--- title: "kOps on AWS" description: "Install Calico Enterprise on a self-managed Kubernetes cluster provisioned with kOps on Amazon Web Services." product: "Calico Enterprise" version: "3.23 (latest)" section: "Install and upgrade" canonical_url: "https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/aws" --- # kOps on AWS ## Big picture Install Calico Enterprise with a self-managed Kubernetes cluster using Kubernetes Operations (kOps) on AWS. kOps is a cluster management tool that provisions cluster VMs and installs Kubernetes. It is a good default choice for most because it gives you access to all Calico Enterprise [flexible and powerful networking features](https://docs.tigera.io/calico-enterprise/latest/networking.md). However, other options may work better for your environment. ## Before you begin **CNI support** - Calico CNI for networking with Calico Enterprise network policy The geeky details of what you get: | Policy | IPAM | CNI | Overlay | Routing | Datastore | | ------ | ------ | ------ | ------- | ------- | ---------- | | Calico | Calico | Calico | IPIP | BGP | Kubernetes | ? - AWS VPC CNI for networking with Calico Enterprise network policy The geeky details of what you get: | Policy | IPAM | CNI | Overlay | Routing | Datastore | | ------ | ---- | --- | ------- | ---------- | ---------- | | Calico | AWS | AWS | No | VPC Native | Kubernetes | ? **Required** - A [compatible kOps cluster](https://docs.tigera.io/calico-enterprise/latest/getting-started/compatibility.md#kops-on-aws) - A [Tigera license key and credentials](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/calico-enterprise.md) - Cluster meets [system requirements](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/requirements.md) - [Install kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/) - [Install AWS CLI tools](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-install.html) ## How to Select one of the following installation paths: - [Install Calico Enterprise networking and network policy](#install-calico-enterprise-networking-and-network-policy) - [Install Amazon VPC networking with Calico Enterprise network policy](#install-amazon-vpc-networking-with-calico-enterprise-network-policy) ### Install Calico Enterprise networking and network policy To use kOps to create a cluster with Calico Enterprise networking and network policy: 1. [Install kOps](https://kops.sigs.k8s.io/install/) on your workstation. 2. [Set up your environment for AWS](https://kops.sigs.k8s.io/getting_started/aws/) . 3. Be sure to [set up an S3 state store](https://kops.sigs.k8s.io/getting_started/aws/#cluster-state-storage) and export its name: ```bash export KOPS_STATE_STORE=s3:// ``` 4. Configure kOps to use Calico Enterprise for networking. Create a cluster with kOps using the `--networking cni` flag. For example: ```text kops create cluster \ --zones us-west-2a \ --networking cni \ ``` > **SECONDARY:** The name of the cluster must be chosen as a valid DNS name belonging to the root user. It can either be a subdomain of an existing domain name or a subdomain which can be configured on AWS Route 53 service. Or, you can add `cni` to your cluster config. Run `kops update cluster --name=` and set the following networking configuration. ```yaml networking: cni: {} ``` > **SECONDARY:** Setting the `--networking cni` flag delegates the installation of the CNI to the user for a later stage. 5. The provisioned kOps cluster will assign its own set of pod network CIDR in the kube-proxy instance different than the one Calico Enterprise expects. To set the cluster cidr for the kube-proxy to match the one expected by Calico Enterprise edit the cluster config `kops edit cluster ` and add the `kubeProxy` config with the `clusterCIDR` expected by the default Calico Enterprise installation. ```yaml spec: ... kubeProxy: clusterCIDR: 192.168.0.0/16 ``` > **SECONDARY:** For more advanced pod networking CIDR configuration, the requirement is to have `ipPools` CIDR set by the Calico Enterprise installation to match cluster CIDR set in kube-proxy. Calico's `ipPools` setting is obtainable in the Installation resource `kubectl get installation -o yaml` and can be configured by editing the operator manifest found in the [install instructions for Calico Enterprise](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/kubernetes/generic-install.md). 6. The default size of the provisioned instance groups for the cluster might not be sufficient for the full installation of kubernetes and Calico Enterprise. To increase the size of the instance groups run `kops edit ig --name ` and edit the following fields accordingly. ```yaml spec: ... machineType: t3.medium maxSize: 1 minSize: 1 ``` The name of the instance groups can be obtained from `kops get instancegroups --name `. 7. Once your cluster has been configured run `kops update cluster --name=` to preview the changes. Then the same command with `--yes` option (ie. `kops update cluster --name= --yes`) to commit the changes to AWS to create the cluster. It may take 10 to 15 minutes for the cluster to be fully created. > **SECONDARY:** Once the cluster has been created, the `kubectl` command should be pointing to the newly created cluster. By default `kops>=1.19` does not update `kubeconfig` to include the cluster certificates, accesses to the cluster through `kubectl` must be configured. 8. Validate that nodes are created. ```bash kubectl get nodes ``` The above should return the status of the nodes in the `Not Ready` state. 9. kOps does not install any CNI when the flag `--networking cni` or `spec.networking: cni {}` is used. In this case the user is expected to install the CNI separately. To Install Calico Enterprise follow the [install instructions for Calico Enterprise](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/kubernetes/generic-install.md). 10. Finally, to delete your cluster once finished, run `kops delete cluster --yes`. You can further customize the Calico Enterprise install with [options listed in the kOps documentation](https://kops.sigs.k8s.io/networking/#calico-example-for-cni-and-network-policy). ### Install Amazon VPC networking with Calico Enterprise network policy You can use Amazon’s VPC CNI plugin for networking, and Calico Enterprise for network policy. The advantage of this approach is that pods are assigned IP addresses associated with Elastic Network Interfaces on worker nodes. The IPs come from the VPC network pool, and therefore do not require NAT to access resources outside the Kubernetes cluster. Set your kOps cluster configuration to: ```yaml networking: amazonvpc: {} ``` After the cluster is up and ready, [Install Calico Enterprise](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/kubernetes/generic-install.md). ## Next steps - [Try out Calico Enterprise network policy](https://docs.tigera.io/calico-enterprise/latest/network-policy/beginners/calico-network-policy.md)