--- title: "Calico Network Policy Comes to Kubernetes" source: "https://wordpress-1075849-4005834.cloudwaysapps.com/blog/calico-network-policy-comes-to-kubernetes/" --- [Technical Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/technical-blog/) # Calico Network Policy Comes to Kubernetes By [Casey Davenport](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/caseydavenport/) on Aug 13, 2015 • 3 min read ## Calico Network Policy on Kubernetes As you may know, Calico was designed from the ground up to support rich, flexible, and secure [network policy](http://docs.projectcalico.org/en/latest/security-model.html). We’ve been working to bring that policy to Kubernetes deployments, and the [latest Calico Kubernetes plugin](http://github.com/projectcalico/calico-kubernetes/releases) does just that, allowing namespace isolation at the network layer, and fine-grained security between your Kubernetes pods. In tandem with this, we’d like to announce that Calico now supports acting in “policy-only” mode. This means you don’t need to use Calico networking to take advantage of Calico’s rich security policy enforcement. Take a look at the demonstration video below to see Calico network policy in Kubernetes in action. The demo uses Calico’s policy-only mode to enforce network policy on a Kubernetes cluster running on the standard GCE cloud provider. Networking is still performed using GCE’s native routing, while Calico is simply enforcing security policy. ### How Does it Work? #### Declaring Policy We make use of the [annotation](http://github.com/GoogleCloudPlatform/kubernetes/blob/release-1.0/docs/user-guide/annotations.md) field on the [v1.podTemplate](http://htmlpreview.github.io/?http://github.com/GoogleCloudPlatform/kubernetes/HEAD/docs/api-reference/definitions.html#_v1_podtemplate) API object to declare network policy. This allows us to declare policy in a concise, easily readable format, matching on arbitrary labels. For example, securing traffic to your backend pods is as easy as adding the following two lines to your backend pod manifest and adding the label “access=backend” to each pod that should be allowed access: ``` `annotations: policy: "allow tcp from label access=backend to port 4001"` ``` Remember you can use arbitrary labels in Calico policy – “access” is just what we chose for this example. Take a look at our GitHub page on [declaring Kubernetes policy](http://github.com/projectcalico/calico-docker/blob/master/docs/kubernetes/KubernetesPolicy.md) for a full set of supported policy statements. #### Behind the Scenes The Calico plugin reads the declared policy combined with the pod’s `namespace` and converts it to Calico policy primitives – profiles, tags, and rules. The policy is realized as iptables rules in the kernel of the Kubernetes node which hosts your pods. Programming ACLs to the kernel means we can take advantage of Linux’s battle-hardened iptables kernel support and eliminate the need for a user-space datapath, improving the security and performance of our network policy. Note the use of `namespace` in the policy mapping. By including the Kubernetes namespace, Calico can enforce Kubernetes namespace isolation. This means pods in your development namespace won’t accidentally interfere with your production pods. Pretty cool! #### What’s Next? This is just the first step – we have a lot of exciting work ahead of us continuing to develop network policy in Kubernetes and ensuring that Calico’s policy implementation can easily be combined with any Kubernetes networking plug-in / cloud provider. We plan on adding richer tag semantics to Calico policy to better support label-selectors, augmenting the Kubernetes API for better policy declaration, and improving policy performance in high-scale Kubernetes clusters. [Open Source](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/open-source/)[Partner/Integration](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/partner-integration/)[Project Calico](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/project-calico/) Add Tigera as a preferred source on Google to see more of our content in your search results. [![Add as a preferred source on Google](https://wordpress-1075849-4005834.cloudwaysapps.com/app/themes/tigera2021/dist/img/google-preferred-source-light.png)](https://www.google.com/preferences/source?q=tigera.io) ## Related posts [![What’s New in Calico: Winter 2026 Release](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/03/What-is-new-in-Calico-winter-2026.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/whats-new-in-calico-winter-2026-release/) [Company Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/company-blog/) #### [What’s New in Calico: Winter 2026 Release](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/whats-new-in-calico-winter-2026-release/) By [Veronika Smolik](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/veronika-smolik/) on Mar 4, 2026 AI Powered Intelligence, Unified Traffic Observability and Scalable Infrastructure Management As anyone managing one or more Kubernetes clusters knows by now, scaling can introduce an exponentially growing number of problems. The sheer volume of metrics,... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/whats-new-in-calico-winter-2026-release/) [![Join Calico at KubeCon Europe 2026: AI Agents, Silent Discos, and Dutch Delights!](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/02/Blog-Kubecon-Euro-2026-.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/calico-at-kubecon-cloudnativecon-europe2026/) #### [Join Calico at KubeCon Europe 2026: AI Agents, Silent Discos, and Dutch Delights!](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/calico-at-kubecon-cloudnativecon-europe2026/) By [Tigera Team](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/marketingtigera-io/) on Feb 25, 2026 The cloud-native community is heading to the historic canals and vibrant tech scene of Amsterdam for KubeCon + CloudNativeCon Europe 2026! From March 23–26, Amsterdam will be buzzing with the latest in Kubernetes, platform engineering,... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/calico-at-kubecon-cloudnativecon-europe2026/) [![Project Calico 3.30+ Hackathon: Show Us What You Can Build!](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/02/Blog-Hackathon-.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/project-calico-3-30-hackathon-show-us-what-you-can-build/) #### [Project Calico 3.30+ Hackathon: Show Us What You Can Build!](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/project-calico-3-30-hackathon-show-us-what-you-can-build/) By [Tigera Team](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/marketingtigera-io/) on Feb 17, 2026 Build the Future of Cloud-Native Networking! 🚀 The Calico community moves fast. With the releases of Calico 3.30 and 3.31, brings improvements in scalability, network security, and visibility. Now, we want to see what YOU... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/project-calico-3-30-hackathon-show-us-what-you-can-build/)