--- title: "Microsoft Azure Kubernetes Service (AKS)" description: "Install Calico Enterprise on an Azure Kubernetes Service (AKS) cluster, including the steps that differ from a self-managed install." product: "Calico Enterprise" version: "3.23 (latest)" section: "Install and upgrade" canonical_url: "https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/aks" --- # Microsoft Azure Kubernetes Service (AKS) ## Big picture Install Calico Enterprise on an AKS managed Kubernetes cluster. ## Before you begin **CNI support** - Calico CNI for networking with Calico Enterprise network policy The geeky details of what you get: | Policy | IPAM | CNI | Overlay | Routing | Datastore | | ------ | ------ | ------ | ------- | ------- | ---------- | | Calico | Calico | Calico | VXLAN | Calico | Kubernetes | ? - Azure CNI networking with Calico Enterprise network policy The geeky details of what you get: | Policy | IPAM | CNI | Overlay | Routing | Datastore | | ------ | ----- | ----- | ------- | ---------- | ---------- | | Calico | Azure | Azure | No | VPC Native | Kubernetes | ? - Azure CNI with overlay networking with Calico Enterprise network policy The geeky details of what you get: | Policy | IPAM | CNI | Overlay | Routing | Datastore | | ------ | ----- | ----- | ------- | ---------- | ---------- | | Calico | Azure | Azure | Yes | VPC Native | Kubernetes | ? **Recommended** - Set suggested value for maximum number of pods per node It is recommended to set the maximum pods per node to be at least 60 for use with Calico Enterprise. The default value in AKS is 30. If you need to increase the number of pods per node, see [Configure maximum pods per node](https://docs.microsoft.com/en-us/azure/aks/configure-azure-cni#configure-maximum-pods-per-node). **Required** - A [compatible AKS cluster](https://docs.tigera.io/calico-enterprise/latest/getting-started/compatibility.md#aks) - To use the Calico CNI, you must configure the AKS cluster with [Bring your own CNI](https://docs.microsoft.com/en-us/azure/aks/use-byo-cni?tabs=azure-cli) - To use the Azure CNI, see [Azure CNI networking](https://docs.microsoft.com/en-us/azure/aks/configure-azure-cni) - To use the Azure CNI with overlay networking, see [Azure CNI with Overlay](https://learn.microsoft.com/en-us/azure/aks/azure-cni-overlay) - Cluster is not using a Kubernetes reconciler If your cluster has an existing version of Calico Enterprise installed, verify that the cluster is not managed by any kind of Kubernetes reconciler. For example, if the `addon-manager` component exists, there will be an annotation called, `addonmanager.kubernetes.io/mode` on either of the following resources (if the resources exist): - `tigera-operator` deployment in the `tigera-operator` namespace - `calico-node` daemonset in the `kube-system` namespace - User account has IAM permissions Verify your user account has IAM permissions to create Kubernetes ClusterRoles, ClusterRoleBindings, Deployments, Service Accounts, and Custom Resource Definitions. The easiest way to grant permissions is to assign the "Kubernetes Service Cluster Admin Role” to your user account. For help, see [AKS access control](https://docs.microsoft.com/en-us/azure/aks/control-kubeconfig-access). - Cluster meets [system requirements](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/requirements.md) - A [Tigera license key and credentials](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/calico-enterprise.md) - [Install kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/) 1. [Option A: Install with Azure CNI networking](#install-aks-with-azure-cni-networking) 2. [Option B: Install with Calico networking](#install-aks-with-calico-enterprise-networking) 3. [Install the Calico Enterprise license](#install-the-calico-enterprise-license) #### Install with Azure CNI networking 1. Install the Tigera Operator and custom resource definitions. ```text kubectl create -f https://downloads.tigera.io/ee/v3.23.2/manifests/operator-crds.yaml ``` ```text kubectl create -f https://downloads.tigera.io/ee/v3.23.2/manifests/tigera-operator.yaml ``` 2. Install the Prometheus operator and related custom resource definitions. The Prometheus operator will be used to deploy Prometheus server and Alertmanager to monitor Calico Enterprise metrics. > **SECONDARY:** > > If you have an existing Prometheus