---
title: "Install Calico Enterprise on an OpenShift HCP cluster"
description: "Install Calico Enterprise on an OpenShift Hosted Control Planes (HCP) cluster."
product: "Calico Enterprise"
version: "3.21"
section: "Install and upgrade"
canonical_url: "https://docs.tigera.io/calico-enterprise/3.21/getting-started/install-on-clusters/openshift/hostedcontrolplanes"
---

# Install Calico Enterprise on an OpenShift HCP cluster

## Big picture

Install Calico Enterprise on an OpenShift Hosted Control Planes (HCP) cluster.

## Value

Provides steps to install Calico Enterprise in [OpenShift Hosted Control Planes (HCP)](https://docs.openshift.com/container-platform/latest/hosted_control_planes/index.html) clusters using the [HyperShift](https://github.com/openshift/hypershift) middleware, augmenting the steps in the [HyperShift documentation](https://hypershift-docs.netlify.app) where appropriate.

## Before you begin

- Ensure that your environment meets the Calico Enterprise [system requirements](https://docs.tigera.io/calico-enterprise/3.21/getting-started/install-on-clusters/openshift/requirements.md).

- Ensure that you have a [RedHat account](https://cloud.redhat.com/). A RedHat account is required to get the pull secret necessary to provision an OpenShift cluster. Note that the OpenShift installer supports a subset of AWS regions.

- If installing on AWS, ensure that you have:

  - Configured an AWS account appropriate for OpenShift 4
  - [Set up your AWS credentials](https://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/setup-credentials.html)
  - Generated a local SSH private key and added it to your ssh-agent

- Install the HyperShift CLI and fulfill all the other [Prerequisites from the HyperShift documentation](https://hypershift-docs.netlify.app/getting-started/#prerequisites).

## How to

### Create the hosting cluster

Deploy an [OpenShift cluster](https://docs.tigera.io/calico-enterprise/3.21/getting-started/install-on-clusters/openshift/installation.md) with Calico Enterprise. This will be the hosting cluster with control-plane nodes for all hosted clusters you deploy with the steps below. Set up your `KUBECONFIG` environment variable to your hosting cluster's kubeconfig file:

```text
export KUBECONFIG=/path/to/kubeconfig
```

### Install the HyperShift operator in the hosting cluster

Follow the steps from the HyperShift documentation to [Install the HyperShift Operator](https://hypershift-docs.netlify.app/getting-started/#install-hypershift-operator).

### Create a hosted cluster

Create a hosted cluster with Calico Enterprise by going through the following steps (slightly modified from the [HyperShift docs](https://hypershift-docs.netlify.app/how-to/aws/other-sdn-providers/#calico)).

1. Create a HostedCluster and set its HostedCluster.spec.networking.networkType to Other:

> **SECONDARY:** Make sure to adjust the variables for the command below to the correct values for your cluster, credentials and environment.

```text
HOSTED_CLUSTER_NAME=my-os-hosted-cluster
REGION=us-west-2
BASE_DOMAIN=www.example.com
AWS_CREDS="$HOME/.aws/credentials"
PULL_SECRET="$HOME/.secrets/redhat-pull-secret.txt"

hypershift create cluster aws \
  --name $HOSTED_CLUSTER_NAME \
  --node-pool-replicas=3 \
  --base-domain $BASE_DOMAIN \
  --pull-secret $PULL_SECRET \
  --aws-creds $AWS_CREDS \
  --region $REGION \
  --generate-ssh \
  --network-type Other
```

> **SECONDARY:** If your hosted cluster is having authorization problems with your Red Hat pull secret (`unauthorized: authentication required` in the HyperShift operator pod logs), make sure it is using a stable release image for the OpenShift Container Platform (OCP). You can find them in \[[https://amd64.ocp.releases.ci.openshift.org](https://amd64.ocp.releases.ci.openshift.org)], for example `--release-image quay.io/openshift-release-dev/ocp-release:4.16.4-x86_64`

> **SECONDARY:** If you face an [issue](https://github.com/openshift/hypershift/issues/3927) with the HyperShift middleware that results in the hosted cluster installation not progressing due to a missing `OVNSbDb` service, patch the hosted cluster resource in order to add it:
>
> ```text
> HOSTED_CLUSTER_NAME=my-os-hosted-cluster
> CLUSTER_NS="clusters"
> oc patch -n ${CLUSTER_NS} hostedcluster ${HOSTED_CLUSTER_NAME} --type='json' -p '[{"op": "add", "path": "/spec/services/-", "value": {"service":"OVNSbDb","servicePublishingStrategy": {"type": "Route"}}}]'
> ```

Once the hosted cluster is up, use the `hypershift` CLI tool to generate the `kubeconfig` file. We strongly recommend you create a separate directory for the hosted cluster, it is very important to not mix up configuration and manifests from the hosting and hosted clusters:

```text
mkdir my_hosted_cluster && cd my_hosted_cluster
hypershift create kubeconfig > hosted_kubeconfig && export KUBECONFIG=$(pwd)/hosted_kubeconfig
```

Then, copy the `aws-creds` secret from the hosting cluster to the hosted cluster. Run this using the hosting cluster kubeconfig to extract the secret to a `yaml` file:

```text
oc get secrets --kubeconfig /path/to/hosting/kubeconfig -n kube-system aws-creds -o yaml > aws-creds.yaml
```

Then import it in the hosted cluster:

```text
oc apply --kubeconfig /path/to/hosted/kubeconfig -f aws-creds.yaml
```

> **SECONDARY:** There is no need to specify the `--kubeconfig` CLI argument if the hosted cluster's kubeconfig file is configured as the `KUBECONFIG` environment variable in your shell.

