--- title: "Enforcing Enterprise Security Controls in Kubernetes using Calico Enterprise" source: "https://wordpress-1075849-4005834.cloudwaysapps.com/blog/enforcing-enterprise-security-controls-in-kubernetes-using-calico-enterprise/" description: "With Calico Enterprise, you can easily apply enterprise security controls to both Kubernetes nodes and pods." --- [Technical Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/technical-blog/) # Enforcing Enterprise Security Controls in Kubernetes using Calico Enterprise By [Bikram Gupta](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/bikramgupta/) on Aug 12, 2020 • 5 min read Hybrid cloud infrastructures run critical business resources and are subject to some of the strictest network security controls. Irrespective of the industry and resource types, these controls broadly fall into three categories. - Segmenting environments (Dev, Staging, Prod) - Enforcing zones (DMZ, Trusted, etc.) - Compliance requirements (GDPR, PCI DSS) Workloads (pods) running on Kubernetes are ephemeral in nature, and IP-based controls are no longer effective. The challenge is to enforce the organizational security controls on the workloads and Kubernetes nodes themselves. Customers need the following capabilities: - Ability to implement security controls both globally and on a per-app basis: Global controls help enforce segmentation across the cluster, and work well when the workloads are classified into different environments and/or zones using labels. As long as the labels are in place, these controls will work for any new workloads. - Generate alerts if security controls are tampered with: Anyone with valid permissions can make changes to the controls. There is a possibility that these controls can be modified without proper authorization or even with a malicious intent to bypass the security. Hence, it is important to monitor changes to the policies. - Produce an audit log showing changes to security controls over time: This is important for compliance purposes. Existing security tools are designed for hosts and do not understand Kubernetes and pods. With Calico Enterprise, you can apply our enterprise security controls to both Kubernetes nodes and pods. Another aspect to consider is monitoring and visibility. Traditional tools are built for IP-based connectivity monitoring. With Kubernetes, you need visibility into the pod, namespace, policy, and labels for a connection. Without Kubernetes-aware logs, there is no visibility into network connectivity. Without visibility, troubleshooting and compliance monitoring becomes really difficult. ## How Does It Work? ![Calico policy example: DEV cannot connect to PROD, showing policy and scalable enforcement](/app/uploads/2020/08/Security-Controls-diagram.png)Kubernetes nodes and workloads must be labeled appropriately, and the app on-boarding workflow must ensure that the labels (required for security controls) are applied to the workloads. Even if the resources auto-scale up or down and are ephemeral, the label ensures a consistent selector for the workload. Then the security controls are applied in a declarative manner. A policy example is shown in the diagram on the right. Irrespective of whether the labels DEV and PROD apply to pods or nodes, Calico Enterprise will enforce the policy. ## Policy Tiers As you grow to hundreds of policies and have different teams accessing the cluster, you will need to plan for role separation. A very common practice is to separate Security, Ops and Dev teams. You may wish to implement the policy model so that each team has access to only its policies. Calico Enterprise provides policy tiers for this purpose. Tiers are Kubernetes resources that can be controlled using role-based access control (RBAC).  The diagram, below, illustrates the tiering model. - Platform tier has the policies for basic cluster component communication and access to resources like storage. - Security tier has organizational controls. Security and Compliance teams have access to this tier. - All applications can be placed under the App tier, or you may further segregate the individual apps (or business unit) into their own tiers. Note that some customers prefer to have a platform tier in the left-most column, to give highest preference to basic cluster functioning. It all comes down to the security blueprint of your organization. ![Diagram showing policy evaluation order across Infosec, Platform, and App tiers, illustrating security blueprint options](/app/uploads/2020/08/security-tiers-300x136.png) Calico Enterprise provides you with comprehensive data on endpoints, policies and logs. Auditors need reports and actionable information, which is typically delivered in the form of logs and reports. You can define the scope of the report or an alert as a Kubernetes resource in Calico Enterprise. Access to reports can be controlled by role (e.g., for individual teams) and are available for download from the