Calico Cloud vs Tetragon

Calico Cloud provides network security, observability and traffic controls for Kubernetes environments in cloud, on-premises or at the edge. Its observability features map network topology, workload connections, dependencies and traffic data to support troubleshooting. Security capabilities include integrated IDS/IPS, WAF and DDoS protection, as well as forensics and network-policy quarantine for infected workloads. Policy tools include recommendations, tiered enforcement and security policy as code in CI/CD pipelines. The listed networking capabilities include eBPF, nftables, iptables, Windows data planes, Envoy Gateway, Egress Gateways and cluster mesh. Compliance reporting covers PCI, SOC 2, HIPAA and GDPR. Tigera presents Calico Cloud as a managed SaaS service and lists self-provisioned Kubernetes, Amazon EKS, Azure AKS, Google GKE and Rancher Kubernetes Engine 2 among supported environments. A cluster needs a CNI installed before connection; Calico Open Source is required if Calico Cloud supplies both networking and network policy. The Free plan permits one user and one cluster, with logs retained for 24 hours.

Tetragon is a Kubernetes-aware security observability and runtime enforcement tool for Linux, container, and Kubernetes workloads. It uses eBPF to monitor activity, filter events, and enforce policies in the kernel in real time. Process reports can include executed binaries, command-line arguments, user IDs, parent processes, and start times. Tetragon also monitors file access and changes, and can block unauthorized file operations at the kernel level. Kubernetes policies can filter activity by namespace, pod labels, and container fields, with support for containerd and CRI-O. Network visibility ties events to processes and workloads and tracks connections, socket lifecycle, and bytes sent or received. The tool also monitors credential changes, kernel module activity, and eBPF program loads and interactions. Findings are available as JSON logs or through gRPC. Installation options include Helm on Kubernetes, released Linux packages, and a container image. Tetragon is a Cilium sub-project and a CNCF project, and is available as an open-source project with no paid plans listed.