tigera · ctauchen · Jul 31, 2026 · Jul 31, 2026 · Jul 31, 2026 · Jul 31, 2026
@@ -6,5 +6,4 @@
 | User interface                  | the $[prodname] web console user interface (with a default of “no access outside the cluster”).                                                                       |
 | Logs and data                   | All nodes configured for log data collection using fluentdLog storage for a single node.<br />One instance of Elasticsearch and Kibana.                        |
 | Threat prevention and detection | Components and dashboards for tracing and blocking suspicious activity.                                                                                        |
-| Compliance reporting            | Components and dashboards to assess Kubernetes workloads and environments for regulatory compliance to enforce controls, and generate audit and evidence data. |
 | Scaling                         | Built-in node scaling using Typha.                                                                                                                             |
@@ -80,7 +80,7 @@ To install a standard $[prodname] cluster with Helm:
 
 1. [Configure a storage class for Calico Enterprise](../../../operations/logstorage/create-storage).
 
-1. Optional: Compliance and packetcapture features are optional. To enable these features, review the `values.yaml` file and set the flag to `enabled: true`. In the next step, use this modified `values.yaml` for the Helm install.
+1. Optional: Packet capture is an optional feature. To enable it, review the `values.yaml` file and set the flag to `enabled: true`. In the next step, use this modified `values.yaml` for the Helm install.
 
     <CodeBlock language='bash'>
         {'$[version]' === 'master'

@@ -34,7 +34,6 @@ Each API in the operator.tigera.io API group configures the installation of a di
 | **Manager**                     | Installs the $[prodname] web console.                                                                                                                                                                    |
 | **ManagementClusterConnection** | Configures a connection to the management cluster for managed clusters.                                                                                                                                      |
 | **TigeraStatus**                | Displays conditions for a component (available, progressing, or degraded).                                                                                                                                   |
-| **Compliance**                  | Configures the $[prodname] compliance reporting feature (Optional). For managed clusters, ensure compliance reporting is enabled first on the management cluster.                                           |
 | **PacketCaptureAPI**            | Configures the $[prodname] packet capture feature (Optional).                                                                                                                                               |
 
 ### Additional configuration

@@ -116,7 +116,7 @@
        --from-file=.dockerconfigjson=<path/to/pull/secret>
    ```
 
-1. Optional: Compliance and packet capture features are optional. To enable these features during installation, download and review the custom-resources.yaml file. Uncomment the necessary CRs and use this custom-resources.yaml for installation.
+1. Optional: Packet capture is an optional feature. To enable it during installation, download and review the custom-resources.yaml file. Uncomment the necessary CRs and use this custom-resources.yaml for installation.
 
     ```bash
    curl -O -L $[filesUrl]/manifests/custom-resources.yaml

@@ -14,7 +14,7 @@ description: Known limitations of Calico Enterprise for Windows that you should
 | Policy                         | - Staged network-policy<br />- Firewall integrations<br />- Policy for hosts (host endpoints, including automatic host endpoints)<br />- Tiered policy: TKG, GKE, AKS<br />- WAF integration<br />- AWS firewall integration<br />- Fortinet integration |
 | Visibility and troubleshooting | - Packet capture<br />- DNS logs<br />- iptable logs<br />- L7 logs                                                                                                                                                                                      |
 | Multi-cluster management       | - Multi-cluster management federated identity endpoints and services<br />- Federated endpoint identity and services                                                                                                                                     |
-| Compliance and security        | - CIS benchmark and other reports<br />- WireGuard encryption for pod-to-pod traffic and host-to-host traffic                                                                                                                                            |
+| Security                       | - WireGuard encryption for pod-to-pod traffic and host-to-host traffic                                                                                                                                            |
 | Data plane                      | - eBPF is a Linux-based feature                                                                                                                                                                                                                          |
 
 ## $[prodname] BGP networking limitations

@@ -126,21 +126,18 @@ These steps differ based on your cluster type. If you are unsure of your cluster
         }
     </CodeBlock>
 
-1. Optional: Compliance and packetcapture features are optional. To enable or maintain the enabled status, review the `values.yaml` file and set the flag to `enabled: true`.
+1. Optional: Packet capture is an optional feature. To enable or maintain the enabled status, review the `values.yaml` file and set the flag to `enabled: true`.
 
