How deeply does Google Anthos in Action cover Calico?

Identifies Calico’s enforcement role and iptables dependency, but does not detail its configuration or internals.

Calico

Calico is an open-source networking and network-security solution for containers, virtual machines, and host-based workloads.

Calico is an open-source networking and network-security solution for containers, virtual machines, and host-based workloads. In GKE Dataplane v1, it implements Kubernetes NetworkPolicies using components that rely heavily on Linux iptables. section 10.2.1

Its responsibility is distinct from kube-proxy’s: Calico enforces network policy, while kube-proxy uses iptables rules to direct Service traffic to healthy Pods. GKE Dataplane v2 instead uses Cilium and eBPF for network policy enforcement, addressing problems associated with the earlier iptables-heavy implementation. section 10.2.1

Table 10.1

Network feature	Existing	New Dataplane
ClusterIP service resolution	kube-proxy using iptables	`cilium-agent` using eBPF on sockets
NodePort service resolution	kube-proxy using iptables	`cilium-agent` using eBPF on eth0 TC hooks
Load balancer service resolution	kube-proxy using iptables redirecting to service chain	`cilium-agent` using eBPF on eth0 TC hooks (same hook as previously)
Network policy enforcement	Calico using iptables	`cilium-agent` using eBPF on socket as well as eth0 TC hooks

Compare the components and mechanisms used for network policy enforcement and Service resolution across the two GKE dataplanes. section 10.2.1

How Google Anthos in Action covers it

liveBook manning.com

Read Google Anthos in Action on liveBook Get the book at manning.com

Also explained in

liveBook manning.com

Acing the Certified Kubernetes Administrator Exam, Second EditionCalico is a container networking and network-policy platform that provides Kubernetes pod connectivity and policy enforcement.

Compare how 2 books explain Calico →

Related concepts

gke dataplane v1used by · GKE Dataplane v1 is the GKE networking implementation based on kube-proxy, iptables, and Calico.
network policyimplements · A network policy is a set of rules that permits or denies network traffic to and from selected workloads or endpoints.
CNI pluginkind of · A CNI plugin is an executable component that configures container network interfaces and connectivity according to the Container Network Interface specification.
Container Network Interfaceimplements · The Container Network Interface is a standard specification and plugin interface for configuring network connectivity and resources for containers.

This explainer was generated by Manning's knowledge graph from the text of Google Anthos in Action. The section links point to the parts of the book it draws on.