--- title: "Case study: Calico enables zero-trust security and policy automation at scale in a multi-cluster environment for Box" source: "https://wordpress-1075849-4005834.cloudwaysapps.com/blog/case-study-calico-enables-zero-trust-security-and-policy-automation-at-scale-in-a-multi-cluster-environment-for-box/" --- [Company Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/company-blog/) # Case study: Calico enables zero-trust security and policy automation at scale in a multi-cluster environment for Box By [Suki Lam](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/suki-lam/) on Jun 08, 2023 • 3 min read Box is a content cloud that helps organizations securely manage their entire content lifecycle from anywhere in the world, powering over 67% of Fortune 500 businesses. As a cloud-first SaaS, the company provides customers with an all-in-one content solution within a highly secure infrastructure, where organizations can work on any content, from projects and contracts to Federal Risk and Authorization Management Program (FedRAMP)-related content. ## Background Box has two types of operations: cloud-managed Kubernetes clusters in hybrid, multi-cloud, and public cloud environments, and self-managed Kubernetes clusters in co-located data centers. The company runs multiple clusters with sizes of 1,000 nodes and larger. As one of the early adopters of Kubernetes, Box began using Kubernetes much before Google Kubernetes Engine (GKE) or Amazon’s Elastic Kubernetes Services (EKS) was born, and has been on the leading edge of innovation for Kubernetes in areas such as security, observability, and automation. In collaboration with Tigera, Box shares how Calico helped the company achieve zero-trust security and policy automation at scale in a multi-cluster environment. ***ICYMI***: Watch this recording from the 2022 CalicoCon Cloud Native Security Summit, where Tapas Kumar Mohapatra of Box shares [how Box moved into automated dependency mapping and policy generation with API v3](https://wordpress-1075849-4005834.cloudwaysapps.com/lp/calicocon-cloud-native-security-summit-2022/fireside-chat-how-box-moved-into-automated-dependency-mapping-and-policy-generation-with-api-v3/) ## Case study highlights Once Box moved to Kubernetes, the content cloud opened a shared Kubernetes infrastructure model with a multi-cluster architecture for its services. As the service owner, the Box Kubernetes infrastructure team needed to be the central service provider and overseer to their internal customer user base, the application development team. ### Challenges Since not all application developers are Kubernetes experts or have the necessary policy-writing expertise, Box’s shared Kubernetes infrastructure and multi-cluster architecture was met with a number of challenges: - Maintaining a zero-trust posture, enforcing granular workload access controls, and gaining observability into all workload and policy communications on a shared infrastructure in an ephemeral environment with thousands of microservices - Troubleshooting and ensuring all deployed security policies can run on multiple clusters and are discoverable to other endpoints - Achieving and maintaining continuous compliance with regional regulations, including PCI DSS, SOC 2, and FedRAMP - On-demand compliance reporting ### Goals Quickly realizing workarounds were too time-consuming and costly, the company searched for a security provider to solve these problems, with four major goals: - Maintain a zero-trust posture for all workloads - Gain visibility into all workload and policy communications and reduce troubleshooting times - Automate multi-cluster security policy creation and management - Ensure continuous compliance with regional regulatory requirements ### Results After implementing Calico Enterprise, Box achieved zero-trust security and gained observability for all workload communications. The company now has a fully automated policy lifecycle that Calico continuously monitors to ensure compliance with regional regulatory requirements for the company’s shared infrastructure spanning multiple clusters in co-located data centers, and public clouds in different regions. “Tigera helped Box enforce zero-trust security, workload observability, and cross-regional compliance for our shared, multi-cluster Kubernetes infrastructure.” —Tapas Mohapatra Sr. Manager, Site Reliability Engineering, Cloud & Kubernetes at Box Read the case study: [Calico enables zero-trust security and policy automation at scale in a multi-cluster environment for Box](https://wordpress-1075849-4005834.cloudwaysapps.com/box-case-study/) [Products](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/products/) Add Tigera as a preferred source on Google to see more of our content in your search results. [![Add as a preferred source on Google](https://wordpress-1075849-4005834.cloudwaysapps.com/app/themes/tigera2021/dist/img/google-preferred-source-light.png)](https://www.google.com/preferences/source?q=tigera.io) ## Related posts [![The Rise of AI Agents and the Reinvention of Kubernetes: Ratan Tipirneni’s 2026 Outlook](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2025/12/The-Rise-of-AI-Agents-and-the-Reinvention-of-Kubernetes.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/2026-the-rise-of-ai-agents/) #### [The Rise of AI Agents and the Reinvention of Kubernetes: Ratan Tipirneni’s 2026 Outlook](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/2026-the-rise-of-ai-agents/) By [Tigera Team](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/marketingtigera-io/) on Dec 30, 2025 Prediction: The next evolution of Kubernetes is not about scale alone, but about intelligence, autonomy, and governance. As part of the article ‘AI and Enterprise Technology Predictions from Industry Experts for 2026′, published by Solutions... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/2026-the-rise-of-ai-agents/) [![How Istio Ambient Mode Delivers Real World Solutions](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2025/12/How-Istio-Ambient-Mode-Delivers-Real-World-Solutions.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/how-istio-ambient-mode-delivers-real-world-solutions/) [Technical Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/technical-blog/) #### [How Istio Ambient Mode Delivers Real World Solutions](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/how-istio-ambient-mode-delivers-real-world-solutions/) By [John Alexander](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/john-alexander/) on Dec 18, 2025 For years, platform teams have known what a service mesh can provide: strong workload identity, authorization, mutual TLS authentication and encryption, fine-grained traffic control, and deep observability across distributed systems. In theory, Istio checked all... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/how-istio-ambient-mode-delivers-real-world-solutions/) [![A Detailed Look at the Calico Ingress Gateway](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2025/11/Blog-A-Detailed-Look-at-the-Calico-Ingress-Gateway.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/a-detailed-look-at-the-calico-ingress-gateway/) #### [A Detailed Look at the Calico Ingress Gateway](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/a-detailed-look-at-the-calico-ingress-gateway/) By [John Alexander](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/john-alexander/) on Nov 20, 2025 The Kubernetes community recently announced that Ingress NGINX, one of the most widely used Ingress controllers, will be retired. This change means teams need to plan for a secure, modern, and future-proof alternative for managing... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/a-detailed-look-at-the-calico-ingress-gateway/)