--- title: "Create a Calico Enterprise managed cluster" description: "Create a Calico Enterprise managed cluster that you can control from you management cluster." product: "Calico Enterprise" version: "3.21" section: "Multi-cluster management" canonical_url: "https://docs.tigera.io/calico-enterprise/3.21/multicluster/set-up-multi-cluster-management/standard-install/create-a-managed-cluster" --- # Create a Calico Enterprise managed cluster ## Big picture Create a Calico Enterprise managed cluster that you can control from your management cluster. ## Value Managing standalone clusters and multiple instances of Elasticsearch is not onerous when you first install Calico Enterprise. As you move to production with 300+ clusters, it is not scalable; you need centralized cluster management and log storage. With Calico Enterprise multi-cluster management, you can securely connect multiple clusters from different cloud providers in a single management plane, and control user access using RBAC. This architecture also supports federation of network policy resources across clusters, and lays the foundation for a “single pane of glass.” ## Before you begin... **Required** - A [Calico Enterprise management cluster](https://docs.tigera.io/calico-enterprise/3.21/multicluster/set-up-multi-cluster-management/standard-install/create-a-management-cluster.md) - A [Calico Enterprise pull secret](https://docs.tigera.io/calico-enterprise/3.21/getting-started/install-on-clusters/calico-enterprise.md) ## How to ### Create a managed cluster Follow these steps in the cluster you intend to use as the managed cluster. **Tab: Kubernetes** #### Install Calico Enterprise 1. Install the Tigera Operator and custom resource definitions. ```text kubectl create -f https://downloads.tigera.io/ee/v3.21.9/manifests/operator-crds.yaml ``` ```text kubectl create -f https://downloads.tigera.io/ee/v3.21.9/manifests/tigera-operator.yaml ``` 2. Install the Prometheus operator and related custom resource definitions. The Prometheus operator will be used to deploy Prometheus server and Alertmanager to monitor Calico Enterprise metrics. > **SECONDARY:** > > If you have an existing Prometheus operator in your cluster that you want to use, skip this step. To work with Calico Enterprise, your Prometheus operator must be v0.40.0 or higher. ```text kubectl create -f https://downloads.tigera.io/ee/v3.21.9/manifests/tigera-prometheus-operator.yaml ``` 3. Install your pull secret. If pulling images directly from `quay.io/tigera`, you will likely want to use the credentials provided to you by your Tigera support representative. If using a private registry, use your private registry credentials. ```text kubectl create secret generic tigera-pull-secret \ --type=kubernetes.io/dockerconfigjson -n tigera-operator \ --from-file=.dockerconfigjson= ``` 4. (Optional) If your cluster architecture requires any custom [Calico Enterprise resources](https://docs.tigera.io/calico-enterprise/3.21/reference/resources.md) to function at startup, install them now using [calicoctl](https://docs.tigera.io/calico-enterprise/3.21/reference/clis/calicoctl/overview.md). 5. (Optional) Compliance and packet capture features are optional. To enable these features during installation, download and review the custom-resources.yaml file. Uncomment the necessary CRs and use this custom-resources.yaml for installation. ```bash curl -O -L https://downloads.tigera.io/ee/v3.21.9/manifests/custom-resources.yaml ``` 6. Download the Tigera custom resources. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico-enterprise/3.21/reference/installation/api.md). ```bash curl -O -L https://downloads.tigera.io/ee/v3.21.9/manifests/custom-resources.yaml ``` Remove the `Manager` custom resource from the manifest file. ```yaml apiVersion: operator.tigera.io/v1 kind: Manager metadata: name: tigera-secure spec: # Authentication configuration for accessing the Tigera manager. # Default is to use token-based authentication. auth: type: Token ``` Remove the `LogStorage` custom resource from the manifest file. ```yaml apiVersion: operator.tigera.io/v1 kind: LogStorage metadata: name: tigera-secure spec: nodes: count: 1 ``` Now apply the modified manifest. ```bash kubectl create -f ./custom-resources.yaml ``` You can now monitor progress with the following command: ```text watch kubectl get tigerastatus ``` Wait until the `apiserver` shows a status of `Available`, then proceed to the next section. #### Create the connection manifest for your managed cluster To connect the managed cluster to your management cluster, you need to create and apply a connection manifest. You can create a connection manifest from the Manager UI in the management cluster or manually using kubectl. ##### Connect cluster - Manager UI 1. In the Manager UI left navbar, click **Managed Clusters**. 