Cilium vs Calico: Which Kubernetes CNI Should You Pick?
Cilium 1.20 and Calico 3.33 shipped within weeks of each other, and the old \”eBPF vs iptables\” framing no longer describes either. A production comparison: dataplanes, network policy models, observability, encryption, Gateway API, what GKE, EKS and AKS actually run, and the migration traps nobody mentions.
Every “Cilium vs Calico” article you have read was probably written around one idea: Cilium is the modern eBPF one, Calico is the older iptables one. Today that idea is simply wrong. Cilium 1.20 was announced in September, Calico Open Source 3.33 shipped on October 1, and the two projects now overlap more than they differ. Calico has an eBPF dataplane and now supports netkit pod devices too. Both enforce the new Kubernetes ClusterNetworkPolicy. Both ship a Gateway API implementation.
Get Aleksei Aleinikov’s stories in your inbox
Join Medium for free to get updates from this writer.
Full deep-dive — Cilium vs Calico: both now ship eBPF, Gateway API and ClusterNetworkPolicy. The real split is L7/FQDN policy, Windows, BGP and your cloud’s default:
👉 alekseialeinikov.com/en/blog/topics/devops/cilium-vs-calico-kubernetes-cni
—
Want more like this? I publish engineering deep-dives — cloud, Kubernetes, DevSecOps and platform engineering — with the numbers and trade-offs the vendor docs leave out. Ad-free, and subscribers get each one by email first:
