What’s New in Calico: Spring 2025

Introducing Calico Cloud Free Tier

Calico provides a unified platform for all your Kubernetes networking, network security, and observability requirements. From ingress/egress management and east-west policy enforcement to multi-cluster connectivity, Calico delivers comprehensive capabilities. It is distribution-agnostic, preventing vendor lock-in and offering a consistent experience across popular Kubernetes distributions and managed services. Calico eliminates silos, providing seamless networking and observability for containers, VMs, and bare metal servers, and extends effortlessly to multi-cluster environments, in the cloud, on-premises, and at the edge.

With the recent release of Calico Open Source 3.30, we added:

• Improved observability to visualize and troubleshoot workload communication with Calico Whisker and the Goldmane API.
• Kubernetes Network Policies are critical for preventing ransomware, achieving microsegmentation to isolate sensitive assets for compliance, and thwarting attacks from malicious actors. However, implementing them effectively can be challenging due to the complexity of identifying, testing, and rapidly updating policies to meet evolving threats. Calico Open Source 3.30 introduces staged policies to enable teams to audit and validate policies before they are enforced, reducing the risk of misconfigured policies and improving security and compliance.
• The ability to manage Kubernetes ingress traffic with Calico Ingress Gateway, a 100% upstream, enterprise-ready implementation of the Kubernetes Gateway API.

And to expand on our robust Calico Open Source 3.30 offering, we’re excited to introduce Calico Cloud Free Tier. This new product edition further expands our open source offerings by providing enhanced observability and policy management capabilities to help visualize and troubleshoot workload communication, and simplify network security enforcement and microsegmentation.

Already using Calico Open Source 3.30 or higher? Get started in less than five minutes. All you need to do is connect your Calico Open Source 3.30 cluster to Calico Cloud Free Tier and see the difference!

Why Calico Cloud Free Tier?

Calico Cloud Free Tier is designed to expand on the capabilities of Calico Open Source and address the many challenges faced by Kubernetes operators and platform engineers, including:

• Limited workload communication observability
• Complex and risky network policy deployments to achieve microsegmentation
• The difficulty of creating effective network security policies

Gain deep insights into workload communication with Calico Dynamic Service Graph

Calico Cloud Free Tier directly addresses these challenges by offering enhanced capabilities, including:

• Improved Observability: Move beyond Calico Open Source visibility. Calico Service Graph provides an intuitive graph-based visualization to view dynamic workload communication and gain quick access to logs for faster analysis and troubleshooting.
• Simplified Microsegmentation: Find all the tools you need to implement microsegmentation, including Policy Board to view enforced and staged policies, policy tiers to enable policies to be enforced in a predetermined order making it possible for multiple teams to collaborate, create, and deploy policies without the risk of conflict, and observability with Dynamic Service Graph.
• Intuitive Dashboards: Utilize Calico Dashboards to easily conduct cluster health monitoring, traffic volume analysis, and troubleshooting.
• Simplified Network Policy Management: Streamline your network policy management workflows with Calico Policy Board, making it significantly easier to view and manage tiered policies, create and edit policy rules, and stage and preview policy behavior.
• Intelligent Policy Recommendations (coming soon): Deploying network policies in live environments is complex and high-risk—platform teams often lack clear knowledge of which pods and services should communicate with each other. This critical information typically resides with developers and is difficult to access, making policy creation a slow and risky endeavour. Calico’s intelligent policy recommendations solves this by automatically discovering allowed traffic flows and generating policy suggestions, reducing misconfigurations and enabling safer, faster policy rollouts.
• Seamless Upgrade to Calico Cloud: Access even more networking, network security, and observability, including firewall integration, multi-cluster networking, automated namespace isolation, enhanced logs such as DNS and audit logs. Learn more about Calico product editions.

Calico Policy Board simplifies microsegmentation by making it easier to create, stage, and safely deploy network policies.

How Calico Cloud Free Tier Enhances Calico Open Source

Feature Comparison: Calico Open Source and Calico Cloud Free Tier

Note: Calico Cloud Free Tier is limited to a single user and a single Kubernetes cluster. See a full feature comparison.

And it doesn’t stop here. Future improvements to Calico Cloud Free Tier will continue to expand usability, add more observability features, further simplify policy management, and more.

Improved Accuracy and Encryption for Commercial Editions

Improved accuracy of Calico policy reporting in flow logs

One of the challenges with evaluating a Calico policy was that it only reported Allow or Deny actions for connections that were established after the policy was created. If the policy was updated while connections were already established, a denied action could still be reported in flow logs when it should be an allow, or vice versa.

To address this issue we changed the behavior of all Calico network policies so that policy rules report what the action is for the current flow and, in a new field, what policies would apply to a new instance of that connection.

This new field in flow logs is called pending and shows you what policies would apply to a flow once a new connection is established. This new field is particularly useful for long-lived connections where a new policy or policy update might be made while connections are already established. Additionally, any staged policy that applies to a flow will now be reported in pending to show that it will apply to similar connections once enforced.

WireGuard: Provide support for encryption between federated endpoints and services in different clusters

WireGuard now supports encryption for data-in-transit between services in different clusters connected via Calico Cluster Mesh.

While WireGuard has been effective for securing traffic within individual clusters, the growing adoption of multi-cluster (federated) architectures requires the same level of encryption support for intra-cluster communication. Without native encryption, cross-cluster communication can introduce security and compliance risks, often forcing organizations to implement more complex solutions like service meshes.

Calico now has WireGuard support to encrypt traffic between federated endpoints across clusters (without needing to use a service mesh).

Benefits:

• Strengthened security and compliance for multi-cluster environments
• Lightweight, operationally simple alternative to service mesh for cross-cluster encryption

Summary

Calico Cloud Free Tier simplifies the adoption of powerful Kubernetes networking and security for platform teams. By offering a seamless upgrade path from Calico Open Source 3.30+ and providing key features like Dynamic Service Graph for enhanced observability, Policy Board for easier policy management, and traffic dashboards for analytics at no cost, Calico Cloud Free Tier enables teams to improve cluster operations without added complexity or expense.

To learn more about these new product capabilities and see them in action, schedule a demo.