--- title: "Install Calico Enterprise on OpenShift" description: "Install Calico Enterprise on a self-managed OpenShift 4 cluster using the Tigera Operator." product: "Calico Enterprise" version: "3.23 (latest)" section: "Install and upgrade" canonical_url: "https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/openshift/installation" --- # Install Calico Enterprise on OpenShift ## Big picture Install an OpenShift 4 cluster with Calico Enterprise. This guide augments the applicable steps in the [OpenShift documentation](https://docs.redhat.com/en/documentation/openshift_container_platform/) to install Calico Enterprise. ## Before you begin **CNI support** Calico CNI for networking with Calico Enterprise network policy The geeky details of what you get: | Policy | IPAM | CNI | Overlay | Routing | Datastore | | ------ | ------ | ------ | ------- | ------- | ---------- | | Calico | Calico | Calico | VXLAN | Calico | Kubernetes | ? **Required** - A [compatible OpenShift cluster](https://docs.tigera.io/calico-enterprise/latest/getting-started/compatibility.md#openshift) Your environment meets the Calico Enterprise [system requirements](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/openshift/requirements.md) - A [RedHat account](https://cloud.redhat.com/) for the pull secret to provision an OpenShift cluster. - OpenShift command line interface from [cloud.redhat.com](https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/installing_on_aws/installer-provisioned-infrastructure) - Cluster meets the Calico Enterprise [system requirements](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/openshift/requirements.md) - **If installing on AWS**, a [configured AWS account](https://docs.openshift.com/container-platform/4.2/installing/installing_aws/installing-aws-account.html) appropriate for OpenShift 4, and have [set up your AWS credentials](https://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/setup-credentials.html). Note that the OpenShift installer supports a subset of [AWS regions](https://docs.openshift.com/container-platform/4.3/installing/installing_aws/installing-aws-account.html#installation-aws-regions_installing-aws-account). - OpenShift installer and OpenShift command line interface from [docs.redhat.com](https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/installing_on_aws/installer-provisioned-infrastructure) - A [generated a local SSH private key](https://docs.openshift.com/container-platform/4.1/installing/installing_aws/installing-aws-default.html#ssh-agent-using_installing-aws-default) that is added to your ssh-agent - A [Tigera license key and credentials](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/calico-enterprise.md) ## How to 1. [Create a configuration file for the OpenShift installer](#create-a-configuration-file-for-the-openshift-installer) 2. [Update the configuration file to use Calico Enterprise](#update-the-configuration-file-to-use-calico-enterprise) 3. [Generate the install manifests](#generate-the-install-manifests) 4. [Add an image pull secret](#add-an-image-pull-secret) 5. [Provide additional configuration](#provide-additional-configuration) 6. [Create the cluster](#create-the-cluster) 7. [Create a storage class](#create-a-storage-class) 8. [Install the Calico Enterprise license](#install-the-calico-enterprise-license) #### Create a configuration file for the OpenShift installer First, create a staging directory for the installation. This directory will contain the configuration file, along with cluster state files, that OpenShift installer will create: ```text mkdir openshift-tigera-install && cd openshift-tigera-install ``` Now run OpenShift installer to create a default configuration file: ```text openshift-install create install-config ``` > **SECONDARY:** > > See the > > [OpenShift installer documentation](https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/installation_overview/ocp-installation-overview) > > for more information about the installer and any configuration changes required for your platform. After the installer finishes, your staging directory will contain the configuration file `install-config.yaml`. #### Update the configuration file to use Calico Enterprise Override the OpenShift networking to use Calico Enterprise and update the AWS instance types to meet the [system requirements](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/openshift/requirements.md): ```bash sed -i 's/\(OpenShiftSDN\|OVNKubernetes\)/Calico/' install-config.yaml ``` > **SECONDARY:** By default openshift-installer creates 3 replicas, you can change these settings by modifying the cloud-provider part in the install-config.yaml > > The following example changes the default deployment instance type and replica quantity. > > install-config.yaml > > ```yaml > ... > platform: > aws: > type: m5.xlarge > replicas: 2 > ... > ``` #### Generate the install manifests Now generate the Kubernetes manifests using your configuration file: ```bash openshift-install create manifests ``` > **SECONDARY:** For OpenShift **v4.16 or newer** on **AWS**, configure AWS security groups