# Install calicoctl with Homebrew Calico CLI tool. Version 3.32.1 via Homebrew; verified 2026-06-27. ## Install ```sh sudo av install brew:calicoctl ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install calicoctl ``` Evidence: local Homebrew formula metadata ## Package facts - **Package key:** brew:calicoctl - **Package manager:** Homebrew - **Package manager page:** - **Version:** 3.32.1 - **Source summary:** Calico CLI tool - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** Apache-2.0 - **Source archive:** - **Last updated:** 2026-06-27T07:47:51Z - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - calicoctl (cli) - calicoctl (alias) ## Build dependencies - go ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 3.32.1 - Package-manager updated: 2026-06-27 - Local data: ok - Upstream repository: https://github.com/projectcalico/calico - info: No cached GitHub release or tag data was available. ## Project history and usage calicoctl is the command-line management tool for Calico Open Source, the Tigera-maintained container networking and network-policy project. It gives package-manager users a direct CLI for Calico resources, BGP configuration, IP address management, node operations, and policy workflows. ### Project history The Calico repository README describes Project Calico as an open-source project created and maintained by Tigera, with a large user and contributor community. It says Calico is widely adopted for container networking and security, powering millions of nodes daily across many countries. The calicoctl documentation defines the tool as a command-line interface for managing Calico Open Source network policy, BGP, IP address management, and node operations. The repository tag history shows component-specific calicoctl tags in the older monorepo era, and the modern docs require the calicoctl version to match the Calico cluster version unless the version mismatch override is used. ### Adoption history calicoctl adoption follows Calico adoption: as Kubernetes and container-network policy became operational necessities, administrators needed a packageable CLI to inspect and manipulate Calico resources outside higher-level deployment tools. The official README's scale claims and 200-plus contributor note indicate the broader Calico ecosystem rather than just the CLI. In practice, calicoctl became a common operational package for cluster administrators, CI jobs, and incident-response shells because it can create, apply, replace, patch, delete, get, validate, convert, and inspect Calico resources from files, directories, stdin, or resource names. ### How it is used Users run `calicoctl` against a Calico datastore or Kubernetes cluster to manage network/security policy, endpoint configuration, IP pools, BGP peers, Felix configuration, host endpoints, workload endpoints, node state, and IPAM. It supports a familiar declarative file flow through `create`, `apply`, `replace`, `patch`, and `delete` commands. The docs warn that calicoctl and Calico versions should match, which is especially relevant for package managers: installing a newer CLI than the cluster can break calls unless `--allow-version-mismatch` is explicitly set. ### Why package nerds care calicoctl is significant because it is a Kubernetes-era infrastructure CLI where package versioning is operationally meaningful. Unlike a generic helper binary, the CLI is coupled to cluster API expectations and is packaged separately for local admin machines, automation runners, and troubleshooting environments. It also represents the packaging shape of cloud-native networking: one source project, many cluster components, a standalone CLI, Helm/operator deployment paths, and version-sensitive compatibility across distributions. ### Timeline - 2010s: Project Calico emerged as an open-source container networking and policy project maintained by Tigera. - 2010s: calicoctl became the CLI surface for managing Calico resources and node/network-policy operations. - 2021: Calico 3.x release stream continued with frequent GitHub releases and component tags. - 2026: Current Calico docs describe calicoctl as the user-reference CLI for Calico Open Source network policy, BGP, IPAM, and node operations. ### Related projects - Related projects include Project Calico, Tigera Operator, Kubernetes NetworkPolicy, CNI plugins, Felix, BIRD, Typha, kube-controllers, Cilium, Flannel, and other Kubernetes networking and policy tools. calicoctl is the direct admin CLI in that ecosystem. ### Sources - - - - ## Security Notes narrow executable package without higher-risk signals. - **Geiger risk:** green / low - narrow executable package without higher-risk signals ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Unix: /etc/calico/calicoctl.cfg ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** calicoctl - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## Related links - [Cloud CLI packages](https://www.automicvault.com/pkg/cloud-clis/) - Belongs to a cloud or infrastructure command family. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Security and crypto packages](https://www.automicvault.com/pkg/security-crypto-tools/) - Matched security, identity, cryptography, password, signing, or certificate metadata. - [go](https://www.automicvault.com/pkg/brew/go/) - Build dependency declared by Homebrew. - [cilium-cli](https://www.automicvault.com/pkg/brew/cilium-cli/) - Shares av.db curated category or tags: cli, kubernetes, networking. - [cni-plugins](https://www.automicvault.com/pkg/brew/cni-plugins/) - Shares av.db curated category or tags: cli, kubernetes, networking. - [coredns](https://www.automicvault.com/pkg/brew/coredns/) - Shares av.db curated category or tags: cli, kubernetes, networking. - [freeradius-server](https://www.automicvault.com/pkg/brew/freeradius-server/) - Shares av.db curated category or tags: cli, network-policy, networking. - [hubble](https://www.automicvault.com/pkg/brew/hubble/) - Shares av.db curated category or tags: cli, kubernetes, networking. - [kubefwd](https://www.automicvault.com/pkg/brew/kubefwd/) - Shares av.db curated category or tags: cli, kubernetes, networking. - [shellz](https://www.automicvault.com/pkg/brew/shellz/) - Shares av.db curated category or tags: cli, kubernetes, networking. - [traefik](https://www.automicvault.com/pkg/brew/traefik/) - Shares av.db curated category or tags: cli, kubernetes, networking. ## Combined YAML source View the package source record on GitHub. [combined/calicoctl.yml](https://github.com/automic-vault/db/blob/main/combined/calicoctl.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated configuration and credential file locations - curated package history - package version freshness - av.db category and tag curation - package relationship graph - cross-ecosystem install command graph