-    If your `values.yaml` configuration does not include `compliance` or `packetCaptureAPI`, add them to the configuration and set to `enabled: true`
+    If your `values.yaml` configuration does not include `packetCaptureAPI`, add it to the configuration and set to `enabled: true`
 
     ```
     packetCaptureAPI:
         enabled: true
-
-    compliance:
-        enabled:true
     ```
 
     or
 
-    If you are using default `values.yaml`, copy the custom `values.yaml` and update compliance and packetCaptureAPI's `enabled`  to `true`. Then, replace `<path-to-values.yaml>` in the next step with this modified `values.yaml` for the Helm upgrade.
+    If you are using default `values.yaml`, copy the custom `values.yaml` and update packetCaptureAPI's `enabled` to `true`. Then, replace `<path-to-values.yaml>` in the next step with this modified `values.yaml` for the Helm upgrade.
 
     <CodeBlock language='bash'>
         {'$[version]' === 'master'

@@ -106,8 +106,8 @@ In a new terminal, install the $[prodname] CNI.
 
 1. Optional: If your cluster architecture requires any custom Calico Enterprise resources to function at startup, install them now using calicoctl.
 
-1. Optional: Compliance and packet capture features are optional.
-   To enable these features during installation, download and review the `custom-resources.yaml` file.
+1. Optional: Packet capture is an optional feature.
+   To enable it during installation, download and review the `custom-resources.yaml` file.
    Uncomment the necessary CRs and use this `custom-resources.yaml` for installation.
 
    ```bash

@@ -34,12 +34,8 @@ Audit logs are also visible in the Kibana dashboard (indexed by, `tigera_secure_
 
 ![kibana-auditlogs](/img/calico-enterprise/kibana-auditlogs.png)
 
-Finally, audit logs provide the core data for compliance reports.
-
-![compliance-reports](/img/calico-enterprise/configuration-compliance.png)
-
 ## Required next step
 
-**Kubernetes resources** are also used in compliance reports and other audit-related features, but they are not enabled by default. You must enable Kubernetes resources through the Kubernetes API server. If you miss this step, some compliance reports will not work, and audit trails will not provide a complete view to your security team.
+**Kubernetes resources** are also used in audit-related features, but they are not enabled by default. You must enable Kubernetes resources through the Kubernetes API server. If you miss this step, audit trails will not provide a complete view to your security team.
 
