---
title: "Rancher Kubernetes Engine (RKE)"
description: "Install Calico Enterprise on a Rancher Kubernetes Engine (RKE) cluster."
product: "Calico Enterprise"
version: "3.23 (latest)"
section: "Install and upgrade"
canonical_url: "https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/rancher"
---

# Rancher Kubernetes Engine (RKE)

## Big picture

Install Calico Enterprise on RKE.

## Before you begin

**CNI support**

Calico CNI for networking with Calico Enterprise network policy:

The geeky details of what you get:

| Policy | IPAM   | CNI    | Overlay | Routing | Datastore  |
| ------ | ------ | ------ | ------- | ------- | ---------- |
| Calico | Calico | Calico | IPIP    | BGP     | Kubernetes |

?

**Required**

- A [compatible RKE cluster](https://docs.tigera.io/calico-enterprise/latest/getting-started/compatibility.md#rke)

  For help, see [Rancher Kubernetes Engine cluster](https://rancher.com/docs/rke/latest/en/). Note that RKE2 is a different Kubernetes distribution and [documented separately](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/rke2.md).

- Configure your cluster for Calico Enterprise CNI

  - Create a [Cluster Config File](https://rke.docs.rancher.com/example-yamls). In the config file under `network`, set the [network plugin](https://rancher.com/docs/rke/latest/en/config-options/add-ons/network-plugins/) to `plugin: none`.

  > **SECONDARY:** You cannot use the Rancher UI to set the RKE CNI set to "none".

- Cluster meets [system requirements](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/requirements.md)

- A [Tigera license key and credentials](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/calico-enterprise.md).

- A `kubectl` environment with access to your cluster

  - Use [Rancher kubectl Shell](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/manage-clusters/access-clusters/use-kubectl-and-kubeconfig#accessing-clusters-with-kubectl-shell-in-the-rancher-ui) for access
  - Ensure you have the [kubeconfig file that was generated when you created the cluster](https://rancher.com/docs/rke/latest/en/installation/#save-your-files).

- If using a kubeconfig file locally, [install and set up the Kubectl CLI tool](https://kubernetes.io/docs/tasks/tools/install-kubectl/).

## How to

- [Install Calico Enterprise](#install-calico-enterprise)
- [Install the Calico Enterprise license](#install-the-calico-enterprise-license)

### Install Calico Enterprise

1. [Configure a storage class for Calico Enterprise.](https://docs.tigera.io/calico-enterprise/latest/operations/logstorage/create-storage.md).

2. Install the Tigera Operator and custom resource definitions.

   ```bash
   kubectl create -f https://downloads.tigera.io/ee/v3.23.2/manifests/operator-crds.yaml
   kubectl create -f https://downloads.tigera.io/ee/v3.23.2/manifests/tigera-operator.yaml
   ```

3. Install the Prometheus operator and related custom resource definitions. The Prometheus operator is used to deploy Prometheus server and Alertmanager to monitor Calico Enterprise metrics.

   > **SECONDARY:** If you have an existing Prometheus operator in your cluster that you want to use, skip this step. To work with Calico Enterprise, your Prometheus operator must be v0.40.0 or higher.

   ```bash
   kubectl create -f https://downloads.tigera.io/ee/v3.23.2/manifests/tigera-prometheus-operator.yaml
   ```

4. Install your pull secret.

   If pulling images directly from `quay.io/tigera`, you will likely want to use the credentials provided to you by your Tigera support representative. If using a private registry, use your private registry credentials instead.

   ```bash
   kubectl create secret generic tigera-pull-secret \
       --type=kubernetes.io/dockerconfigjson -n tigera-operator \
       --from-file=.dockerconfigjson=<path/to/pull/secret>
   ```

5. Install any extra [Calico Enterprise resources](https://docs.tigera.io/calico-enterprise/latest/reference/resources.md) needed at cluster start using [calicoctl](https://docs.tigera.io/calico-enterprise/latest/reference/clis/calicoctl/overview.md).

6. Install the Tigera custom resources. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api.md).

   ```bash
   kubectl create -f https://downloads.tigera.io/ee/v3.23.2/manifests/custom-resources.yaml
   ```

   Monitor progress with the following command:

   ```bash
   watch kubectl get tigerastatus
   ```

   Wait until the `apiserver` shows a status of `Available`, then proceed to the next section.

### Install the Calico Enterprise license

```bash
kubectl create -f </path/to/license.yaml>
```

Monitor progress with the following command:

```bash
watch kubectl get tigerastatus
```

## Next steps

**Recommended**

- [Configure access to the Calico Enterprise web console](https://docs.tigera.io/calico-enterprise/latest/operations/cnx/access-the-manager.md)
- [Authentication quickstart](https://docs.tigera.io/calico-enterprise/latest/operations/cnx/authentication-quickstart.md)
- [Configure your own identity provider](https://docs.tigera.io/calico-enterprise/latest/operations/cnx/configure-identity-provider.md)

**Recommended - Networking**

- The default networking uses IP in IP encapsulation with BGP routing. For all networking options, see [Determine best networking option](https://docs.tigera.io/calico-enterprise/latest/networking/determine-best-networking.md).

**Recommended - Security**

- [Get started with Calico Enterprise tiered network policy](https://docs.tigera.io/calico-enterprise/latest/network-policy/policy-tiers/tiered-policy.md)