--- title: "Zero-Trust Workload Access Security" source: "https://www.tigera.io/tigera-products/zero-trust-workload-security/" description: "Enforce zero-trust workload access in Kubernetes with Calico. Control which workloads and external services can communicate to cut risk and lateral movement." --- Solution # Zero-Trust Workload Access Security Reduce attack surface and mitigate risk with egress access controls, microsegmentation, and security policy recommendations. [Start Free](https://www.calicocloud.io/) [Get a Demo](https://www.tigera.io/demo/) ![Egress Access Control](https://embed-ssl.wistia.com/deliveries/af69c2a236791e4d0fdbbfadfaeea7fa.jpg?image_crop_resized=612x344) ## Benefits Secure Kubernetes traffic within and outside the cluster to reduce risk, achieve compliance, and actively protect against security threats ![Magnifying glass icon with an exclamation mark.](https://www.tigera.io/app/uploads/2023/04/icon-Intrusion-detection-prevention.svg) ### Reduce the Risk of Data Exfiltration Secure workload access to external resources using DNS policies and network sets ![Radar screen icon.](https://www.tigera.io/app/uploads/2023/04/icon-Runtime-Threat-Defense.svg) ### Limit the Blast Radius of Breaches Eliminate lateral threat movement in the cluster with identity-aware microsegmentation ![Four distinct outlined shapes: three rounded squares and one circle.](https://www.tigera.io/app/uploads/2023/04/icon-Workload-Isolation.svg) ### Workload Isolation Isolate workloads and prevent unauthorized cross-tenant access ## Trusted by Customers Worldwide [![Orange logo](https://www.tigera.io/app/uploads/2022/03/logo-Orange.png)](http://www.orange.com/en) [![Essentra logo](https://www.tigera.io/app/uploads/2022/04/logo-Essentra.png)](https://www.essentra.com/en) [![Siemens Healthineers logo](https://www.tigera.io/app/uploads/2022/09/logo-siemens-healthineers.png)](https://www.siemens-healthineers.com/) [![RBC logo](https://www.tigera.io/app/uploads/2024/05/logo-RBC.png)](https://www.rbcroyalbank.com/) [![Marsh McLennan logo](https://www.tigera.io/app/uploads/2022/03/logo-Marsh-and-McLennan.png)](http://www.mmc.com/) [![Presidio logo](https://www.tigera.io/app/uploads/2024/05/logo-Presidio.png)](https://www.presidio.com/) [![Box logo](https://www.tigera.io/app/uploads/2022/03/logo-box.png)](http://www.box.com/home) [![Nvidia logo](https://www.tigera.io/app/uploads/2024/05/logo-Nvidia.png)](https://www.nvidia.com/) [![FM Global logo](https://www.tigera.io/app/uploads/2023/03/logo-FM-Global.png)](https://www.fmglobal.com/) [![Upwork logo](https://www.tigera.io/app/uploads/2022/12/logo-upwork.png)](https://www.upwork.com/) [![GoDaddy logo](https://www.tigera.io/app/uploads/2023/03/logo-GoDaddy.png)](https://www.godaddy.com/) [![Arvato Systems logo](https://www.tigera.io/app/uploads/2025/01/logo-Arvato-systems.png)](https://www.arvato-systems.com/) [![Aldagi logo](https://www.tigera.io/app/uploads/2022/10/logo-aldagi.png)](https://aldagi.ge/en/) [![NBC Universal logo](https://www.tigera.io/app/uploads/2022/09/logo-NBC-Universal.png)](https://www.nbcuniversal.com/) [![Chipotle logo](https://www.tigera.io/app/uploads/2024/05/logo-Chipotle.png)](https://www.chipotle.com/) [![Meridianlink logo](https://www.tigera.io/app/uploads/2022/03/logo-Meridianlink.png)](http://www.meridianlink.com/) [![Mulligan Funding logo](https://www.tigera.io/app/uploads/2022/03/logo-MulliganFunding.png)](https://www.mulliganfunding.com/) [![HanseMerkur logo](https://www.tigera.io/app/uploads/2022/03/logo-HanseMerkur.png)](http://www.hmrv.de/en) [![Fiserv logo](https://www.tigera.io/app/uploads/2022/12/logo-fiserv.png)](https://www.fiserv.com/) [![Berenberg logo](https://www.tigera.io/app/uploads/2022/03/logo-BERENBERG.png)](http://www.berenberg.de/en/) [![eHealth logo](https://www.tigera.io/app/uploads/2023/10/logo-eHealth.png)](https://www.tigera.io/ehealth-case-study/) [![Coinmetrics logo](https://www.tigera.io/app/uploads/2022/03/logo-coinmetrics.png)](http://coinmetrics.io/) ![Service Graph Screenshot](https://www.tigera.io/app/uploads/2023/04/service-graph-13.png) ### Egress Access Controls Secure access from individual pods in a Kubernetes cluster to external resources, including cloud services, databases, and 3rd-party APIs with DNS policies and network sets. [Learn More](https://www.tigera.io/features/access-controls/) ![Edit Policy - DNS Policy Screenshot](https://www.tigera.io/app/uploads/2022/09/Edit-Policy-DNS-Policy.png) ### DNS Policies Enforce DNS policies at the source pod so that fully qualified domain names (FQDN/DNS) can be used to allow access from a pod or set of pods (via label selector) to external resources—eliminating the need for a firewall rule or equivalent. Define