--- title: "Why use Typha in your Calico Kubernetes Deployments?" source: "https://wordpress-1075849-4005834.cloudwaysapps.com/blog/why-use-typha-in-your-calico-kubernetes-deployments/" description: "Typha is not optional, but is a necessary component of your Calico deployment for any decent-sized production cluster." --- [Technical Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/technical-blog/) # Why use Typha in your Calico Kubernetes Deployments? By [Bikram Gupta](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/bikramgupta/) on Apr 07, 2020 • 3 min read [Calico](https://wordpress-1075849-4005834.cloudwaysapps.com/) is an open source networking and network security solution for containers, virtual machines, and native host-based workloads. Calico supports a broad range of platforms including [Kubernetes](http://kubernetes.io/), [OpenShift](http://www.openshift.com/), [Docker EE](http://www.mirantis.com/software/docker/docker-enterprise/), [OpenStack](http://www.openstack.org/), and bare metal. In this blog, we will focus on Kubernetes pod networking and network security using Calico. Calico uses [etcd](http://etcd.io/) as the back-end datastore. When you run Calico on Kubernetes, you can use the same etcd datastore through the [Kubernetes API server.](http://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/) This is called a [Kubernetes backed datastore](http://docs.projectcalico.org/getting-started/kubernetes/hardway/the-calico-datastore) (KDD) in Calico. The following diagram shows a block-level architecture of Calico. ![Calico block-level architecture diagram](/app/uploads/2020/04/Calico-block-architecture-300x169.png) Calico-node runs as a [Daemonset](http://kubernetes.io/docs/concepts/workloads/controllers/daemonset/), and has a fair amount of interaction with the Kubernetes API server. It’s easy for you to profile that by simply enabling audit logs for [calico-node](http://github.com/projectcalico/node). For example, in my [kubeadm](http://kubernetes.io/docs/reference/setup-tools/kubeadm/kubeadm/) cluster, I used the following [audit configuration](http://gist.github.com/bikram20/dab23fcb5d88f2b465c2d8f37705a22c#file-gistfile1-txt) [![Code of audit configuration](/app/uploads/2020/04/audit-configuration-300x191.png)](http://gist.github.com/bikram20/dab23fcb5d88f2b465c2d8f37705a22c#file-gistfile1-txt) To set the context, this is my [cluster configuration.](http://gist.github.com/bikram20/1d17d659d7429cbb114a0850933dc0b8#file-gistfile1-txt) [![Code of cluster configuration](/app/uploads/2020/04/cluster-configuration-300x168.png)](http://gist.github.com/bikram20/1d17d659d7429cbb114a0850933dc0b8#file-gistfile1-txt) As we are running [Typha](http://github.com/projectcalico/typha) already, let us profile the API calls for both Calico and Typha components. I used the [following commands](http://gist.github.com/bikram20/b0dfe8f2d8777ab4f92f69de1bb8e3d9#file-gistfile1-txt) to extract the unique API calls for each. [![Code to extract the unique API calls](/app/uploads/2020/04/commands1-280x300.png)](http://gist.github.com/bikram20/b0dfe8f2d8777ab4f92f69de1bb8e3d9#file-gistfile1-txt) [![Code to extract the unique API calls](/app/uploads/2020/04/commands2-259x300.png)](http://gist.github.com/bikram20/b0dfe8f2d8777ab4f92f69de1bb8e3d9#file-gistfile1-txt) [![Code to extract the unique API calls](/app/uploads/2020/04/commands3-300x59.png)](http://gist.github.com/bikram20/b0dfe8f2d8777ab4f92f69de1bb8e3d9#file-gistfile1-txt) If you ignore the license key API calls from calico-node, you will see that the API calls from calico-node are an order of magnitude smaller than the API calls from Typha. I also sent the logs over to Elasticsearch, and here’s a simple plot for comparison. As you can see, there’s a massive difference between the API calls generated from Typha vs. Calico. (Kibana JSON available [here](http://gist.github.com/bikram20/5c3a4d7896edcfa136f6fe624e7d2a6d)). ![Graph that shows the difference between the API calls generated from Typha vs. Calico](/app/uploads/2020/04/Filters-300x148.png) The key point is that API calls from Typha will remain constant as you scale the cluster. If you watch the raw log pattern from gist, above, the bulk of API calls from Typha are watch events. [Typha](http://github.com/projectcalico/typha) is a read-only system. It watches for changes in various resources, and does a fan-out to all its clients (calico-node). This significantly reduces the load on the API server. [An instance of Typha sits between the datastore](http://github.com/projectcalico/typha#project-calico) (such