--- title: "Zero-Trust Workload Access Controls" source: "https://wordpress-1075849-4005834.cloudwaysapps.com/features/access-controls/" description: "Reduce the attack surface of cloud-native applications with secure, fine-grained, zero-trust access from Kubernetes pods to resources outside the cluster." --- Solution # Zero-Trust Workload Access Controls Reduce the attack surface of cloud-native applications by enabling secure, fine-grained, zero-trust access from Kubernetes pods to resources outside the cluster [Start Free](https://www.calicocloud.io/) [Get a Demo](https://www.tigera.io/demo/) ## Benefits ![Two overlapping blue parallelograms](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2021/05/Icon-1.png) ### Granular Access Fine-grained access to resources outside of the cluster, like databases, cloud-managed services, third-party APIs, and other applications that are not yet containerized ### Production-Ready Safely and securely transition Kubernetes workloads from pilot to production ### Maintain Compliance Maintain compliance with existing enterprise and regulatory security requirements ## Trusted by Customers Worldwide [![Orange logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-Orange.png)](http://www.orange.com/en) [![Siemens Healthineers logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/09/logo-siemens-healthineers.png)](https://www.siemens-healthineers.com/) [![RBC logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2024/05/logo-RBC.png)](https://www.rbcroyalbank.com/) [![Marsh McLennan logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-Marsh-and-McLennan.png)](http://www.mmc.com/) [![Nowcom logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-NOWCOM.png)](http://www.nowcom.com/) [![Presidio logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2024/05/logo-Presidio.png)](https://www.presidio.com/) [![Box logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-box.png)](http://www.box.com/home) [![Nvidia logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2024/05/logo-Nvidia.png)](https://www.nvidia.com/) [![FM Global logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2023/03/logo-FM-Global.png)](https://www.fmglobal.com/) [![Upwork logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/12/logo-upwork.png)](https://www.upwork.com/) [![Essentra logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/04/logo-Essentra.png)](https://www.essentra.com/en) [![GoDaddy logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2023/03/logo-GoDaddy.png)](https://www.godaddy.com/) [![Arvato Systems logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2025/01/logo-Arvato-systems.png)](https://www.arvato-systems.com/) [![Aldagi logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/10/logo-aldagi.png)](https://aldagi.ge/en/) [![NBC Universal logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/09/logo-NBC-Universal.png)](https://www.nbcuniversal.com/) [![Chipotle logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2024/05/logo-Chipotle.png)](https://www.chipotle.com/) [![Meridianlink logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-Meridianlink.png)](http://www.meridianlink.com/) [![Mulligan Funding logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-MulliganFunding.png)](https://www.mulliganfunding.com/) [![HanseMerkur logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-HanseMerkur.png)](http://www.hmrv.de/en) [![Fiserv logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/12/logo-fiserv.png)](https://www.fiserv.com/) [![Berenberg logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-BERENBERG.png)](http://www.berenberg.de/en/) [![eHealth logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2023/10/logo-eHealth.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/ehealth-case-study/) [![Coinmetrics logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-coinmetrics.png)](http://coinmetrics.io/) ## Capabilities ![Edit Policy - DNS Policy Screenshot](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/09/Edit-Policy-DNS-Policy.png) ### DNS Policies ##### **Author DNS policies for fine-grained access** - Calico extends the open-source policy model so that fully qualified domain names (FQDN / DNS) can be used to allow access from a pod or set of pods (via label selector) to external resources (databases, cloud services, third-party APIs). - Security policies based on domain names (DNS) enable fine-grained controls that are enforced at the source pod, eliminating the need for a firewall rule or equivalent. DNS endpoints can be defined as an exact address (e.g. google.com) or can include wildcards (e.g. *.google.com). DNS endpoints can also be used within [Global Network