---
title: "Upgrade from Calico to Calico Enterprise on OpenShift"
description: "Steps to upgrade from open source Calico to Calico Enterprise on OpenShift."
product: "Calico Enterprise"
version: "3.21"
section: "Install and upgrade"
canonical_url: "https://docs.tigera.io/calico-enterprise/3.21/getting-started/upgrading/upgrading-calico-to-calico-enterprise/upgrade-to-tsee-openshift"
---

# Upgrade from Calico to Calico Enterprise on OpenShift

## Prerequisites

Ensure that your Kubernetes cluster is running with open source Calico on the latest release using an operator-based installation. If not, follow the [Calico upgrade documentation](https://docs.tigera.io/calico/latest/operations/upgrading/openshift-upgrade.md) before continuing.

Ensure your Kubernetes cluster is using the Kubernetes datastore. If you are using an `etcdv3` datastore, or the cluster doesn't have a datastore, contact Tigera Support to upgrade the datastore.

Your Kubernetes cluster must not be running in production. Operator-based upgrades from open source Calico are not recommended for production clusters due to limited testing. Also, upgrades are not tested with open source Calico prior to v3.15.

If your cluster already has Calico Enterprise installed, follow the [Upgrading Calico Enterprise from an earlier release guide](https://docs.tigera.io/calico-enterprise/3.21/getting-started/upgrading/upgrading-enterprise/openshift-upgrade.md) instead.

## Prepare your cluster for the upgrade

Calico Enterprise creates default-deny policies for all Calico and Tigera namespaces, including calico-system. If you deploy workloads into the calico-system namespace, you must create policy that allows the required traffic for your workloads prior to upgrade.

### Deleting Goldmane and Whisker resources (for upgrades from Calico 3.30 or later)

If you are upgrading from Calico 3.30 and have custom resources related to Goldmane and Whisker, you should delete these resources before the upgrade.

```bash
oc delete goldmanes,whiskers --all
```

If you receive error indicating the custom resource definitions or resource type does not exist, it means these resources were not present in your cluster. You can safely ignore the error and proceed.

## Upgrade Calico to Calico Enterprise

### Before you begin

**Required**

- [Configure a storage class for Calico Enterprise.](https://docs.tigera.io/calico-enterprise/3.21/operations/logstorage/create-storage.md)

### Install Calico Enterprise

**Download the new manifests**

Make the manifests directory.

```bash
mkdir manifests
```

Download the Calico Enterprise manifests for OpenShift and add them to the generated manifests directory:

```bash
mkdir calico
wget -qO- https://downloads.tigera.io/ee/v3.21.9/manifests/ocp.tgz | tar xvz --strip-components=1 -C calico  --exclude=03-cr-*
cp calico/* manifests/
```

**Add an image pull secret**

Update the contents of the secret with the image pull secret provided to you by Tigera support representative.

For example, if the secret is located at `~/.docker/config.json`, run the following commands.

```text
SECRET=$(cat ~/.docker/config.json | tr -d '\n\r\t ' | base64 -w 0)
sed -i "s/SECRET/${SECRET}/" manifests/02-pull-secret.yaml
```

> (Optional) If your cluster architecture requires any custom [Calico Enterprise resources](https://docs.tigera.io/calico-enterprise/3.21/reference/resources.md) to function at startup, install them now using [calicoctl](https://docs.tigera.io/calico-enterprise/3.21/reference/clis/calicoctl/overview.md).

**Install Calico Enterprise**

1. Apply the Tigera Operators and custom resource definitions.

   ```bash
   oc apply --server-side --force-conflicts -f manifests/
   ```

2. Optional: If your cluster architecture requires any custom [Calico resources](https://docs.tigera.io/calico-enterprise/3.21/reference/resources.md) to function at startup, install them now using [calicoctl](https://docs.tigera.io/calico-enterprise/3.21/reference/clis/calicoctl/overview.md).

3. Create the custom resources for Calico Enterprise features, see [the installation reference](https://docs.tigera.io/calico-enterprise/3.21/reference/installation/api.md).

   ```bash
   oc apply -f https://downloads.tigera.io/ee/v3.21.9/manifests/ocp/tigera-enterprise-resources.yaml
   ```

4. Patch installation.

   ```bash
   oc patch installations.operator.tigera.io default --type merge -p '{"spec":{"variant":"TigeraSecureEnterprise","imagePullSecrets":[{"name":"tigera-pull-secret"}]}}'
   ```

5. You can now monitor the upgrade progress with the following command:

   ```bash
   watch oc get tigerastatus
   ```

Wait until the `apiserver` shows a status of `Available`, then proceed to the next section.

> **SECONDARY:** To troubleshoot problems, use `oc get tigerastatus -o yaml`.

### Install the Calico Enterprise license

Install the Calico Enterprise license provided to you by Tigera.

```text
oc create -f </path/to/license.yaml>
```

Apply the Calico Enterprise manifests for the Prometheus operator.

> **SECONDARY:**
>
> Complete this step only if you are using the Calico Enterprise Prometheus operator (including adding your own Prometheus operator). Skip this step if you are using
>
> [BYO Prometheus](https://docs.tigera.io/calico-enterprise/3.21/operations/monitor/prometheus/support.md)
>
>  that you manage yourself.

```bash
oc apply -f https://downloads.tigera.io/ee/v3.21.9/manifests/ocp/tigera-prometheus-operator.yaml
```

You can now monitor progress with the following command:

```text
watch oc get tigerastatus
```