as the Kubernetes API server) and many instances of Felix. ![Datastore diagram](/app/uploads/2020/04/datastore-pen-drawing-300x169.png) Another way to understand this is to simply generate a [clusterRole](http://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole) from the audit logs of Typha and calico-node. When reviewing the clusterRoles, you will see that Typha is primarily doing get, list, and watch. Whereas calico-node does create, update, delete, patch, get, and list on resources. The watch events, which are very frequent given the dynamic nature of configuration and pods, are handled by Typha. ![Code snippet](/app/uploads/2020/04/bottom-text-window-300x80.png) Without Typha, every calico-node would have to register its own watch with the API Server, and the load on the API server would multiply as you scale up the number of nodes. By having Typha, all the watch events are off-loaded to Typha and read only once from the API server. Hence Typha is not optional, but is a necessary component of your Calico deployment for any decent-sized production cluster. ————————————————- [**Free Online Training**](https://wordpress-1075849-4005834.cloudwaysapps.com/events/) Access Live and On-Demand Kubernetes Tutorials [**Calico Enterprise – Free Trial**](https://www.calicocloud.io/home) Solve Common Kubernetes Roadblocks and Advance Your Enterprise Adoption [Open Source](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/open-source/)[Project Calico](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/project-calico/) Add Tigera as a preferred source on Google to see more of our content in your search results. [![Add as a preferred source on Google](https://wordpress-1075849-4005834.cloudwaysapps.com/app/themes/tigera2021/dist/img/google-preferred-source-light.png)](https://www.google.com/preferences/source?q=tigera.io) ## Related posts [![What’s New in Calico: Winter 2026 Release](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/03/What-is-new-in-Calico-winter-2026.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/whats-new-in-calico-winter-2026-release/) [Company Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/company-blog/) #### [What’s New in Calico: Winter 2026 Release](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/whats-new-in-calico-winter-2026-release/) By [Veronika Smolik](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/veronika-smolik/) on Mar 4, 2026 AI Powered Intelligence, Unified Traffic Observability and Scalable Infrastructure Management As anyone managing one or more Kubernetes clusters knows by now, scaling can introduce an exponentially growing number of problems. The sheer volume of metrics,... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/whats-new-in-calico-winter-2026-release/) [![Join Calico at KubeCon Europe 2026: AI Agents, Silent Discos, and Dutch Delights!](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/02/Blog-Kubecon-Euro-2026-.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/calico-at-kubecon-cloudnativecon-europe2026/) #### [Join Calico at KubeCon Europe 2026: AI Agents, Silent Discos, and Dutch Delights!](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/calico-at-kubecon-cloudnativecon-europe2026/) By [Tigera Team](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/marketingtigera-io/) on Feb 25, 2026 The cloud-native community is heading to the historic canals and vibrant tech scene of Amsterdam for KubeCon + CloudNativeCon Europe 2026! From March 23–26, Amsterdam will be buzzing with the latest in Kubernetes, platform engineering,... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/calico-at-kubecon-cloudnativecon-europe2026/) [![Project Calico 3.30+ Hackathon: Show Us What You Can Build!](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/02/Blog-Hackathon-.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/project-calico-3-30-hackathon-show-us-what-you-can-build/) #### [Project Calico 3.30+ Hackathon: Show Us What You Can Build!](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/project-calico-3-30-hackathon-show-us-what-you-can-build/) By [Tigera Team](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/marketingtigera-io/) on Feb 17, 2026 Build the Future of Cloud-Native Networking! 🚀 The Calico community moves fast. With the releases of Calico 3.30 and 3.31, brings improvements in scalability, network security, and visibility. Now, we want to see what YOU... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/project-calico-3-30-hackathon-show-us-what-you-can-build/)