SAN JOSE, Calif., November 10, 2025 – Tigera, the creator and maintainer of Project Calico, today announced two major innovations to its eBPF-based Unified Network Security Platform for Kubernetes. The new capabilities include:
- Calico AI: A new suite of AI-powered capabilities, including an intelligent assistant, that helps platform and DevOps teams secure, optimize, and troubleshoot their Kubernetes environments.
- Integrated Istio Ambient Mode Service Mesh: A native integration of the newer, sidecarless Istio ambient mode that provides a single solution for unified networking, zero-trust security, and observability from layer 3 through layer 7.
Together, these advancements extend Calico’s position as the most complete, open, and AI-powered platform for Kubernetes network security—uniting Calico, eBPF, Istio, Envoy Gateway, and now AI-driven insights into a single operator-managed stack.
This milestone builds on Tigera’s April launch of the Calico Ingress Gateway—powered by a hardened 100% upstream distribution of Envoy Gateway—and extends Calico’s capabilities beyond ingress to include east-west service-to-service traffic management.
“Our vision is to give teams the power of the best open source projects in one unified, enterprise-hardened platform that works consistently across any Kubernetes distribution and prevents vendor lock-in,” said Ratan Tipirneni, CEO, Tigera. “By integrating Istio alongside Calico and Envoy Gateway and providing Calico AI, we’re simplifying operations while staying true to the open source foundation that the Kubernetes community trusts most.”
Introducing Calico AI:
Calico AI provides an AI assistant for Kubernetes network operations—helping teams detect issues, surface insights, and enforce network policies through natural language interactions.
Calico’s AI assistant enables users to query their environment with natural language prompts like:
- “Which services are receiving external traffic?”
- “Which staged policies have denied traffic in the last 48 hours?”
- “Which anomalies and misconfigurations are most likely to cause an outage?”
- “Recommend policy improvements to tighten security posture?”
This AI capability goes beyond a simple chatbot—it acts as a proactive, context-aware assistant integrated directly into Calico’s UI and API.
Integrated Istio ambient mode service mesh to simplify service-to-service security
As organizations scale microservices, managing east-west communication becomes complex.
Kubernetes networking covers the basics, but teams often struggle with inconsistent resilience logic (retries, timeouts, circuit breakers), manual traffic splitting for canary or blue-green rollouts, and difficulty encrypting, authenticating, and authorizing internal traffic.
Available in Calico Open Source, the Calico + Istio ambient mode integration solves these challenges by providing:
- Automatic mTLS and workload identity enforcement
- Fine-grained L7 policy and traffic control
- Safe, progressive deployments with traffic weighting and failovers
Improved microservices observability with Calico + Istio ambient mode integration
Calico + Istio ambient mode integration delivers dynamic L7 traffic management, including canary, blue-green, and A/B rollouts, along with automatic retries, circuit breakers, and failovers. Integrated OpenTelemetry-based observability provides distributed tracing and real-time service graphs—empowering developers to deploy confidently while platform teams maintain centralized control.
One Platform for Networking, Network Security, and Observability
The new Calico Unified Network Security Platform provides platform teams with a single, operator-managed solution combining Kubernetes networking, service mesh, and gateway capabilities. This allows teams to gain consistent network policy enforcement across Calico (L3–L4) and Istio (L7) layers with unified visibility into traffic and performance, eliminating the overhead of managing multiple tools. Calico works consistently across any Kubernetes distribution, virtual machines, and bare metal servers, ensuring enterprises can avoid vendor lock-in
Commitment to Open Source: Calico, eBPF, Envoy, and Istio
Calico now combines popular open source projects for Kubernetes networking—Calico, eBPF, Istio, and Envoy Gateway—into a single platform that’s tested, hardened, and supported by Tigera.
- 100% upstream, hardened Istio and Envoy Gateway integrated with Calico
- High-performance eBPF data plane for networking
- Single deployment and lifecycle management via the Tigera Operator
- Unified L3–L7 policy model spanning networking, service mesh, egress and ingress control
This approach gives organizations the flexibility and transparency of open source with the operational confidence of a supported enterprise platform.
This addition strengthens Calico’s position as the most complete open-source and enterprise platform for Kubernetes networking and network security—covering everything from pod connectivity to application-aware traffic management in one solution.
These new capabilities will be generally available early next year.
To learn more about the latest innovations, please visit here.
About Tigera
Tigera provides Calico, a unified network security and observability platform to prevent, detect and mitigate security breaches in Kubernetes clusters. Tigera’s open-source offering, Calico Open Source, is the most widely adopted container networking and security solution.
Powering more than 100M containers across 8M+ nodes in 166 countries, Calico software is supported across all major cloud providers and Kubernetes distributions, and is used by leading companies including Discover, Chipotle, NBCUniversal, HanseMerkur, Box, Siemens Healthineers, Playtech, Royal Bank of Canada, and Bell Canada.
Media Contact
Janelle Carter
Media relations, Tigera
contact@tigera.io
