--- title: "Mirantis Kubernetes Engine (MKE 3)" description: "Install Calico Enterprise on a Mirantis Kubernetes Engine (MKE) 3 cluster." product: "Calico Enterprise" version: "3.23 (latest)" section: "Install and upgrade" canonical_url: "https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/docker-enterprise" --- # Mirantis Kubernetes Engine (MKE 3) ## Big picture Install Calico Enterprise on a Mirantis Kubernetes Engine (MKE 3) cluster (formerly Docker Enterprise). ## Before you begin **CNI support** Calico CNI for networking with Calico Enterprise network policy: The geeky details of what you get: | Policy | IPAM | CNI | Overlay | Routing | Datastore | | ------ | ------ | ------ | ------- | ------- | ---------- | | Calico | Calico | Calico | IPIP | BGP | Kubernetes | ? **Required** - A [compatible MKE 3 cluster](https://docs.tigera.io/calico-enterprise/latest/getting-started/compatibility.md#mke) with: - A minimum of three nodes for non-production deployments - CNI flag set to unmanaged, `--unmanaged-cni` so MKE 3 does not install the default Calico Enterprise networking plugin For help, see [Docker Enterprise](https://docs.docker.com/), and [Docker EE Best Practices and Design Considerations](https://docs.mirantis.com/docker-enterprise/v3.0/dockeree-ref-arch/deploy-manage/best-practices-design.html) - To access the MKE 3 control plane via the CLI, you must download a Client Certificate Bundle from the web UI, which contains the necessary TLS certificates and environment scripts to authenticate kubectl and docker commands. For more information, see [Access an MKE cluster (Client Bundles)](https://docs.mirantis.com/mke/3.8/ops/access-cluster.html). - Configure MKE 3 to allow the service account `tigera-operator` to schedule CNI workloads on all nodes in the cluster. This can be done by executing the following command. Refer to the MKE 3 documentation around obtaining an admin bearer authentication token for making this call. ```bash curl -k -H "Authorization: Bearer " -X PUT https:///collectionGrants/system:serviceaccount:tigera-operator:tigera-operator/swarm/scheduler ``` Replace the following: - ``: The value of bearer admin token. - ``: The public IP for any manager node in the cluster. - Cluster meets [system requirements](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/requirements.md) - A [Tigera license key and credentials](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/calico-enterprise.md) - Install [Install kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/) ## How to - [Install Calico Enterprise](#install-calico-enterprise) - [Install the Calico Enterprise license](#install-the-calico-enterprise-license) ### Install Calico Enterprise 1. [Configure a storage class for Calico Enterprise](https://docs.tigera.io/calico-enterprise/latest/operations/logstorage/create-storage.md). 2. Configure Tigera Operator and Calico CNI plugin role bindings for Docker EE. ```bash kubectl create clusterrolebinding tigera-operator-cluster-admin -n tigera-operator \ --clusterrole cluster-admin --serviceaccount tigera-operator:tigera-operator kubectl create clusterrolebinding calico-cni-plugin-cluster-admin -n calico-system \ --clusterrole cluster-admin --serviceaccount calico-system:calico-cni-plugin ``` 3. Install the Tigera Operator and custom resource definitions. ```bash kubectl create -f https://downloads.tigera.io/ee/v3.23.2/manifests/operator-crds.yaml kubectl create -f https://downloads.tigera.io/ee/v3.23.2/manifests/tigera-operator.yaml ``` 4. Install the Prometheus operator and related custom resource definitions. The Prometheus operator will be used to deploy Prometheus server and Alertmanager to monitor Calico Enterprise metrics. > **SECONDARY:** If you have an existing Prometheus operator in your cluster that you want to use, skip this step. To work with Calico Enterprise, your Prometheus operator must be v0.40.0 or higher. ```bash kubectl create -f https://downloads.tigera.io/ee/v3.23.2/manifests/tigera-prometheus-operator.yaml ``` 5. Install your pull secret. If pulling images directly from `quay.io/tigera`, you will likely want to use the credentials provided to you by your Tigera support representative. If using a private registry, use your private registry credentials instead. ```bash kubectl create secret generic tigera-pull-secret \ --type=kubernetes.io/dockerconfigjson -n tigera-operator \ --from-file=.dockerconfigjson= ``` 6. Install any extra [Calico Enterprise resources](https://docs.tigera.io/calico-enterprise/latest/reference/resources.md) needed at cluster start using [calicoctl](https://docs.tigera.io/calico-enterprise/latest/reference/clis/calicoctl/overview.md). 7. Install the Tigera custom resources. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api.md). ```bash kubectl create -f https://downloads.tigera.io/ee/v3.23.2/manifests/custom-resources.yaml ``` Monitor progress with the following command: ```bash watch kubectl get tigerastatus ``` Wait until the `apiserver` shows a status of `Available`, then proceed to the next section. ### Install the Calico Enterprise license To use Calico Enterprise, you must install the license provided to you by Tigera. ```bash kubectl create -f ``` Monitor progress with the following command: ```bash watch kubectl get tigerastatus ``` ## Next steps **Recommended** - [Configure access to the Calico Enterprise web console](https://docs.tigera.io/calico-enterprise/latest/operations/cnx/access-the-manager.md) - [Authentication quickstart](https://docs.tigera.io/calico-enterprise/latest/operations/cnx/authentication-quickstart.md) - [Configure an external identity provider](https://docs.tigera.io/calico-enterprise/latest/operations/cnx/configure-identity-provider.md) **Recommended - Networking** - The default networking uses IP-in-IP with BGP routing. For all networking options, see [Determine best networking option](https://docs.tigera.io/calico-enterprise/latest/networking/determine-best-networking.md). **Recommended - Security** - [Get started with Calico Enterprise tiered network policy](https://docs.tigera.io/calico-enterprise/latest/network-policy/policy-tiers/tiered-policy.md)