Sets](https://docs.projectcalico.org/reference/resources/globalnetworkset). ![Egress Controls Diagram](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/09/Egress-Controls.png) ### Egress Gateway ##### **Use Egress Gateway to integrate with existing network firewalls** - Calico’s Egress Access Gateway assigns a fixed, routable IP to a Kubernetes namespace. All egress pod traffic from that namespace is assigned that routable IP address to identify the workload running within that namespace. This enables the cluster to securely scale while preserving the limited number of routable IPs and leveraging non-routable IPs for all other pod traffic within the cluster. - A single firewall rule can be defined that allows all pods within a namespace to securely access resources outside of the cluster, in effect establishing a universal firewall. The platform team only has to manage one firewall rule instead of many, saving time and eliminating the burden of multiple firewall change requests to the security team. Beyond the cluster, enterprise monitoring systems such as SIEMs can identify an application/workload in a Kubernetes namespace via its source IP address. - Enterprise security teams can leverage familiar, existing firewall tools, processes, and architecture, thereby simplifying and facilitating Kubernetes adoption and deployment. ![Edit Policy Zero Trust Workload Access Controls CIDR Screenshot](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/09/CIDR.png) ### Global and namespaced NetworkSets ##### **Use IP Subnet/CIDR ranges in security policies** - Calico GlobalNetworkSets and namespaced NetworkSets can use CIDR notations for a range of IPs to use in a network policy, to automatically update access control policies for all the IPs described by the CIDR notation. Calico NetworkSets can be used to apply policy to control traffic going to or coming from external, non-Calico networks. And using Calico NetworkSets, you can easily scale out by using the same set of IPs in multiple policies. ## How It Works ![Zero Trust Workload Security / Egress Gateways](https://embed-ssl.wistia.com/deliveries/be1ab766c74a259843fb09708e3f6c80.jpg?image_crop_resized=612x344) Calico helps you granularly restrict access from Kubernetes clusters to resources outside the cluster in different ways. This not only protects your cluster resources, it provides you with the flexibility to align with your specific architecture. Fully qualified domain names can be used in DNS policies to control access from a pod or set of pods to an external resource. You can enforce the controls from a firewall outside the cluster using the Egress Gateway. Or you can securely enable access by using NetworkSets to limit IP ranges for egress and ingress traffic to/from workloads. Additional resources: - Access control best practices - Whitepaper - Hands-on workshop ## Available on Microsoft Azure, AWS, and Google Marketplace Get started right away on Azure, AWS, or Google Cloud—every Calico component you need to get up and running is ready to go. [On Azure](https://azuremarketplace.microsoft.com/en-ca/marketplace/apps/tigerainc1620235671643.calicocloudsaas?tab=overview) [On AWS](https://aws.amazon.com/marketplace/pp/prodview-pq3tgvtlj3wce) [On Google Cloud](https://console.cloud.google.com/marketplace/product/tigera-public/calico-cloud?inv=1&invt=Ab27_g&project=tigera-public) ![Microsoft Azure, AWS, and Google Cloud logos.](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2025/07/Solution-cloud-marketplace-AWS-Azure-03.svg) ## Resources ![Zero trust in the cloud: Best practices and potential pitfalls](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/10/zero-trust-for-cloud-native-workloads.png) Blog ### Zero trust in the cloud: Best practices and potential pitfalls Secure cloud-native applications with zero trust. Learn zero trust implementations best practices and pitfalls. [Learn More](https://www.tigera.io/blog/zero-trust-in-the-cloud-best-practices-and-potential-pitfalls/) ![Zero-Trust for Cloud-Native Workloads Maturity Assessment](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/01/generic-Tigera-1200x628-1-380x200.png) Assessment ### Zero-Trust for Cloud-Native Workloads Maturity Assessment This survey will help you understand what you are missing and guide you through what is required to successfully start and continuously improve your security posture for zero-trust workloads [Learn More](https://www.tigera.io/lp/zero-trust-assessment/) ![Calico Logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/01/Calico-logo-2026-black-text.svg) ## Ready to Get Started? Get started for free or request a demo to see Calico in action [Start Free](https://www.calicocloud.io/) [Get a Demo](https://wordpress-1075849-4005834.cloudwaysapps.com/demo/)