Calico Platform

What it does

Calico Platform is a Kubernetes network security and microsegmentation platform delivered as the Calico Cloud and Calico Enterprise editions, built on the open-source Project Calico that Tigera created and maintains. Its distinguishing mechanism is a pluggable data plane: eBPF programs enforce network policy inside the Linux kernel, replacing iptables and kube-proxy, while one policy model extends to Windows nodes, VMs, bare-metal hosts, and Istio ambient-mode service mesh traffic through a modified zTunnel that preserves destination ports for Layer 3 and 4 policy.

How it works

Calico installs as the cluster networking and policy engine, recording flow and DNS logs into a Dynamic Service Graph that maps namespace, service, and pod dependencies. A policy recommendation engine converts unaddressed flows into namespace-scoped staged policies, previewed against traffic before enforcement, with policy tiers ordering security, platform, and application rules. Domain-based egress policy validates destinations against trusted DNS responses, egress gateways give outbound traffic fixed source IPs, and WireGuard encrypts pod traffic in transit. Workload intrusion detection, threat feeds, and a Web Application Firewall (WAF) raise security events, and GlobalReport resources produce inventory, network-access, policy-audit, and CIS benchmark evidence.

Credentials and traction

Calico was named a Leader and Outperformer in the 2025 GigaOm Radar for Container Networking, and Tigera was a G2 Leader and High Performer in Winter 2026 and a Global InfoSec Awards winner in 2023 and 2024. Customers include NVIDIA, Royal Bank of Canada, Box, Siemens Healthineers, NBCUniversal, Chipotle, GoDaddy, Upwork, Fiserv, Discover, and Bell Canada. The open-source Calico core secures 8 million nodes across 1 million clusters, and Calico Cloud is sold through the AWS, Azure, and Google marketplaces.