 - [Enable Kubernetes audit logs](../kube-audit.mdx)
@@ -77,22 +77,6 @@ resourceNames: ['flows', 'dns']
 verbs: ['get']
 ```
 
-### Logs for compliance reporting
-
-$[prodname] compliance reports are based on archived **flow logs** and **audit logs** for these resources:
-
-- Pods
-- Host endpoints
-- Service accounts
-- Namespaces
-- Kubernetes service endpoints
-- Global network sets
-- $[prodname] and Kubernetes network policies
-- Global network policies
-- Network sets
-
-$[prodname] also supports archiving [CloudWatch for EKS audit logs](../../reference/installation/api.mdx#logcollectorspec).
-
 ## Additional resources
 
 - [Log storage recommendations](../../operations/logstorage/log-storage-recommendations.mdx)

@@ -15,7 +15,7 @@ Enable Kubernetes audit logs so security teams and auditors can see all the chan
 
 ### About Kubernetes audit logs
 
-**Kubernetes resources** are used in $[prodname] compliance reports and other audit-related features, but they are not enabled by default. You must enable Kubernetes resources through the Kubernetes API server. If you miss this step, some compliance reports will not work, and audit trails will not provide a complete view to your security team.
+**Kubernetes resources** are used in $[prodname] audit-related features, but they are not enabled by default. You must enable Kubernetes resources through the Kubernetes API server. If you miss this step, audit trails will not provide a complete view to your security team.
 
 You must enable the following Kubernetes resources for each cluster:
 
@@ -27,7 +27,7 @@ You must enable the following Kubernetes resources for each cluster:
 
 ### Audit logs in the web console
 
-Like $[prodname] audit logs, Kubernetes audit logs are displayed in the web console in the Timeline dashboard, Kibana dashboard (indexed by, `tigera_secure_ee_audit_kube`), and provide the core data for compliance reports.
+Like $[prodname] audit logs, Kubernetes audit logs are displayed in the web console in the Timeline dashboard and Kibana dashboard (indexed by, `tigera_secure_ee_audit_kube`).
 
 ## Before you begin
 
@@ -162,7 +162,7 @@ Amazon EKS writes Kubernetes audit logs to [Amazon CloudWatch logs](https://aws.
    />
 1. Make note of the region where the cluster is hosted (for example, `us-west-2`) for a later step.
 
-### Create a restricted AWS user for compliance reporting
+### Create a restricted AWS user for audit log access
 
 1. Go to the **AWS IAM console** and add a user.
 1. On the **Add user** page, make these changes:

@@ -33,7 +33,7 @@ Data plane traffic continues to flow without interruption — policy enforcement
 | $[prodname] resources | Read-only. The Tigera API server rejects create and update requests; get, list, and delete on existing resources still succeed. Calico Open Source resources are not affected. |
 | Flow, DNS, and audit logs | Stopped. Fluentd is scaled down and logs are no longer forwarded to Elasticsearch. |
 | Prometheus metrics for $[prodname] components | Stopped. The Operator removes the $[prodname] ServiceMonitor so metrics are no longer scraped. |
-| Web console | Service Graph, Kibana, Alerts, and Compliance remain visible in read-only mode; attempts to create or modify resources are not saved. |
+| Web console | Service Graph, Kibana, and Alerts remain visible in read-only mode; attempts to create or modify resources are not saved. |
 
 We recommend that you proactively manage your license to avoid disruption to observability and management workflows.
 

@@ -1,5 +1,5 @@
 ---
-description: Configure persistent storage in Calico Enterprise for flow logs, DNS logs, audit logs, and compliance reports before installation.
+description: Configure persistent storage in Calico Enterprise for flow logs, DNS logs, and audit logs before installation.
 ---
 
 # Configure storage for logs and reports
@@ -11,7 +11,7 @@ import TabItem from '@theme/TabItem';
 
 ## Big picture
 
-Before installing $[prodname], you must configure persistent storage for flow logs, DNS logs, audit logs, and compliance reports.
+Before installing $[prodname], you must configure persistent storage for flow logs, DNS logs, and audit logs.
 
 ## Concepts
 

@@ -19,12 +19,11 @@ The following diagram shows the components that comprise a Kubernetes on-premise
   imageBackgroundColor='white'
 />
 
-Calico open-source components are the foundation of $[prodname]. $[prodname] provides value-added components for visibility and troubleshooting, compliance, policy lifecycle management, threat detection, and multi-cluster management.
+Calico open-source components are the foundation of $[prodname]. $[prodname] provides value-added components for visibility and troubleshooting, policy lifecycle management, threat detection, and multi-cluster management.
 
 ## $[prodname] components
 
 - [calicoq](#calicoq)
-- [Compliance](#compliance)
 - [Linseed API and ES gateway](#linseed-api-and-es-gateway)
 - [Intrusion detection](#intrusion-detection)
 - [kube-controllers](#kube-controllers)
@@ -68,40 +67,6 @@ For cloud providers, $[prodname] has a separate plugin for each major cloud orch
 
 **Main task**: A command line tool for policy inspection to ensure policies are configured as intended. For example, you can determine which endpoints a selector or policy matches, or which policies apply to an endpoint. Requires a separate installation. [calicoq](../clis/calicoq/index.mdx).
 
-### Compliance
-
-**Main task**: Generates compliance reports for the Kubernetes cluster. Report are based on archived flow and audit logs for $[prodname] resources, plus any audit logs you’ve configured for Kubernetes resources in the Kubernetes API server. Compliance reports provide the following high-level information:
