--- title: "Amazon Elastic Kubernetes Service (EKS)" description: "Install the full Calico Enterprise stack — including observability, threat defense, and tiered policy — on an Amazon EKS cluster." product: "Calico Enterprise" version: "3.23 (latest)" section: "Install and upgrade" canonical_url: "https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/eks" --- # Amazon Elastic Kubernetes Service (EKS) ## Big picture Install Calico Enterprise on an EKS managed Kubernetes cluster. ## Before you begin **CNI support** - Calico CNI for networking with Calico Enterprise network policy The geeky details of what you get by default: | Policy | IPAM | CNI | Overlay | Routing | Datastore | | ------ | ------ | ------ | ------- | ------- | ---------- | | Calico | Calico | Calico | IPIP | BGP | Kubernetes | ? - AWS CNI networking with Calico Enterprise network policy The geeky details of what you get by default: | Policy | IPAM | CNI | Overlay | Routing | Datastore | | ------ | ---- | --- | ------- | ---------- | ---------- | | Calico | AWS | AWS | No | VPC Native | Kubernetes | ? **Required** - You have a [compatible EKS cluster](https://docs.tigera.io/calico-enterprise/latest/getting-started/compatibility.md#eks). - Your cluster meets the [system requirements](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/requirements.md). - You [disabled network policy for the AWS VPC CNI](https://docs.aws.amazon.com/eks/latest/userguide/network-policy-disable.html). - You have a [Tigera license key and credentials](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/calico-enterprise.md). - You [installed kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/) on your workstation. ## How to 1. [Option A: Install with Amazon VPC networking](#install-eks-with-amazon-vpc-networking) 2. [Option B: Install with Calico CNI networking](#install-eks-with-calico-networking) 3. [Install the Calico Enterprise license](#install-the-calico-enterprise-license) #### Install EKS with Amazon VPC networking 1. Install the Tigera Operator and custom resource definitions. ```text kubectl create -f https://downloads.tigera.io/ee/v3.23.2/manifests/operator-crds.yaml ``` ```text kubectl create -f https://downloads.tigera.io/ee/v3.23.2/manifests/tigera-operator.yaml ``` 2. Install the Prometheus operator and related custom resource definitions. The Prometheus operator will be used to deploy Prometheus server and Alertmanager to monitor Calico Enterprise metrics. > **SECONDARY:** > > If you have an existing Prometheus operator in your cluster that you want to use, skip this step. To work with Calico Enterprise, your Prometheus operator must be v0.40.0 or higher. ```text kubectl create -f https://downloads.tigera.io/ee/v3.23.2/manifests/tigera-prometheus-operator.yaml ``` 3. Install your pull secret. If pulling images directly from `quay.io/tigera`, you will likely want to use the credentials provided to you by your Tigera support representative. If using a private registry, use your private registry credentials instead. ```text kubectl create secret generic tigera-pull-secret \ --type=kubernetes.io/dockerconfigjson -n tigera-operator \ --from-file=.dockerconfigjson= ``` 4. Install any extra [Calico Enterprise resources](https://docs.tigera.io/calico-enterprise/latest/reference/resources.md) needed at cluster start using [calicoctl](https://docs.tigera.io/calico-enterprise/latest/reference/clis/calicoctl/overview.md). 5. Install the Tigera custom resources. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api.md). ```text kubectl create -f https://downloads.tigera.io/ee/v3.23.2/manifests/eks/custom-resources.yaml ``` You can now monitor progress with the following command: ```text watch kubectl get tigerastatus ``` Wait until the `apiserver` shows a status of `Available`, then proceed to [install the Calico Enterprise license](#install-the-calico-enterprise-license). #### Install EKS with Calico networking Calico Enterprise networking cannot currently be installed on the EKS control plane nodes. As a result the control plane nodes will not be able to initiate network connections to Calico Enterprise pods. (This is a general limitation of EKS's custom networking support, not specific to Calico Enterprise.) As a workaround, trusted pods that require control plane nodes to connect to them, such as those implementing admission controller