168.0.0/16   (65 ribu alamat)
blockSize      26               (64 alamat per node)
service CIDR   10.96.0.0/12
kubernetes CIDR 172.16.0.0/16

Rule of thumb: a larger blockSize gives each node more local addresses but wastes unused ones. Tune it to the pod density per node.

#BGP Topology

For clusters above around 50 nodes, design route reflectors (episode 8) instead of a full-mesh. Also decide whether to peer with external routers for direct routing (episode 9) or stick with encapsulation.

calicoctl node status
calicoctl get bgppeer -o wide
calicoctl get bgpconfiguration default -o yaml | grep -E "mesh|asNumber"

#Dataplane and Encapsulation

#Decision Matrix

Pick a combination based on your infrastructure:

• On-prem + BGP available: direct routing, Never/Never, optional WireGuard.
• Cloud without pod routing: VXLAN CrossSubnet, or IPIP Always.
• Extreme performance + modern kernel: eBPF (episode 17), DSR, no kube-proxy.
• Traffic confidentiality between nodes: add WireGuard (episode 15).

Document these decisions together with their reasoning in the repository — incidents rarely happen because of a wrong choice, but often because there's no record.

#Policy and Security Design

#Tier Structure

Three standard production tiers:

security  (order 100)  - default deny global, break-glass, blocklist
platform  (order 200)  - DNS, monitoring, node, ekspor bersama
application (order 300) - policy per tim dan per aplikasi

The baseline in the security tier is set by the platform team and can't be overridden. The application tier is delegated to the application teams, with policy-writing guidance.

#Security Checklist

Before production, make sure: global default deny is active, host endpoints protect management ports (episode 14), WireGuard is enabled where needed (episode 15), and egress is controlled (episode 10). Verify:

calicoctl get globalnetworkpolicy -o wide
calicoctl get hostendpoint -o wide
kubectl get felixconfiguration default -o yaml | grep -i wireguard
calicoctl get egressgatewaypolicy -A -o wide

#Upgrades, CI/CD, and Observability

#Upgrade Strategy

Plan an upgrade once a year with a maintenance window: back up resources (calicoctl get --export), upgrade the operator, watch tigerastatus, then verify with smoke tests. Follow the release notes for major version jumps (episode 20).

#GitOps Pipeline

All Calico configuration — Installation, IPPool, BGPPeer, policy — is managed through a repository (episode 18). The pipeline validates the YAML, applies it to staging, then to production after review.

#Observability and Sizing

Monitor the key metrics: calico_felix_* for dataplane health, typha for API load, and calico-node CPU/memory. For sizing, give the calico-node DaemonSet enough CPU requests and don't overcommit on nodes with many workloads.

kubectl top pods -n calico-system -l k8s-app=calico-node
kubectl get pods -n calico-system -o wide

kubectl top pods shows the real usage — the basis for tuning requests and limits.

#Incident Runbook

#One-Page Procedure

For each incident, follow a fixed sequence:

1. kumpulkan status: calicoctl node status + tigerastatus
2. persempit lapisan: endpoint? route? policy? BGP? IPAM?
3. periksa log Felix dan typha
4. terapkan perbaikan terkecil dulu
5. verifikasi dengan smoke test
6. tulis post-mortem

Practice this runbook in a game day with your team, so that when a real incident happens, the reflexes are already trained.

#Conclusion

Episode 21 assembles the whole series into a production architecture: CIDR and BGP planning, documented dataplane decisions, tier design and a security checklist, an upgrade strategy, GitOps, observability, and a well-practiced runbook.

Key takeaways:

• Pick a unique CIDR per cluster and tune blockSize to pod density.
• Route reflectors are a must for large clusters; document the BGP topology.
• The dataplane is chosen from a matrix: on-prem, cloud, eBPF, and WireGuard.
• Security-platform-application tiers separate authority and blast radius.
• Upgrade yearly with backups, maintenance windows, and smoke tests.
• A practiced runbook turns panic into procedure.

In the final episode 22 we'll look at the alternative ecosystem and final reflection — a comparison of Calico versus Cilium, Flannel, and Weave, when to choose each, a recap of the journey through episodes 0-21, a production checklist, and Calico's future in the era of eBPF and policy standardization.