Calico Cloud vs KubeArmor
Calico Cloud
calicocloud.ioKubeArmor
kubearmor.ioSide by side
| Figure | Calico Cloud | KubeArmor |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | Yes | — |
| Open source | — | — |
| Web | Yes | — |
| Windows | Yes | — |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 4 | 1 |
| Spec score · Cloud Workload Protection Platforms | 8.9 (#2) | 8.5 (#3) |
| Integrations | Calico Cloud supports Prometheus and Grafana metrics, either through its Tigera-managed Prometheus operator or a customer-provided Prometheus deployment. | Project repositories include OpenTelemetry, Prometheus, Kafka, Grafana, ELK dashboards, a GitHub Action, and a Rancher UI extension. |
| Purpose | Calico Cloud provides network security, observability, and traffic controls for Kubernetes environments in cloud, on-premises, or at the edge. | KubeArmor is an open-source, cloud-native runtime security system that hardens workloads and enforces security policies. |
| Support limits | Tigera says the distributions it lists are those it currently tests and supports; other distributions may connect with Calico Open Source installed, with Support available for guidance. | The support matrix marks some environments as observability-only, including RHEL or CentOS 8.4 and earlier on Kubernetes and Oracle Ampere; VMware Tanzu entries are marked as under construction. |
| What it does | Calico Cloud is a managed networking, network-security and observability service for Kubernetes workloads across cloud, on-premises and edge environments. | KubeArmor is a cloud-native runtime security enforcement system that restricts process execution, file access, and networking operations for pods, containers, and nodes. |
Plans
Calico Cloud
- FreeFree
- Calico Cloud SaaS PlatformPriced on request
- Calico EnterprisePriced on request
- Pay-As-You-GoPriced on request
In their own words
Calico Cloud
Calico Cloud provides network security, observability and traffic controls for Kubernetes environments in cloud, on-premises or at the edge. Its observability features map network topology, workload connections, dependencies and traffic data to support troubleshooting. Security capabilities include integrated IDS/IPS, WAF and DDoS protection, as well as forensics and network-policy quarantine for infected workloads. Policy tools include recommendations, tiered enforcement and security policy as code in CI/CD pipelines. The listed networking capabilities include eBPF, nftables, iptables, Windows data planes, Envoy Gateway, Egress Gateways and cluster mesh. Compliance reporting covers PCI, SOC 2, HIPAA and GDPR. Tigera presents Calico Cloud as a managed SaaS service and lists self-provisioned Kubernetes, Amazon EKS, Azure AKS, Google GKE and Rancher Kubernetes Engine 2 among supported environments. A cluster needs a CNI installed before connection; Calico Open Source is required if Calico Cloud supplies both networking and network policy. The Free plan permits one user and one cluster, with logs retained for 24 hours.
KubeArmor
KubeArmor is an open-source runtime security system for enforcing policies on cloud-native workloads. It uses Linux Security Modules such as AppArmor, SELinux, and BPF-LSM, with eBPF for alerts, telemetry, and container-process tracking. Policies can restrict process execution, file access, networking operations, and resource use. Container policies support Allow, Audit, and Block actions, with Block as the default; system-call monitoring is audit-only. Kubernetes policies can target pods through labels and label expressions, and rules can match paths, network protocols, capabilities, and system calls. The deployment matrix covers Kubernetes, non-Kubernetes containers, virtual machines, and bare-metal hosts. It lists Kubernetes environments including GKE, AKS, OKE, IKS, EKS, OpenShift, Rancher, and DigitalOcean Kubernetes, but support varies by operating system, architecture, and enforcement mode. Some environments are observability-only, and VMware Tanzu entries are under construction. KubeArmor is a community-governed CNCF Sandbox project. The free plan is free; installation guidance uses Helm and kubectl.