--- title: "Requirements" description: "Cluster and Windows host requirements you must meet before installing Calico Enterprise for Windows." product: "Calico Enterprise" version: "3.23 (latest)" section: "Install and upgrade" canonical_url: "https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/windows-calico/requirements" --- # Requirements ## What's supported in this release ✓ Install: - Operator install for Kubernetes clusters using hostprocess containers (HPC) on Windows nodes ✓ Platforms: Kubernetes, OpenShift, RKE, EKS, AKS ✓ Networking: - Kubernetes, on-premises: Calico CNI with BGP or VXLAN - OpenShift: Calico CNI with BGP or VXLAN - Rancher Kubernetes Engine: Calico CNI with BGP or VXLAN - EKS: VPC CNI - AKS: Azure CNI ## Requirements Because the Kubernetes and Calico Enterprise control components do not run on Windows yet, a hybrid Linux/Windows cluster is required. ### CNI and networking options The following table summarizes the networking options and considerations. | Networking | Components | **Value/Content** | | ----------------------- | --------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Calico Enterprise BGP | Windows CNI plugin: calico.exe Linux: Calico Enterprise for policy and networking | Calico Enterprise's native networking approach, supports: - Auto-configured node-to-node BGP mesh over an L2 fabric - Peering with external routers for an L3 fabric - Calico Enterprise IPAM and IP aggregation (with some limitations) - Route reflectors **Note**: Windows node cannot act as route reflectors. - Kubernetes API datastore driver **AWS users**: If running on AWS, you must disable the source/dest check on your EC2 instances so that hosts can forward traffic on behalf of pods. | | Calico Enterprise VXLAN | Windows CNI plugin: calico.exe Linux: Calico Enterprise for policy and networking | Calico Enterprise's VXLAN overlay, supports: - VXLAN overlay, which can traverse most networks. - Auto-configured node-to-node routing - Calico Enterprise IPAM and IP aggregation (with some limitations) - Kubernetes API datastore driver **Note**: VXLAN runs on UDP port 4789 (this is the only port supported by Windows), remember to open that port between your Calico Enterprise hosts in any firewalls / security groups. | | Cloud provider | Windows CNI plugin: win-bridge.exe Linux: Calico Enterprise policy-only | A useful fallback, particularly if you have a Kubernetes cloud provider that automatically installs inter-host routes. Calico Enterprise has been tested with the standard **win-bridge.exe** CNI plugin so it should work with any networking provider that ultimately uses win-bridge.exe to network the pod (such as the Azure CNI plugin and cloud provider). | > **SECONDARY:** If Calico CNI with VXLAN is used, BGP must be disabled. See the [installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api.md#bgpoption). ### Kubernetes version For Kubernetes versions for your platform, see [Support and compatibility](https://docs.tigera.io/calico-enterprise/latest/getting-started/compatibility.md). When using Operator install and Windows hostprocess containers (HPC), see [here for the additional requirements](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/windows-calico/operator.md#hpc-requirements). ### Linux platform requirements - At least four Linux Kubernetes worker nodes to run Calico Enterprise's cluster-wide components that meets [Linux system requirements](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/requirements.md), and is installed with Calico Enterprise v3.5.0+ - Must not be running in eBPF mode - VXLAN or BGP without encapsulation is supported if using Calico Enterprise CNI. IPIP (Calico Enterprise's default encapsulation mode) is not supported. Turn off IPIP on the default IP pool. **Tab: Operator managed IP pools** For IP pools managed through the `Installation` resource, patch the `Installation` to update the encapsulation. The operator reconciles these `IPPool` resources from the `Installation`, so direct edits to the `IPPool` are silently reverted. ```bash kubectl patch installation default --type=json \ -p '[{"op":"replace","path":"/spec/calicoNetwork/ipPools/0/encapsulation","value":"VXLAN"}]' ``` If your cluster has additional operator-managed IP pools, repeat the command for each, replacing `0` in `/spec/calicoNetwork/ipPools/0` with the index of the pool. Use `"None"` instead of `"VXLAN"` for BGP without encapsulation. **Tab: User managed IP pools** For `IPPool` resources created directly (not through the `Installation`), patch the `IPPool`: ```bash kubectl patch ippool default-ipv4-ippool -p '{"spec":{"ipipMode":"Never","vxlanMode":"Always"}}' ``` - If using Calico Enterprise IPAM, strict affinity of IPAM configuration must be set to `true`. ```bash kubectl patch ipamconfigurations default --type merge --patch='{"spec": {"strictAffinity": true}}' ``` > **SECONDARY:** For operator-managed Linux Calico Enterprise clusters, three Linux worker nodes are required to meet high-availability requirements for Typha. ### Windows platform requirements - Windows versions: - (deprecated) Windows Server 1809 (build 17763.1432 or later) - Windows Server 2022 (build 20348.169 or later) > **SECONDARY:** Windows Server version support differs for each Kubernetes version. Review the [Windows OS Version Support](https://kubernetes.io/docs/setup/production-environment/windows/intro-windows-in-kubernetes/#windows-os-version-support) table for the Windows Server versions supported by each Kubernetes version. #### Operator install requirements - Kubernetes v1.22+ - Enable HostProcess containers support. For Kubernetes v1.22, see [here](https://kubernetes.io/docs/tasks/configure-pod-container/create-hostprocess-pod/#before-you-begin). For Kubernetes v1.23+, HostProcess containers are enabled by default. - [containerd](https://kubernetes.io/docs/setup/production-environment/container-runtimes/#containerd) v1.6.0+ - The Windows nodes have joined the cluster. - See [this section of the operator install guide for example commands](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/windows-calico/operator.md#hpc-requirements). ### EKS requirements - The VPC controllers must be installed to run Windows pods. - An instance role on the Windows instance must have permissions to get `namespaces` and get `secrets` in the calico-system namespace (or kube-system namespace if you are using a non operator-managed Calico Enterprise installation.) ### AKS requirements - Calico Enterprise for Windows can be enabled only on newly created clusters. - Non-HPC Calico Enterprise for Windows is available with Kubernetes version 1.20 or later ## Next steps [Install Calico for Windows using operator](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/windows-calico/operator.md)