2. On the Managed Clusters page, click the button, **Add Cluster**. 3. Name your cluster that is easily recognized in a list of managed clusters, and click Create Cluster. 4. Download the manifest. ##### connect-cluster---kubectl Choose a name for your managed cluster and then add it to your **management cluster**. The following commands will create a manifest with the name of your managed cluster in your current directory. 1. First, decide on the name for your managed cluster. Because you will eventually have several managed clusters, choose a name that can be easily recognized in a list of managed clusters. The name is also used in steps that follow. ```bash export MANAGED_CLUSTER=my-managed-cluster ``` 2. Get the namespace in which the Tigera Operator is running in your managed cluster (in most cases this will be `tigera-operator`): ```bash export MANAGED_CLUSTER_OPERATOR_NS=tigera-operator ``` 3. Add a managed cluster and save the manifest containing a [ManagementClusterConnection](https://docs.tigera.io/calico-enterprise/3.21/reference/installation/api.md#managementclusterconnection) and a Secret. ```bash kubectl -o jsonpath="{.spec.installationManifest}" > $MANAGED_CLUSTER.yaml create -f - < **SECONDARY:** > > If you have an existing Prometheus operator in your cluster that you want to use, skip this step. To work with Calico Enterprise, your Prometheus operator must be v0.40.0 or higher. ```text kubectl create -f https://downloads.tigera.io/ee/v3.21.9/manifests/tigera-prometheus-operator.yaml ``` 3. Install your pull secret. If pulling images directly from `quay.io/tigera`, you will likely want to use the credentials provided to you by your Tigera support representative. If using a private registry, use your private registry credentials instead. ```text kubectl create secret generic tigera-pull-secret \ --type=kubernetes.io/dockerconfigjson -n tigera-operator \ --from-file=.dockerconfigjson= ``` 4. Install any extra [Calico resources](https://docs.tigera.io/calico-enterprise/3.21/reference/resources.md) needed at cluster start using [calicoctl](https://docs.tigera.io/calico-enterprise/3.21/reference/clis/calicoctl/overview.md). 5. Download the Tigera custom resources. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico-enterprise/3.21/reference/installation/api.md). ```bash curl -O -L https://downloads.tigera.io/ee/v3.21.9/manifests/custom-resources.yaml ``` Remove the `Manager` custom resource from the manifest file. ```yaml apiVersion: operator.tigera.io/v1 kind: Manager metadata: name: tigera-secure spec: # Authentication configuration for accessing the Tigera manager. # Default is to use token-based authentication. auth: type: Token ``` Remove the `LogStorage` custom resource from the manifest file. ```yaml apiVersion: operator.tigera.io/v1 kind: LogStorage metadata: name: tigera-secure spec: nodes: count: 1 ``` Now apply the modified manifest. ```bash kubectl create -f ./custom-resources.yaml ``` You can now monitor progress with the following command: ```text watch kubectl get tigerastatus ``` Wait until the `apiserver` shows a status of `Available`, then proceed to the next section. #### Create the connection manifest for your managed cluster To connect the managed cluster to your management cluster, you need to create and apply a connection manifest. You can create a connection manifest from the Manager UI in the management cluster or manually using kubectl. ##### Connect cluster - Manager UI 1. In the Manager UI left navbar, click **Managed Clusters**. 2. On the Managed Clusters page, click the button, **Add Cluster**. 3. Name your cluster that is easily recognized in a list of managed clusters, and click Create Cluster. 4. Download the manifest. ##### connect-cluster---kubectl Choose a name for your managed cluster and then add it to your **management cluster**. The following commands will create a manifest with the name of your managed cluster in your current directory. 