DNS endpoints as an exact address (e.g., google.com) or with wildcards (e.g., *.google.com). [Learn More](https://www.tigera.io/blog/workload-access-control-securely-connecting-containers-and-kubernetes-with-the-outside-world/) ![Edit Policy Zero Trust Workload Access Controls CIDR Screenshot](https://www.tigera.io/app/uploads/2022/09/CIDR.png) ### Global and Namespaced Network Sets Automatically update access controls for all IPs described by the CIDR notation using IP subnet/CIDR in security policies. Control incoming or outgoing traffic from external, non-Calico networks with the same policy. Easily scale by using the same set of IPs in multiple policies. ![Egress Controls Diagram](https://www.tigera.io/app/uploads/2022/09/Egress-Controls.png) ### Egress Gateway Identify the traffic source at the namespace or pod level from a Kubernetes cluster to communicate to the external resource. Assign a fixed, routable IP to a Kubernetes namespace to identify workloads running within that namespace. [Learn More](https://www.tigera.io/blog/calico-egress-gateway-universal-firewall-integration-for-kubernetes/) ![Edit Policy Segmentation Granularity Screenshot](https://www.tigera.io/app/uploads/2022/09/Edit-Policy-Segmentation-Granularity.png) ### Identity-Aware Microsegmentation Segment workloads using workload identities to achieve workload isolation and limit lateral communication. Define security policies as code to enforce consistent segmentation policies across the environment. [Learn More](https://www.tigera.io/features/microsegmentation/) ![Service Graph displaying connected services and HTTP flow data.](https://www.tigera.io/app/uploads/2022/09/service-graph-06.png) ### Application-Layer Policy Apply security controls at the application level to secure pod-to-pod traffic, including HTTP methods and URL paths. Eliminate the operational complexity of deploying an additional service mesh. Gain application-layer visibility into service-to-service communication. [Learn More](https://www.tigera.io/tigera-products/service-mesh/) ## Available on Microsoft Azure, AWS, and Google Marketplace Get started right away on Azure, AWS, or Google Cloud—every Calico component you need to get up and running is ready to go. [On Azure](https://azuremarketplace.microsoft.com/en-ca/marketplace/apps/tigerainc1620235671643.calicocloudsaas?tab=overview) [On AWS](https://aws.amazon.com/marketplace/pp/prodview-pq3tgvtlj3wce) [On Google Cloud](https://console.cloud.google.com/marketplace/product/tigera-public/calico-cloud?inv=1&invt=Ab27_g&project=tigera-public) ![Microsoft Azure, AWS, and Google Cloud logos.](https://www.tigera.io/app/uploads/2025/07/Solution-cloud-marketplace-AWS-Azure-03.svg) ## Customer Testimonial Here’s what our customers are saying about us ![Quotation marks](https://www.tigera.io/app/themes/tigera2021/dist/img/quotes-sign.svg) Tigera helped Upwork migrate to Kubernetes on Amazon EKS and meet our InfoSec team’s mandate for zero-trust security. We were able to deploy Calico in two weeks and secure our EKS cluster in just six months. Angelos Lenis Sr. Manager, Platform Engineering, Upwork ![Upwork Logo](https://www.tigera.io/app/uploads/2023/10/logo-Upwork-170x60-1.png) [Learn More](https://www.tigera.io/upwork-case-study/) [Read Customer Stories](https://www.tigera.io/customer-stories/) ## Featured Resources Developer-created resources to help you secure your Kubernetes deployment ![Using Access Controls for Containerized Workload Protection](https://www.tigera.io/app/uploads/2023/04/Featured-resources-Workload-WP.png) White Paper ### Using Access Controls for Containerized Workload Protection Without workload access controls, organizations risk non-compliance, ransomware attacks, and more. [Read More](https://www.tigera.io/lp/workload-access-controls/) ![Microsegmentation Datasheet](https://www.tigera.io/app/uploads/2023/04/Featured-resources-Microsegmentation.png) Datasheet ### Microsegmentation Datasheet Scalable, unified microsegmentation for cloud-native workloads across all of your environments. [Read More](https://info.tigera.io/rs/805-GFH-732/images/datasheet-microsegmentation.pdf) ![Achieving EU GDPR Compliance in a Multi-Tenant Environment](https://www.tigera.io/app/uploads/2023/04/Featured-resources-Aldagi-CS.png) Case Study ### Achieving EU GDPR Compliance in a Multi-Tenant Environment Using Calico, Aldagi achieved EU GDPR compliance and accelerated application launch times at scale. [Read More](https://www.tigera.io/aldagi-case-study/) [All Resources](https://www.tigera.io/resources/) ![Calico Logo](https://www.tigera.io/app/uploads/2026/01/Calico-logo-2026-black-text.svg) ## Ready to Get Started? Get started for free or request a demo to see Calico in action