---
title: "Tanzu Kubernetes Grid (TKG)"
description: "Install Calico Enterprise on a VMware Tanzu Kubernetes Grid (TKG) cluster."
product: "Calico Enterprise"
version: "3.23 (latest)"
section: "Install and upgrade"
canonical_url: "https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/tkg"
---

# Tanzu Kubernetes Grid (TKG)

## Big picture

Install Calico Enterprise on a Tanzu Kubernetes Grid cluster.

## Before you begin

**CNI support**

Calico CNI for networking with Calico Enterprise network policy:

The geeky details of what you get:

| Policy | IPAM   | CNI    | Overlay | Routing | Datastore  |
| ------ | ------ | ------ | ------- | ------- | ---------- |
| Calico | Calico | Calico | IPIP    | BGP     | Kubernetes |

?

**Required**

- A [compatible TKG cluster](https://docs.tigera.io/calico-enterprise/latest/getting-started/compatibility.md#tkg)

- Configure your cluster for Calico Enterprise CNI The workload cluster must be configured with `CNI: none`. When the workload cluster is bootstrapped, the nodes will be in a `NotReady` state until Calico Enterprise is installed. For more information, see [Tanzu networking](https://docs.vmware.com/en/VMware-Tanzu-Kubernetes-Grid/1.4/vmware-tanzu-kubernetes-grid-14/GUID-tanzu-k8s-clusters-networking.html) and [Tanzu configuration file reference](https://docs.vmware.com/en/VMware-Tanzu-Kubernetes-Grid/1.4/vmware-tanzu-kubernetes-grid-14/GUID-tanzu-config-reference.html).

- Cluster meets the [system requirements](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/requirements.md)

- A [Tigera license key and credentials](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/calico-enterprise.md)

- If using AWS, EC2 instances must be configured to belong to a separate SecurityGroup with ingress rules:

  - Calico (BGP) TCP 179
  - Calico (Typha) TCP 5473

- Web console Prometheus metrics TCP 9081

- Web console BGP metrics TCP 9900

## How to

- [Install Calico Enterprise](#install-calico-enterprise)
- [Install Calico Enterprise license](#install-calico-enterprise-license)

#### Install Calico Enterprise

- [Configure storage for Calico Enterprise](https://docs.tigera.io/calico-enterprise/latest/operations/logstorage/create-storage.md).

1. Install the Tigera Operator and custom resource definitions.

   ```text
   kubectl create -f https://downloads.tigera.io/ee/v3.23.2/manifests/operator-crds.yaml
   ```

   ```text
   kubectl create -f https://downloads.tigera.io/ee/v3.23.2/manifests/tigera-operator.yaml
   ```

2. Install the Prometheus operator and related custom resource definitions. The Prometheus operator will be used to deploy Prometheus server and Alertmanager to monitor Calico Enterprise metrics.

   > **SECONDARY:**
   >
   > If you have an existing Prometheus operator in your cluster that you want to use, skip this step. To work with Calico Enterprise, your Prometheus operator must be v0.40.0 or higher.

   ```text
   kubectl create -f https://downloads.tigera.io/ee/v3.23.2/manifests/tigera-prometheus-operator.yaml
   ```

3. Install your pull secret.

   If pulling images directly from `quay.io/tigera`, you will likely want to use the credentials provided to you by your Tigera support representative. If using a private registry, use your private registry credentials.

   ```text
   kubectl create secret generic tigera-pull-secret \
     --type=kubernetes.io/dockerconfigjson -n tigera-operator \
     --from-file=.dockerconfigjson=<path/to/pull/secret>
   ```

4. (Optional) If your cluster architecture requires any custom [Calico Enterprise resources](https://docs.tigera.io/calico-enterprise/latest/reference/resources.md) to function at startup, install them now using [calicoctl](https://docs.tigera.io/calico-enterprise/latest/reference/clis/calicoctl/overview.md).

5. (Optional) Compliance and packet capture features are optional. To enable these features during installation, download and review the custom-resources.yaml file. Uncomment the necessary CRs and use this custom-resources.yaml for installation.

   ```bash
   curl -O -L https://downloads.tigera.io/ee/v3.23.2/manifests/custom-resources.yaml
   ```

6. Install the Tigera custom resources. For more information on configuration options available, see [the installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api.md).

   ```text
   kubectl create -f https://downloads.tigera.io/ee/v3.23.2/manifests/custom-resources.yaml
   ```

   You can now monitor progress with the following command:

   ```text
   watch kubectl get tigerastatus
   ```

   Wait until the `apiserver` shows a status of `Available`, then proceed to the next section.

#### Install Calico Enterprise license

Install the Calico Enterprise license provided to you by Tigera.

```text
kubectl create -f </path/to/license.yaml>
```

You can now monitor progress with the following command:

```text
watch kubectl get tigerastatus
```

## Next steps

**Recommended**

- [Configure access to the Calico Enterprise web console](https://docs.tigera.io/calico-enterprise/latest/operations/cnx/access-the-manager.md)

**Recommended - Networking**

- The default networking uses IP in IP encapsulation with BGP routing. For all networking options, see [Determine best networking option](https://docs.tigera.io/calico-enterprise/latest/networking/determine-best-networking.md).

**Recommended - Security**

- [Get started with Calico Enterprise tiered network policy](https://docs.tigera.io/calico-enterprise/latest/network-policy/policy-tiers/tiered-policy.md)