---
title: "Install using Helm"
description: "Install Calico Open Source on a Kubernetes cluster using a Helm 3 chart."
product: "Calico Open Source"
version: "3.32 (latest)"
section: "Installing and upgrading"
canonical_url: "https://docs.tigera.io/calico/latest/getting-started/kubernetes/helm"
---

# Install using Helm

## Big picture

Install Calico on a Kubernetes cluster using Helm 3.

## Value

Helm charts are a way to package up an application for Kubernetes (similar to `apt` or `yum` for operating systems). Helm is also used by tools like ArgoCD to manage applications in a cluster, taking care of install, upgrade (and rollback if needed), etc.

## Before you begin

**Required**

- Install Helm 3

- Kubernetes cluster meets these requirements:

  - Kubernetes is installed *without* a CNI plugin **OR** cluster is running a compatible CNI for Calico to run in policy-only mode
  - x86-64, arm64, ppc64le, or s390x processors
  - RedHat Enterprise Linux 7.x+, CentOS 7.x+, Ubuntu 18.04+, or Debian 9.x+

- `kubeconfig` is configured to work with your cluster (check by running `kubectl get nodes`)

- Calico can manage `cali` and `tunl` interfaces on the hosts. If NetworkManager is present on the hosts, refer to [Configure NetworkManager](https://docs.tigera.io/calico/latest/operations/troubleshoot/troubleshooting.md#configure-networkmanager).

## Concepts

### Operator based installation

In this guide, you install the Tigera Operator and custom resource definitions using the Helm 3 chart. The Tigera Operator provides lifecycle management for Calico exposed via the Kubernetes API defined as a custom resource definition.

## How to

### Download the Helm chart

1. Add the Calico Helm repo:

```bash
helm repo add projectcalico https://docs.tigera.io/calico/charts
```

### Customize the Helm chart

If you are installing on a cluster installed by EKS, GKE, AKS or Mirantis Kubernetes Engine (MKE), or you need to customize TLS certificates, you **must** customize this Helm chart by creating a `values.yaml` file. Otherwise, you can skip this step.

1. If you are installing on a cluster installed by EKS, GKE, AKS or Mirantis Kubernetes Engine (MKE), set the `kubernetesProvider` as described in the [Installation reference](https://docs.tigera.io/calico/latest/reference/installation/api.md#provider). For example:

   ```text
   echo '{ installation: {kubernetesProvider: EKS }}' > values.yaml
   ```

   For Azure AKS cluster with no Kubernetes CNI pre-installed, create `values.yaml` with the following command:

   ```text
   cat > values.yaml <<EOF
   installation:
     kubernetesProvider: AKS
     cni:
       type: Calico
     calicoNetwork:
       bgp: Disabled
       ipPools:
       - cidr: 10.244.0.0/16
         encapsulation: VXLAN
   EOF
   ```

For more information about configurable options via `values.yaml` please see [Helm installation reference](https://docs.tigera.io/calico/latest/reference/installation/helm_customization.md).

### Install Calico

1. Create the `tigera-operator` namespace.

   ```bash
   kubectl create namespace tigera-operator
   ```

2. Install the necessary custom resource definitions.

   ```bash
   helm template calico-crds projectcalico/crd.projectcalico.org.v1 --version v3.32.1 | kubectl apply --server-side -f -
   ```

   > **SUCCESS:** To install with [native v3 CRDs](https://docs.tigera.io/calico/latest/operations/native-v3-crds.md) (tech preview) instead, use the v3 CRD chart:
   >
   > ```bash
   > helm template calico-crds projectcalico/projectcalico.org.v3 --version v3.32.1 | kubectl apply --server-side -f -
   > ```
   >
   > Native v3 CRDs eliminate the need for the aggregation API server and allows `kubectl` to manage `projectcalico.org/v3` resources directly.

3. Install the Tigera Operator using the Helm chart:

   ```bash
   helm install calico projectcalico/tigera-operator --version v3.32.1 --namespace tigera-operator
   ```

   or if you created a `values.yaml` above:

   ```bash
   helm install calico projectcalico/tigera-operator --version v3.32.1 -f values.yaml --namespace tigera-operator
   ```

4. Confirm that all of the pods are running with the following command.

   ```bash
   watch kubectl get pods -n calico-system
   ```

   Wait until each pod has the `STATUS` of `Running`.

   > **SECONDARY:** The Tigera Operator installs resources in the `calico-system` namespace. Other install methods may use the `kube-system` namespace instead.

Congratulations! You have now installed Calico using the Helm 3 chart.

## Next steps

**Required**

- [Install and configure calicoctl](https://docs.tigera.io/calico/latest/operations/calicoctl/install.md)

**Recommended tutorials**

- [Secure a simple application using the Kubernetes NetworkPolicy API](https://docs.tigera.io/calico/latest/network-policy/get-started/kubernetes-policy/kubernetes-policy-basic.md)
- [Control ingress and egress traffic using the Kubernetes NetworkPolicy API](https://docs.tigera.io/calico/latest/network-policy/get-started/kubernetes-policy/kubernetes-policy-advanced.md)
- [Run a tutorial that shows blocked and allowed connections in real time](https://docs.tigera.io/calico/latest/network-policy/get-started/kubernetes-policy/kubernetes-demo.md)