Skip to content
SPECIFICTION
Get listed

Calico Cloud

calicocloud.io

Free plan WebWindowsLinuxAPISelf-hosted
Visit calicocloud.io
Spec score 8.9 #2 of 23 in Cloud Workload Protection Platforms

What it is

Calico Cloud provides network security, observability and traffic controls for Kubernetes environments in cloud, on-premises or at the edge. Its observability features map network topology, workload connections, dependencies and traffic data to support troubleshooting. Security capabilities include integrated IDS/IPS, WAF and DDoS protection, as well as forensics and network-policy quarantine for infected workloads. Policy tools include recommendations, tiered enforcement and security policy as code in CI/CD pipelines. The listed networking capabilities include eBPF, nftables, iptables, Windows data planes, Envoy Gateway, Egress Gateways and cluster mesh. Compliance reporting covers PCI, SOC 2, HIPAA and GDPR. Tigera presents Calico Cloud as a managed SaaS service and lists self-provisioned Kubernetes, Amazon EKS, Azure AKS, Google GKE and Rancher Kubernetes Engine 2 among supported environments. A cluster needs a CNI installed before connection; Calico Open Source is required if Calico Cloud supplies both networking and network policy. The Free plan permits one user and one cluster, with logs retained for 24 hours.

Spec sheet

What it does
Calico Cloud is a managed networking, network-security and observability service for Kubernetes workloads across cloud, on-premises and edge environments.Read 14 Oct 2026 · calicocloud.io
Purpose
Calico Cloud provides network security, observability, and traffic controls for Kubernetes environments in cloud, on-premises, or at the edge.Read 4 Oct 2026 · calicocloud.io
Integrations
Calico Cloud supports Prometheus and Grafana metrics, either through its Tigera-managed Prometheus operator or a customer-provided Prometheus deployment.Read 14 Oct 2026 · docs.tigera.io
Compliance
The site describes compliance reporting for PCI, SOC 2, HIPAA, and GDPR, including scheduled or on-demand reports and exportable compliance data.Read 4 Oct 2026 · calicocloud.io
API and extensibility
The Tigera Operator exposes an operator.tigera.io/v1 Kubernetes API with resources such as Installation, APIServer, EgressGateway, GatewayAPI, IntrusionDetection and PacketCaptureAPI.Read 14 Oct 2026 · docs.tigera.io
Automated installation
Automated deployment is supported through Helm and kubectl using client credentials, custom values files and a published Calico Cloud Helm repository.Read 14 Oct 2026 · docs.tigera.io
Browser requirements
The web console supports the latest two versions of Chrome and Safari.Read 14 Oct 2026 · docs.tigera.io
Cluster requirements
A cluster must have a CNI installed before connecting; Calico Open Source is required when Calico Cloud will provide both networking and network policy.Read 4 Oct 2026 · docs.tigera.io
Company legal seller
AWS Marketplace identifies Tigera Inc. as the seller of Calico Cloud.Read 14 Oct 2026 · aws.amazon.com
Console browsers
The web console supports the latest two versions of Chrome and Safari.Read 4 Oct 2026 · docs.tigera.io
CPU architectures
Supported node architectures are x86-64 and ARM64.Read 14 Oct 2026 · docs.tigera.io
Documentation depth
The documentation includes installation guides, system requirements, troubleshooting checklists, API schemas, resource definitions, tutorials, operations guidance and release notes.Read 14 Oct 2026 · docs.tigera.io
Egress gateway
Its egress gateway assigns static source IP addresses to Kubernetes pod traffic for firewall and identification integrations.Read 14 Oct 2026 · aws.amazon.com
Independent company profile
Gartner describes Tigera as a private company founded in 2016 with a San Jose head office and 51–200 employees.Read 14 Oct 2026 · gartner.com
Ingress gateway
The ingress gateway uses Kubernetes Gateway API with an enterprise-hardened Envoy Gateway implementation.Read 14 Oct 2026 · aws.amazon.com
Installation prerequisite
A cluster must already have a CNI installed before it can be connected to Calico Cloud.Read 14 Oct 2026 · docs.tigera.io
Limit: documentation and setup
PeerSpot feedback asks for clearer documentation, a more intuitive setup process and better troubleshooting guidance.Read 14 Oct 2026 · peerspot.com
Limit: performance and support
PeerSpot’s product summary reports concerns about performance speed, troubleshooting complexity and customer-support responsiveness.Read 14 Oct 2026 · peerspot.com
Maker headquarters and age