operator in your cluster that you want to use, skip this step. To work with Calico Enterprise, your Prometheus operator must be v0.40.0 or higher. ```text kubectl create -f https://downloads.tigera.io/ee/v3.23.2/manifests/tigera-prometheus-operator.yaml ``` 3. Install your pull secret. If pulling images directly from `quay.io/tigera`, you will likely want to use the credentials provided to you by your Tigera support representative. If using a private registry, use your private registry credentials instead. ```text kubectl create secret generic tigera-pull-secret \ --type=kubernetes.io/dockerconfigjson -n tigera-operator \ --from-file=.dockerconfigjson= ``` 4. Install any extra [Calico Enterprise resources](https://docs.tigera.io/calico-enterprise/latest/reference/resources.md) needed at cluster start using [calicoctl](https://docs.tigera.io/calico-enterprise/latest/reference/clis/calicoctl/overview.md). 5. Install the Tigera custom resources. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api.md). ```text kubectl create -f https://downloads.tigera.io/ee/v3.23.2/manifests/aks/custom-resources.yaml ``` You can now monitor progress with the following command: ```text watch kubectl get tigerastatus ``` Wait until the `apiserver` shows a status of `Available`, then proceed to [install the Calico Enterprise license](#install-the-calico-enterprise-license). #### Install with Calico Enterprise networking 1. [Configure a storage class for Calico Enterprise](https://docs.tigera.io/calico-enterprise/latest/operations/logstorage/create-storage.md). 2. Install the Tigera Operator and custom resource definitions. ```text kubectl create -f https://downloads.tigera.io/ee/v3.23.2/manifests/operator-crds.yaml ``` ```text kubectl create -f https://downloads.tigera.io/ee/v3.23.2/manifests/tigera-operator.yaml ``` 3. Install the Prometheus operator and related custom resource definitions. The Prometheus operator will be used to deploy Prometheus server and Alertmanager to monitor Calico Enterprise metrics. > **SECONDARY:** > > If you have an existing Prometheus operator in your cluster that you want to use, skip this step. To work with Calico Enterprise, your Prometheus operator must be v0.40.0 or higher. ```text kubectl create -f https://downloads.tigera.io/ee/v3.23.2/manifests/tigera-prometheus-operator.yaml ``` 4. Install your pull secret. If pulling images directly from `quay.io/tigera`, you will likely want to use the credentials provided to you by your Tigera support representative. If using a private registry, use your private registry credentials instead. ```text kubectl create secret generic tigera-pull-secret \ --type=kubernetes.io/dockerconfigjson -n tigera-operator \ --from-file=.dockerconfigjson= ``` 5. Install any extra [Calico Enterprise resources](https://docs.tigera.io/calico-enterprise/latest/reference/resources.md) needed at cluster start using [calicoctl](https://docs.tigera.io/calico-enterprise/latest/reference/clis/calicoctl/overview.md). 6. Install the Tigera custom resources. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api.md). ```text kubectl create -f https://downloads.tigera.io/ee/v3.23.2/manifests/aks/custom-resources-calico-cni.yaml ``` You can now monitor progress with the following command: ```text watch kubectl get tigerastatus ``` Wait until the `apiserver` shows a status of `Available`, then proceed to [install the Calico Enterprise license](#install-the-calico-enterprise-license). #### Install the Calico Enterprise license In order to use Calico Enterprise, you must install the license provided to you by Tigera. ```text kubectl create -f ``` You can now monitor progress with the following command: ```text watch kubectl get tigerastatus ``` ## Next steps - [Configure access to the Calico Enterprise web console](https://docs.tigera.io/calico-enterprise/latest/operations/cnx/access-the-manager.md) - [Get started with Kubernetes network policy](https://docs.tigera.io/calico-enterprise/latest/network-policy/get-started/kubernetes-network-policy.md) - [Get started with Calico Enterprise network policy](https://docs.tigera.io/calico-enterprise/latest/network-policy/beginners/calico-network-policy.md) - [Enable default deny for Kubernetes pods](https://docs.tigera.io/calico-enterprise/latest/network-policy/beginners/kubernetes-default-deny.md)