---
title: "Google Kubernetes Engine (GKE)"
description: "Install the full Calico Enterprise stack — including observability, threat defense, and tiered policy — on a Google Kubernetes Engine (GKE) cluster."
product: "Calico Enterprise"
version: "3.23 (latest)"
section: "Install and upgrade"
canonical_url: "https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/gke"
---

# Google Kubernetes Engine (GKE)

## Big picture

Install Calico Enterprise on a GKE managed Kubernetes cluster.

## Before you begin

**CNI support**

GKE CNI with Calico Enterprise network policy:

The geeky details of what you get:

| Policy | IPAM       | CNI | Overlay | Routing    | Datastore  |
| ------ | ---------- | --- | ------- | ---------- | ---------- |
| Calico | Host Local | GKE | No      | VPC Native | Kubernetes |

?

**Required**

- A [compatible GKE cluster](https://docs.tigera.io/calico-enterprise/latest/getting-started/compatibility.md#gke)

- Cluster has these Networking settings:

  - Intranode visibility is enabled
  - Network policy is disabled

* Dataplane V2 is disabled

- GKE control plane access to TCP ports 5443, 8080 and 9090 The GKE control plane must be able to access the Calico Enterprise API server which runs with pod networking on TCP ports 5443 and 8080, and the Calico Enterprise Prometheus server which runs with pod networking on TCP port 9090. For multi-zone clusters and clusters with the "master IP range" configured, you will need to add a GCP firewall rule to allow access to those ports from the control plane nodes.

- User account has IAM permissions

  Verify your user account has IAM permissions to create Kubernetes ClusterRoles, ClusterRoleBindings, Deployments, Service Accounts, and Custom Resource Definitions. The easiest way to grant permissions is to assign the "Kubernetes Service Cluster Admin Role” to your user account. For help, see [GKE access control](https://docs.cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control).

  > **SECONDARY:** By default, GCP users often have permissions to create basic Kubernetes resources (such as Pods and Services) but lack the permissions to create ClusterRoles and other admin resources. Even if you can create basic resources, it's worth verifying that you can create admin resources before continuing.

- Cluster meets [system requirements](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/requirements.md)

- A [Tigera license key and credentials](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/calico-enterprise.md#get-private-registry-credentials-and-license-key)

- [Install kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/)

## How to

1. Install Calico Enterprise
2. Install the Calico Enterprise license

#### Install Calico Enterprise

1. Install the Tigera Operator and custom resource definitions.

   ```text
   kubectl create -f https://downloads.tigera.io/ee/v3.23.2/manifests/operator-crds.yaml
   ```

   ```text
   kubectl create -f https://downloads.tigera.io/ee/v3.23.2/manifests/tigera-operator.yaml
   ```

2. Install the Prometheus operator and related custom resource definitions. The Prometheus operator will be used to deploy Prometheus server and Alertmanager to monitor Calico Enterprise metrics.

   > **SECONDARY:**
   >
   > If you have an existing Prometheus operator in your cluster that you want to use, skip this step. To work with Calico Enterprise, your Prometheus operator must be v0.40.0 or higher.

   ```text
   kubectl create -f https://downloads.tigera.io/ee/v3.23.2/manifests/tigera-prometheus-operator.yaml
   ```

3. Install your pull secret.

   If pulling images directly from `quay.io/tigera`, you will likely want to use the credentials provided to you by your Tigera support representative. If using a private registry, use your private registry credentials instead.

   ```text
   kubectl create secret generic tigera-pull-secret \
       --type=kubernetes.io/dockerconfigjson -n tigera-operator \
       --from-file=.dockerconfigjson=<path/to/pull/secret>
   ```

4. Install any extra [Calico resources](https://docs.tigera.io/calico-enterprise/latest/reference/resources.md) needed at cluster start using [calicoctl](https://docs.tigera.io/calico-enterprise/latest/reference/clis/calicoctl/overview.md).

5. Install the Tigera custom resources. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api.md).

   ```text
   kubectl create -f https://downloads.tigera.io/ee/v3.23.2/manifests/custom-resources.yaml
   ```

   You can now monitor progress with the following command:

   ```text
   watch kubectl get tigerastatus
   ```

   Wait until the `apiserver` shows a status of `Available`, then proceed to the next section.

#### Install the Calico Enterprise license

In order to use Calico Enterprise, you must install the license provided to you by Tigera.

```text
kubectl create -f </path/to/license.yaml>
```

You can now monitor progress with the following command:

```text
watch kubectl get tigerastatus
```

## Next steps

- [Configure access to the Calico Enterprise web console](https://docs.tigera.io/calico-enterprise/latest/operations/cnx/access-the-manager.md)
- [Get started with Kubernetes network policy](https://docs.tigera.io/calico-enterprise/latest/network-policy/get-started/kubernetes-network-policy.md)
- [Get started with Calico Enterprise network policy](https://docs.tigera.io/calico-enterprise/latest/network-policy/beginners/calico-network-policy.md)
- [Enable default deny for Kubernetes pods](https://docs.tigera.io/calico-enterprise/latest/network-policy/beginners/kubernetes-default-deny.md)