---
title: "Rancher Kubernetes Engine (RKE)"
description: "Install Calico Open Source on a Rancher Kubernetes Engine cluster."
product: "Calico Open Source"
version: "3.32 (latest)"
section: "Installing and upgrading"
canonical_url: "https://docs.tigera.io/calico/latest/getting-started/kubernetes/rancher"
---

# Rancher Kubernetes Engine (RKE)

## Big picture

Install Calico as the required CNI for networking and/or network policy on Rancher-deployed clusters.

## Concepts

Calico supports the Calico CNI with Calico network policy:

The geeky details of what you get:

| Policy | IPAM   | CNI    | Overlay | Routing | Datastore  |
| ------ | ------ | ------ | ------- | ------- | ---------- |
| Calico | Calico | Calico | IPIP    | BGP     | Kubernetes |

?

## Before you begin

**Required**

- A compatible [Rancher Kubernetes Engine cluster](https://rancher.com/docs/rke/latest/en/) with version 1.3

  - Configure your cluster with a [Cluster Config File](https://rke.docs.rancher.com/installation#creating-the-cluster-configuration-file) and specify [no network plugin](https://rancher.com/docs/rke/latest/en/config-options/add-ons/network-plugins/) by setting `plugin: none` under `network` in your configuration file.

- RKE cluster meets the [Calico requirements](https://docs.tigera.io/calico/latest/getting-started/kubernetes/requirements.md)

- A `kubectl` environment with access to your cluster

  - Use [Rancher kubectl Shell](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/manage-clusters/access-clusters/use-kubectl-and-kubeconfig#accessing-clusters-with-kubectl-shell-in-the-rancher-ui) for access
  - Ensure you have the [kubeconfig file that was generated when you created the cluster](https://rancher.com/docs/rke/latest/en/installation/#save-your-files).

- If using a kubeconfig file locally, [install and set up the Kubectl CLI tool](https://kubernetes.io/docs/tasks/tools/install-kubectl/).

## How to

- [Install Calico](#install-calico)

### Install Calico

1. Install the Tigera Operator and custom resource definitions.

   ```text
   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/v1_crd_projectcalico_org.yaml
   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/tigera-operator.yaml
   ```

   > **SECONDARY:** Due to the large size of the CRD bundle, `kubectl apply` might exceed request limits. Instead, use `kubectl create` or `kubectl replace`.

2. Install Calico by creating the necessary custom resource. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico/latest/reference/installation/api.md).

   ```text
   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/custom-resources.yaml
   ```

   > **SECONDARY:** Before creating this manifest, read its contents and make sure its settings are correct for your environment. For example, you may need to change the default IP pool CIDR to match your pod network CIDR. Rancher uses `10.42.0.0/16` by default.

   > **SECONDARY:** If you are installing Calico on Windows nodes in this cluster, please see the [Calico for Windows for RKE](https://docs.tigera.io/calico/latest/getting-started/kubernetes/windows-calico/rancher.md) installation instructions.

3. Confirm that all of the pods are running with the following command.

   ```text
   watch kubectl get pods -n calico-system
   ```

   Wait until each pod has the `STATUS` of `Running`.

Congratulations! You now have an RKE cluster running Calico

## Next steps

**Required**

- [Install and configure calicoctl](https://docs.tigera.io/calico/latest/operations/calicoctl/install.md)

**Recommended tutorials**

- [Secure a simple application using the Kubernetes NetworkPolicy API](https://docs.tigera.io/calico/latest/network-policy/get-started/kubernetes-policy/kubernetes-policy-basic.md)
- [Control ingress and egress traffic using the Kubernetes NetworkPolicy API](https://docs.tigera.io/calico/latest/network-policy/get-started/kubernetes-policy/kubernetes-policy-advanced.md)
- [Run a tutorial that shows blocked and allowed connections in real time](https://docs.tigera.io/calico/latest/network-policy/get-started/kubernetes-policy/kubernetes-demo.md)