Tigera and Canonical have announced a collaboration to give enterprises a common architecture for running multi-tenant Kubernetes clusters across cloud, on-premises virtual machines and edge environments. The arrangement pairs Canonical Kubernetes with Calico, Tigera’s networking and network security platform, and includes commercial support from both companies.
Announced November 9, 2026, at KubeCon + CloudNativeCon North America, the offering is described as a reference architecture: a blueprint intended to help platform teams standardize the operating system, Kubernetes distribution and networking layer used in their environments. The companies say those components are often assembled from different vendors, which can result in inconsistent hardening, differing support timelines and network policies that do not behave uniformly across environments.
The joint architecture brings Canonical’s Ubuntu Pro and Canonical Kubernetes together with Calico’s networking and policy capabilities. It is aimed at organizations operating multiple tenants—groups that share cluster infrastructure but need controls over how their workloads communicate. The companies position the combined design as a way to establish central governance while allowing tenant teams to manage policies within defined limits.
Support and cluster deployment
Canonical Kubernetes is a CNCF-compliant Kubernetes distribution that can scale from a single node to highly available clusters, according to the announcement. It can be deployed using Cluster API. Canonical says Ubuntu Pro and Canonical Kubernetes are supported for up to 15 years, a substantially longer period than the roughly 14-month upstream Kubernetes support window cited by the companies.
That extended support horizon is relevant to enterprises planning deployments across varied locations, where platform teams may need to keep a consistent foundation in service over time. The announcement does not specify a particular upgrade schedule or detail how support terms apply to individual customer deployments; it presents the long support period as part of the combined architecture’s enterprise focus.
Calico’s policy and connectivity features
Calico contributes an eBPF data plane and a set of networking and security functions for managing traffic between workloads and clusters. Its identity-aware microsegmentation is intended to let teams define access based on workload identity. Policy tiers allow platform administrators to set organization-wide guardrails and delegate policy management to tenants without handing over those central controls.
The listed capabilities also include ingress and egress gateways built on the Kubernetes Gateway API, DNS-based controls and Cluster Mesh for connecting clusters across sites. Together, these features address different parts of cluster networking: applying policy to workload communications, managing traffic entering or leaving clusters, controlling access through DNS-related rules, and linking separate clusters.
Tigera President Pervez Sikora emphasized governance as a condition for multi-tenant deployments. “Multi-tenant Kubernetes fails without strong governance. Calico’s policy tiers allow platform teams to establish central guardrails while giving tenants autonomy within those guardrails,” he said.
A reference design for mixed environments
The collaboration focuses on a consistent design spanning public cloud, on-premises virtual machines and edge settings rather than on a single deployment location. For platform teams, the proposed blueprint combines the Kubernetes distribution and operating-system support from Canonical with Calico’s network policy and connectivity layer. Both vendors are providing commercial support for the architecture.
The announcement does not describe a new Kubernetes version, a launch date for a separate product or specific performance results. Instead, it outlines how the existing Canonical and Tigera technologies are intended to fit together for organizations seeking multi-tenant clusters. Customers evaluating the approach will need to assess how its support arrangements, deployment model and policy controls map to their own requirements across sites.
By bringing the components into one reference architecture, Tigera and Canonical are addressing a familiar platform-management challenge identified in their announcement: keeping cluster operations and network governance aligned when workloads run in different environments. The stated goal is a standardized starting point, backed by both vendors, for enterprises that need tenant separation alongside centrally managed controls.
