---
title: "Helm"
description: "Install Calico Enterprise on a Kubernetes cluster using the Helm 3 package manager."
product: "Calico Enterprise"
version: "3.23 (latest)"
section: "Install and upgrade"
canonical_url: "https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/kubernetes/helm"
---

# Helm

## Big picture

Install Calico Enterprise on a Kubernetes cluster using Helm 3.

## Value

Helm charts are a way to package up an application for Kubernetes (similar to `apt` or `yum` for operating systems). Helm is also used by tools like ArgoCD to manage applications in a cluster, taking care of install, upgrade (and rollback if needed), etc.

## Before you begin

**Required**

- Install Helm 3
- `kubeconfig` is configured to work with your cluster (check by running `kubectl get nodes`)
- [Credentials for the Tigera private registry and a license key](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/calico-enterprise.md)

## Concepts

### Operator based installation

In this guide, you install the Tigera Calico operator and custom resource definitions using the Helm 3 chart. The Tigera Operator provides lifecycle management for Calico Enterprise exposed via the Kubernetes API defined as a custom resource definition.

## How to

### Download the Helm chart

```bash
helm repo add tigera-ee https://downloads.tigera.io/ee/charts
helm repo update
helm pull tigera-ee/tigera-operator --version v3.23.2
helm pull tigera-ee/crd.projectcalico.org.v1 --version v3.23.2
```

### Prepare the Installation Configuration

You **must** provide the desired configuration for your cluster via the `values.yaml`, otherwise installation will use the default settings based on the auto-detected provider. The configurations you need to provide depends on your cluster's settings and your desired state.

Some important configurations you might need to provide to the installer (via `values.yaml`) includes (but not limited to): *kubernetesProvider*, *cni type*, or if you need to customize *TLS certificates*.

Here are some examples for updating `values.yaml` with your configurations:

Example 1. Providing `kubernetesProvider`: if you are installing on a cluster installed by EKS, set the `kubernetesProvider` as described in the [Installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api.md#provider)

```bash
echo '{ installation: {kubernetesProvider: EKS }}' > values.yaml
```

Example 2. Providing custom settings in `values.yaml` for Azure AKS cluster with no Kubernetes CNI pre-installed:

```bash
cat > values.yaml <<EOF
installation:
  kubernetesProvider: AKS
  cni:
    type: Calico
  calicoNetwork:
    bgp: Disabled
    ipPools:
    - cidr: 10.244.0.0/16
      encapsulation: VXLAN
EOF
```

For more information about configurable options via `values.yaml` please see [Helm installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/helm_customization.md).

### Install Calico Enterprise

Standalone is a standard Kubernetes cluster.

To install a standard Calico Enterprise cluster with Helm:

1. [Configure a storage class for Calico Enterprise](https://docs.tigera.io/calico-enterprise/latest/operations/logstorage/create-storage.md).

2. Optional: Compliance and packetcapture features are optional. To enable these features, review the `values.yaml` file and set the flag to `enabled: true`. In the next step, use this modified `values.yaml` for the Helm install.

   ```bash
   helm show values ./tigera-operator-v3.23.2-0.tgz >values.yaml
   ```

3. Install the necessary custom resource definitions.

   ```bash
   helm template calico-crds crd.projectcalico.org.v1-v3.23.2-0.tgz | kubectl apply --server-side -f -
   ```

4. Install the Tigera Operator using the Helm 3 chart:

   ```bash
   helm install calico-enterprise tigera-operator-v3.23.2-0.tgz \
   --set-file imagePullSecrets.tigera-pull-secret=<path/to/pull/secret>,tigera-prometheus-operator.imagePullSecrets.tigera-pull-secret=<path/to/pull/secret> \
   --set-file licenseKeyContent=<path/to/license/file/yaml> \
   --namespace tigera-operator \
   --create-namespace
   ```

   or if you created a `values.yaml` above:

   ```bash
   helm install calico-enterprise tigera-operator-v3.23.2-0.tgz -f values.yaml \
   --set-file imagePullSecrets.tigera-pull-secret=<path/to/pull/secret>,tigera-prometheus-operator.imagePullSecrets.tigera-pull-secret=<path/to/pull/secret> \
   --set-file licenseKeyContent=<path/to/license/file/yaml> \
   --namespace tigera-operator \
   --create-namespace
   ```

5. You can now monitor progress with the following command:

   ```bash
   watch kubectl get tigerastatus
   ```

   Congratulations! You have now installed Calico Enterprise using the Helm 3 chart.

## Next steps

**Multicluster Management**

- [Create a Calico Enterprise management cluster](https://docs.tigera.io/calico-enterprise/latest/multicluster/set-up-multi-cluster-management/standard-install/create-a-management-cluster.md)
- [Create a Calico Enterprise managed cluster](https://docs.tigera.io/calico-enterprise/latest/multicluster/set-up-multi-cluster-management/standard-install/create-a-managed-cluster.md)

**Recommended**

- [Configure access to the Calico Enterprise web console](https://docs.tigera.io/calico-enterprise/latest/operations/cnx/access-the-manager.md)
- [Authentication quickstart](https://docs.tigera.io/calico-enterprise/latest/operations/cnx/authentication-quickstart.md)
- [Configure your own identity provider](https://docs.tigera.io/calico-enterprise/latest/operations/cnx/configure-identity-provider.md)

**Recommended - Networking**

- The default networking is IP in IP encapsulation using BGP routing. For all networking options, see [Determine best networking option](https://docs.tigera.io/calico-enterprise/latest/networking/determine-best-networking.md).

**Recommended - Security**

- [Get started with Calico Enterprise tiered network policy](https://docs.tigera.io/calico-enterprise/latest/network-policy/policy-tiers/tiered-policy.md)