1. First, decide on the name for your managed cluster. Because you will eventually have several managed clusters, choose a name that can be easily recognized in a list of managed clusters. The name is also used in steps that follow. ```bash export MANAGED_CLUSTER=my-managed-cluster ``` 2. Get the namespace in which the Tigera Operator is running in your managed cluster (in most cases this will be `tigera-operator`): ```bash export MANAGED_CLUSTER_OPERATOR_NS=tigera-operator ``` 3. Add a managed cluster and save the manifest containing a [ManagementClusterConnection](https://docs.tigera.io/calico-enterprise/3.21/reference/installation/api.md#managementclusterconnection) and a Secret. ```bash kubectl -o jsonpath="{.spec.installationManifest}" > $MANAGED_CLUSTER.yaml create -f - < **SECONDARY:** > > If you have an existing Prometheus operator in your cluster that you want to use, skip this step. To work with Calico Enterprise, your Prometheus operator must be v0.40.0 or higher. ```text kubectl create -f https://downloads.tigera.io/ee/v3.21.9/manifests/tigera-prometheus-operator.yaml ``` 3. Install your pull secret. If pulling images directly from `quay.io/tigera`, you will likely want to use the credentials provided to you by your Tigera support representative. If using a private registry, use your private registry credentials instead. ```text kubectl create secret generic tigera-pull-secret \ --type=kubernetes.io/dockerconfigjson -n tigera-operator \ --from-file=.dockerconfigjson= ``` 4. Install any extra [Calico Enterprise resources](https://docs.tigera.io/calico-enterprise/3.21/reference/resources.md) needed at cluster start using [calicoctl](https://docs.tigera.io/calico-enterprise/3.21/reference/clis/calicoctl/overview.md). 5. Download the Tigera custom resources. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico-enterprise/3.21/reference/installation/api.md). ```bash curl -O -L https://downloads.tigera.io/ee/v3.21.9/manifests/eks/custom-resources.yaml ``` Remove the `Manager` custom resource from the manifest file. ```yaml apiVersion: operator.tigera.io/v1 kind: Manager metadata: name: tigera-secure spec: # Authentication configuration for accessing the Tigera manager. # Default is to use token-based authentication. auth: type: Token ``` Remove the `LogStorage` custom resource from the manifest file. ```yaml apiVersion: operator.tigera.io/v1 kind: LogStorage metadata: name: tigera-secure spec: nodes: count: 1 ``` Now apply the modified manifest. ```bash kubectl create -f ./custom-resources.yaml ``` 6. Monitor progress with the following command: ```bash watch kubectl get tigerastatus ``` Wait until the `apiserver` shows a status of `Available`, then proceed to the next section. #### Install EKS with Calico networking Calico Enterprise networking cannot currently be installed on the EKS control plane nodes. As a result the control plane nodes will not be able to initiate network connections to Calico Enterprise pods. (This is a general limitation of EKS's custom networking support, not specific to Calico Enterprise.) As a workaround, trusted pods that require control plane nodes to connect to them, such as those implementing admission controller webhooks, can include `hostNetwork:true` in their pod spec. See the Kubernetes API [pod spec](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#PodSpec) definition for more information on this setting. ##### Create an EKS cluster For these instructions, we will use `eksctl` to provision the cluster. However, you can use any of the methods in [Getting Started with Amazon EKS](https://docs.aws.amazon.com/eks/latest/userguide/getting-started.html) Before you get started, make sure you have downloaded and configured the [necessary prerequisites](https://docs.aws.amazon.com/eks/latest/userguide/getting-started-eksctl.html#eksctl-prereqs) 1. First, create an Amazon EKS cluster without any nodes. ```bash eksctl create cluster --name my-calico-cluster --without-nodegroup ``` 2. Since this cluster will use Calico Enterprise for networking, you must delete the `aws-node` daemon set to disable AWS VPC networking for pods. ```bash kubectl delete daemonset -n kube-system aws-node ``` ##### Install Calico Enterprise 1. [Configure a storage class for Calico Enterprise.](https://docs.tigera.io/calico-enterprise/3.21/operations/logstorage/create-storage.md) 2. Install the Tigera Operator and custom resource definitions. ```text kubectl create -f https://downloads.tigera.io/ee/v3.21.9/manifests/operator-crds.yaml ``` ```text kubectl create -f https://downloads.tigera.io/ee/v3.21.9/manifests/tigera-operator.yaml ``` 3. Install the Prometheus operator and related custom resource definitions. The Prometheus operator will be used to deploy Prometheus server and Alertmanager to monitor Calico Enterprise metrics. > **SECONDARY:** > > If you have an existing Prometheus operator in your cluster that you want to use, skip this step. To work