--- title: "System requirements" description: "Cluster, platform, and version requirements a Kubernetes cluster must meet before it can connect to Calico Cloud." product: "Calico Cloud" version: "v23.0.1" section: "Install and upgrade" canonical_url: "https://docs.tigera.io/calico-cloud/get-started/system-requirements" --- # System requirements Before you connect your cluster to Calico Cloud, make sure your cluster meets the system requirements. Your cluster must already have a CNI installed before you can connect to Calico Cloud. ## Kubernetes distributions and CNIs Calico Cloud works with Kubernetes on self-provisioned infrastructure and on managed Kubernetes distributions. To use Calico Cloud for both networking and network policy, your cluster must have Calico Open Source installed before you connect to Calico Cloud. For most managed distributions, you can use the provider's CNI for networking and use Calico Cloud for network policy. | Distribution | Supported CNIs | | --------------------------------------------- | --------------------------------------------------- | | Kubernetes on self-provisioned infrastructure | - Calico Open Source 3.20 or later | | Amazon Elastic Kubernetes Service | - Calico Open Source 3.20 or later - Amazon VPC CNI | | Azure Kubernetes Service | - Calico Open Source 3.20 or later - Azure CNI | | Google Kubernetes Engine | - Calico Open Source 3.20 or later - GKE CNI | | Rancher Kubernetes Engine 2 | - Calico Open Source 3.20 or later | > **SECONDARY:** The Kubernetes distributions listed above are those that Tigera currently tests and supports for Calico Cloud. You may be able to connect clusters on other distributions with Calico Open Source installed as the CNI. For more information about connecting other cluster types to Calico Cloud, [contact Support](https://tigeraio.my.site.com/community/s/login/). ### Other distributions The Calico Cloud installer may be able to successfully connect ## Kubernetes versions To install Calico Cloud v23.0.1, your Kubernetes distribution must be based on one of the following Kubernetes versions: - Kubernetes 1.36 - Kubernetes 1.35 - Kubernetes 1.34 Kubernetes compatibility for older versions of Calico Cloud | Calico Cloud version | Kubernetes versions | | -------------------- | ------------------- | | 23.0.0 | 1.34-1.36 | | 22.5.0 | 1.31-1.35 | | 22.4.1 | 1.31-1.35 | | 22.4.0 | 1.31-1.34 | | 22.3.0 | 1.31-1.34 | | 22.2.0 | 1.31-1.34 | | 22.1.0 | 1.31-1.34 | | 22.0.1 | 1.31-1.33 | | 22.0.0 | 1.31-1.33 | | 21.3.0 | 1.31-1.33 | | 21.2.0 | 1.30-1.31 | | 21.1.0 | 1.30-1.31 | | 21.0.0 | 1.30-1.31 | | 20.4.0 | 1.29-1.31 | | 20.3.1 | 1.29-1.30 | | 20.2.0 | 1.28-1.30 | | 20.1.0 | 1.28-1.30 | | 20.0.1 | 1.28-1.30 | | 20.0.0 | 1.28-1.30 | > **SUCCESS:** You can connect a cluster that uses a more recent (and unsupported) version of Kubernetes, but only for testing and development purposes. Connecting such a cluster is not suitable for production or any other workloads. To connect a cluster with an unsupported version of Kubernetes, start by following the standard installation procedure. When the installation fails, follow the instructions in the error message to connect your cluster. ## Architectures Calico Cloud can be installed on nodes based on the following chip architectures: - x86-64 - ARM64 ## Windows node support for hybrid clusters Calico Cloud supports hybrid Kubernetes clusters that use a Linux control plane with Windows nodes. You can install Calico Cloud on clusters of this type on the following managed distributions: - Amazon Elastic Kubernetes Service - Azure Kubernetes Service ## Browser support for the web console To access the web console, you can use latest two versions of the following web browsers: - Chrome - Safari ## Kubernetes reconcilers - Calico Cloud cannot be usually be installed on clusters that are managed by any kind of Kubernetes reconciler (for example, the Kubernetes `addon-manager` component). To verify, look for an annotation called `addonmanager.kubernetes.io/mode` on either of the following resources. (The resources may not exist). - `tigera-operator` deployment in the `tigera-operator` namespace - `calico-node` daemonset in the `kube-system` namespace If the following command finds addonmanager on either of the resources, then the `addon-manager` component is being used. Find a different cluster to use. ```bash kubectl get -n -o yaml | grep ' addonmanager.kubernetes.io/mode:' ``` - Some AKS clusters with the `addon-manager` component are compatible with Calico Cloud. If output from the following command includes "EnsureExists", then the install is compatible with Calico Cloud. ```bash kubectl get CustomResourceDefinition installations.operator.tigera.io -o yaml | grep ' addonmanager.kubernetes.io/mode:' ``` > **SECONDARY:** If the command output does not include "EnsureExists" and you are on a recent version of AKS your cluster might still be compatible. You can [contact Support](https://tigeraio.my.site.com/community/s/login/) for more information. > **WARNING:** If your cluster already has Calico installed by AKS and managed by the `addon-manager` component, the standard [uninstall](https://docs.tigera.io/calico-cloud/operations/disconnect.md) is not supported. You will need to reach out to support to create a plan to uninstall Calico Cloud. ## Distribution-specific requirements ### Azure Kubernetes Service - Your cluster uses a supported combination of the `networkPlugin` and `networkPolicy` configurations: - `"networkPlugin": "none"` and `"networkPolicy": null` - `"networkPlugin": "azure"` and `"networkPolicy": null` - `"networkPlugin": "azure"` and `"networkPolicy": "calico"` You can check your configuration by running the following command: ```bash az aks show --query 'networkProfile' ``` - If your cluster uses the Azure CNI, your cluster's CNI is set to [transparent mode](https://docs.microsoft.com/en-us/azure/aks/faq#what-is-azure-cni-transparent-mode-vs-bridge-mode). ```bash az vmss run-command invoke -g -n --scripts "cat /etc/cni/net.d/*" --command-id RunShellScript --instance-id 0 --query 'value[0].message' ``` If the Azure CNI is enabled, the output should include `"mode": "transparent"`. ### Google Kubernetes Service - Your cluster's network policy is disabled. To verify, run the following command: ```bash gcloud container clusters describe --flatten addonsConfig.networkPolicyConfig.disabled ``` * Your cluster's Dataplane V2 is set to `null`. To verify, run the following command: ```bash gcloud container clusters describe --flatten networkConfig.datapathProvider ``` ### Rancher Kubernetes Engine 2 - The Calico Open Source CNI must not be provisioned by the RKE2 installer. You can connect an RKE2 cluster to Calico Cloud only if: - the RKE2 cluster was installed without a CNI - Calico Open Source was installed manually To verify, run this command to see the configuration on your control-plane node: ```bash cat /etc/rancher/rke2/config.yaml ``` You should see `cni: none`. If you're creating a new RKE2 cluster, you can set this configuration as an environment variable (`RKE2_CNI=none`) when you run the installation script. ## Next steps - [Prepare your cluster for Calico Cloud](https://docs.tigera.io/calico-cloud/get-started/prepare-cluster.md)