LinkedIn lists Tigera as privately held, founded in 2016, headquartered in San Jose, California, with 51–200 employees.Read 14 Oct 2026 · linkedin.com
Managed service
Calico Cloud is presented as a fully managed SaaS service run by Tigera, with a free trial available without a credit card.Read 4 Oct 2026 · calicocloud.io
Network security
The platform applies fine-grained network policies, including egress restrictions by IP, domain and CIDR, and can recommend namespace-isolation policies.Read 14 Oct 2026 · aws.amazon.com
Network visibility
Its observability features show network topology, workload connections, dependencies, and traffic data to support troubleshooting.Read 4 Oct 2026 · calicocloud.io
Networking
The site lists eBPF, nftables, iptables, Windows data planes, Envoy Gateway, Egress Gateways, and cluster mesh capabilities.Read 4 Oct 2026 · calicocloud.io
Observability dashboards
Built-in dashboards cover traffic flows, policy decisions and layer-7 requests, with custom dashboards supported.Read 14 Oct 2026 · docs.tigera.io
Open-source relationship
Project Calico code is released under Apache License 2.0, while Calico Cloud itself is a commercial managed service.Read 14 Oct 2026 · tigera.io
Platform architecture
Calico Cloud supports x86-64 and ARM64 nodes and hybrid Kubernetes clusters with a Linux control plane and Windows nodes on EKS or AKS.Read 4 Oct 2026 · docs.tigera.io
Policy management
The web console includes a policy editor and policy dashboard; the free tier limits editing to view-only.Read 14 Oct 2026 · calicocloud.io
Praise: deployment and support
PeerSpot summaries describe deployment as comparatively easy and cite knowledgeable support and strong usability of the interface.Read 14 Oct 2026 · peerspot.com
Praise: security and visibility
PeerSpot reviewers repeatedly praise micro-segmentation, traffic visualization, observability, policy management and improved security or compliance posture.Read 14 Oct 2026 · peerspot.com
Rating on AWS Marketplace
4.4 out of 5 from 46 ratingsRead 14 Oct 2026 · aws.amazon.com
Rating on Gartner Peer Insights
5.0 out of 5 from 3 ratingsRead 14 Oct 2026 · gartner.com
Rating on PeerSpot
3.9 out of 5 from 4 reviewsRead 14 Oct 2026 · peerspot.com
Rating on TrustRadius
0 out of 10 from 0 reviews and ratingsRead 14 Oct 2026 · trustradius.com
Release limitation
Version 24.0.0 removed compliance reporting from the web console and deprecated the Envoy layer-7 collector.Read 14 Oct 2026 · docs.tigera.io
Release news: October 13 2026
Version 24.0.0 added a redesigned policy editor with YAML view, route and namespace-scoped Gateway WAF in technical preview, and an eBPF layer-7 log collector.Read 14 Oct 2026 · docs.tigera.io
Security and compliance
Vendor pages describe support for PCI, SOC 2, HIPAA and GDPR compliance workflows and policy-as-code enforcement.Read 14 Oct 2026 · calicocloud.io
Self-hosting
Calico Cloud is managed SaaS; Tigera positions Calico Enterprise as the self-managed alternative.Read 14 Oct 2026 · tigera.io
Service graph
Calico Cloud provides service-graph and traffic-visualization views showing workload connections, dependencies and flow data.Read 14 Oct 2026 · tigera.io
Support limits
Tigera says the distributions it lists are those it currently tests and supports; other distributions may connect with Calico Open Source installed, with Support available for guidance.Read 4 Oct 2026 · docs.tigera.io
Supported Kubernetes environments
Tigera lists self-provisioned Kubernetes, Amazon EKS, Azure AKS, Google GKE, and Rancher Kubernetes Engine 2 among tested and supported environments.Read 4 Oct 2026 · docs.tigera.io
Supported Kubernetes providers
Documented supported environments include self-provisioned Kubernetes, Amazon EKS, Azure AKS, Google GKE and Rancher RKE2.Read 14 Oct 2026 · docs.tigera.io
Threat defense
Paid Calico Cloud includes threat detection, while the free tier excludes threat defense and alerting.Read 14 Oct 2026 · calicocloud.io
Threat protection
The product describes integrated IDS/IPS, WAF, and DDoS protection, along with forensics and network-policy quarantine for infected workloads.Read 4 Oct 2026 · calicocloud.io
Upgrade limitation
The 23.0.0 upgrade could block and deny cluster DNS traffic; version 23.0.1 was issued as the fix, with support required for affected clusters.Read 14 Oct 2026 · docs.tigera.io
Usage API
Version 23 added read-only API keys for a Usage API returning vCPU and managed-cluster data.Read 14 Oct 2026 · docs.tigera.io
Version requirements
Calico Cloud 24.0.0 supports Kubernetes versions 1.34 through 1.36.Read 14 Oct 2026 · docs.tigera.io