to allow BGP, typha and IP-in-IP encapsulation traffic by editing the OpenShift cluster-api manifests. > > Edit `spec.network.cni.cniIngressRules` in the `cluster-api/02_infra-cluster.yaml` file to add > > ```yaml > cniIngressRules: > (...) > - description: BGP (calico) > fromPort: 179 > protocol: tcp > toPort: 179 > - description: IP-in-IP (calico) > fromPort: -1 > protocol: "4" > toPort: -1 > - description: Typha (calico) > fromPort: 5473 > protocol: tcp > toPort: 5473 > ``` Download the Calico Enterprise manifests for OpenShift and add them to the generated manifests directory: ```bash mkdir calico wget -qO- https://downloads.tigera.io/ee/v3.23.2/manifests/ocp.tgz | tar xvz --strip-components=1 -C calico cp calico/* manifests/ ``` #### Add an image pull secret Update the contents of the secret with the image pull secret provided to you by Tigera support representative. For example, if the secret is located at `~/.docker/config.json`, run the following commands. ```text SECRET=$(cat ~/.docker/config.json | tr -d '\n\r\t ' | base64 -w 0) sed -i "s/SECRET/${SECRET}/" manifests/02-pull-secret.yaml ``` #### Provide additional configuration To provide additional configuration during installation (for example, BGP configuration or peers), use a Kubernetes ConfigMap with your desired Calico Enterprise resources. If you do not need to provide additional configuration, skip this section. To include [Calico Enterprise resources](https://docs.tigera.io/calico-enterprise/latest/reference/resources.md) during installation, edit `manifests/02-configmap-calico-resources.yaml` in order to add your own configuration. > **SECONDARY:** If you have a directory with the Calico Enterprise resources, you can create the file with the command: > > ```text > kubectl create configmap -n tigera-operator calico-resources \ > --from-file= --dry-run -o yaml \ > > manifests/02-configmap-calico-resources.yaml > ``` > > With recent versions of `kubectl` it is necessary to have a kubeconfig configured or add `--server='127.0.0.1:443'` even though it is not used. > **SECONDARY:** If you have provided a `calico-resources` configmap and the tigera-operator pod fails to come up with `Init:CrashLoopBackOff`, check the output of the init-container with `kubectl logs -n tigera-operator -l k8s-app=tigera-operator -c create-initial-resources`. #### Create the cluster Start the cluster creation with the following command and wait for it to complete. ```text openshift-install create cluster ``` #### Create a storage class Calico Enterprise requires storage for logs and reports. Before finishing the installation, you must [create a StorageClass for Calico Enterprise](https://docs.tigera.io/calico-enterprise/latest/operations/logstorage/create-storage.md). #### Install the Calico Enterprise license In order to use Calico Enterprise, you must install the license provided to you by a Tigera support representative. Before applying the license, wait until the Tigera API server is ready with the following command: ```text watch oc get tigerastatus ``` Wait until the `apiserver` shows a status of `Available`. After the Tigera API server is ready, apply the license: ```text oc create -f ``` #### Install Calico Enterprise resources Apply the custom resources for enterprise features. ```bash oc create -f https://downloads.tigera.io/ee/v3.23.2/manifests/ocp/tigera-enterprise-resources.yaml ``` Apply the Calico Enterprise manifests for the Prometheus operator. > **SECONDARY:** > > Complete this step only if you are using the Calico Enterprise Prometheus operator (including adding your own Prometheus operator). Skip this step if you are using > > [BYO Prometheus](https://docs.tigera.io/calico-enterprise/latest/operations/monitor/prometheus/support.md) > > that you manage yourself. ```bash oc create -f https://downloads.tigera.io/ee/v3.23.2/manifests/ocp/tigera-prometheus-operator.yaml ``` You can now monitor progress with the following command: ```text watch oc get tigerastatus ``` When it shows all components with status `Available`, proceed to the next step. (Optional) Apply the full CRDs including descriptions. ```bash oc apply --server-side --force-conflicts -f https://downloads.tigera.io/ee/v3.23.2/manifests/operator-crds.yaml ``` ## Next steps **Recommended** - [Configure access to the Calico Enterprise web console](https://docs.tigera.io/calico-enterprise/latest/operations/cnx/access-the-manager.md) - [Authentication quickstart](https://docs.tigera.io/calico-enterprise/latest/operations/cnx/authentication-quickstart.md) - [Configure your own identity provider](https://docs.tigera.io/calico-enterprise/latest/operations/cnx/configure-identity-provider.md) **Recommended - Networking** - The default networking uses IP in IP encapsulation with BGP routing. For all networking options, see [Determine best networking option](https://docs.tigera.io/calico-enterprise/latest/networking/determine-best-networking.md). **Recommended - Security** - [Get started with Calico Enterprise tiered network policy](https://docs.tigera.io/calico-enterprise/latest/network-policy/policy-tiers/tiered-policy.md)