--- title: "Upgrade from Calico to Calico Enterprise" description: "Upgrade from an operator-installed Calico Open Source cluster to Calico Enterprise on Kubernetes." product: "Calico Enterprise" version: "3.23 (latest)" section: "Install and upgrade" canonical_url: "https://docs.tigera.io/calico-enterprise/latest/getting-started/upgrading/upgrading-calico-to-calico-enterprise/upgrade-to-tsee/standard" --- # Upgrade from Calico to Calico Enterprise ## Prerequisites Ensure that your Kubernetes cluster is running with open source Calico on the latest release using an operator-based installation. If not, follow the [Calico upgrade documentation](https://docs.tigera.io/calico/latest/operations/upgrading/kubernetes-upgrade.md) before continuing. Calico Enterprise only supports clusters with a Kubernetes datastore. Please contact Tigera Support for assistance upgrading a cluster with an `etcdv3` datastore. If your cluster already has Calico Enterprise installed, follow the [Upgrading Calico Enterprise from an earlier release guide](https://docs.tigera.io/calico-enterprise/latest/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee.md) instead. For hybrid Linux and Windows clusters, ensure that your Windows nodes have at least 4 cores, 8GB RAM. ## Prepare your cluster for the upgrade Calico Enterprise creates default-deny policies for all Calico and Tigera namespaces, including calico-system. If you deploy workloads into the calico-system namespace, you must create policy that allows the required traffic for your workloads prior to upgrade. ### Deleting Goldmane and Whisker resources (for upgrades from Calico 3.30 or later) If you are upgrading from Calico 3.30 and have custom resources related to Goldmane and Whisker, you should delete these resources before the upgrade. ```bash kubectl delete goldmanes,whiskers --all ``` If you receive error indicating the custom resource definitions or resource type does not exist, it means these resources were not present in your cluster. You can safely ignore the error and proceed. ## Upgrade Calico to Calico Enterprise > **SECONDARY:** GKE upgrades from open source Calico are not currently supported. ### Before you begin **Required** - [Configure a storage class for Calico Enterprise.](https://docs.tigera.io/calico-enterprise/latest/operations/logstorage/create-storage.md) ### Install Calico Enterprise **Tab: Kubernetes** 1. Download the new manifests for Tigera Operator. ```bash curl -L -O https://downloads.tigera.io/ee/v3.23.2/manifests/tigera-operator.yaml ``` 2. Download the new manifests for Prometheus operator. > **SECONDARY:** > > If you have an existing Prometheus operator in your cluster that you want to use, skip this step. To work with Calico Enterprise, your Prometheus operator must be v0.40.0 or higher. ```bash curl -L -O https://downloads.tigera.io/ee/v3.23.2/manifests/tigera-prometheus-operator.yaml ``` 3. If you previously [installed using a private registry](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/private-registry.md), you will need to [push the new images ](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/private-registry/private-registry-regular.md#push-calico-enterprise-images-to-your-private-registry)and then [update the manifest](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/private-registry/private-registry-regular.md#run-the-operator-using-images-from-your-private-registry) downloaded in the previous step. 4. Apply the manifest for Tigera Operator. ```bash kubectl apply --server-side --force-conflicts -f tigera-operator.yaml ``` 5. If you downloaded the manifests for Prometheus operator from the earlier step, then apply them now. ```bash kubectl apply --server-side --force-conflicts -f tigera-prometheus-operator.yaml ``` 6. Install your pull secret. If pulling images directly from `quay.io/tigera`, you will likely want to use the credentials provided to you by your Tigera support representative. If using a private registry, use your private registry credentials instead. ```text kubectl create secret generic tigera-pull-secret \ --type=kubernetes.io/dockerconfigjson -n tigera-operator \ --from-file=.dockerconfigjson= ``` 7. Install the Tigera custom resources. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api.md). ```bash kubectl apply -f https://downloads.tigera.io/ee/v3.23.2/manifests/custom-resources-upgrade-from-calico.yaml ``` **Tab: EKS** 1. Download the new manifests for Tigera Operator. ```bash curl -L -O https://downloads.tigera.io/ee/v3.23.2/manifests/tigera-operator.yaml ``` 2. Download the new manifests for Prometheus operator. > **SECONDARY:** > > If you have an existing Prometheus operator in your cluster that you want to use, skip this step. To work with Calico Enterprise, your Prometheus operator must be v0.40.0 or higher. ```bash curl -L -O https://downloads.tigera.io/ee/v3.23.2/manifests/tigera-prometheus-operator.yaml ``` 3. If you previously [installed using a private registry](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/private-registry.md), you will need to [push the new images ](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/private-registry/private-registry-regular.md#push-calico-enterprise-images-to-your-private-registry)and then [update the