with Calico Enterprise, your Prometheus operator must be v0.40.0 or higher. ```text kubectl create -f https://downloads.tigera.io/ee/v3.21.9/manifests/tigera-prometheus-operator.yaml ``` 4. Install your pull secret. If pulling images directly from `quay.io/tigera`, you will likely want to use the credentials provided to you by your Tigera support representative. If using a private registry, use your private registry credentials instead. ```text kubectl create secret generic tigera-pull-secret \ --type=kubernetes.io/dockerconfigjson -n tigera-operator \ --from-file=.dockerconfigjson= ``` 5. Install any extra [Calico Enterprise resources](https://docs.tigera.io/calico-enterprise/3.21/reference/resources.md) needed at cluster start using [calicoctl](https://docs.tigera.io/calico-enterprise/3.21/reference/clis/calicoctl/overview.md). 6. To configure Calico Enterprise for use with the Calico CNI plugin, we must create an `Installation` resource that has `spec.cni.type: Calico`. Install the `custom-resources-calico-cni.yaml` manifest, which includes this configuration. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico-enterprise/3.21/reference/installation/api.md). 7. Download the Tigera custom resources. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico-enterprise/3.21/reference/installation/api.md). ```bash curl -O -L https://downloads.tigera.io/ee/v3.21.9/manifests/eks/custom-resources-calico-cni.yaml ``` Remove the `Manager` custom resource from the manifest file. ```yaml apiVersion: operator.tigera.io/v1 kind: Manager metadata: name: tigera-secure spec: # Authentication configuration for accessing the Tigera manager. # Default is to use token-based authentication. auth: type: Token ``` Remove the `LogStorage` custom resource from the manifest file. ```yaml apiVersion: operator.tigera.io/v1 kind: LogStorage metadata: name: tigera-secure spec: nodes: count: 1 ``` Now apply the modified manifest. ```bash kubectl create -f ./custom-resources-calico-cni.yaml ``` 8. Monitor progress with the following command: ```bash watch kubectl get tigerastatus ``` 9. Finally, add nodes to the cluster. ```bash eksctl create nodegroup --cluster my-calico-cluster --node-type t3.xlarge --node-ami auto --max-pods-per-node 100 ``` > **Tip**: Without the `--max-pods-per-node` option above, EKS will limit the [number of pods based on node-type](https://github.com/awslabs/amazon-eks-ami/blob/main/nodeadm/internal/kubelet/eni-max-pods.txt). See `eksctl create nodegroup --help` for the full set of node group options. 10. Monitor progress with the following command: ```text watch kubectl get tigerastatus ``` Wait until the `apiserver` shows a status of `Available`, then proceed to the next section. #### Create the connection manifest for your managed cluster To connect the managed cluster to your management cluster, you need to create and apply a connection manifest. You can create a connection manifest from the Manager UI in the management cluster or manually using kubectl. ##### Connect cluster - Manager UI 1. In the Manager UI left navbar, click **Managed Clusters**. 2. On the Managed Clusters page, click the button, **Add Cluster**. 3. Name your cluster that is easily recognized in a list of managed clusters, and click Create Cluster. 4. Download the manifest. ##### connect-cluster---kubectl Choose a name for your managed cluster and then add it to your **management cluster**. The following commands will create a manifest with the name of your managed cluster in your current directory. 1. First, decide on the name for your managed cluster. Because you will eventually have several managed clusters, choose a name that can be easily recognized in a list of managed clusters. The name is also used in steps that follow. ```bash export MANAGED_CLUSTER=my-managed-cluster ``` 2. Get the namespace in which the Tigera Operator is running in your managed cluster (in most cases this will be `tigera-operator`): ```bash export MANAGED_CLUSTER_OPERATOR_NS=tigera-operator ``` 3. Add a managed cluster and save the manifest containing a [ManagementClusterConnection](https://docs.tigera.io/calico-enterprise/3.21/reference/installation/api.md#managementclusterconnection) and a Secret. ```bash kubectl -o jsonpath="{.spec.installationManifest}" > $MANAGED_CLUSTER.yaml create -f - < **SECONDARY:** > > If you have an existing Prometheus operator in your cluster that you want to use, skip this step. To work with Calico Enterprise, your Prometheus operator must be v0.40.0 or higher. ```text kubectl create -f