---
title: "Install calicoctl"
description: "Install the CLI for Calico."
product: "Calico Enterprise"
version: "3.21"
section: "Operations"
canonical_url: "https://docs.tigera.io/calico-enterprise/3.21/operations/clis/calicoctl/install"
---

# Install calicoctl

## Big picture

`calicoctl` allows you to create, read, update, and delete Calico Enterprise objects from the command line. These objects represent the networking and policy of your cluster.

You should limit access to `calicoctl` and your Calico Enterprise datastore to trusted administrators. We discuss methods of limiting access to the Calico Enterprise datastore in the [configuration section](https://docs.tigera.io/calico-enterprise/3.21/operations/clis/calicoctl/configure.md).

You can run `calicoctl` on any host with network access to the Calico Enterprise datastore as either a binary or a container.

## How to

> **SECONDARY:** Make sure you always install the version of `calicoctl` that matches the version of Calico Enterprise running on your cluster.

- [Install calicoctl as a binary on a single host](#install-calicoctl-as-a-binary-on-a-single-host)
- [Install calicoctl as a container on a single host](#install-calicoctl-as-a-container-on-a-single-host)

### Install calicoctl as a binary on a single host

<!-- tabs -->

**Tab: Linux**

Log into the host, open a terminal prompt, and navigate to the location where you want to install the binary.

> **SECONDARY:** Consider navigating to a location that's in your `PATH`. For example, `/usr/local/bin/`.

Use the following command to download the `calicoctl` binary.

```bash
curl -o calicoctl -L https://downloads.tigera.io/ee/binaries/v3.21.9/calicoctl
```

Set the file to be executable.

```bash
chmod +x calicoctl
```

> **SECONDARY:** If the location of `calicoctl` is not already in your `PATH`, move the file to one that is or add its location to your `PATH`. This will allow you to invoke it without having to prepend its location.

**Tab: macOS**

Log into the host, open a terminal prompt, and navigate to the location where you want to install the binary.

> **SECONDARY:** Consider navigating to a location that's in your `PATH`. For example, `/usr/local/bin/`.

Use the following commands to download the `calicoctl` binary.

- ARM64 (Apple Silicon):

  ```bash
  curl -o calicoctl -L https://downloads.tigera.io/ee/binaries/v3.21.9/calicoctl-darwin-arm64
  ```

- AMD64 (Intel):

  ```bash
  curl -o calicoctl -L https://downloads.tigera.io/ee/binaries/v3.21.9/calicoctl-darwin-amd64
  ```

Set the file to be executable.

```bash
chmod +x calicoctl
```

> **SECONDARY:** If you get the error, `cannot be opened because the developer cannot be verified` when using `calicoctl` for the first time, go to `Applications > System Preferences > Security & Privacy` in the `General` tab at the bottom of the window click `Allow anyway`.

> **SECONDARY:** If the location of `calicoctl` is not already in your `PATH`, move the file to one that is or add its location to your `PATH`. This will allow you to invoke it without having to prepend its location.

**Tab: Windows**

Use the following PowerShell command to download the `calicoctl` binary.

> **SUCCESS:** Consider running PowerShell as administrator and navigating to a location that's in your `PATH`. For example, `C:\Windows`.

```bash
Invoke-WebRequest -Uri "https://downloads.tigera.io/ee/binaries/v3.21.9/calicoctl-windows-amd64.exe" -OutFile "calicoctl.exe"
```

<!-- /tabs -->

### Install calicoctl as a container on a single host

1. Ensure that you have the [`config.json` file with the private Tigera registry credentials](https://docs.tigera.io/calico-enterprise/3.21/getting-started/install-on-clusters/calico-enterprise.md#get-private-registry-credentials-and-license-key).

2. From a terminal prompt, use the following command to either create or open the `~/.docker/config.json` file.

   ```bash
   vi ~/.docker/config.json
   ```

3. Depending on the existing contents of the file, edit it in one of the following ways.

   - **New file**: Paste in the entire contents of the `config.json` file from Tigera.

   - **Existing file without quay.io object**: Add the following lines from the `config.json` inside the `"auth"` object.

     ```json
     "quay.io": {
       "auth": "<ROBOT-TOKEN-VALUE>",
       "email": ""
     }
     ```

   - **Existing file with quay.io object**: Add the following lines from the `config.json` inside the `"quay.io"` object.

     ```json
     "auth": "<ROBOT-TOKEN-VALUE>",
     "email": ""
     ```

4. Save and close the file.

5. Use the following commands to pull the `calicoctl` image from the Tigera registry.

   ```bash
   docker pull quay.io/tigera/calicoctl:v3.21.9
   ```

6. Confirm that the image has loaded by typing `docker images`.

   ```bash
   REPOSITORY                TAG               IMAGE ID       CREATED         SIZE
   tigera/calicoctl    v3.21.9            e07d59b0eb8a   2 minutes ago   42MB
   ```

**Next step**:

[Configure calicoctl to connect to your datastore](https://docs.tigera.io/calico-enterprise/3.21/operations/clis/calicoctl/configure.md).