---
title: "Install an OpenShift 4 cluster with Calico VPP"
description: "Install Calico Open Source with the VPP data plane on an OpenShift 4 cluster."
product: "Calico Open Source"
version: "3.32 (latest)"
section: "Installing and upgrading"
canonical_url: "https://docs.tigera.io/calico/latest/getting-started/kubernetes/vpp/openshift"
---

# Install an OpenShift 4 cluster with Calico VPP

## Big picture

Install an OpenShift 4 cluster with Calico VPP.

## Value

Augments the applicable steps in the [OpenShift documentation](https://docs.redhat.com/en/documentation/openshift_container_platform/) to install Calico VPP.

## How to

### Before you begin

- Ensure that your environment meets the Calico [system requirements](https://docs.tigera.io/calico/latest/getting-started/kubernetes/openshift/requirements.md) except those related to the management of `cali*`, `tunl*` and `vxlan.calico` interfaces.

- Ensure that you have a [RedHat account](https://cloud.redhat.com/). A RedHat account is required to get the pull secret necessary to provision an OpenShift cluster.

- Currently, we only support installing on AWS with OpenShift **v4.13 or later**, so ensure that you have:

  - Configured an AWS account appropriate for OpenShift 4
  - [Set up your AWS credentials](https://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/setup-credentials.html)
  - Generated a local SSH private key and added it to your ssh-agent

> **SECONDARY:** Please note that the OpenShift installer supports only a subset of AWS regions.

### Create a configuration file for the OpenShift installer

Create a staging directory for the installation. This directory will contain the configuration file, along with cluster state files, that the OpenShift installer will create:

```bash
mkdir openshift-tigera-install && cd openshift-tigera-install
```

Run the OpenShift installer to create a default configuration file:

```bash
openshift-install create install-config
```

> **SECONDARY:** Refer to the [OpenShift installer documentation](https://docs.redhat.com/en/documentation/openshift_container_platform/) for more information about the installer and any configuration changes required for your platform.

Once the installer has finished, your staging directory will contain the configuration file `install-config.yaml`.

### Update the configuration file to use Calico

Override the OpenShift networking to use Calico and update the AWS instance types to meet the [system requirements](https://docs.tigera.io/calico/latest/getting-started/kubernetes/openshift/requirements.md):

```bash
sed -i 's/networkType:.*/networkType: Calico/' install-config.yaml
sed -i 's/platform: {}/platform:\n    aws:\n      type: m5.4xlarge/' install-config.yaml
```

### Generate the install manifests

Generate the Kubernetes manifests using your configuration file:

```bash
openshift-install create manifests
```

Download the Calico manifests for OpenShift and add them to the generated manifests directory:

```bash
mkdir calico
wget -qO- https://github.com/projectcalico/calico/releases/download/v3.32.1/ocp.tgz | \
tar xvz --exclude=ocp/01-configmap-kubernetes-services-endpoint.yaml --exclude=ocp/cluster-network-operator.yaml --strip-components=1 -C calico
cp calico/* manifests/
```

Download the Calico VPP manifests for OpenShift and add them to the generated manifests directory:

```bash
mkdir vpp
cd vpp
curl -O "https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.32.0/yaml/platforms/openshift/00-namespace-calico-vpp-dataplane.yaml"
curl -o 03-cr-installation.yaml "https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.32.0/yaml/platforms/openshift/01-cr-installation.yaml"
curl -o 02-configmap-calico-vpp-resources.yaml "https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.32.0/yaml/platforms/openshift/03-configmap-calico-vpp-resources.yaml"
curl -o 02-role-calico-vpp-dataplane.yaml "https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.32.0/yaml/platforms/openshift/03-role-calico-vpp-dataplane.yaml"
curl -o 02-rolebinding-calico-vpp-dataplane.yaml "https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.32.0/yaml/platforms/openshift/03-rolebinding-calico-vpp-dataplane.yaml"
curl -o 02-serviceaccount-calico-vpp-dataplane.yaml "https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.32.0/yaml/platforms/openshift/03-serviceaccount-calico-vpp-dataplane.yaml"
curl -O "https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.32.0/yaml/platforms/openshift/04-calico-vpp-nohuge.yaml"
cd ..
cp vpp/* manifests/
```

