Calico Whisker is quickly becoming the go-to tool for teams that want granular, real-time visibility into their Kubernetes network traffic and security posture. It provides an intuitive, high-level view of your network, but as with any new tool, there are going to be questions: How does it handle manifest-based installations versus operator-based ones? Can it leverage eBPF for high-performance data collection? What’s the best way to export its rich flow logs to your existing SIEM or visualize traffic on a network map?
Getting the most out of Calico Whisker requires understanding its inner workings and this guide is designed to help you master this exciting tool with support from the Calico community.
We’ve compiled the most frequently asked questions from our community Slack, support conversations, and CalicoCon sessions. This Q&A covers everything from initial installation tips and version requirements to advanced topics like filtering flow logs and integrating with Goldmane, the powerful API that underpins Calico Whisker.
Frequently Asked Questions From The Community
Whether you’re just beginning to evaluate Calico Whisker or looking to extract more value from your current deployment, this guide provides clear, actionable answers to help you level up your Kubernetes observability game.
I’m not sure which version of Calico I’m running. Can I use Whisker?
Yes you can, noting that Calico Whisker requires Calico v3.30 or higher. If you’re running an older version, you’ll need to upgrade your cluster first.
To check your Calico version, run the following command:
kubectl exec -it -n tigera-operator deployment/tigera-operator -- operator --versionIf your version is older than v3.30, follow the upgrade guide or 📹 watch the video below for a demonstration of how to upgrade Calico on Kubernetes:
My Calico installation is manifest-based. Is Whisker still supported?
Yes! While we recommend upgrading to the operator-based installation for a smoother experience and easier lifecycle management, you can still use Calico Whisker with a manifest-based installation.
Check out this detailed installation guide for enabling Calico Whisker manually.
Why doesn’t Calico Whisker support exposure via a LoadBalancer?
Calico Whisker and Goldmane contain sensitive network and workload data and are secured via NetworkPolicies by default. We strongly recommend against exposing this data externally.
If you absolutely must expose it, you can create a new ingress NetworkPolicy to allow external traffic. However, you should also use the Calico Ingress Gateway and add authentication to ensure only authorized users can access your network data.
Here’s an example of the NetworkPolicy:
kubectl create -f -<<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: whisker-ext-access
namespace: calico-system
spec:
ingress:
- ports:
- port: 8081
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: whisker
policyTypes:
- Ingress
EOFIs Calico Whisker based on eBPF?
Yes, Calico Whisker leverages eBPF for network observability. Calico Whisker and its underlying API, Goldmane, will use eBPF-based instrumentation to collect the necessary network information. Running in eBPF mode is not only fast but also highly scalable.
Switching to eBPF is a single command away! Learn more about enabling eBPF.
What do “Enforced” and “Pending” indicate in the Policy tab?
In the Policy tab, these terms refer to the status of your NetworkPolicies:
- Enforced: Policies that are currently applied to a flow.
- Pending: Includes enforced policies that would apply to this flow once a new connection is established as well as staged policies that would apply if they were promoted.
For more information, see our staged policy documentation.
Whisker isn’t showing any flow data — what could be the issue?
If the Calico Whisker UI isn’t displaying any flow logs from the cluster, the issue is likely upstream and not with the UI itself.
There are a few things you can check:
- Verify Goldmane is receiving flow logs by running
kubectllogs on the Goldmane pod. - Check Felix data plane configuration.
- Wait a moment for traffic. If you haven’t had any recent traffic, the console may appear empty at first. Generate some pod traffic and wait for the flows to appear.
Calico Whisker is great — but how can I visualize flows on a network map?
The easiest way to visualize your traffic is with Calico Cloud Free Tier. You can upgrade directly from the Calico Whisker UI to unlock Calico’s Service Graph for visual traffic insights. Goldmane also provides gRPC channels that can be used to ship data to any platforms such as Grafana servicemap or other OpenTelemetry based visualizations. However, such third-party integration requires you to write the integration layer between Calico and that platform.
📹 Watch the video below to learn how to access Calico’s Service Graph:
We’ve already made a significant investment in a SIEM platform. Can I export Whisker logs to my own SIEM?
Yes you can! Use Goldmane, Calico Whisker’s flow log API, to stream logs to any SIEM. We demonstrated this at CalicoCon 2025 EMEA.
📹 Watch: How to Integrate Calico with External APIs.
Pro community tip: If you’re looking to save on SIEM costs, Calico Cloud Free Tier includes powerful logging and analytics at no cost. 😀
Are there any limits in Calico Whisker?
Calico Whisker itself has no query or UI limits. However, Goldmane retains 24 hours of flow logs by default. You can extend retention by integrating with Calico Cloud or by building a Goldmane pipeline to a local storage.
What filters are available in Calico Whisker via the Goldmane API?
Calico Whisker’s flow logs can be filtered on these attributes:
| Filter | Description |
|---|---|
| Policy | Select flows based on matched/staged policies (great for testing staged policies). |
Source Namespace(source_namespaces) |
Flows originating from a namespace. |
Source(source_names) |
Specific pod or workload names. In case of a deployment these informations are aggregated (e.g.,whisker-746cf6f489-*). |
Destination Namespace(dest_namespaces) |
Flows targeting a namespace. |
Destination(dest_names) |
Flows to specific destinations. In case of a deployment these informations are aggregated (e.g.,goldmane-78ccd47684-*). |
| Protocol/Port (L4) | Filter TCP, UDP, or port-specific flows. |
You can also mix and match these filters. For instance, you could start by filtering for a policy name. If that policy is a Calico global network policy that applies across many namespaces, you can then drill down to select only the specific namespaces you want to investigate.
📹 Watch the video below for a demonstration:
Do you have more questions? The Calico community is here to help!
Join our Slack community to connect with experts and fellow community users. You can get your questions answered and get help diagnosing challenges directly from the community.
It’s a free resource, just like Calico Open Source and Calico Cloud Free Tier.
