---
title: "Configure calicoctl"
description: "Overview reference for configuring calicoctl datastore access in Calico Enterprise, comparing config-file, environment-variable, and kubeconfig methods."
product: "Calico Enterprise"
version: "3.23 (latest)"
section: "Operations"
canonical_url: "https://docs.tigera.io/calico-enterprise/latest/operations/clis/calicoctl/configure/overview"
---

# Configure calicoctl

## Big picture

Learn how to configure the calicoctl CLI tool for your cluster.

## Value

The `calicoctl` CLI tool provides helpful administrative commands for interacting with a Calico Enterprise cluster.

## Concepts

### Default calicoctl behavior

Most `calicoctl` commands require access to the Calico Enterprise datastore. By default, calicoctl will attempt to read from the Kubernetes API based on the default kubeconfig.

## How to

### Configure access using a Configuration file

By default, `calicoctl` will look for a configuration file at `/etc/calico/calicoctl.cfg`. You can override this using the `--config` option with commands that require datastore access. The file can be in either YAML or JSON format. It must be valid and readable by `calicoctl`. For example:

```yaml
apiVersion: projectcalico.org/v3
kind: CalicoAPIConfig
metadata:
spec:
  datastoreType: "etcdv3"
  etcdEndpoints: "http://etcd1:2379,http://etcd2:2379"
  ...
```

### Configure access using environment variables

If `calicoctl` cannot locate, read, or access a configuration file, it will check a specific set of environment variables.

For a full set of options and examples, see [Configure calicoctl to connect to the datastore](https://docs.tigera.io/calico-enterprise/latest/operations/clis/calicoctl/configure/datastore.md)

> **SECONDARY:** When running `calicoctl` inside a container, any environment variables and configuration files must be passed to the container so they are available to the process inside. It can be useful to keep a running container (that sleeps) configured for your datastore, then it is possible to `exec` into the container and have an already configured environment.