manifest](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/private-registry/private-registry-regular.md#run-the-operator-using-images-from-your-private-registry) downloaded in the previous step. 4. Apply the manifest for Tigera Operator. ```bash kubectl apply --server-side --force-conflicts -f tigera-operator.yaml ``` 5. If you downloaded the manifests for Prometheus operator from the earlier step, then apply them now. ```bash kubectl apply --server-side --force-conflicts -f tigera-prometheus-operator.yaml ``` 6. Install your pull secret. If pulling images directly from `quay.io/tigera`, you will likely want to use the credentials provided to you by your Tigera support representative. If using a private registry, use your private registry credentials instead. ```text kubectl create secret generic tigera-pull-secret \ --type=kubernetes.io/dockerconfigjson -n tigera-operator \ --from-file=.dockerconfigjson= ``` 7. Install the Tigera custom resources. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api.md). ```bash kubectl apply -f https://downloads.tigera.io/ee/v3.23.2/manifests/eks/custom-resources-upgrade-from-calico.yaml ``` **Tab: AKS** > **SECONDARY:** The following instructions are only for AKS clusters that use a Kubernetes reconciler. For AKS clusters with a self-managed Calico installation (including AKS clusters with Calico CNI), or a cluster that is not using a reconciler, follow the upgrade steps under the **Kubernetes** tab. These upgrade instructions will upgrade your AKS clusters with Azure CNI and an AKS-managed Calico installation. 1. Switch the active operator to the one that will be installed to the new namespace. First, download the helper script: ```bash curl -L -O https://docs.tigera.io/calico-enterprise/3.23/scripts/switch-active-operator.sh ``` Then switch the active operator. This will deactivate the currently running operator. ```text chmod a+x ./switch-active-operator.sh ./switch-active-operator.sh tigera-operator-enterprise ``` 2. Download the new manifests for Tigera Operator. ```bash curl -L -o tigera-operator.yaml https://downloads.tigera.io/ee/v3.23.2/manifests/aks/tigera-operator-upgrade.yaml ``` 3. Download the new manifests for Prometheus operator. > **SECONDARY:** > > If you have an existing Prometheus operator in your cluster that you want to use, skip this step. To work with Calico Enterprise, your Prometheus operator must be v0.40.0 or higher. ```bash curl -L -O https://downloads.tigera.io/ee/v3.23.2/manifests/tigera-prometheus-operator.yaml ``` 4. If you previously [installed using a private registry](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/private-registry.md), you will need to [push the new images ](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/private-registry/private-registry-regular.md#push-calico-enterprise-images-to-your-private-registry)and then [update the manifest](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/private-registry/private-registry-regular.md#run-the-operator-using-images-from-your-private-registry) downloaded in the previous step. 5. Apply the manifest for Tigera Operator. ```bash kubectl apply --server-side --force-conflicts -f tigera-operator.yaml ``` 6. If you downloaded the manifests for Prometheus operator from the earlier step, then apply them now. ```bash kubectl apply --server-side --force-conflicts -f tigera-prometheus-operator.yaml ``` 7. Install your pull secret. If pulling images directly from `quay.io/tigera`, you will likely want to use the credentials provided to you by your Tigera support representative. If using a private registry, use your private registry credentials instead. ```text kubectl create secret generic tigera-pull-secret \ --type=kubernetes.io/dockerconfigjson -n tigera-operator-enterprise \ --from-file=.dockerconfigjson= ``` 8. Download the custom resources manifest. ```bash curl -L -o custom-resources.yaml https://downloads.tigera.io/ee/v3.23.2/manifests/aks/custom-resources-upgrade-from-calico.yaml ``` 9. If you are [installing using a private registry](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/private-registry.md), you will need to update the manifest downloaded in the previous step. Update the `spec.registry`, `spec.imagePath`, and `spec.imagePrefix` fields of the installation resource with the registry name, image path, and image prefix of your private registry. 10. Apply the Tigera custom resources manifest. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api.md). ```bash kubectl apply -f custom-resources.yaml ``` Wait until the `apiserver` shows a status of `Available`, then proceed to the next section. > **SECONDARY:** If there are any problems you can use `kubectl get tigerastatus -o yaml` to get more details. ### Install the Calico Enterprise license To use Calico Enterprise, you must install the license provided to you by Tigera. ```text kubectl create -f ``` You can now monitor progress with the following command: ```text watch kubectl get tigerastatus ``` ### Next steps - [Configure access to the Calico Enterprise web console](https://docs.tigera.io/calico-enterprise/latest/operations/cnx/access-the-manager.md) - [Authentication quickstart](https://docs.tigera.io/calico-enterprise/latest/operations/cnx/authentication-quickstart.md)