Plans and prices

Free Free 1 user · 1 cluster · requires Calico Open Source 3.30+ · 24-hour logs · view-only policy editor · no packet capture, egress gateway, threat defense, DNS/L7, alerts or anomaly detection Read 14 Oct 2026 · calicocloud.io
Calico Cloud SaaS Platform Priced on request $0.025 / vCPU Hour; usage-based or annual subscription via cloud marketplaces Ingress gateway · observability · policy management · egress gateways · threat detection · enterprise support · 7-day log retention · unlimited users · multi-cluster support Read 14 Oct 2026 · tigera.io
Calico Enterprise Priced on request Custom Pricing Self-managed platform · ingress gateway · observability · policy management · egress gateways · threat detection · enterprise support · custom log retention · unlimited users · multi-cluster support Read 14 Oct 2026 · tigera.io
Pay-As-You-Go Priced on request Unlimited users · Unlimited clusters · 7-day log retention · Packet capture · Egress Gateway · Threat Defense · DNS and L7 · Alerts · Anomaly Detection Read 4 Oct 2026 · calicocloud.io

Every Calico Cloud plan and price →

Strong points and limits

Strong points

  • Maps network topology, connections and traffic data.
  • Includes IDS/IPS, WAF and DDoS protection.
  • Supports policy as code in CI/CD pipelines.
  • Compliance reports cover four named frameworks.

Limits

  • The Free plan is limited to one user and one cluster.
  • Free-plan logs are retained for 24 hours.
  • Clusters need a CNI installed before connection.
  • Console support is limited to the latest two Chrome and Safari versions.

Who it suits

It suits teams operating Kubernetes across cloud, on-premises or edge environments that need network visibility, policy controls or compliance reporting. The Free plan is limited to one user and one cluster.

Calico Cloud in depth

Read the full write-up

Overview

Calico Cloud is a managed Kubernetes networking and security service for teams running clusters across cloud, on-premises, or edge environments. It suits operators who want visibility and policy controls alongside threat protection; it is less suited to teams seeking general-purpose endpoint security or a cluster-free deployment.

Tigera runs the service as SaaS, but clusters need a CNI installed before they can connect. If Calico Cloud is to provide both networking and network policy, Calico Open Source is also required. Those prerequisites make it a better fit for teams that already manage Kubernetes networking than for buyers seeking a standalone security layer.

Key features

Visibility, policy, and threat protection

Network topology, workload connections, dependencies, and traffic data help operators investigate how services communicate and where connectivity problems arise. Policy recommendations, tiered enforcement, and policy as code in CI/CD pipelines give teams ways to turn that visibility into controlled changes. The Free plan's Policy Editor is view-only, however, so it is a starting point for inspecting policies rather than managing them.

Calico Cloud describes integrated IDS/IPS, WAF, and DDoS protection, along with forensics and network-policy quarantine for infected workloads. Response actions include denying HTTP traffic, blocking traffic to suspicious IPs, and creating a security-event exception. These Kubernetes-focused controls are relevant to teams protecting cluster workloads, not a substitute for broad endpoint protection.

Networking and compliance

Networking capabilities include eBPF, nftables, iptables, Windows data planes, Envoy Gateway, Egress Gateways, and cluster mesh. That range supports varied Kubernetes networking designs, including hybrid clusters with a Linux control plane and Windows nodes on EKS or AKS. Compliance reporting covers PCI, SOC 2, HIPAA, and GDPR, with scheduled or on-demand reports and exportable data; teams needing those outputs should account for the Free plan's short log retention and limited policy access.

Pricing

Calico Cloud uses a freemium model, with a Free plan and custom pricing for Pay-As-You-Go. Tigera offers a free trial without requiring a credit card.

