--- title: "Create a Calico Enterprise managed cluster" description: "Install Calico Enterprise managed cluster using Helm application package manager." product: "Calico Enterprise" version: "3.21" section: "Multi-cluster management" canonical_url: "https://docs.tigera.io/calico-enterprise/3.21/multicluster/set-up-multi-cluster-management/helm-install/create-a-managed-cluster-helm" --- # Create a Calico Enterprise managed cluster ## Big picture Create a Calico Enterprise managed cluster that you can control from your management cluster using Helm 3. ## Value Helm charts are a way to package up an application for Kubernetes (similar to `apt` or `yum` for operating systems). Helm is also used by tools like ArgoCD to manage applications in a cluster, taking care of install, upgrade (and rollback if needed), etc. ## Before you begin **Required** - Install Helm 3 - `kubeconfig` is configured to work with your cluster (check by running `kubectl get nodes`) - [Credentials for the Tigera private registry and a license key](https://docs.tigera.io/calico-enterprise/3.21/getting-started/install-on-clusters/calico-enterprise.md) ## Concepts ### Operator-based installation In this guide, you install the Tigera Calico operator and custom resource definitions using the Helm 3 chart. The Tigera Operator provides lifecycle management for Calico Enterprise exposed via the Kubernetes API defined as a custom resource definition. ## How to ### Download the Helm chart ```bash helm repo add tigera-ee https://downloads.tigera.io/ee/charts helm repo update helm pull tigera-ee/tigera-operator --version v3.21.9 ``` ### Prepare the Installation Configuration You **must** provide the desired configuration for your cluster via the `values.yaml`, otherwise installation will use the default settings based on the auto-detected provider. The configurations you need to provide depends on your cluster's settings and your desired state. Some important configurations you might need to provide to the installer (via `values.yaml`) includes (but not limited to): *kubernetesProvider*, *cni type*, or if you need to customize *TLS certificates*. Here are some examples for updating `values.yaml` with your configurations: Example 1. Providing `kubernetesProvider`: if you are installing on a cluster installed by EKS, set the `kubernetesProvider` as described in the [Installation reference](https://docs.tigera.io/calico-enterprise/3.21/reference/installation/api.md#provider) ```bash echo '{ installation: {kubernetesProvider: EKS }}' > values.yaml ``` Example 2. Providing custom settings in `values.yaml` for Azure AKS cluster with no Kubernetes CNI pre-installed: ```bash cat > values.yaml < ``` 1. Export the management cluster certificate and managed cluster certificate and key. If you haven't already done so, generate the base64 encoded CRT and KEY for this managed cluster: ```bash openssl genrsa 2048 | base64 -w 0 > my-managed-cluster.key.base64 openssl req -new -key <(base64 -d my-managed-cluster.key.base64) -subj "/CN=my-managed-cluster" | \ openssl x509 -req -signkey <(base64 -d my-managed-cluster.key.base64) -days 365 | base64 -w 0 > my-managed-cluster.crt.base64 ``` Get the MANAGEMENT\_CLUSTER\_CRT by running the following command on the management cluster: ```bash kubectl get secret -n tigera-operator $(kubectl get managementcluster tigera-secure -o jsonpath='{.spec.tls.secretName}') -o jsonpath='{.data.tls\.crt}' > management-cluster.crt.base64 ``` Export the managed cluster variables: ```bash export MANAGEMENT_CLUSTER_CRT=$(cat management-cluster.crt.base64) export MANAGED_CLUSTER_CRT=$(cat my-managed-cluster.crt.base64) export MANAGED_CLUSTER_KEY=$(cat my-managed-cluster.key.base64) ``` 1. Append the management cluster context to your `values.yaml`: ```bash echo " managementClusterConnection: enabled: true managementClusterAddress: $MANAGEMENT_CLUSTER_ADDR management: tls: crt: $MANAGEMENT_CLUSTER_CRT managed: tls: crt: $MANAGED_CLUSTER_CRT key: $MANAGED_CLUSTER_KEY" >> values.yaml ``` 1. Install the Tigera Operator and custom resource definitions using the Helm 3 chart: ```bash helm install calico-enterprise tigera-operator-v3.21.9-0.tgz -f values.yaml \ --set-file imagePullSecrets.tigera-pull-secret=,tigera-prometheus-operator.imagePullSecrets.tigera-pull-secret= \ --set-file licenseKeyContent= \ --set logStorage.enabled=false --set manager.enabled=false \ --namespace tigera-operator --create-namespace ``` 1. You can now monitor progress with the following command: ```bash watch kubectl get tigerastatus ``` #### Provide permissions to view the managed cluster To access resources belonging to a managed cluster from the Calico Enterprise web console, the service or user account used to log in must have appropriate permissions defined in the managed cluster. Define admin-level permissions for the service account `mcm-user` we created to log in to the web console. Run the following command against your managed cluster. ```bash kubectl create clusterrolebinding mcm-user-admin --clusterrole=tigera-network-admin --serviceaccount=default:mcm-user ``` Congratulations! You have now installed Calico Enterprise for a managed cluster using the Helm 3 chart. ## Next steps **Recommended** - [Configure access to the Calico Enterprise web console](https://docs.tigera.io/calico-enterprise/3.21/operations/cnx/access-the-manager.md) - [Authentication quickstart](https://docs.tigera.io/calico-enterprise/3.21/operations/cnx/authentication-quickstart.md) - [Configure your own identity provider](https://docs.tigera.io/calico-enterprise/3.21/operations/cnx/configure-identity-provider.md) **Recommended - Networking** - The default networking is IP in IP encapsulation using BGP routing. For all networking options, see [Determine best networking option](https://docs.tigera.io/calico-enterprise/3.21/networking/determine-best-networking.md). **Recommended - Security** - [Get started with Calico Enterprise tiered network policy](https://docs.tigera.io/calico-enterprise/3.21/network-policy/policy-tiers/tiered-policy.md)