---
title: "Calico policy"
description: "Use Calico Open Source policy resources to secure both workloads and hosts beyond what Kubernetes NetworkPolicy alone supports."
product: "Calico Open Source"
version: "3.32 (latest)"
section: "Network policy"
canonical_url: "https://docs.tigera.io/calico/latest/network-policy/get-started/calico-policy/"
---

# Calico policy

## [📄️Get started with Calico network policy](https://docs.tigera.io/calico/latest/network-policy/get-started/calico-policy/calico-network-policy.md)

[Write your first Calico Open Source NetworkPolicy — sample policies that exercise the rich rule features that extend Kubernetes NetworkPolicy.](https://docs.tigera.io/calico/latest/network-policy/get-started/calico-policy/calico-network-policy.md)

## [📄️Calico automatic labels](https://docs.tigera.io/calico/latest/network-policy/get-started/calico-policy/calico-labels.md)

[Reference list of automatic labels Calico Open Source attaches to resources, useful as selectors in policy rules.](https://docs.tigera.io/calico/latest/network-policy/get-started/calico-policy/calico-labels.md)

## [📄️Get started with Calico network policy for OpenStack](https://docs.tigera.io/calico/latest/network-policy/get-started/calico-policy/network-policy-openstack.md)

[Extend OpenStack security groups with Calico Open Source network policy and label-based rules for VMs running on OpenStack.](https://docs.tigera.io/calico/latest/network-policy/get-started/calico-policy/network-policy-openstack.md)

## [📄️Calico policy tutorial](https://docs.tigera.io/calico/latest/network-policy/get-started/calico-policy/calico-policy-tutorial.md)

[Step-by-step tutorial for advanced Calico Open Source policy patterns — namespace scoping, allow-all, deny-all, and ingress and egress controls.](https://docs.tigera.io/calico/latest/network-policy/get-started/calico-policy/calico-policy-tutorial.md)