---
title: "Calico nftables data plane"
description: "Install Calico Open Source with the nftables data plane instead of the default iptables back end."
product: "Calico Open Source"
version: "3.32 (latest)"
section: "Installing and upgrading"
canonical_url: "https://docs.tigera.io/calico/latest/getting-started/kubernetes/nftables"
---

# Calico nftables data plane

## Big picture

Install Calico using the nftables data plane.

## Value

Kubernetes introduced a beta status [kube-proxy Service implementation based on nftables](https://kubernetes.io/docs/reference/networking/virtual-ips/#proxy-mode-nftables) in Kubernetes v1.31 which promises better performance than the default iptables implementation. Installing Calico in nftables mode provides a networking and network policy implementation that is compatible with the upstream nftables kube-proxy.

> **INFO:** To use Calico in nftables mode, your cluster's kube-proxy must also be in nftables mode.
>
> Example KubeProxyConfiguration resource
>
> ```yaml
> apiVersion: kubeproxy.config.k8s.io/v1alpha1
> kind: KubeProxyConfiguration
> mode: nftables
> ```

## Before you begin

**Required**

- A Linux host that meets the following requirements:

  - x86-64, arm64, ppc64le, or s390x processor
  - 2CPU
  - 2GB RAM
  - 10GB free disk space
  - Linux kernel version 5.13 or later with `nft` >= 1.0.1

- Calico can manage `cali` and `tunl` interfaces on the host

  If NetworkManager is present on the host, see [Configure NetworkManager](https://docs.tigera.io/calico/latest/operations/troubleshoot/troubleshooting.md#configure-networkmanager).

## How to

### Create a single-host Kubernetes cluster with the nftables kube-proxy enabled.

1. [Follow the Kubernetes instructions to install kubeadm](https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/)

   > **SECONDARY:** After installing kubeadm, do not power down or restart the host. Instead, continue directly to the next step.

2. As a regular user with sudo privileges, open a terminal on the host that you installed kubeadm on.

3. Create a kubeadm configuration file that enables the nftables kube-proxy mode.

   ```bash
   cat > config.yaml <<EOF
   apiVersion: kubeadm.k8s.io/v1beta4
   kind: InitConfiguration
   ---
   kind: ClusterConfiguration
   apiVersion: kubeadm.k8s.io/v1beta4
   kubernetesVersion: v1.31.0
   proxy: {}
   networking:
     podSubnet: "192.168.0.0/16"
   ---
   apiVersion: kubeproxy.config.k8s.io/v1alpha1
   kind: KubeProxyConfiguration
   mode: nftables
   EOF
   ```

   > **SECONDARY:** If 192.168.0.0/16 is already in use within your network you must select a different pod network CIDR, replacing 192.168.0.0/16 in the above configuration.

4. Initialize the control plane using the following command.

   ```bash
   sudo kubeadm init --config=config.yaml
   ```

5. Execute the following commands to configure kubectl (also returned by `kubeadm init`).

   ```bash
   mkdir -p $HOME/.kube
   sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
   sudo chown $(id -u):$(id -g) $HOME/.kube/config
   ```

### Install Calico in nftables data plane mode

1. Install the Tigera Operator and custom resource definitions.

   ```bash
   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/v1_crd_projectcalico_org.yaml
   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/tigera-operator.yaml
   ```

   > **SECONDARY:** Due to the large size of the CRD bundle, `kubectl apply` might exceed request limits. Instead, use `kubectl create` or `kubectl replace`.

2. Install Calico by creating the necessary custom resource. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico/latest/reference/installation/api.md).

   ```bash
   cat > custom-resources.yaml <<EOF
   apiVersion: operator.tigera.io/v1
   kind: Installation
   metadata:
     name: default
   spec:
     calicoNetwork:
       linuxDataplane: Nftables
       ipPools:
       - name: default-ipv4-ippool
         blockSize: 26
         cidr: 192.168.0.0/16
         encapsulation: VXLANCrossSubnet
         natOutgoing: Enabled
         nodeSelector: all()
   ---
   apiVersion: operator.tigera.io/v1
   kind: APIServer
   metadata:
     name: default
   spec: {}
   EOF
   ```

   ```bash
   kubectl create -f custom-resources.yaml
   ```

   > **SECONDARY:** Before creating this manifest, read its contents and make sure its settings are correct for your environment. For example, you may need to change the default IP pool CIDR to match your pod network CIDR.

3. Confirm that all of the pods are running with the following command.

   ```bash
   watch kubectl get pods -n calico-system
   ```

   Wait until each pod has the `STATUS` of `Running`.

   > **SECONDARY:** The Tigera Operator installs resources in the `calico-system` namespace. Other install methods may use the `kube-system` namespace instead.

4. Remove the taints on the control plane so that you can schedule pods on it.

   ```bash
   kubectl taint nodes --all node-role.kubernetes.io/control-plane-
   ```

   It should return the following.

   ```text
   node/<your-hostname> untainted
   ```

5. Confirm that you now have a node in your cluster with the following command.

   ```bash
   kubectl get nodes -o wide
   ```

   It should return something like the following.

   ```text
   NAME              STATUS   ROLES    AGE   VERSION   INTERNAL-IP   EXTERNAL-IP   OS-IMAGE             KERNEL-VERSION    CONTAINER-RUNTIME
   <your-hostname>   Ready    master   52m   v1.12.2   10.128.0.28   <none>        Ubuntu 18.04.1 LTS   4.15.0-1023-gcp   docker://18.6.1
   ```

Congratulations! You now have a single-host Kubernetes cluster with Calico in nftables mode.

## Next steps

**Required**

- [Install and configure calicoctl](https://docs.tigera.io/calico/latest/operations/calicoctl/install.md)

**Recommended tutorials**

- [Secure a simple application using the Kubernetes NetworkPolicy API](https://docs.tigera.io/calico/latest/network-policy/get-started/kubernetes-policy/kubernetes-policy-basic.md)
- [Control ingress and egress traffic using the Kubernetes NetworkPolicy API](https://docs.tigera.io/calico/latest/network-policy/get-started/kubernetes-policy/kubernetes-policy-advanced.md)
- [Run a tutorial that shows blocked and allowed connections in real time](https://docs.tigera.io/calico/latest/network-policy/get-started/kubernetes-policy/kubernetes-demo.md)
- [Hands-on workshop: Learn the basics of Calico, and Kubernetes.](https://www.tigera.io/tutorials/?_sf_s=Calico%20Basics)