---
title: "Install Calico for policy and flannel (aka Canal) for networking"
description: "Install Calico Open Source network policy on an existing Flannel-networked cluster without replacing the data plane."
product: "Calico Open Source"
version: "3.32 (latest)"
section: "Installing and upgrading"
canonical_url: "https://docs.tigera.io/calico/latest/getting-started/kubernetes/flannel/install-for-flannel"
---

# Install Calico for policy and flannel (aka Canal) for networking

## Before you begin

> **SECONDARY:** Calico includes native VXLAN capabilities without the need for flannel. If you're planning on using flannel for VXLAN, we recommend instead installing Calico using IP-in-IP or VXLAN mode. See how to [determine the best networking option](https://docs.tigera.io/calico/latest/networking/determine-best-networking.md) for your cluster. If you're already using flannel for networking, you can [migrate your existing clusters to Calico networking](https://docs.tigera.io/calico/latest/getting-started/kubernetes/flannel/migration-from-flannel.md).

Ensure that you have a Kubernetes cluster that meets the Calico [system requirements](https://docs.tigera.io/calico/latest/getting-started/kubernetes/requirements.md). If you don't, follow the steps in [Installing kubeadm](https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/).

## Installing Calico for policy and flannel (aka Canal) for networking

### Selecting a datastore type

The procedure differs according to your datastore type. Refer to the section that matches your type.

- [Kubernetes API datastore](#installing-with-the-kubernetes-api-datastore-recommended) (recommended)

- [etcd datastore](#installing-with-the-etcd-datastore)

### Installing with the Kubernetes API datastore (recommended)

1. Ensure that the Kubernetes controller manager has the following flags set:\
   `--cluster-cidr=<your-pod-cidr>` and `--allocate-node-cidrs=true`.

   > **SUCCESS:** On kubeadm, you can pass `--pod-network-cidr=<your-pod-cidr>` to kubeadm to set both Kubernetes controller flags.

2. Download the flannel networking manifest for the Kubernetes API datastore.

   ```bash
   curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/canal.yaml -O
   ```

3. If your cluster is configured to use pod CIDR `10.244.0.0/16`, skip to the next step. If your cluster is configured to use a different pod CIDR, replace `10.244.0.0/16` in the downloaded manifest with the correct pod CIDR.

4. Issue the following command to install Calico.

   ```bash
   kubectl apply -f canal.yaml
   ```

5. If you wish to enforce application layer policies and secure workload-to-workload communications with mutual TLS authentication, continue to [Enable application layer policy](https://docs.tigera.io/calico/latest/network-policy/istio/app-layer-policy.md) (optional).

The geeky details of what you get:

| Policy | IPAM       | CNI    | Overlay | Routing | Datastore  |
| ------ | ---------- | ------ | ------- | ------- | ---------- |
| Calico | Host-local | Calico | VXLAN   | Static  | Kubernetes |

?

### Installing with the etcd datastore

We strongly recommend using the Kubernetes API datastore, but if you prefer to use etcd, complete the following steps.

1. Download the Calico networking manifest.

   ```bash
   curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/canal-etcd.yaml -O
   ```

2. If your cluster is configured to use pod CIDR `10.244.0.0/16`, skip to the next step. If your cluster is configured to use a different pod CIDR, replace `10.244.0.0/16` in the downloaded manifest with the correct pod CIDR.

3. In the `ConfigMap` named `calico-config`, set the value of `etcd_endpoints` to the IP address and port of your etcd server.

   > **SUCCESS:** You can specify more than one using commas as delimiters.

4. Apply the manifest using the following command.

   ```bash
   kubectl apply -f canal-etcd.yaml
   ```

5. If you wish to enforce application layer policies and secure workload-to-workload communications with mutual TLS authentication, continue to [Enable application layer policy](https://docs.tigera.io/calico/latest/network-policy/istio/app-layer-policy.md) (optional).

The geeky details of what you get:

| Policy | IPAM       | CNI    | Overlay | Routing | Datastore |
| ------ | ---------- | ------ | ------- | ------- | --------- |
| Calico | Host-local | Calico | VXLAN   | Static  | etcd      |

?