UI. ## Advantages - Enterprise Security Controls fulfills some baseline requirements in your Kubernetes journey - Audit logs for the controls help you to meet organizational and regulatory compliance requirements - Rich flow logs with Kubernetes context help you with troubleshooting and compliance, and accelerate your Kubernetes adoption ## Using Enterprise Security Controls It’s important to adapt your existing security controls to Kubernetes. Here are some recommended approaches: - Build your blueprint for Enterprise Security Controls in Kubernetes and get stakeholder approval. Your blueprint should have a well-defined label taxonomy. - Use Calico Enterprise tiers to implement role separation. This enables you to implement organizational controls cluster-wide, and still allow the Dev team to define policies for their applications. This helps to facilitate agile adoption. - Use Calico Enterprise flow visualization and dashboards for visibility and troubleshooting. Provide access to the Dev team to enable them to resolve their app connectivity issues faster. ## Want to learn more? Explore these resources… Policy tiers: [https://docs.tigera.io/calico-enterprise/latest/network-policy/policy-tiers/#the-default-tier-always-last](https://docs.tigera.io/calico-enterprise/latest/network-policy/policy-tiers/#the-default-tier-always-last) Protect Kubernetes nodes: [https://docs.tigera.io/calico-enterprise/latest/network-policy/hosts/protect-hosts#how-to](https://docs.tigera.io/calico-enterprise/latest/network-policy/hosts/protect-hosts#how-to) Flow and audit logs: [https://docs.tigera.io/security/logs/](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/overview) Compliance reports: [https://docs.tigera.io/security/compliance-reports/](https://docs.tigera.io/calico-enterprise/latest/compliance/) [Products](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/products/) Add Tigera as a preferred source on Google to see more of our content in your search results. [![Add as a preferred source on Google](https://wordpress-1075849-4005834.cloudwaysapps.com/app/themes/tigera2021/dist/img/google-preferred-source-light.png)](https://www.google.com/preferences/source?q=tigera.io) ## Related posts [![The Rise of AI Agents and the Reinvention of Kubernetes: Ratan Tipirneni’s 2026 Outlook](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2025/12/The-Rise-of-AI-Agents-and-the-Reinvention-of-Kubernetes.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/2026-the-rise-of-ai-agents/) [Company Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/company-blog/) #### [The Rise of AI Agents and the Reinvention of Kubernetes: Ratan Tipirneni’s 2026 Outlook](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/2026-the-rise-of-ai-agents/) By [Tigera Team](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/marketingtigera-io/) on Dec 30, 2025 Prediction: The next evolution of Kubernetes is not about scale alone, but about intelligence, autonomy, and governance. As part of the article ‘AI and Enterprise Technology Predictions from Industry Experts for 2026′, published by Solutions... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/2026-the-rise-of-ai-agents/) [![How Istio Ambient Mode Delivers Real World Solutions](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2025/12/How-Istio-Ambient-Mode-Delivers-Real-World-Solutions.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/how-istio-ambient-mode-delivers-real-world-solutions/) #### [How Istio Ambient Mode Delivers Real World Solutions](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/how-istio-ambient-mode-delivers-real-world-solutions/) By [John Alexander](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/john-alexander/) on Dec 18, 2025 For years, platform teams have known what a service mesh can provide: strong workload identity, authorization, mutual TLS authentication and encryption, fine-grained traffic control, and deep observability across distributed systems. In theory, Istio checked all... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/how-istio-ambient-mode-delivers-real-world-solutions/) [![A Detailed Look at the Calico Ingress Gateway](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2025/11/Blog-A-Detailed-Look-at-the-Calico-Ingress-Gateway.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/a-detailed-look-at-the-calico-ingress-gateway/) #### [A Detailed Look at the Calico Ingress Gateway](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/a-detailed-look-at-the-calico-ingress-gateway/) By [John Alexander](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/john-alexander/) on Nov 20, 2025 The Kubernetes community recently announced that Ingress NGINX, one of the most widely used Ingress controllers, will be retired. This change means teams need to plan for a secure, modern, and future-proof alternative for managing... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/a-detailed-look-at-the-calico-ingress-gateway/)