- Self-managed Kubernetes Security and Observability platform
- Works across hybrid or multi-cloud configurations, any cloud, any Kubernetes distribution, VMs and bare metal
- Supports mixed Linux / Windows workloads and eBPF dataplane
- Includes high-touch customer support with dedicated Customer Success Engineer
Why Calico Enterprise?
Calico Enterprise’s Kubernetes-native architecture extends the declarative nature of Kubernetes to specify “security and observability as code,” which ensures consistent enforcement of security policies and compliance, and provides observability for troubleshooting across multi-cluster, multi-cloud and hybrid deployments.
Calico Enterprise provides a common security model that works across any public cloud service in a hybrid or multi-cloud configuration, with any Kubernetes distribution, and with VMs and bare metals. Calico Enterprise’s pluggable dataplane, with support for Windows, Linux and eBPF, makes it a future-proof choice for mixed workload environments.
Solution
North-South Controls
Control north-south traffic, limit access to external endpoints on a per-pod basis and protect your Kubernetes cluster. The Calico Enterprise Egress Gateway enables you to securely integrate with firewalls, monitoring systems like SIEMS, and other systems that don’t understand the dynamic nature of container orchestration.
You can author DNS policies that implement fine-grained access controls between a workload and the external services it needs to connect to, like Amazon RDS, ElasticCache, and more. In addition, Calico Enterprise tightly integrates with AWS Security Groups giving you secure, pod-level access to Amazon EKS.
CAPABILITIES INCLUDE
- DNS Policy
- Egress Gateway
- AWS Security Group Integration
East-West Controls
East-West controls enable you to limit the blast radius when a security breach results in an APT (advanced persistent threat). You can perform micro-segmentation for both container and VM workloads. Calico Enterprise’s “defense-in-depth” approach provides protection on three levels: host, container/VM and application. Using a single policy framework, you can set controls at all of these levels using a declarative model.
FEATURES INCLUDE
- Microsegmentation
- Host, Container/VM and application protection
- Single policy framework
Security and Compliance
If you’re working with sensitive data that falls under regulatory compliance mandates like PCI, HIPAA, SOC2, or GDPR, Calico Enterprise provides data-in-transit encryption with industry-leading performance, as well as compliance reporting for security policies and controls.
Calico Enterprise has an incredibly rich Intrusion Detection and Protection (IDS/IPS) feature set that includes threat feeds to identify known bad actors like bots, custom alerts for known attacks, anomaly detection, and honeypods. We take an automated approach to malware detection and response to target and remediate threats like DGA (Domain Generation Algorithm) and the unpatched Kubernetes CVE-2020-8554 vulnerability.
FEATURES INCLUDE
- Data-in-Transit Encryption
- Intrusion Detection and Prevention
- Compliance Reporting and Alerts
Observability
Distributed applications are very difficult to troubleshoot. Calico Enterprise solves that problem by dynamically generating a service graph that enables anyone to easily understand how microservices are behaving and interacting with each other at run-time, simplifying the debugging process. The Dynamic Service Graph provides a rich set of information with Kubernetes context, including across which namespaces workloads are communicating, detailed DNS information, detailed logs for every single flow in your cluster, and how network policies are being evaluated. DevOps teams can quickly identify the source of a problem at the application, process, and socket levels as well as through an automated packet capture function.
FEATURES INCLUDE
- Dynamic Service Graph
- Application Layer Observability
- DNS Dashboard
- Dynamic Packet Capture
- Flow Log Visualizer
Unified Controls
Unified controls in Calico Enterprise enable security and observability across multi-cluster, multi-cloud and hybrid cloud environments, and provide a single pane of glass to ensure consistent application of security controls across both containers and VMs. Unified controls also reduce the complexity for DevOps teams running the clusters by supporting self-service security and CI/CD integration. Using “policy as code”, Calico Enterprise fully automates the cluster-wide, end-to-end policy deployment process including any necessary security changes.
Built on open-source Calico, the most widely adopted Kubernetes CNI, Calico Enterprise also supports third-party CNIs including EKS VPC, Azure CNI, and GKE to expand your choice of public cloud providers.
CAPABILITIES INCLUDE
- Unified Controls: Security and Observability across Multi-cluster, Multi- and Hybrid Cloud Environments
- Self-Service Security
- Policy Tiers
Calico Enterprise Features
Want to see how these features are used? Check out our use cases.