Calico Cloud

Calico Cloud provides network security, observability, and traffic controls for Kubernetes environments in cloud, on-premises, and edge settings. Its visibility tools map network topology, workload connections, dependencies, and traffic to support troubleshooting. Security features include integrated IDS/IPS, WAF, and DDoS protection, along with forensics and network-policy quarantine for infected workloads. Teams can use policy recommendations, tiered enforcement, and security policy as code in CI/CD pipelines. Listed networking capabilities include eBPF, nftables, iptables, Windows data planes, Envoy Gateway, Egress Gateways, and cluster mesh. Compliance reporting covers PCI, SOC 2, HIPAA, and GDPR, with scheduled or on-demand reports and exportable data. Tigera presents the product as a managed SaaS service. Supported environments include self-provisioned Kubernetes, Amazon EKS, Azure AKS, Google GKE, and Rancher Kubernetes Engine 2. A cluster needs a CNI installed before connecting; Calico Open Source is required if Calico Cloud supplies both networking and network policy. The Free plan allows one user and one cluster, retains logs for 24 hours, and has a view-only Policy Editor.

Calico Cloud combines Kubernetes traffic visibility, network controls, and security features in a managed service. The free plan is limited in users, clusters, log retention, and policy editing, so check those constraints against deployment needs.

Calico Cloud suits teams securing and monitoring Kubernetes clusters across cloud, on-premises, or edge environments. Its stated support for Linux and Windows nodes, x86-64 and ARM64, and major cloud Kubernetes services may fit mixed deployments.

Calico Cloud is a managed Kubernetes service that combines network observability, policy controls, and workload protection across cloud, on-premises, and edge clusters. It suits platform and security teams already running Kubernetes and willing to meet its CNI requirements. Its strongest case is unified traffic insight and enforcement; teams wanting broad endpoint security or a generous free tier should look elsewhere.

Overview

Tigera operates Calico Cloud as an agent-based SaaS service. The console maps network topology, workload connections, dependencies, and traffic, giving operators practical context when a service cannot reach another or an unexpected flow appears. Policy recommendations, tiered enforcement, and security policy as code extend that visibility into controlled configuration changes and CI/CD workflows.

Connecting a cluster requires a CNI. Calico Open Source is mandatory when Calico Cloud is expected to provide both networking and network policy, so the service is a better fit for teams prepared to own Kubernetes networking than for organizations seeking a standalone security product. Tigera lists self-provisioned Kubernetes, Amazon EKS, Azure AKS, Google GKE, and Rancher Kubernetes Engine 2 as tested and supported environments; other distributions may connect with Calico Open Source, with support limited to guidance.

Key features

Observability and policy

Topology and dependency views make traffic relationships easier to investigate than raw flow records alone. Policy recommendations can turn observed behavior into proposed controls, while tiered enforcement allows teams to introduce restrictions progressively. Policy as code in CI/CD pipelines is valuable for organizations that require reviewable, repeatable security changes rather than console-only edits.

Threat protection and response

Calico Cloud combines described IDS/IPS, WAF, and DDoS protection with forensics and network-policy quarantine for infected workloads. Response actions include denying HTTP traffic, blocking traffic to suspicious IP addresses, and creating security-event exceptions. That combination is aimed at protecting container and Kubernetes workloads, not replacing a general endpoint suite.

Networking and compliance

The networking stack spans eBPF, nftables, iptables, Windows data planes, Envoy Gateway, Egress Gateways, and cluster mesh. This breadth matters for mixed operating systems and multi-cluster designs, although the right choice depends on the architecture already in place. Compliance reporting covers PCI, SOC 2, HIPAA, and GDPR, with scheduled or on-demand reports and exportable data.

Calico Cloud supports x86-64 and ARM64 nodes, plus hybrid clusters with a Linux control plane and Windows nodes on EKS or AKS. The web console supports the latest two versions of Chrome and Safari. Linux and Windows hosts, AWS, Microsoft Azure, and Google Cloud are supported targets.

