calico-calicoctl

What is calico-calicoctl?

The calicoctl image provides the calicoctl CLI, the primary management interface for Project Calico. Calico is a widely-used container networking and network policy solution for Kubernetes. calicoctl is used to create, read, update, and delete Calico resources such as GlobalNetworkPolicy, IPPool, BGPPeer, and HostEndpoint objects that are not exposed through standard Kubernetes API objects.

It is used by platform engineers and cluster operators to inspect network policy enforcement, configure BGP peering for on-premises clusters, manage IP address pools, and troubleshoot connectivity between pods.

How to use this image

Check cluster and node status:

docker run --rm \
  -v /etc/calico/calicoctl.cfg:/etc/calico/calicoctl.cfg:ro \
  calico/ctl:latest get nodes

Run as a kubectl plugin (via a wrapper):

# Pull and run calicoctl in datastore mode
docker run --rm \
  -e DATASTORE_TYPE=kubernetes \
  -e KUBECONFIG=/root/.kube/config \
  -v ~/.kube:/root/.kube:ro \
  calico/ctl:latest get globalnetworkpolicies

Apply a GlobalNetworkPolicy:

docker run --rm \
  -e DATASTORE_TYPE=kubernetes \
  -e KUBECONFIG=/root/.kube/config \
  -v ~/.kube:/root/.kube:ro \
  -v $(pwd)/policy.yaml:/policy.yaml:ro \
  calico/ctl:latest apply -f /policy.yaml

Inspect IP pools:

docker run --rm \
  -e DATASTORE_TYPE=kubernetes \
  -e KUBECONFIG=/root/.kube/config \
  -v ~/.kube:/root/.kube:ro \
  calico/ctl:latest get ippools -o wide

Image variants

calico/ctl:latest

The latest stable calicoctl release. Use this for general management tasks when you want the most recent features.

calico/ctl:<version>

Pinned version tags such as calico/ctl:v3.27.0. The calicoctl version must match the Calico version running in your cluster, so pinning is strongly recommended for production.