--- title: "Install calicoctl" description: "Install the calicoctl command-line tool as a binary or container so administrators can manage Calico Open Source resources from any workstation." product: "Calico Open Source" version: "3.32 (latest)" section: "Operations" canonical_url: "https://docs.tigera.io/calico/latest/operations/calicoctl/install" --- # Install calicoctl ## Big picture This guide helps you install the `calicoctl` command line tool to manage Calico resources and perform administrative functions. ## Value The `calicoctl` command line tool is required to use many of Calico's features. It is used to manage Calico policies and configuration, as well as view detailed cluster status. ## Concepts ### API groups All Kubernetes resources belong to an API group. The API group is indicated by the resource's `apiVersion`. For example, Calico uses resources in the `projectcalico.org/v3` API group for configuration, and the operator uses resources in the `operator.tigera.io/v1` API group. You can read more about API groups in [the Kubernetes documentation](https://kubernetes.io/docs/reference/using-api/#api-groups). ### calicoctl and kubectl To manage Calico APIs in the `projectcalico.org/v3` API group, you should use `calicoctl`. This is because `calicoctl` provides important validation and defaulting for these resources that is not available in `kubectl`. However, `kubectl` should still be used to manage other Kubernetes resources. > **SECONDARY:** If you would like to use `kubectl` to manage `projectcalico.org/v3` API resources, you can use the [Calico API server](https://docs.tigera.io/calico/latest/operations/install-apiserver.md). Alternatively, when using [native v3 CRDs](https://docs.tigera.io/calico/latest/operations/native-v3-crds.md), `kubectl` can manage `projectcalico.org/v3` resources directly as native CRDs without needing the API server or calicoctl for resource management. > **WARNING:** Never modify resources in the `crd.projectcalico.org` API group directly. These are internal data representations and modifying them directly may result in unexpected behavior. In addition to resource management, `calicoctl` also enables other Calico administrative tasks such as viewing IP pool utilization and BGP status. ### Datastore Calico objects are stored in one of two datastores, either etcd or Kubernetes. The choice of datastore is determined at the time Calico is installed. Typically for Kubernetes installations the Kubernetes datastore is the default. You can run `calicoctl` on any host with network access to the Calico datastore as either a binary or a container. For step-by-step instructions, refer to the section that corresponds to your desired deployment. ## How to > **SECONDARY:** Make sure you always install the version of `calicoctl` that matches the version of Calico running on your cluster. - [Install calicoctl as a binary on a single host](#install-calicoctl-as-a-binary-on-a-single-host) - [Install calicoctl as a container on a single host](#install-calicoctl-as-a-container-on-a-single-host) ### Install calicoctl as a binary on a single host **Tab: Linux** 1. Log into the host, open a terminal prompt, and navigate to the location where you want to install the binary. > **SUCCESS:** Consider navigating to a location that's in your `PATH`. For example, `/usr/local/bin/`. 2. Use the following commands to download the `calicoctl` binary. - AMD64: ```text curl -L https://github.com/projectcalico/calico/releases/download/v3.32.1/calicoctl-linux-amd64 -o calicoctl ``` - ARM64: ```text curl -L https://github.com/projectcalico/calico/releases/download/v3.32.1/calicoctl-linux-arm64 -o calicoctl ``` - PPC64le: ```text curl -L https://github.com/projectcalico/calico/releases/download/v3.32.1/calicoctl-linux-ppc64le -o calicoctl ``` 3. Set the file to be executable. ```bash chmod +x ./calicoctl ``` > **SECONDARY:** If the location of `calicoctl` is not already in your `PATH`, move the file to one that is or add its location to your `PATH`. This will allow you to invoke it without having to prepend its location. **Tab: macOS** 1. Log into the host, open a terminal prompt, and navigate to the location where you want to install the binary. > **SUCCESS:** Consider navigating to a location that's in your `PATH`. For example, `/usr/local/bin/`. 2. Use the following commands to download the `calicoctl` binary. - ARM64 (Apple Silicon): ```text curl -L https://github.com/projectcalico/calico/releases/download/v3.32.1/calicoctl-darwin-arm64 -o calicoctl ``` - AMD64 (Intel): ```text curl -L https://github.com/projectcalico/calico/releases/download/v3.32.1/calicoctl-darwin-amd64 -o calicoctl ``` 3. Set the file to be executable. ```bash chmod +x calicoctl ``` > **SECONDARY:** If you are faced with `cannot be opened because the developer cannot be verified` error when using `calicoctl` for the first time. go to `Applications > System Preferences > Security & Privacy` in the `General` tab at the bottom of the window click `Allow anyway`. > **SECONDARY:** If the location of `calicoctl` is not already in your `PATH`, move the file to one that is or add its location to your `PATH`. This will allow you to invoke it without having to prepend its location. **Tab: Windows** 1. Use the following PowerShell command to download the `calicoctl` binary. > **SUCCESS:** Consider running PowerShell as administrator and navigating to a location that's in your `PATH`. For example, `C:\Windows`. ```text Invoke-WebRequest -Uri "https://github.com/projectcalico/calico/releases/download/v3.32.1/calicoctl-windows-amd64.exe" -OutFile "calicoctl.exe" ``` ### Install calicoctl as a container on a single host To install `calicoctl` as a container on a single host, log into the target host and issue the following command. ```bash docker pull calico/ctl:v3.32.1 ``` **Next step**: [Configure `calicoctl` to connect to your datastore](https://docs.tigera.io/calico/latest/operations/calicoctl/configure.md).