webhooks, can include `hostNetwork:true` in their pod spec. See the Kubernetes API [pod spec](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#PodSpec) definition for more information on this setting. ##### Create an EKS cluster For these instructions, we will use `eksctl` to provision the cluster. However, you can use any of the methods in [Getting Started with Amazon EKS](https://docs.aws.amazon.com/eks/latest/userguide/getting-started.html) Before you get started, make sure you have downloaded and configured the [necessary prerequisites](https://docs.aws.amazon.com/eks/latest/userguide/getting-started-eksctl.html#eksctl-prereqs) 1. First, create an Amazon EKS cluster without any nodes. ```bash eksctl create cluster --name my-calico-cluster --without-nodegroup ``` 2. Since this cluster will use Calico Enterprise for networking, you must delete the `aws-node` daemon set to disable AWS VPC networking for pods. ```bash kubectl delete daemonset -n kube-system aws-node ``` ##### Install Calico Enterprise 1. [Configure a storage class for Calico Enterprise.](https://docs.tigera.io/calico-enterprise/latest/operations/logstorage/create-storage.md) 2. Install the Tigera Operator and custom resource definitions. ```text kubectl create -f https://downloads.tigera.io/ee/v3.23.2/manifests/operator-crds.yaml ``` ```text kubectl create -f https://downloads.tigera.io/ee/v3.23.2/manifests/tigera-operator.yaml ``` 3. Install the Prometheus operator and related custom resource definitions. The Prometheus operator will be used to deploy Prometheus server and Alertmanager to monitor Calico Enterprise metrics. > **SECONDARY:** > > If you have an existing Prometheus operator in your cluster that you want to use, skip this step. To work with Calico Enterprise, your Prometheus operator must be v0.40.0 or higher. ```text kubectl create -f https://downloads.tigera.io/ee/v3.23.2/manifests/tigera-prometheus-operator.yaml ``` 4. Install your pull secret. If pulling images directly from `quay.io/tigera`, you will likely want to use the credentials provided to you by your Tigera support representative. If using a private registry, use your private registry credentials instead. ```text kubectl create secret generic tigera-pull-secret \ --type=kubernetes.io/dockerconfigjson -n tigera-operator \ --from-file=.dockerconfigjson= ``` 5. Install any extra [Calico Enterprise resources](https://docs.tigera.io/calico-enterprise/latest/reference/resources.md) needed at cluster start using [calicoctl](https://docs.tigera.io/calico-enterprise/latest/reference/clis/calicoctl/overview.md). 6. To configure Calico Enterprise for use with the Calico CNI plugin, we must create an `Installation` resource that has `spec.cni.type: Calico`. Install the `custom-resources-calico-cni.yaml` manifest, which includes this configuration. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api.md). ```text kubectl create -f https://downloads.tigera.io/ee/v3.23.2/manifests/eks/custom-resources-calico-cni.yaml ``` 7. Finally, add nodes to the cluster. ```bash eksctl create nodegroup --cluster my-calico-cluster --node-type t3.xlarge --node-ami auto --max-pods-per-node 100 ``` > **Tip**: Without the `--max-pods-per-node` option above, EKS will limit the [number of pods based on node-type](https://github.com/awslabs/amazon-eks-ami/blob/main/nodeadm/internal/kubelet/eni-max-pods.txt). See `eksctl create nodegroup --help` for the full set of node group options. 8. Monitor progress with the following command: ```text watch kubectl get tigerastatus ``` Wait until the `apiserver` shows a status of `Available`, then proceed to the next section. #### Install the Calico Enterprise license In order to use Calico Enterprise, you must install the license provided to you by Tigera. ```text kubectl create -f ``` You can now monitor progress with the following command: ```text watch kubectl get tigerastatus ``` ## Next steps - [Configure access to the Calico Enterprise web console](https://docs.tigera.io/calico-enterprise/latest/operations/cnx/access-the-manager.md) **Recommended** - [Get started with Calico Enterprise network policy](https://docs.tigera.io/calico-enterprise/latest/network-policy/beginners/calico-network-policy.md) - [Enable default deny for Kubernetes pods](https://docs.tigera.io/calico-enterprise/latest/network-policy/beginners/kubernetes-default-deny.md)