--- title: "Operations" description: "Day-2 operations for Calico Enterprise clusters covering upgrades, web console access, CLIs, certificate management, log storage, monitoring, eBPF, and troubleshooting." product: "Calico Enterprise" version: "3.23 (latest)" section: "Operations" canonical_url: "https://docs.tigera.io/calico-enterprise/latest/operations/" --- # Operations Post-installation tasks for managing Calico Enterprise. ## Configuring the web console ##### [Configure access to the web console](https://docs.tigera.io/calico-enterprise/latest/operations/cnx/access-the-manager.md) [Expose the Calico Enterprise web console outside the cluster through ingress, a load balancer service, or port forwarding for administrator access.](https://docs.tigera.io/calico-enterprise/latest/operations/cnx/access-the-manager.md) ##### [Authentication quickstart](https://docs.tigera.io/calico-enterprise/latest/operations/cnx/authentication-quickstart.md) [Sign in to the Calico Enterprise web console and Kibana with default service-account token authentication for a quick first-time setup.](https://docs.tigera.io/calico-enterprise/latest/operations/cnx/authentication-quickstart.md) ##### [Configure an external identity provider](https://docs.tigera.io/calico-enterprise/latest/operations/cnx/configure-identity-provider.md) [Connect an external identity provider to Calico Enterprise so users authenticate against an existing IdP when signing in to the web console and Kibana.](https://docs.tigera.io/calico-enterprise/latest/operations/cnx/configure-identity-provider.md) ##### [Configure user roles and permissions](https://docs.tigera.io/calico-enterprise/latest/operations/cnx/roles-and-permissions.md) [Configure Kubernetes RBAC roles and bindings to scope user access to Calico Enterprise features, tiered policies, observability views, and management plane APIs.](https://docs.tigera.io/calico-enterprise/latest/operations/cnx/roles-and-permissions.md) ## calicoctl and calicoq ##### [Install calicoctl](https://docs.tigera.io/calico-enterprise/latest/operations/clis/calicoctl/install.md) [Install the calicoctl command-line tool as a binary or container so administrators can manage Calico Enterprise resources from any workstation.](https://docs.tigera.io/calico-enterprise/latest/operations/clis/calicoctl/install.md) ##### [Configure calicoctl](https://docs.tigera.io/calico-enterprise/latest/operations/clis/calicoctl/configure/overview.md) [Overview reference for configuring calicoctl datastore access in Calico Enterprise, comparing config-file, environment-variable, and kubeconfig methods.](https://docs.tigera.io/calico-enterprise/latest/operations/clis/calicoctl/configure/overview.md) ##### [Configure calicoctl to connect to the datastore](https://docs.tigera.io/calico-enterprise/latest/operations/clis/calicoctl/configure/datastore.md) [Sample calicoctl configuration for connecting to the Kubernetes API datastore in a Calico Enterprise cluster, with kubeconfig credential settings.](https://docs.tigera.io/calico-enterprise/latest/operations/clis/calicoctl/configure/datastore.md) ##### [Install calicoq](https://docs.tigera.io/calico-enterprise/latest/operations/clis/calicoq/installing.md) [Install the calicoq command-line tool as a binary or container on any host with network access to the Calico Enterprise datastore.](https://docs.tigera.io/calico-enterprise/latest/operations/clis/calicoq/installing.md) ##### [Configure calicoq](https://docs.tigera.io/calico-enterprise/latest/operations/clis/calicoq/configure/overview.md) [Overview reference for configuring calicoq datastore access in Calico Enterprise, covering config files, environment variables, and Kubernetes credentials.](https://docs.tigera.io/calico-enterprise/latest/operations/clis/calicoq/configure/overview.md) ##### [Configure calicoq to connect to the datastore](https://docs.tigera.io/calico-enterprise/latest/operations/clis/calicoq/configure/datastore.md) [Sample calicoq configuration for connecting to the Kubernetes API datastore in a Calico Enterprise cluster, with kubeconfig credential settings.](https://docs.tigera.io/calico-enterprise/latest/operations/clis/calicoq/configure/datastore.md) ## Securing component communications See [Provide TLS certificates for Calico Enterprise components](https://docs.tigera.io/calico-enterprise/latest/operations/comms.md) for the consolidated TLS reference. ## Storage ##### [Log storage recommendations](https://docs.tigera.io/calico-enterprise/latest/operations/logstorage/log-storage-recommendations.md) [Reference recommendations for Calico Enterprise log storage covering Elastic Cloud on Kubernetes, StorageClasses, node sizing, and production capacity.](https://docs.tigera.io/calico-enterprise/latest/operations/logstorage/log-storage-recommendations.md) ##### [Configure storage for logs and reports](https://docs.tigera.io/calico-enterprise/latest/operations/logstorage/create-storage.md) [Configure persistent storage in Calico Enterprise for flow logs, DNS logs, audit logs, and compliance reports before installation.](https://docs.tigera.io/calico-enterprise/latest/operations/logstorage/create-storage.md) ##### [Adjust log storage size](https://docs.tigera.io/calico-enterprise/latest/operations/logstorage/adjust-log-storage-size.md) [Resize the Calico Enterprise log storage cluster by tuning node counts, replicas, CPU, and memory during or after installation