Calico Enterprise 3.19 (latest) documentation

Microsoft Azure Kubernetes Service (AKS)

Big picture

Install Calico Enterprise on an AKS managed Kubernetes cluster.

CNI support

Calico CNI for networking with Calico Enterprise network policy

The geeky details of what you get:

Policy IPAM CNI Overlay Routing Datastore
Azure CNI networking with Calico Enterprise network policy

The geeky details of what you get:

Policy IPAM CNI Overlay Routing Datastore
Azure CNI with overlay networking with Calico Enterprise network policy

The geeky details of what you get:

Policy IPAM CNI Overlay Routing Datastore

Recommended

Set suggested value for maximum number of pods per node

It is recommended to set the maximum pods per node to be at least 60 for use with Calico Enterprise. The default value in AKS is 30. If you need to increase the number of pods per node, see Configure maximum pods per node.

Required

A compatible AKS cluster
- To use the Calico CNI, you must configure the AKS cluster with Bring your own CNI
- To use the Azure CNI, see Azure CNI networking
- To use the Azure CNI with overlay networking, see Azure CNI with Overlay
Cluster is not using a Kubernetes reconciler

If your cluster has an existing version of Calico Enterprise installed, verify that the cluster is not managed by any kind of Kubernetes reconciler. For example, if addon-manager exists, there will be an annotation called, addonmanager.kubernetes.io/mode on either of the following resources (if the resources exist):
- tigera-operator deployment in the tigera-operator namespace
- calico-node daemonset in the kube-system namespace
User account has IAM permissions

Verify your user account has IAM permissions to create Kubernetes ClusterRoles, ClusterRoleBindings, Deployments, Service Accounts, and Custom Resource Definitions. The easiest way to grant permissions is to assign the "Kubernetes Service Cluster Admin Role” to your user account. For help, see AKS access control.
Cluster meets system requirements
A Tigera license key and credentials
Install kubectl

Install the Tigera operator and custom resource definitions.

kubectl create -f https://downloads.tigera.io/ee/v3.19.4/manifests/tigera-operator.yaml

Install the Prometheus operator and related custom resource definitions. The Prometheus operator will be used to deploy Prometheus server and Alertmanager to monitor Calico Enterprise metrics.
note
If you have an existing Prometheus operator in your cluster that you want to use, skip this step. To work with Calico Enterprise, your Prometheus operator must be v0.40.0 or higher.
```
kubectl create -f https://downloads.tigera.io/ee/v3.19.4/manifests/tigera-prometheus-operator.yaml
```
Install your pull secret.
If pulling images directly from quay.io/tigera, you will likely want to use the credentials provided to you by your Tigera support representative. If using a private registry, use your private registry credentials instead.
```
kubectl create secret generic tigera-pull-secret \
    --type=kubernetes.io/dockerconfigjson -n tigera-operator \
    --from-file=.dockerconfigjson=<path/to/pull/secret>
```
Install any extra Calico Enterprise resources needed at cluster start using calicoctl.
Install the Tigera custom resources. For more information on configuration options available in this manifest, see the installation reference.
```
kubectl create -f https://downloads.tigera.io/ee/v3.19.4/manifests/aks/custom-resources.yaml
```
You can now monitor progress with the following command:
```
watch kubectl get tigerastatus
```

Wait until the apiserver shows a status of Available, then proceed to install the Calico Enterprise license.

Install the Tigera operator and custom resource definitions.

kubectl create -f https://downloads.tigera.io/ee/v3.19.4/manifests/tigera-operator.yaml

Install the Prometheus operator and related custom resource definitions. The Prometheus operator will be used to deploy Prometheus server and Alertmanager to monitor Calico Enterprise metrics.
note
If you have an existing Prometheus operator in your cluster that you want to use, skip this step. To work with Calico Enterprise, your Prometheus operator must be v0.40.0 or higher.
```
kubectl create -f https://downloads.tigera.io/ee/v3.19.4/manifests/tigera-prometheus-operator.yaml
```
Install your pull secret.
If pulling images directly from quay.io/tigera, you will likely want to use the credentials provided to you by your Tigera support representative. If using a private registry, use your private registry credentials instead.
```
kubectl create secret generic tigera-pull-secret \
    --type=kubernetes.io/dockerconfigjson -n tigera-operator \
    --from-file=.dockerconfigjson=<path/to/pull/secret>
```
Install any extra Calico Enterprise resources needed at cluster start using calicoctl.
Install the Tigera custom resources. For more information on configuration options available in this manifest, see the installation reference.
```
kubectl create -f https://downloads.tigera.io/ee/v3.19.4/manifests/aks/custom-resources-calico-cni.yaml
```
You can now monitor progress with the following command:
```
watch kubectl get tigerastatus
```

Wait until the apiserver shows a status of Available, then proceed to install the Calico Enterprise license.

In order to use Calico Enterprise, you must install the license provided to you by Tigera.

kubectl create -f </path/to/license.yaml>

You can now monitor progress with the following command:

watch kubectl get tigerastatus