---
title: "Install Calico Enterprise for Windows on RKE"
description: "Install Calico Enterprise for Windows on a Rancher Kubernetes Engine (RKE) cluster with Windows worker nodes."
product: "Calico Enterprise"
version: "3.23 (latest)"
section: "Install and upgrade"
canonical_url: "https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/windows-calico/rancher"
---

# Install Calico Enterprise for Windows on RKE

## Big picture

Install Calico Enterprise for Windows on Rancher Kubernetes Engine (RKE).

## Before you begin

**Supported networking**

- BGP with no encapsulation
- VXLAN

**Required**

- A [compatible RKE cluster](https://docs.tigera.io/calico-enterprise/latest/getting-started/compatibility.md#rke)

- An RKE cluster provisioned with [no network plugin](https://rancher.com/docs/rke/latest/en/config-options/add-ons/network-plugins#disabling-deployment-of-a-network-plug-in)

- One or more Windows nodes that meet the [requirements](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/windows-calico/requirements.md).

## How to

The following steps will outline the installation of Calico Enterprise networking on the RKE cluster, then the installation of Calico Enterprise for Windows on the Windows nodes.

1. Install the Tigera Operator and custom resource definitions.

   ```bash
   kubectl create -f https://downloads.tigera.io/ee/v3.23.2/manifests/operator-crds.yaml
   kubectl create -f https://downloads.tigera.io/ee/v3.23.2/manifests/tigera-operator.yaml
   ```

2. Download the necessary Installation custom resources.

   ```bash
   wget https://downloads.tigera.io/ee/v3.23.2/manifests/custom-resources.yaml
   ```

3. Update the `calicoNetwork` options, ensuring that the correct pod CIDR is set. (Rancher uses `10.42.0.0/16` by default.) Below are sample installations for VXLAN and BGP networking using the default Rancher pod CIDR:

   **VXLAN**

   ```yaml
   apiVersion: operator.tigera.io/v1
   kind: Installation
   metadata:
     name: default
   spec:
      # Configures Calico networking.
     calicoNetwork:
       bgp: Disabled
       ipPools:
       - blockSize: 26
         cidr: 10.42.0.0/16
         encapsulation: VXLAN
         natOutgoing: Enabled
         nodeSelector: all()
   ```

   **BGP**

   ```yaml
   apiVersion: operator.tigera.io/v1
   kind: Installation
   metadata:
     name: default
   spec:
      # Configures Calico networking.
     calicoNetwork:
       ipPools:
       - blockSize: 26
         cidr: 10.42.0.0/16
         encapsulation: None
         natOutgoing: Enabled
         nodeSelector: all()
   ```

   > **SECONDARY:** For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api.md).

4. Apply the updated custom resources:

   ```bash
   kubectl create -f custom-resources.yaml
   ```

5. Configure strict affinity:

   ```bash
   kubectl patch ipamconfigurations default --type merge --patch='{"spec": {"strictAffinity": true}}'
   ```

6. Finally, install Calico Enterprise for Windows. For an operator installation, follow the [operator guide](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/windows-calico/operator.md). For VXLAN clusters, follow the instructions under the "Kubernetes VXLAN" tab. For BGP clusters, follow the instructions under the "Kubernetes BGP" tab.

   > **SECONDARY:** For Rancher default values for service CIDR and DNS cluster IP, see the [Rancher kube-api service options](https://rancher.com/docs/rke/latest/en/config-options/services/#kubernetes-api-server-options).

7. Check the status of the nodes with `kubectl get nodes`. If you see that the Windows node has the status `Ready`, then you have a Calico Enterprise for Windows on RKE cluster ready for Linux and Windows workloads!

## Next steps

- [Try the basic policy demo](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/windows-calico/demo.md)
- [Secure pods with Calico Enterprise network policy](https://docs.tigera.io/calico-enterprise/latest/network-policy/beginners/calico-network-policy.md)