https://downloads.tigera.io/ee/v3.21.9/manifests/tigera-prometheus-operator.yaml ``` 3. Install your pull secret. If pulling images directly from `quay.io/tigera`, you will likely want to use the credentials provided to you by your Tigera support representative. If using a private registry, use your private registry credentials instead. ```text kubectl create secret generic tigera-pull-secret \ --type=kubernetes.io/dockerconfigjson -n tigera-operator \ --from-file=.dockerconfigjson= ``` 4. Install any extra [Calico Enterprise resources](https://docs.tigera.io/calico-enterprise/3.21/reference/resources.md) needed at cluster start using [calicoctl](https://docs.tigera.io/calico-enterprise/3.21/reference/clis/calicoctl/overview.md). 5. Download the Tigera custom resources. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico-enterprise/3.21/reference/installation/api.md). ```bash curl -O -L https://downloads.tigera.io/ee/v3.21.9/manifests/aks/custom-resources.yaml ``` Remove the `Manager` custom resource from the manifest file. ```yaml apiVersion: operator.tigera.io/v1 kind: Manager metadata: name: tigera-secure spec: # Authentication configuration for accessing the Tigera manager. # Default is to use token-based authentication. auth: type: Token ``` Remove the `LogStorage` custom resource from the manifest file. ```yaml apiVersion: operator.tigera.io/v1 kind: LogStorage metadata: name: tigera-secure spec: nodes: count: 1 ``` Now apply the modified manifest. ```bash kubectl create -f ./custom-resources.yaml ``` You can now monitor progress with the following command: ```text watch kubectl get tigerastatus ``` Wait until the `apiserver` shows a status of `Available`, then proceed to the next section. #### Install with Calico Enterprise networking 1. [Configure a storage class for Calico Enterprise](https://docs.tigera.io/calico-enterprise/3.21/operations/logstorage/create-storage.md). 2. Install the Tigera Operator and custom resource definitions. ```text kubectl create -f https://downloads.tigera.io/ee/v3.21.9/manifests/operator-crds.yaml ``` ```text kubectl create -f https://downloads.tigera.io/ee/v3.21.9/manifests/tigera-operator.yaml ``` 3. Install the Prometheus operator and related custom resource definitions. The Prometheus operator will be used to deploy Prometheus server and Alertmanager to monitor Calico Enterprise metrics. > **SECONDARY:** > > If you have an existing Prometheus operator in your cluster that you want to use, skip this step. To work with Calico Enterprise, your Prometheus operator must be v0.40.0 or higher. ```text kubectl create -f https://downloads.tigera.io/ee/v3.21.9/manifests/tigera-prometheus-operator.yaml ``` 4. Install your pull secret. If pulling images directly from `quay.io/tigera`, you will likely want to use the credentials provided to you by your Tigera support representative. If using a private registry, use your private registry credentials instead. ```text kubectl create secret generic tigera-pull-secret \ --type=kubernetes.io/dockerconfigjson -n tigera-operator \ --from-file=.dockerconfigjson= ``` 5. Install any extra [Calico Enterprise resources](https://docs.tigera.io/calico-enterprise/3.21/reference/resources.md) needed at cluster start using [calicoctl](https://docs.tigera.io/calico-enterprise/3.21/reference/clis/calicoctl/overview.md). 6. Download the Tigera custom resources. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico-enterprise/3.21/reference/installation/api.md). ```bash curl -O -L https://downloads.tigera.io/ee/v3.21.9/manifests/aks/custom-resources-calico-cni.yaml ``` Remove the `Manager` custom resource from the manifest file. ```yaml apiVersion: operator.tigera.io/v1 kind: Manager metadata: name: tigera-secure spec: # Authentication configuration for accessing the Tigera manager. # Default is to use token-based authentication. auth: type: Token ``` Remove the `LogStorage` custom resource from the manifest file. ```yaml apiVersion: operator.tigera.io/v1 kind: LogStorage metadata: name: tigera-secure spec: nodes: count: 1 ``` Now apply the modified manifest. ```bash kubectl create -f ./custom-resources-calico-cni.yaml ``` You can now monitor progress with the following command: ```text watch kubectl get tigerastatus ``` Wait until the `apiserver` shows a status of `Available`, then proceed to the next section. #### Create the connection manifest for your managed cluster To connect the managed cluster to your management cluster, you need to create and apply a connection manifest. You can create a connection manifest from the Manager UI in the management cluster or manually using kubectl. ##### Connect cluster - Manager UI 1. In the Manager UI left navbar, click **Managed Clusters**. 