---
title: "Helm installation reference"
description: "Helm chart values reference for installing Calico Enterprise covering supported overrides and operator configuration knobs."
product: "Calico Enterprise"
version: "3.23 (latest)"
section: "Reference"
canonical_url: "https://docs.tigera.io/calico-enterprise/latest/reference/installation/helm_customization"
---

# Helm installation reference

You can customize the following resources and settings during Calico Enterprise Helm-based installation using the file, `values.yaml`.

- [Installation](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api.md#installationspec)
- [Api server](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api.md#apiserverspec)
- [Compliance](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api.md#compliancespec)
- [Intrusion detection](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api.md#intrusiondetectionspec)
- [Log collector](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api.md#logcollectorspec)
- [Log storage](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api.md#logstoragespec)
- [Manager](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api.md#managerspec)
- [Monitor](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api.md#monitorspec)
- [Policy recommendation](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api.md#policyrecommendationspec)
- [Authentication](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api.md#authenticationspec)
- [Application layer](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api.md#applicationlayerspec)
- [Amazon cloud integration](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api.md)
- [Default felix configuration](https://docs.tigera.io/calico-enterprise/latest/reference/resources/felixconfig.md#spec)

> **SECONDARY:** If you customize Felix configuration when you install Calico Enterprise, the `crd.projectcalico.org/v1` API group is used. However, when you apply Felix configuration customization after installation (when the calico-apiserver is running), use the `projectcalico.org/v3` API group. When using [native v3 CRDs](https://docs.tigera.io/calico-enterprise/latest/operations/native-v3-crds.md), only the `projectcalico.org/v3` API group is installed and should always be used.

### Sample values.yaml

Here is a sample `values.yaml` file with settings for custom resources. You must enable the custom resource using `enabled: true` to provide custom configurations; custom resources set to false are ignored.

```yaml
installation:
  enabled: true
  <installation resource spec fields to configure>

apiServer:
  enabled: true
  <apiServer resource spec fields to configure>

intrusionDetection:
  enabled: true
  <intrusionDetection resource spec to configure>

logCollector:
  enabled: true
  <logCollector resource spec fields to configure>

logStorage:
  enabled: true
  nodes:
    count: 1
  <logStorage resource spec fields to configure>

manager:
  enabled: true
  <manager resource spec fields to configure>

monitor:
  enabled: true
  <monitor resource spec fields to configure>

compliance:
  enabled: true
  <compliance resource spec fields to configure>

policyRecommendation:
  enabled: true
  <policyRecommendation resource spec fields to configure>

authentication:
  enabled: false
  <if enabled is true: authentication resource spec fields to configure>

applicationLayer:
  enabled: false
  <if enabled is true: applicationLayer resource spec fields to configure>

amazonCloudIntegration:
  enabled: false
  <if enabled is true: amazonCloudIntegration resource spec fields to configure>

defaultFelixConfiguration:
  enabled: false
  <if enabled is true: felixConfiguration resource spec fields to configure>
```

## Common customizations

Common customizations that you might want to configure are number of replicas, pod affinity, and encryption using WireGuard.

### Number of replicas

This setting defines the number of replicas for Calico Enterprise components that can run simultaneously in multiple instances. To configure this setting, see [controlPlaneReplicas](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api.md#installationspec). The components for the replicas are:

- calico-manager
- calico-apiserver
- tigera-dex
- tigera-kibana
- es-gateway

To set a specific replica for these components, you must provide the setting in your custom values.yaml file:

```yaml
installation:
  enable: true
  controlPlaneReplicas: 3 # desired number of replicas for the components listed above.
```

### Pod affinity

You can define pod affinity for the following Tigera components. Update the appropriate custom resource in your custom `values.yaml`.

- calico-apiserver: through ApiServer resource
- calico-nodes: through CalicoNodeDaemonSet property in the Installation resource
- calico-kube-controllers: through CalicoKubeControllersDeployment property in the Installation resource
- compliance deployment pods (compliance-snapshotter, compliance-server, compliance-controller, compliance-benchmarker, compliance-scaleloader, compliance-reporter): through Compliance resource
- elasticsearch pods: through LogStorage resource - for more info on this option please checkout [Advanced Node Scheduling](https://docs.tigera.io/calico-enterprise/latest/operations/logstorage/advanced-node-scheduling.md)

### Encryption using WireGuard

[WireGuard encryption](https://docs.tigera.io/calico-enterprise/latest/compliance/encrypt-cluster-pod-traffic.md#enable-wireguard-for-a-cluster) is configured in the FelixConfiguration. To set encryption for your cluster, update the `values.yaml` file.

```yaml
defaultFelixConfiguration:
  enabled: true
  wireguardEnabled: true
  wireguardEnabledV6: true
```