--- title: "Install an OpenShift 4 cluster with Calico" description: "Install Calico Open Source on a self-managed OpenShift 4 cluster using the operator-based installation flow." product: "Calico Open Source" version: "3.32 (latest)" section: "Installing and upgrading" canonical_url: "https://docs.tigera.io/calico/latest/getting-started/kubernetes/openshift/installation" --- # Install an OpenShift 4 cluster with Calico ## Big picture Install an OpenShift 4 cluster with Calico. ## Value Augments the applicable steps in the [OpenShift documentation](https://docs.redhat.com/en/documentation/openshift_container_platform/) to install Calico. ## How to ### Before you begin - Ensure that your environment meets the Calico [system requirements](https://docs.tigera.io/calico/latest/getting-started/kubernetes/openshift/requirements.md). - Ensure that you have a [RedHat account](https://cloud.redhat.com/). A RedHat account is required to get the pull secret necessary to provision an OpenShift cluster. Note that the OpenShift installer supports a subset of AWS regions. - If installing on AWS, ensure that you have: - Configured an AWS account appropriate for OpenShift 4 - [Set up your AWS credentials](https://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/setup-credentials.html) - Generated a local SSH private key and added it to your ssh-agent ### Create a configuration file for the OpenShift installer First, create a staging directory for the installation. This directory will contain the configuration file, along with cluster state files, that OpenShift installer will create: ```text mkdir openshift-tigera-install && cd openshift-tigera-install ``` Now run OpenShift installer to create a default configuration file: ```text openshift-install create install-config ``` > **SECONDARY:** Refer to the [OpenShift installer documentation](https://docs.redhat.com/en/documentation/openshift_container_platform/) for more information about the installer and any configuration changes required for your platform. Once the installer has finished, your staging directory will contain the configuration file `install-config.yaml`. ### Update the configuration file to use Calico Override the OpenShift networking to use Calico and update the AWS instance types to meet the [system requirements](https://docs.tigera.io/calico/latest/getting-started/kubernetes/openshift/requirements.md): ```bash sed -i 's/\(OpenShiftSDN\|OVNKubernetes\)/Calico/' install-config.yaml ``` ### Generate the install manifests Now generate the Kubernetes manifests using your configuration file: ```bash openshift-install create manifests ``` > **SECONDARY:** For OpenShift **v4.16 or newer** on **AWS**, configure AWS security groups to allow BGP, typha and IP-in-IP encapsulation traffic by editing the OpenShift cluster-api manifests. > > Edit `spec.network.cni.cniIngressRules` in the `cluster-api/02_infra-cluster.yaml` file to add the following rules: > > ```yaml > cniIngressRules: > (...) > - description: BGP (calico) > fromPort: 179 > protocol: tcp > toPort: 179 > - description: IP-in-IP (calico) > fromPort: -1 > protocol: "4" > toPort: -1 > - description: Typha (calico) > fromPort: 5473 > protocol: tcp > toPort: 5473 > ``` Download the Calico manifests for OpenShift and add them to the generated manifests directory: ```bash mkdir calico wget -qO- https://github.com/projectcalico/calico/releases/download/v3.32.1/ocp.tgz | \ tar xvz --strip-components=1 -C calico cp calico/* manifests/ ``` ### Select and configure a data plane Calico manifests for OpenShift are ready to configure and install the **eBPF** data plane. The steps in the **eBPF (recommended)** tab below will guide you through the process. You can also select a different tab to follow the steps for configuring another data plane. **Tab: eBPF (recommended)** To configure the eBPF data plane, you need to: 1. Set the `KUBERNETES_SERVICE_HOST` attribute in the `manifests/01-configmap-kubernetes-services-endpoint.yaml` file. The following command extracts the `apiServerURL` from the `manifests/cluster-infrastructure-02-config.yml` file and sets it. ```bash API_SERVER_URL=$(cat manifests/cluster-infrastructure-02-config.yml | sed -n 's/.*apiServerInternalURI: https:\/\/\(api-int\.[^:]*\).*/\1/p') && \ sed -i "s|^\([^:]*KUBERNETES_SERVICE_HOST: \).