--- title: "Requirements" description: "Cluster and Windows host requirements you must meet before installing Calico Open Source for Windows." product: "Calico Open Source" version: "3.32 (latest)" section: "Installing and upgrading" canonical_url: "https://docs.tigera.io/calico/latest/getting-started/kubernetes/windows-calico/requirements" --- # Requirements ## What's supported in this release ✓ Install: - Operator install for Kubernetes clusters using hostprocess containers (HPC) on Windows nodes ✓ Platforms: Kubernetes, OpenShift, RKE, EKS, AKS ✓ Networking: - Kubernetes, on-premises: Calico CNI with BGP or VXLAN - OpenShift: Calico CNI with BGP or VXLAN - Rancher Kubernetes Engine: Calico CNI with BGP or VXLAN - EKS: VPC CNI - AKS: Azure CNI ## Requirements Because the Kubernetes and Calico control components do not run on Windows yet, a hybrid Linux/Windows cluster is required. ### CNI and networking options The following table summarizes the networking options and considerations. | Networking | Components | **Value/Content** | | -------------- | ---------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Calico BGP | Windows CNI plugin: calico.exe Linux: Calico for policy and networking | Calico's native networking approach, supports: - Auto-configured node-to-node BGP mesh over an L2 fabric - Peering with external routers for an L3 fabric - Calico IPAM and IP aggregation (with some limitations) - Route reflectors (including the new in-cluster route reflector introduced in Calico v3.3). **Note**: Windows node cannot act as route reflectors. - Kubernetes API datastore driver **AWS users**: If running on AWS, you must disable the source/dest check on your EC2 instances so that hosts can forward traffic on behalf of pods. | | Calico VXLAN | Windows CNI plugin: calico.exe Linux: Calico for policy and networking | Calico's VXLAN overlay, supports: - VXLAN overlay, which can traverse most networks. - Auto-configured node-to-node routing - Calico IPAM and IP aggregation (with some limitations) - Kubernetes API datastore driver **Note**: VXLAN runs on UDP port 4789 (this is the only port supported by Windows), remember to open that port between your Calico hosts in any firewalls / security groups. | | Cloud provider | Windows CNI plugin: win-bridge.exe Linux: Calico policy-only | A useful fallback, particularly if you have a Kubernetes cloud provider that automatically installs inter-host routes. Calico has been tested with the standard **win-bridge.exe** CNI plugin so it should work with any networking provider that ultimately uses win-bridge.exe to network the pod (such as the Azure CNI plugin and cloud provider). | > **SECONDARY:** If Calico CNI with VXLAN is used, BGP must be disabled. See the [installation reference](https://docs.tigera.io/calico/latest/reference/installation/api.md#bgpoption). ### Datastores When using Operator install, only Kubernetes datastore (kdd) is supported. ### Kubernetes version See the [Kubernetes requirements](https://docs.tigera.io/calico/latest/getting-started/kubernetes/requirements.md#kubernetes-requirements). When using Operator install and Windows hostprocess containers (HPC), see [here for the additional requirements](https://docs.tigera.io/calico/latest/getting-started/kubernetes/windows-calico/operator.md#hpc-requirements). Earlier versions may work, but we do not actively test Calico for Windows against them, and they may have known issues and incompatibilities. ### Linux platform requirements - At least one Linux Kubernetes worker node to run Calico's cluster-wide components that meets [Linux system requirements](https://docs.tigera.io/calico/latest/getting-started/kubernetes/requirements.md), and is installed with Calico. Calico v3.27+ is required for Operator installs. - VXLAN or BGP without encapsulation is supported if using Calico CNI. IPIP (Calico's default encapsulation mode) is not supported. Turn off IPIP on the default IP pool. **Tab: Operator managed IP pools** For IP pools managed through the `Installation` resource, patch the `Installation` to update the encapsulation. The operator reconciles these `IPPool` resources from the `Installation`, so direct edits to the `IPPool` are silently reverted. ```bash kubectl patch installation default --type=json \ -p '[{"op":"replace","path":"/spec/calicoNetwork/ipPools/0/encapsulation","value":"VXLAN"}]' ``` If your cluster has additional operator-managed IP pools, repeat the command for each, replacing `0` in `/spec/calicoNetwork/ipPools/0` with the index of the pool. Use `"None"` instead of `"VXLAN"` for BGP without encapsulation. **Tab: User managed IP pools** For `IPPool` resources created directly (not through the `Installation`), patch the `IPPool`. For VXLAN: ```bash kubectl patch ippool default-ipv4-ippool -p '{"spec":{"ipipMode":"Never","vxlanMode":"Always"}}' ``` For BGP without encapsulation, set both modes to `Never`: ```bash kubectl patch ippool default-ipv4-ippool -p '{"spec":{"ipipMode":"Never","vxlanMode":"Never"}}' ``` - If using Calico IPAM, strict affinity of IPAM configuration must be set to `true`. ```bash kubectl patch ipamconfigurations default --type merge --patch='{"spec": {"strictAffinity": true}}' ``` > **SECONDARY:** For operator-managed Linux Calico clusters, three Linux worker nodes are required to meet the high-availability requirements for Typha, which only runs on Linux nodes. ### Windows platform requirements - Windows versions: - Windows Server 1809 (build 17763.1432 or later) - Windows Server 2022 (build 20348.169 or later) > **SECONDARY:** Windows Server version support differs for each Kubernetes version. Review the [Windows OS Version Support](https://kubernetes.io/docs/setup/production-environment/windows/intro-windows-in-kubernetes/#windows-os-version-support) table for the Windows Server versions supported by each Kubernetes version. #### Operator install requirements - Kubernetes v1.22+ - Enable HostProcess containers support. For Kubernetes v1.22, see [here](https://kubernetes.io/docs/tasks/configure-pod-container/create-hostprocess-pod/#before-you-begin). For Kubernetes v1.23+, HostProcess containers are enabled by default. - [containerd](https://kubernetes.io/docs/setup/production-environment/container-runtimes/#containerd) v1.6.0+ - The Windows nodes have joined the cluster. - See [this section of the operator install guide for example commands](https://docs.tigera.io/calico/latest/getting-started/kubernetes/windows-calico/operator.md#hpc-requirements). ### EKS requirements - The VPC controllers must be installed to run Windows pods. - An instance role on the Windows instance must have permissions to get `namespaces` and get `secrets` in the calico-system namespace (or kube-system namespace if you are using a non operator-managed Calico installation.) ### AKS requirements - Calico for Windows can be enabled only on newly created clusters. - Non-HPC Calico for Windows is available with Kubernetes version 1.20 or later ## Next steps [Install Calico for Windows using operator](https://docs.tigera.io/calico/latest/getting-started/kubernetes/windows-calico/operator.md)