Sniffing & Spoofingkubernetesnetworkingsecuritypolicycalico

calicoctl

Calico is a networking and network security solution for Kubernetes, virtual machines, and bare-metal workloads. calicoctl is the command line tool used to manage Calico resources, policies, and node instances.

Description

Calico provides a widely adopted, battle-tested open source solution for networking and network security in containerized and virtualized environments. The calicoctl tool enables users to create, replace, apply, patch, delete, and retrieve Calico resources such as network policies and endpoint configurations.

It is particularly useful for managing security policies in Kubernetes clusters, viewing endpoint details, and handling Calico node instances. Administrators can use it to enforce network segmentation and security rules across workloads.

The tool supports operations via files, directories, stdin, or direct resource identifiers, making it flexible for automation and scripting in production environments.

How It Works

calicoctl interacts with Calico's control plane to manage networking and security resources in Kubernetes or other supported platforms. It uses kubeconfig contexts for cluster communication and supports operations like creating or replacing resources through YAML manifests or direct commands. Log levels control verbosity, and version mismatch allowances ensure compatibility between client and cluster versions.

Installation

bash
sudo apt install calicoctl

Flags

-h --helpShow this screen.
-l --log-level=<level>Set the log level (one of panic, fatal, error, warn, info, debug) [default: panic]
--context=<context>The name of the kubeconfig context to use.
--allow-version-mismatchAllow client and cluster versions mismatch.

Examples

Show the usage and options screen for calicoctl.
calicoctl -h
Create a resource by file, directory or stdin.
calicoctl create <file>
Replace a resource by file, directory or stdin.
calicoctl replace <file>
Apply a resource by file, directory or stdin. This creates a resource if it does not exist, and replaces a resource if it does exist.
calicoctl apply <file>
Patch a preexisting resource in place.
calicoctl patch <resource>
Delete a resource identified by file, directory, stdin or resource type and name.
calicoctl delete <resource>
Get a resource identified by file, directory, stdin or resource type and name.
calicoctl get <resource>
Get Calico nodes with info log level.
calicoctl --log-level=info get nodes
Updated 2026-04-16kali.org ↗