Make sure that `SERVICE_PREFIX` in `manifests/02-configmap-calico-vpp-resources.yaml` matches the service CIDR of the cluster:

```bash
SERVICE_CIDR=`grep -A1 serviceNetwork: ./manifests/cluster-config.yaml | tail -n1 | cut -d '-' -f2`
sed -i "s#SERVICE_PREFIX:.*#SERVICE_PREFIX:$SERVICE_CIDR#" ./manifests/02-configmap-calico-vpp-resources.yaml
```

### Optionally provide additional configuration

You may want to provide Calico or the VPP data plane with additional configuration at install time. For example, BGP configuration or peers. You can use a Kubernetes ConfigMap with your desired Calico resources to set configuration as part of the installation. If you do not need to provide additional configuration, you can skip this section.

To include [Calico resources](https://docs.tigera.io/calico/latest/reference/resources.md) during installation, edit `manifests/02-configmap-calico-resources.yaml` to add your own configuration.

To customize the configuration of the VPP data plane, edit `manifests/02-configmap-calico-vpp-resources.yaml`. For details refer to the **Configuration options** section of [Getting Started](https://docs.tigera.io/calico/latest/getting-started/kubernetes/vpp/getting-started.md).

> **SECONDARY:** If you have a directory with the Calico resources, you can create the file with the command:
>
> ```text
> oc create configmap -n tigera-operator calico-resources \
> --from-file=<resource-directory> --dry-run -o yaml \
> manifests/02-configmap-calico-resources.yaml
> ```
>
> With recent versions of `oc` it is necessary to have a kubeconfig configured or add `--server='127.0.0.1:443'` even though it is not used.

> **SECONDARY:** If you have provided a `calico-resources` ConfigMap and the tigera-operator pod fails to come up with `Init:CrashLoopBackOff`, check the output of the init-container with `oc logs -n tigera-operator -l k8s-app=tigera-operator -c create-initial-resources`.

### Create the cluster

Start the cluster creation with the following command and wait for it to complete.

```bash
openshift-install create cluster
```

Once the above command is complete, you can verify Calico VPP is installed by verifying the components are available with the following command.

```bash
oc get tigerastatus
```

### Optionally integrate with Operator Lifecycle Manager

In OpenShift Container Platform, the [Operator Lifecycle Manager (OLM)](https://docs.openshift.com/container-platform/4.4/operators/understanding_olm/olm-understanding-olm.html#olm-overview_olm-understanding-olm) helps cluster administrators manage the lifecycle of operators in their cluster. Managing the Calico operator with OLM gives administrators a single place to manage operators.

1. To register the running Calico operator with OLM, first you will need to create an OperatorGroup for the operator:

```bash
oc apply -f - <<EOF
apiVersion: operators.coreos.com/v1
kind: OperatorGroup
metadata:
  name: tigera-operator
  namespace: tigera-operator
spec:
  targetNamespaces:
    - tigera-operator
EOF
```

2. Create a subscription to the operator. By subscribing to the operator package, the Calico operator will be managed by OLM.

```bash
oc apply -f - <<EOF
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
  name: tigera-operator
  namespace: tigera-operator
spec:
  channel: release-v1.42
  installPlanApproval: Manual
  name: tigera-operator
  source: certified-operators
  sourceNamespace: openshift-marketplace
  startingCSV: tigera-operator.v1.42.3
EOF
```

3. Log in to the OpenShift console, navigate to the Installed Operators section and approve the install plan for the operator.

> **SECONDARY:** This may trigger the operator deployment and all of its resources (pods, deployments, etc.) to be recreated.

The OpenShift console provides an interface for editing the operator installation, viewing the operator's status, and more.

## Next steps

After installing Calico VPP, you can benefit from the features of the VPP data plane, such as fast [IPsec](https://docs.tigera.io/calico/latest/getting-started/kubernetes/vpp/ipsec.md) or [WireGuard](https://docs.tigera.io/calico/latest/network-policy/encrypt-cluster-pod-traffic.md) encryption.

**Tools**

- [Install and configure calicoctl](https://docs.tigera.io/calico/latest/operations/calicoctl/install.md) to configure and monitor your cluster.

**Security**

- [Secure pods with Calico network policy](https://docs.tigera.io/calico/latest/network-policy/get-started/calico-policy/calico-network-policy.md)