For Platform Engineering & Security Teams

The unified platform for Kubernetes networking, network security, and observability.

Built on the most trusted open-source technologies in Kubernetes — Calico Open Source, Istio, Envoy, and eBPF — the Calico platform gives platform engineering teams a single management plane to enforce, observe, and troubleshoot all workload communication — across every cluster, every distribution, and every environment.

8M+ Nodes Secured Daily

1M+ Clusters Under Management

Leader & Outperformer

Get a Demo Talk to an Expert

THE PROBLEM

Managing Kubernetes networking and security is harder than it should be.

Running a secure, resilient Kubernetes environment requires managing multiple distinct types of communication — ingress, egress, pod-to-pod, service-to-service, and multi-cluster. Each has its own complexity. Each is a potential vulnerability.
Most platform teams address this with best-of-breed tools — and immediately pay the integration tax.

The integration tax

Every traffic type requires a specialized tool — each with its own install, management, and troubleshooting workflow. There's no system-level view; when something breaks, you stitch data together manually across tools. Worse, Kubernetes distributions require multiple upgrades per year, and every upgrade risks breaking the integrations. The testing and debugging that follows consumes weeks of engineering time — over and over again. Your best engineers spend their time on plumbing instead of building.

The alternative

Standardizing on your Kubernetes platform provider's native tooling — trades one problem for another. You eliminate the integration work but walk straight into a walled garden. Lock-in that limits flexibility, drives up costs, and removes your ability to choose better tools as the market evolves.

THE SOLUTION

One management plane. All your tools. Every environment.

The Calico platform brings Calico Open Source, Istio, and Envoy together under a single operator and a single console — giving your platform team unified control over every type of workload communication without the integration tax.

And because the Calico platform works consistently across every Kubernetes distribution — EKS, GKE, AKS, OpenShift, Rancher, and more — you’re never locked into a single provider’s ecosystem. Move workloads between distributions freely, on your terms.

Enterprise-Grade Networking, Network Security & Observability

A single platform covering the full spectrum — ingress, egress, pod networking, service mesh, load balancer, VM networking, and multi-cluster networking — combined with enterprise-grade network security controls and deep observability. Everything your environment needs, under one roof.

Unified Management

One operator installs, configures, and manages Calico Open Source, Istio, and Envoy. No stitching tools together. No independent upgrade cycles. No integration gaps.

Distribution Agnostic

The Calico platform works the same way regardless of which Kubernetes distribution you run — EKS, GKE, AKS, OpenShift, Rancher, and more. Your teamlearns one operational model and it works everywhere, eliminating re-training costs as your infrastructure evolves.

Enterprise-Grade Networking

The networking foundation for modern Kubernetes environments.

Key capabilities

Pod networking

High-performance, scalable pod networking powered by eBPF and Calico Open Source, the most widely deployed CNI in the industry

Multi-cluster networking

Seamless connectivity across multiple Kubernetes clusters, enabling distributed applications to communicate securely across cluster boundaries

Service mesh

Full-featured service mesh powered by Istio with Ambient Mode — sidecarless mutual TLS, traffic management, and deep observability between services without the resource overhead of per-pod sidecar proxies

Ingress gateway

Secure, high-performance ingress traffic management powered by Envoy — controlling how external traffic enters your cluster

Egress gateway

Control and secure all traffic leaving your cluster — enforce egress policies, enable NAT, and maintain visibility over external communication

Load balancer

Enterprise-grade load balancing for Kubernetes services — distributing traffic efficiently across workloads with full policy control

VM networking

All networking capabilities extended to VMs running in Kubernetes — consistent connectivity and policy enforcement across containerized and virtualized workloads

Enterprise-Grade Network Security

The full spectrum of network security, in one platform.

Key capabilities

Network policies

Fine-grained, label-based network policy enforcement for Kubernetes workloads

DNS policies

Control workload access to external services by domain name, not just IP — a critical capability for dynamic cloud environments where IPs change constantly

Network sets

Define and reuse groups of IPs, CIDRs, and domains across multiple policies — reducing policy complexity and maintenance overhead at scale

Encryption

Mutual TLS and WireGuard-based encryption for workload-to-workload communication — enforced automatically, without application changes

Staged policies

Author and test policies in observation mode before enforcing them — see exactly what traffic would be affected before a single connection is blocked

Policy tiers

Define policy enforcement order across platform, security, and application teams — ensuring organizational governance without policy conflicts

Network Threat Detection, Observability & Incident Response

Detect threats. Understand your environment. Respond fast.

Key capabilities

IDS/IPS

Intrusion detection and prevention that monitors workload traffic for known threat signatures and anomalous behavior — automatically alerting or blocking based on policy

Packet capture

On-demand and policy-triggered packet capture for deep forensic analysis — no external tools required

Dynamic service graph

A real-time, visual map of all workload communication in your environment — see exactly how services are connected, what's talking to what, and where anomalies exist

WAF (Web Application Firewall)

Protect workloads against common web-based attacks including OWASP Top 10 threats — enforced at the Kubernetes layer without changes to application code

DDoS protection

Detect and mitigate volumetric and application-layer DDoS attacks before they impact workload availability

Alerts

Configurable alerting on policy violations, anomalous traffic patterns, and threat detections — integrated with your existing SIEM and incident response workflows

Unified Management Plane

Unified Management Plane: One console to rule them all.