PlanPriceWhat it includesFreefreeOne user, one cluster, Calico 3.30 or greater, 24-hour log retention, and view-only Policy Editor.Pay-As-You-GoCustom pricingUnlimited users and clusters, 7-day log retention, packet capture, Egress Gateway, Threat Defense, DNS and L7, alerts, and anomaly detection.Free is useful for a single user evaluating one cluster, but the 24-hour retention window and read-only policy editor constrain ongoing investigation and policy work. Pay-As-You-Go removes the user and cluster caps and adds operational and security capabilities, making it the more appropriate tier for teams running production environments; its 7-day retention remains a consideration for investigations that need a longer history.

Platforms

Calico Cloud supports Linux and Windows hosts, x86-64 and ARM64 nodes, and AWS, Microsoft Azure, and Google Cloud. Tested and supported Kubernetes environments include self-provisioned Kubernetes, Amazon EKS, Azure AKS, Google GKE, and Rancher Kubernetes Engine 2. Other distributions may connect with Calico Open Source installed, with Support available for guidance, but Tigera's support position is clearest for the environments it tests.

The web console supports the latest two versions of Chrome and Safari. Its agent-based deployment and Kubernetes prerequisites mean it is not a lightweight option for environments without an established cluster and CNI.

Who it's for

Calico Cloud is a strong fit for Kubernetes platform and security teams that need to understand traffic, apply network policy, and bring threat protection and compliance reporting into cluster operations. Its support for cloud, on-premises, edge, and hybrid Linux/Windows clusters gives it scope across mixed deployments.

It is a weaker fit for organizations looking for general-purpose device security, a fully open-ended Free tier, or a cluster security service that can be connected without first meeting networking prerequisites.

Pros and cons

Pros: Combines network topology and traffic visibility with policy recommendations and enforcement options, helping operators investigate and control cluster communications in one service.

Pros: Offers a broad Kubernetes networking feature set and supports Linux, Windows, x86-64, and ARM64 environments across major cloud platforms.

Pros: Includes compliance reporting for PCI, SOC 2, HIPAA, and GDPR, with scheduled or on-demand reports and exportable data.

Cons: The Free plan is limited to one user and one cluster, retains logs for only 24 hours, and makes the Policy Editor view-only.

Cons: Connecting a cluster requires an existing CNI, and Calico Open Source is necessary if Calico Cloud is to supply both networking and network policy.

Cons: Pay-As-You-Go has custom pricing, so teams cannot assess its cost from a published rate.

Alternatives

For a broader directory of options, see Cloud Workload Protection Platforms.

Bitdefender Total Security is the more relevant choice for personal device protection across Android, iOS, macOS, and Windows; its Total Security Individual plan is $59.99 a year, billed at the first-year price, plus applicable sales tax, for five devices and one account.

CrowdStrike Falcon Surface is an option for teams seeking exposure management across Linux, macOS, web, and Windows.

Amazon GuardDuty may suit buyers who prefer an AWS-focused, pay-as-you-go service; charges depend on the volume and source of analyzed logs, events, workloads, or data, and vary by AWS Region.

Qualys TotalCloud offers a free license for limited API calls for control evaluation, which may suit a narrow evaluation use case; its Cloud Platform subscription has custom pricing.

KubeArmor is a free, open-source runtime security project for buyers who prefer a self-hosted option; workload and platform support varies by its support matrix.

SentinelOne Singularity Cloud Security is an alternative with commercial and complete plans billed per endpoint; their listed data retention terms are 90 days and 14 days respectively.

Sysdig Secure may be worth considering for buyers whose licensing needs are organized around host counts; its licensing is based on the number of hosts in a customer environment, with compute instances used for CSPM.

ARMO Platform is another self-hosted or web option; ARMO maintains Kubescape, a CNCF project used as its data engine.

Verdict

Choose Calico Cloud if your team already operates Kubernetes clusters and wants network visibility, policy management, and security features in a managed service. Its strongest case is the combination of traffic insight and controls across varied cluster environments. Look elsewhere if you need general-purpose endpoint protection, cannot meet its CNI requirements, or need clear pricing before committing beyond the tightly capped Free plan.

Verdict

Calico Cloud brings Kubernetes visibility, policy controls and security features together as a managed service. Confirm cluster prerequisites and the Free plan limits before connecting an environment.

Where Specifiction places it

Alternatives to Calico CloudAll alternatives →