Pricing

Free

The Free plan costs nothing. It allows one user and one cluster, requires Calico 3.30 or greater, retains logs for 24 hours, and limits the Policy Editor to view-only access. This is suitable for a small proof of concept or an individual operator evaluating cluster visibility. The single-seat, single-cluster cap and short retention make it unsuitable for a team rollout, historical investigations, or active policy authoring.

Pay-As-You-Go

Pay-As-You-Go uses custom pricing and removes the user and cluster caps. It adds seven-day log retention, packet capture, Egress Gateway, Threat Defense, DNS and L7 controls, alerts, and anomaly detection. Those additions address production operations and incident response, but buyers need a quote before they can compare total cost. The plan is the logical choice for multi-cluster teams that need the service's broader networking and security controls.

Tigera offers a free trial without requiring a credit card. The published plans do not state a trial duration or renewal terms.

Platforms

Calico Cloud runs as managed web software for Linux and Windows-backed Kubernetes deployments, with self-hosted cluster support and cloud coverage for AWS, Microsoft Azure, and Google Cloud. Supported environments include EKS, AKS, GKE, self-provisioned Kubernetes, and Rancher Kubernetes Engine 2. A CNI must be installed before connection, and Calico Open Source is required for Calico-provided networking plus network policy.

Who it's for

Choose Calico Cloud if you operate Kubernetes across multiple environments and want traffic discovery, policy management, threat protection, and compliance reporting in one managed service. It is especially appropriate for platform teams that can standardize on supported distributions and satisfy the CNI prerequisite. It is a poor match for users seeking desktop or mobile protection, a broad endpoint-security console, or a free plan that supports several collaborators and clusters.

Pros and cons

• Pro: Network topology, dependencies, and traffic data provide actionable troubleshooting context.
• Pro: IDS/IPS, WAF, DDoS protection, forensics, and quarantine cover prevention through response for Kubernetes workloads.
• Pro: Policy recommendations, tiered enforcement, and policy as code support governed security changes.
• Pro: Multi-cloud, hybrid-node, ARM64, Windows data-plane, and cluster-mesh support accommodate varied Kubernetes estates.
• Con: The Free plan is restricted to one user, one cluster, 24-hour logs, and view-only policy editing.
• Con: Pay-As-You-Go pricing is custom, so production budgeting requires a sales quote.
• Con: Cluster connection depends on an existing CNI, with Calico Open Source required for Calico networking and policy.

Alternatives

For a broader shortlist, see Cloud Workload Protection Platforms.

• Bitdefender Total Security is the better pick for cross-device consumer protection on Android, iOS, macOS, and Windows; its Total Security Individual plan is $59.99 a year for the first year, covering five devices and one account.
• SentinelOne Singularity Cloud Security suits teams wanting endpoint-billed cloud security with 90-day or 14-day data-retention options, rather than Kubernetes networking controls.
• Amazon GuardDuty fits AWS-centric monitoring with pay-as-you-go charges based on analyzed data sources and regions, plus a free trial.
• KubeArmor is a free, open-source runtime-security project for Linux and Kubernetes users who prefer self-hosting.
• Qualys TotalCloud is an alternative for cloud-platform security with a free license limited to API calls for control evaluation.
• Tetragon is a free open-source option for Kubernetes and Linux installations without paid plans.
• Falco is a zero-cost open-source choice for Linux runtime detection.
• Tracee is a Linux-only open-source project requiring a compatible kernel and elevated capabilities.

Verdict

Calico Cloud is a strong choice for Kubernetes platform and security teams that want managed traffic visibility, enforceable network policy, and integrated workload defenses across supported environments. Choose it for the unified operational view and production features in Pay-As-You-Go; look elsewhere if the one-user Free plan, custom pricing, or Kubernetes networking prerequisites do not fit your deployment.