-
-- Protection
-  - Endpoints explicitly protected using ingress or egress policy
-- Policies and services
-  - Policies and services associated with endpoints
-  - Policy audit logs
-- Traffic
-  - Allowed ingress/egress traffic to/from namespaces, and to/from the internet
-
-Compliance is comprised of these components:
-
-**compliance-snapshotter**
-
-Handles listing of required Kubernetes and $[prodname] configuration and pushes snapshots to Elasticsearch. Snapshots give you visibility into configuration changes, and how the cluster-wide configuration has evolved within a reporting interval.
-
-**compliance-reporter**
-
-Handles report generation. Reads configuration history from Elasticsearch and determines time evolution of cluster-wide configuration, including relationships between policies, endpoints, services and networksets. Data is then passed through a zero-trust aggregator to determine the "worst-case outliers" in the reporting interval.
-
-**compliance-controller**
-
-Reads report configuration, and manages creation, deletion, and monitoring of report generation jobs.
-
-**compliance-server**
-
-Provides the API for listing, downloading, and rendering reports, and RBAC by performing authentication and authorization through the Kubernetes API server. RBAC is determined from the users RBAC for the GlobalReportType and GlobalReport resources.
-
-**compliance-benchmarker**
-
-A daemonset that runs checks in the CIS Kubernetes Benchmark on each node so you can see if Kubernetes is securely deployed.
-
 ### Linseed API and ES gateway
 
 The Linseed API uses mTLS to connect to clients, and provides an API to access Elasticsearch data. The ES gateway proxies requests to Elasticsearch, and provides backwards-compatibility for managed clusters that run versions before 3.17.
@@ -122,7 +87,7 @@ The Linseed API uses mTLS to connect to clients, and provides an API to access E
 
 ### Manager
 
-**Main task**: Provides network traffic visibility, centralized multi-cluster management, threat-defense troubleshooting, policy lifecycle management, and compliance using a browser-based UI for multiple roles/stakeholders. [Manager](../installation/api.mdx#manager).
+**Main task**: Provides network traffic visibility, centralized multi-cluster management, threat-defense troubleshooting, and policy lifecycle management using a browser-based UI for multiple roles/stakeholders. [Manager](../installation/api.mdx#manager).
 
 ### Packet capture API
 

@@ -6,5 +6,4 @@
 | User interface                  | the $[prodname] web console user interface (with a default of “no access outside the cluster”).                                                                       |
 | Logs and data                   | All nodes configured for log data collection using fluentdLog storage for a single node.<br />One instance of Elasticsearch and Kibana.                        |
 | Threat prevention and detection | Components and dashboards for tracing and blocking suspicious activity.                                                                                        |
-| Compliance reporting            | Components and dashboards to assess Kubernetes workloads and environments for regulatory compliance to enforce controls, and generate audit and evidence data. |
 | Scaling                         | Built-in node scaling using Typha.                                                                                                                             |
@@ -80,7 +80,7 @@ To install a standard $[prodname] cluster with Helm:
 
 1. [Configure a storage class for Calico Enterprise](../../../operations/logstorage/create-storage).
 
-1. Optional: Compliance and packetcapture features are optional. To enable these features, review the `values.yaml` file and set the flag to `enabled: true`. In the next step, use this modified `values.yaml` for the Helm install.
+1. Optional: Packet capture is an optional feature. To enable it, review the `values.yaml` file and set the flag to `enabled: true`. In the next step, use this modified `values.yaml` for the Helm install.
 
     <CodeBlock language='bash'>
         {'$[version]' === 'master'

@@ -34,7 +34,6 @@ Each API in the operator.tigera.io API group configures the installation of a di
 | **Manager**                     | Installs the $[prodname] web console.                                                                                                                                                                    |
 | **ManagementClusterConnection** | Configures a connection to the management cluster for managed clusters.                                                                                                                                      |
 | **TigeraStatus**                | Displays conditions for a component (available, progressing, or degraded).                                                                                                                                   |
-| **Compliance**                  | Configures the $[prodname] compliance reporting feature (Optional). For managed clusters, ensure compliance reporting is enabled first on the management cluster.                                           |
 | **PacketCaptureAPI**            | Configures the $[prodname] packet capture feature (Optional).                                                                                                                                               |
 
 ### Additional configuration