*\$|\1\"$API_SERVER_URL\"|" manifests/01-configmap-kubernetes-services-endpoint.yaml ``` 2. Include the following `spec.template.spec.dnsConfig.nameservers` block to resolve the apiserver DNS in the `manifests/02-tigera-operator.yaml` file. For clusters in AWS, the DNS server address is 169.254.169.253. ```yaml spec: template: spec: (...) dnsConfig: nameservers: - 169.254.169.253 # AWS DNS server ``` **Tab: Iptables** To install Calico with iptables, you need to: 1. Set `linuxDataplane` to `Iptables` in the `manifests/03-cr-installation.yaml` file. 2. Remove the `manifests/cluster-network-operator.yaml` and `manifests/01-configmap-kubernetes-services-endpoint.yaml` files. You can do it by running the following command: ```bash sed -i 's/^\(\s*linuxDataplane:\s*\)BPF/\1Iptables/' manifests/03-cr-installation.yaml && \ rm -f manifests/cluster-network-operator.yaml && \ rm -f manifests/01-configmap-kubernetes-services-endpoint.yaml ``` ### Optionally provide additional configuration You may want to provide Calico with additional configuration at install-time. For example, BGP configuration or peers. You can use a Kubernetes ConfigMap with your desired Calico resources to set configuration as part of the installation. If you do not need to provide additional configuration, you can skip this section. To include [Calico resources](https://docs.tigera.io/calico/latest/reference/resources.md) during installation, edit `manifests/02-configmap-calico-resources.yaml` to add your own configuration. > **SECONDARY:** If you have a directory with the Calico resources, you can create the file with the command: > > ```text > oc create configmap -n tigera-operator calico-resources \ > --from-file= --dry-run -o yaml \ > manifests/02-configmap-calico-resources.yaml > ``` > > With recent versions of oc it is necessary to have a kubeconfig configured or add `--server='127.0.0.1:443'` even though it is not used. > **SECONDARY:** If you have provided a `calico-resources` configmap and the tigera-operator pod fails to come up with `Init:CrashLoopBackOff`, check the output of the init-container with `oc logs -n tigera-operator -l k8s-app=tigera-operator -c create-initial-resources`. ### Create the cluster Start the cluster creation with the following command and wait for it to complete. ```bash openshift-install create cluster ``` Once the above command is complete, you can verify Calico is installed by verifying the components are available with the following command. ```text oc get tigerastatus ``` > **SECONDARY:** To get more information, add `-o yaml` to the above command. ### Optionally integrate with Operator Lifecycle Manager (OLM) In OpenShift Container Platform, the [Operator Lifecycle Manager](https://docs.openshift.com/container-platform/4.4/operators/understanding_olm/olm-understanding-olm.html#olm-overview_olm-understanding-olm) helps cluster administrators manage the lifecycle of operators in their cluster. Managing the Calico operator with OLM gives administrators a single place to manage operators. To register the running Calico operator with OLM, first you will need to create an OperatorGroup for the operator: ```bash oc apply -f - < **SECONDARY:** This may trigger the operator deployment and all of its resources (pods, deployments, etc.) to be recreated. The OpenShift console provides an interface for editing the operator installation, viewing the operator's status, and more. ## Next steps **Recommended - Networking** - If you are using the default BGP networking with full-mesh node-to-node peering with no encapsulation, go to [Configure BGP peering](https://docs.tigera.io/calico/latest/networking/configuring/bgp.md) to get traffic flowing between pods. - If you are unsure about networking options, or want to implement encapsulation (overlay networking), see [Determine best networking option](https://docs.tigera.io/calico/latest/networking/determine-best-networking.md). **Recommended - Security** - [Secure Calico component communications](https://docs.tigera.io/calico/latest/network-policy/comms/crypto-auth.md) - [Secure hosts by installing Calico on hosts](https://docs.tigera.io/calico/latest/getting-started/bare-metal/about.md) - [Secure pods with Calico network policy](https://docs.tigera.io/calico/latest/network-policy/get-started/calico-policy/calico-network-policy.md) - If you are using Calico with Istio service mesh, get started here: [Enable application layer policy](https://docs.tigera.io/calico/latest/network-policy/istio/app-layer-policy.md)