Key capabilities

Single operator

Single operator for installation, configuration, and lifecycle management of Calico Open Source, Istio, and Envoy

Unified dashboard

Unified dashboard for visibility across all workload communication types

Consistent operational model

Consistent operational model across EKS, GKE, AKS, OpenShift, Rancher, and more

Single pane of glass

Single pane of glass for multi-cluster environments

Heterogeneous policy enforcement

Policy enforcement extended to VMs and bare metal hosts outside Kubernetes

Policy Management & Observability

Key capabilities

Policy recommendation engine

Automatically evaluates traffic flows and recommends network policies based on observed communication patterns

Policy simulation

Test and validate policies in a simulated environment before deploying to production — zero risk, full confidence

Policy hierarchy tiers

Define policy enforcement order across multiple teams, ensuring platform and security teams can author policies independently without conflict

Flow visualization

See exactly how workloads are communicating, what's being blocked, and what's being allowed — in real time

Multi-Cluster & Multi-Distribution Support

One platform. Every cluster. Every distribution.

Key capabilities

Consistent policy enforcement

Consistent policy enforcement across every Kubernetes distribution — cloud-managed and self-managed

Multi-cluster visibility

Multi-cluster visibility and management from a single console

Federated policy management

Author policies once, enforce across multiple clusters

Operational consistency

Freedom to move workloads between providers without re-learning operational procedures

Support for hybrid environments

Kubernetes clusters, VMs, and bare metal hosts under unified management

TECHNOLOGY STACK

Built on the best open-source technologies in Kubernetes networking.

The Calico platform is built on the most proven open-source technologies in the Kubernetes networking and security ecosystem — with a unified management plane that installs, configures, and manages them through a single operator. Best-of-breed capabilities without the integration burden.

The world’s most widely deployed Kubernetes CNI. Chosen freely by millions of developers before it was ever part of an enterprise product. Calico Open Source provides the foundational networking and network policy enforcement layer — battle-proven at the most demanding scale in the industry.

Open-source note: All four technologies are open-source with active CNCF communities. The Calico platform gives you enterprise management and support for these tools — without locking you into proprietary alternatives.

GET STARTED

Three ways to run Calico. One consistent experience.

Calico is available in three editions — all built on the same open-source foundation, all delivering the same core networking, security, and observability capabilities. Start with open source and scale into enterprise features as your needs grow, or go straight to the full platform. Choose based on your operational model — not on whether you’re “ready.”

Calico Open Source

Community-Supported

The foundation. Calico Open Source delivers high-performance pod networking, network policy enforcement, and core networking capabilities — free, open-source, and community-supported. Millions of developers and organizations already run Calico Open Source in production. It’s the most widely deployed CNI in the industry, and it’s the starting point for everything the Calico platform offers.

High-performance pod networking with eBPF
Kubernetes network policy enforcement
Active open-source community and documentation
The foundation that Calico Cloud and Calico Enterprise build on

Get Started Read the Docs

Calico Cloud

SaaS — Managed by Tigera

The fastest way to get the full Calico experience. Calico Cloud is a fully managed SaaS offering: Tigera handles the infrastructure, upgrades, and operations so your team can focus on securing workloads, not managing the platform itself. Everything in Calico Open Source, plus unified management, Istio and Envoy integration, and enterprise-grade security and observability.

Everything in Calico Open Source, plus:
Unified management plane for Calico Open Source, Istio, and Envoy
Policy recommendations and troubleshooting
Enterprise-grade network security, threat detection, and observability
Fully managed; no infrastructure to operate
Free trial available; start immediately, no credit card required

Get a Demo Start Free

Calico Enterprise

Self-Hosted — Deployed in Your Environment

For organizations that require full control over where their data lives and how the platform is operated. Calico Enterprise deploys in your own environment (on-premises, air-gapped, or in your own cloud) with the same full feature set as Calico Cloud, backed by enterprise support and SLAs from Tigera.

Everything in Calico Cloud, plus:
Full control over deployment and data residency
Supports air-gapped and on-premises environments
Enterprise support and SLAs
Designed for organizations with strict compliance and data sovereignty requirements

Talk to an Expert Get a Demo

Ready to eliminate the integration tax?

Join the platform teams at NVIDIA, RBC, Bloomberg, and hundreds of other organizations who trust Calico to secure their most demanding Kubernetes environments.

Get a Demo Talk to an Expert

The unified platform for Kubernetes networking, network security, and observability.

Managing Kubernetes networking and security is harder than it should be.

The integration tax

The alternative

One management plane. All your tools. Every environment.

Enterprise-Grade Networking, Network Security & Observability

Unified Management

Distribution Agnostic

Everything your platform team needs.

The networking foundation for modern Kubernetes environments.

The full spectrum of network security, in one platform.

Detect threats. Understand your environment. Respond fast.

Unified Management Plane: One console to rule them all.

Policy Management & Observability

One platform. Every cluster. Every distribution.

Built on the best open-source technologies in Kubernetes networking.

Trusted by platform teams at the world's most demanding organizations.

Three ways to run Calico. One consistent experience.

Calico Open Source

Calico Cloud

Calico Enterprise

Ready to eliminate the integration tax?

Sign up for Tigera & Calico news