Implement Kubernetes network segmentation using Calico NetworkPolicy and GlobalNetworkPolicy for zero-trust pod-to-pod communication.
Calico is an open-source CNI plugin that provides fine-grained network policy enforcement for Kubernetes clusters. It implements the full Kubernetes NetworkPolicy API and extends it with Calico-specific GlobalNetworkPolicy, supporting policy ordering, deny rules, and service-account-based selectors.
kubectl and calicoctl CLI tools# Install the Tigera operator
kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.27.0/manifests/tigera-operator.yaml
# Install Calico custom resources
kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.27.0/manifests/custom-resources.yaml
# Verify installation
kubectl get pods -n calico-system
watch kubectl get pods -n calico-system
# Install calicoctl
kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.27.0/manifests/calicoctl.yaml
# Check Calico pods
kubectl get pods -n calico-system
# Check Calico node status
kubectl exec -n calico-system calicoctl -- calicoctl node status
# Check IP pools
kubectl exec -n calico-system calicoctl -- calicoctl get ippool -o wide
# deny-all-ingress.yaml
apiVersion: networking.k8s.io/v1