Tigera and Canonical partner to deliver resilient multi-tenant Kubernetes across cloud, on-premises, and edge

Calico’s zero-trust networking and microsegmentation join Canonical’s CNCF-compliant Kubernetes and Ubuntu Pro, to deliver a securely designed and scalable platform to run container and VM workloads

SAN JOSE, Calif. and LONDON — November 9, 2026 — Tigera, the company behind Calico, and Canonical, the publisher of Ubuntu, today announced a collaboration to help enterprises run security maintained, compliant, multi-tenant Kubernetes in the cloud, on-prem VMs, and at the edge. The companies are pairing Canonical’s supported, CNCF-compliant Kubernetes distribution with Calico’s networking and network security layer to deliver an opinionated, enterprise-ready blueprint for cloud, on-premises, and edge environments.

Platform teams standardizing on Kubernetes across on-premises, public cloud, and edge sites routinely assemble the stack themselves: an operating system from one vendor, a Kubernetes distribution from another, and a networking and security layer from a third. The result is inconsistent hardening, uneven support timelines, and network policy that behaves differently in every environment. The joint Tigera and Canonical solution closes those gaps with a repeatable reference architecture backed by commercial support at both layers.

Ubuntu Pro and Canonical Kubernetes: A foundation supported for up to 15 years

Canonical contributes a securely designed operating system baseline and a complete open-source platform. Ubuntu Pro delivers security maintenance, long-term support, and helps enterprises meet their compliance needs. Canonical Kubernetes scales from a single node to highly available production clusters, deployable via Cluster API for automated operations at scale. Both Ubuntu and Canonical Kubernetes are supported for up to 15 years—well beyond the roughly 14-month upstream Kubernetes timeline—and Canonical’s chiseled containers extend the same security and support model to popular language runtimes.

Calico: Network security that travels with the workload

Tigera’s Calico platform contributes the networking and network security layer. Identity-aware, Kubernetes-native microsegmentation enforces policy at scale, while policy tiers let platform teams delegate policy administration to individual tenants without losing central control, separating platform guardrails from tenant policy intent and reducing policy sprawl. Calico applies one model consistently across VMs and containers, on-premises, edge, and cloud, through a single management plane powered by a high performance eBPF data plane. Egress gateways provide stable egress IPs and auditable outbound traffic; ingress gateways built on the Kubernetes Gateway API integrate with a web application firewall; DNS-based controls help prevent access to unauthorized services by name; and Cluster Mesh connects clusters across sites and regions. A dynamic service and threat graph, in-product dashboards, and dynamic packet capture give teams the visibility to troubleshoot traffic flows at the network layer.

“Multi-tenant Kubernetes fails without strong governance. Calico’s policy tiers allow platform teams to establish central guardrails while giving tenants autonomy within those guardrails. Paired with Canonical’s enterprise Kubernetes distribution, we’re giving platform teams a complete stack they can standardize on with confidence,” said Pervez Sikora, President at Tigera.

“Our customers have long valued the combination of security and flexibility offered by Canonical’s infrastructure solutions,” said Cédric Gégout, VP Product Management at Canonical. “Our collaboration with Tigera brings consistent networking and strong tenant isolation, providing customers with a reliable, unified foundation to deploy their workloads across any cloud, on-premises or edge environment. The stable release cadence of Canonical Kubernetes and long-term security maintenance offered by Ubuntu Pro provide peace of mind for up to 15 years.”

Together, the companies deliver strong tenant isolation inside shared clusters or across them, governed centrally; a consistent network security posture and consistent visibility wherever workloads run; deployment stability aligned to the Ubuntu LTS cadence; and a practical path to connect clusters across sites for high availability, migration, and hybrid patterns.

Meet the teams at KubeCon

Find Tigera and Canonical at KubeCon + CloudNativeCon North America, November 9–12, 2026, in Salt Lake City, at booth #150 (Tigera) and booth #128 (Canonical). To learn more, visit tigera.io and canonical.com. 

About Tigera

Tigera secures AI agents on any Kubernetes platform, from the kernel with eBPF. With Tigera Lynx, enterprises run AI agents in production and stay in control: Lynx discovers every agent, governs every call, contains any agent that steps out of line, and keeps a record of what each one did. Tigera created Project Calico, which secures more than 8 million Kubernetes nodes every day, and the commercial Calico platform is trusted by Global 2000 enterprises including NVIDIA, Royal Bank of Canada, Chipotle, Bloomberg, and GoDaddy. Learn more at www.tigera.io.

About Canonical

Canonical, the publisher of Ubuntu, provides open source security, support and services. Our portfolio covers critical systems, from the smallest devices to the largest clouds, from the kernel to containers, from databases to AI. With customers that include top tech brands, emerging startups, governments and home users, Canonical delivers trusted open source for everyone. Learn more at https://canonical.com/