Calico provides an enterprise-hardened, fully upstream distribution of Istio Ambient Mode, built from source, managed by the Tigera Operator, and supported with Tigera’s enterprise-grade support and CVE protection.
Solution
Istio Ambient Mode
Istio Ambient Mode delivers service-to-service authentication, authorization, encryption, traffic shaping and observability without the complexity of sidecars.
Benefits
Strengthen security, streamline traffic control, and gain unified observability—all without sidecars
Enable universal mTLS
Authenticate, authorize and encrypt all service-to-service traffic to prevent tampering, unauthorized access, and data exposure
Improved traffic control
Use shared waypoint proxies to manage application-level traffic for safer, more reliable service communication
Deep observability
Combine Calico’s L3/L4 network traffic insights with Ambient Mode’s application level (L7) telemetry to troubleshoot faster
Trusted by Customers Worldwide
Application Traffic Control and Authorization
Istio Ambient Mode provides rich application (L7) traffic control through shared waypoint proxies, enabling progressive rollouts, A/B testing, and resilience features like circuit breaking and timeouts, all while enforcing fine-grained network policies for secure service communication.
mTLS for East-West Traffic
Automatically authenticate and encrypt all service-to-service communication using mutual TLS (mTLS) at the node(L4) and application layers (L7), ensuring secure east-west traffic without relying on sidecar proxies.
Seamless Policy Compatibility
Calico preserves the original destination ports inside the ztunnels, ensuring existing Kubernetes and Calico network policies continue to work unchanged, and function seamlessly with Istio Ambient Mode, with no policy rewrites required.
Integrated Application (L7) Observability With Calico
Ambient Mode’s waypoint proxies generate rich application (L7) metrics, traces, and logs, giving Calico unified visibility across network flows and application traffic in one platform.
Simple Istio Ambient Mesh Deployment
Calico uses the Tigera Operator to automatically install and manage Istio Ambient Mode, providing service-mesh capabilities without complicated setup or ongoing maintenance.
Available on Microsoft Azure, AWS, and Google Marketplace
Get started right away on Azure, AWS, or Google Cloud—every Calico component you need to get up and running is ready to go.
Customer Testimonial
Here’s what our customers are saying about us
Kubernetes, in itself, comes with constant change. Calico’s multi-cluster management gave Box the required capabilities to solve the security, observability, and compliance challenges we faced as a multi-cloud company that runs over 1,000 nodes.
It was previously a nightmare to operate multiple siloed tools across six clusters, and now it takes just a couple of clicks and an annual update of Calico.
Featured Resources
Developer-created resources to help you secure your Kubernetes deployment
Ready to Get Started?
Get started for free or request a demo to see Calico in action