### Create a storage class

Calico Enterprise requires storage for logs and reports. Before finishing the installation, you must [create a StorageClass for Calico Enterprise](https://docs.tigera.io/calico-enterprise/3.21/operations/logstorage/create-storage.md).

### Download the Calico Enterprise install manifests

Now download and apply the Calico Enterprise manifests according to the [HyperShift docs](https://hypershift-docs.netlify.app/how-to/aws/other-sdn-providers/#calico).

Download the Calico Enterprise manifests for OpenShift:

```bash
mkdir calico
wget -qO- https://downloads.tigera.io/ee/v3.21.9/manifests/ocp.tgz | tar xvz --strip-components=1 -C calico
```

### Add an image pull secret

Update the contents of the secret with the image pull secret provided to you by a Tigera support representative.

For example, if the secret is located at \~/.docker/config.json, run the following commands.

```text
SECRET=$(cat ~/.docker/config.json | tr -d '\n\r\t ' | base64 -w 0)
sed -i "s/SECRET/${SECRET}/" calico/02-pull-secret.yaml
```

### Optionally provide additional configuration

You may want to provide Calico with additional configuration at install-time. For example, BGP configuration or peers. You can use a Kubernetes ConfigMap with your desired Calico resources to set configuration as part of the installation. If you do not need to provide additional configuration, you can skip this section.

To include [Calico resources](https://docs.tigera.io/calico-enterprise/3.21/reference/resources.md) during installation, edit `calico_hosted/02-configmap-calico-resources.yaml` to add your own configuration.

> **SECONDARY:** If you have a directory with the Calico resources, you can create the file with the command:
>
> ```text
> oc create configmap -n tigera-operator calico-resources \
> --from-file=<resource-directory> --dry-run -o yaml \
> calico/02-configmap-calico-resources.yaml
> ```
>
> With recent versions of oc it is necessary to have a kubeconfig configured or add `--server='127.0.0.1:443'` even though it is not used.

> **SECONDARY:** If you have provided a `calico-resources` configmap and the tigera-operator pod fails to come up with `Init:CrashLoopBackOff`, check the output of the init-container with `oc logs -n tigera-operator -l k8s-app=tigera-operator -c create-initial-resources`.

### Apply the Calico Enterprise install manifests

Apply the install manifests paying attention to the required order. First apply all necessary manifests to install the Tigera Operator:

```text
cd calico/
ls 00* | xargs -n1 oc apply -f
ls 01* | xargs -n1 oc apply -f
ls 02* | xargs -n1 oc apply -f
```

Then wait until the Tigera Operator creates the necessary CustomResourceDefinitions (CRDs) before applying the CustomResources to install Calico Enterprise on your cluster:

```text
timeout --foreground 600 bash -c "while ! kubectl get crd installations.operator.tigera.io; do sleep 5; done" # wait until CRDs are created by the operator
ls 03* | xargs -n1 oc apply -f
```

> **SECONDARY:** You can safely ignore any `ls: cannot access '0X*': No such file or directory` errors if there's no yaml files with that prefix to be applied.

### Install the Calico Enterprise license

In order to use Calico Enterprise, you must install the license provided to you by Tigera support representative. Before applying the license, wait until the Tigera API server is ready with the following command:

```text
watch oc get tigerastatus
```

Wait until the `apiserver` shows a status of `Available`.

After the Tigera API server is ready, apply the license:

```text
oc create -f </path/to/license.yaml>
```

### Install Calico Enterprise resources

Apply the custom resources for enterprise features.

```bash
oc create -f https://downloads.tigera.io/ee/v3.21.9/manifests/ocp/tigera-enterprise-resources.yaml
```

Apply the Calico Enterprise manifests for the Prometheus operator.

> **SECONDARY:**
>
> Complete this step only if you are using the Calico Enterprise Prometheus operator (including adding your own Prometheus operator). Skip this step if you are using
>
> [BYO Prometheus](https://docs.tigera.io/calico-enterprise/3.21/operations/monitor/prometheus/support.md)
>
>  that you manage yourself.

```bash
oc create -f https://downloads.tigera.io/ee/v3.21.9/manifests/ocp/tigera-prometheus-operator.yaml
```

You can now monitor progress with the following command:

```text
watch oc get tigerastatus
```

When it shows all components with status `Available`, proceed to the next step.

(Optional) Apply the full CRDs including descriptions.

```bash
oc apply --server-side --force-conflicts -f https://downloads.tigera.io/ee/v3.21.9/manifests/operator-crds.yaml
```

## Next steps

**Recommended**

- [Configure access to the Calico Enterprise web console](https://docs.tigera.io/calico-enterprise/3.21/operations/cnx/access-the-manager.md)
- [Authentication quickstart](https://docs.tigera.io/calico-enterprise/3.21/operations/cnx/authentication-quickstart.md)
- [Configure your own identity provider](https://docs.tigera.io/calico-enterprise/3.21/operations/cnx/configure-identity-provider.md)

**Recommended - Networking**

- The default networking uses IP in IP encapsulation with BGP routing. For all networking options, see [Determine best networking option](https://docs.tigera.io/calico-enterprise/3.21/networking/determine-best-networking.md).

**Recommended - Security**

- [Get started with Calico Enterprise tiered network policy](https://docs.tigera.io/calico-enterprise/3.21/network-policy/policy-tiers/tiered-policy.md)