2. On the Managed Clusters page, click the button, **Add Cluster**. 3. Name your cluster that is easily recognized in a list of managed clusters, and click Create Cluster. 4. Download the manifest. ##### connect-cluster---kubectl Choose a name for your managed cluster and then add it to your **management cluster**. The following commands will create a manifest with the name of your managed cluster in your current directory. 1. First, decide on the name for your managed cluster. Because you will eventually have several managed clusters, choose a name that can be easily recognized in a list of managed clusters. The name is also used in steps that follow. ```bash export MANAGED_CLUSTER=my-managed-cluster ``` 2. Get the namespace in which the Tigera Operator is running in your managed cluster (in most cases this will be `tigera-operator`): ```bash export MANAGED_CLUSTER_OPERATOR_NS=tigera-operator ``` 3. Add a managed cluster and save the manifest containing a [ManagementClusterConnection](https://docs.tigera.io/calico-enterprise/3.21/reference/installation/api.md#managementclusterconnection) and a Secret. ```bash kubectl -o jsonpath="{.spec.installationManifest}" > $MANAGED_CLUSTER.yaml create -f - < **SECONDARY:** > > See the > > [OpenShift installer documentation](https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/installation_overview/ocp-installation-overview) > > for more information about the installer and any configuration changes required for your platform. After the installer finishes, your staging directory will contain the configuration file `install-config.yaml`. #### Update the configuration file to use Calico Enterprise Override the OpenShift networking to use Calico Enterprise and update the AWS instance types to meet the [system requirements](https://docs.tigera.io/calico-enterprise/3.21/getting-started/install-on-clusters/openshift/requirements.md): ```bash sed -i 's/\(OpenShiftSDN\|OVNKubernetes\)/Calico/' install-config.yaml ``` > **SECONDARY:** By default openshift-installer creates 3 replicas, you can change these settings by modifying the cloud-provider part in the install-config.yaml > > The following example changes the default deployment instance type and replica quantity. > > install-config.yaml > > ```yaml > ... > platform: > aws: > type: m5.xlarge > replicas: 2 > ... > ``` #### Generate the install manifests Now generate the Kubernetes manifests using your configuration file: ```bash openshift-install create manifests ``` > **SECONDARY:** For OpenShift **v4.16 or newer** on **AWS**, configure AWS security groups to allow BGP, typha and IP-in-IP encapsulation traffic by editing the OpenShift cluster-api manifests. > > Edit `spec.network.cni.cniIngressRules` in the `cluster-api/02_infra-cluster.yaml` file to add > > ```yaml > cniIngressRules: > (...) > - description: BGP (calico) > fromPort: 179 > protocol: tcp > toPort: 179 > - description: IP-in-IP (calico) > fromPort: -1 > protocol: "4" > toPort: -1 > - description: Typha (calico) > fromPort: 5473 > protocol: tcp > toPort: 5473 > ``` Download the Calico Enterprise manifests for OpenShift and add them to the generated manifests directory: ```bash mkdir calico wget -qO- https://downloads.tigera.io/ee/v3.21.9/manifests/ocp.tgz | tar xvz --strip-components=1 -C calico cp calico/* manifests/ ``` #### Add an image pull secret Update the contents of the secret with the image pull secret provided to you by Tigera support representative. For example, if the secret is located at `~/.docker/config.json`, run the following commands. ```text SECRET=$(cat ~/.docker/config.json | tr -d '\n\r\t ' | base64 -w 0) sed -i "s/SECRET/${SECRET}/" manifests/02-pull-secret.yaml ``` #### Provide additional configuration To provide additional configuration during installation (for example, BGP configuration or peers), use a Kubernetes ConfigMap with your desired Calico Enterprise resources. If you do not need to provide additional configuration, skip this section. To include [Calico Enterprise resources](https://docs.tigera.io/calico-enterprise/3.21/reference/resources.md) during installation, edit `manifests/02-configmap-calico-resources.yaml` in order to add your own configuration. > **SECONDARY:** If you have a directory with the Calico Enterprise resources, you can create the file with the command: > > ```text > kubectl create configmap -n tigera-operator calico-resources \ > --from-file= --dry-run -o yaml \ > > manifests/02-configmap-calico-resources.yaml > ``` > > With recent versions of `kubectl` it is necessary to have a kubeconfig configured or add `--server='127.0.0.1:443'` even though it is not used. > **SECONDARY:** If you have provided a `calico-resources` configmap and the tigera-operator pod fails to come up with `Init:CrashLoopBackOff`, check the output of the init-container with `kubectl logs -n tigera-operator -l k8s-app=tigera-operator -c create-initial-resources`. #### Create the cluster Start the cluster creation with the following command and wait for it to complete. ```text openshift-install create cluster ``` #### Create a storage class Calico Enterprise requires storage for logs and reports. Before finishing the installation, you must [create a StorageClass for Calico Enterprise](https://docs.tigera.io/calico-enterprise/3.21/operations/logstorage/create-storage.md). #### Install Calico Enterprise resources Download the Tigera custom resources. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico-enterprise/3.21/reference/installation/api.md). ```bash curl -O -L https://downloads.tigera.io/ee/v3.21.9/manifests/ocp/tigera-enterprise-resources.yaml ``` Remove the `Manager` custom resource from the manifest file. ```yaml apiVersion: operator.tigera.io/v1 kind: Manager metadata: name: tigera-secure spec: # Authentication configuration for accessing the Tigera manager. # Default is to use token-based authentication. auth: type: Token ``` Remove the `LogStorage` custom resource from the manifest file. ```yaml apiVersion: operator.tigera.io/v1 kind: LogStorage metadata: name: tigera-secure spec: nodes: count: 1 ``` Now apply the modified manifest. ```text oc create -f ./tigera-enterprise-resources.yaml ``` Apply the Calico Enterprise manifests for the Prometheus operator. > **SECONDARY:** > > Complete this step only if you are using the Calico Enterprise Prometheus operator (including adding your own Prometheus operator). Skip this step if you are using > > [BYO Prometheus](https://docs.tigera.io/calico-enterprise/3.21/operations/monitor/prometheus/support.md) > > that you manage yourself. ```bash oc create -f https://downloads.tigera.io/ee/v3.21.9/manifests/ocp/tigera-prometheus-operator.yaml ``` You can now monitor progress with the following command: ```text watch oc get tigerastatus ``` When it shows all components with status `Available`, proceed to the next step. (Optional) Apply the full CRDs including descriptions. ```bash oc apply --server-side --force-conflicts -f https://downloads.tigera.io/ee/v3.21.9/manifests/operator-crds.yaml ``` #### Create the connection manifest for your managed cluster To connect the managed cluster to your management cluster, you need to create and apply a connection manifest. You can create a connection manifest from the Manager UI in the management cluster or manually using oc. ##### Connect cluster - Manager UI 1. In the Manager UI left navbar, click **Managed Clusters**. 2. On the Managed Clusters page, click the button, **Add Cluster**. 3. Name your cluster that is easily recognized in a list of managed clusters, and click Create Cluster. 4. Download the manifest. ##### connect-cluster---kubectl Choose a name for your managed cluster and then add it to your **management cluster**. The following commands will create a manifest with the name of your managed cluster in your current directory. 1. First, decide on the name for your managed cluster. Because you will eventually have several managed clusters, choose a name that can be easily recognized in a list of managed clusters. The name is also used in steps that follow. ```bash export MANAGED_CLUSTER=my-managed-cluster ``` 2. Get the namespace in which the Tigera Operator is running in your managed cluster (in most cases this will be `tigera-operator`): ```bash export MANAGED_CLUSTER_OPERATOR_NS=tigera-operator ``` 3. Add a managed cluster and save the manifest containing a [ManagementClusterConnection](https://docs.tigera.io/calico-enterprise/3.21/reference/installation/api.md#managementclusterconnection) and a Secret. ```bash oc -o jsonpath="{.spec.installationManifest}" > $MANAGED_CLUSTER.yaml create -f - < ## Next steps - When you are ready to fine-tune your multi-cluster management deployment for production, see [Fine-tune multi-cluster management](https://docs.tigera.io/calico-enterprise/3.21/multicluster/fine-tune-deployment.md) - To change an existing Calico Enterprise standalone cluster to a management or managed cluster, see [Change cluster types](https://docs.tigera.io/calico-enterprise/3.21/multicluster/change-cluster-type.md)