for production workloads.](https://docs.tigera.io/calico-enterprise/latest/operations/logstorage/adjust-log-storage-size.md) ##### [Advanced Node Scheduling](https://docs.tigera.io/calico-enterprise/latest/operations/logstorage/advanced-node-scheduling.md) [Steer Calico Enterprise Elasticsearch pod and replica placement across Kubernetes nodes with data-node selectors and shard scheduling controls.](https://docs.tigera.io/calico-enterprise/latest/operations/logstorage/advanced-node-scheduling.md) ## Monitoring ##### [Prometheus support](https://docs.tigera.io/calico-enterprise/latest/operations/monitor/prometheus/support.md) [Reference for Prometheus support in Calico Enterprise covering the bundled operator-managed install and bring-your-own Prometheus deployment options.](https://docs.tigera.io/calico-enterprise/latest/operations/monitor/prometheus/support.md) ##### [Bring your own Prometheus](https://docs.tigera.io/calico-enterprise/latest/operations/monitor/prometheus/byo-prometheus.md) [Scrape Calico Enterprise component metrics from an existing bring-your-own Prometheus deployment instead of the bundled operator-managed Prometheus.](https://docs.tigera.io/calico-enterprise/latest/operations/monitor/prometheus/byo-prometheus.md) ##### [Configure Prometheus](https://docs.tigera.io/calico-enterprise/latest/operations/monitor/prometheus/configure-prometheus.md) [Configure Calico Enterprise Prometheus rules for denied-packet alerts and persistent storage by editing the bundled PrometheusRule and StorageClass resources.](https://docs.tigera.io/calico-enterprise/latest/operations/monitor/prometheus/configure-prometheus.md) ##### [Configure Alertmanager](https://docs.tigera.io/calico-enterprise/latest/operations/monitor/prometheus/alertmanager.md) [Configure Alertmanager in a Calico Enterprise cluster to route Prometheus alerts to operators with deduplication, grouping, silencing, and inhibition rules.](https://docs.tigera.io/calico-enterprise/latest/operations/monitor/prometheus/alertmanager.md) ##### [Recommended Prometheus metrics](https://docs.tigera.io/calico-enterprise/latest/operations/monitor/metrics/recommended-metrics.md) [Recommended Prometheus metrics for Calico Enterprise Typha, Felix, and policy components, covering the signals most critical to cluster health.](https://docs.tigera.io/calico-enterprise/latest/operations/monitor/metrics/recommended-metrics.md) ##### [BGP metrics](https://docs.tigera.io/calico-enterprise/latest/operations/monitor/metrics/bgp-metrics.md) [Monitor BGP peering and route exchange in Calico Enterprise clusters by defining Prometheus rules and thresholds for peer health and route counts.](https://docs.tigera.io/calico-enterprise/latest/operations/monitor/metrics/bgp-metrics.md) ##### [Policy metrics](https://docs.tigera.io/calico-enterprise/latest/operations/monitor/metrics/policy-metrics.md) [Monitor the runtime effect of Calico Enterprise policies on cluster traffic by defining Prometheus rules and thresholds that fire alerts on policy hits.](https://docs.tigera.io/calico-enterprise/latest/operations/monitor/metrics/policy-metrics.md) ##### [Elasticsearch and Fluentd metrics](https://docs.tigera.io/calico-enterprise/latest/operations/monitor/metrics/elasticsearch-and-fluentd-metrics.md) [Track Calico Enterprise Elasticsearch and Fluentd metrics in Prometheus to alert on flow, DNS, audit, and compliance log collection or storage disruptions.](https://docs.tigera.io/calico-enterprise/latest/operations/monitor/metrics/elasticsearch-and-fluentd-metrics.md) ##### [License metrics](https://docs.tigera.io/calico-enterprise/latest/operations/monitor/metrics/license-agent.md) [Monitor Calico Enterprise license metrics such as how many days until license expires.](https://docs.tigera.io/calico-enterprise/latest/operations/monitor/metrics/license-agent.md) ## eBPF ##### [eBPF use cases](https://docs.tigera.io/calico-enterprise/latest/operations/ebpf/use-cases-ebpf.md) [Guidance on when the Calico Enterprise eBPF data plane fits a workload compared to the standard iptables data plane, with trade-offs and feature comparisons.](https://docs.tigera.io/calico-enterprise/latest/operations/ebpf/use-cases-ebpf.md) ##### [Enable eBPF on an existing cluster](https://docs.tigera.io/calico-enterprise/latest/operations/ebpf/enabling-ebpf.md) [Switch a running Calico Enterprise cluster to the eBPF data plane on an existing installation as an alternative to the iptables data plane.](https://docs.tigera.io/calico-enterprise/latest/operations/ebpf/enabling-ebpf.md) ##### [Install in eBPF mode](https://docs.tigera.io/calico-enterprise/latest/operations/ebpf/install.md) [Install Calico Enterprise with the eBPF data plane during initial cluster setup as an alternative to the iptables data plane.](https://docs.tigera.io/calico-enterprise/latest/operations/ebpf/install.md) ##### [Troubleshoot eBPF mode](https://docs.tigera.io/calico-enterprise/latest/operations/ebpf/troubleshoot-ebpf.md) [Troubleshooting guide for the Calico Enterprise eBPF data plane covering verification logs, service connectivity, BPF map inspection, and common failure modes.](https://docs.tigera.io/calico-enterprise/latest/operations/ebpf/troubleshoot-ebpf.md) ## Troubleshooting ##### [Troubleshooting and diagnostics](https://docs.tigera.io/calico-enterprise/latest/operations/troubleshoot/troubleshooting.md) [Troubleshooting guide for Calico Enterprise clusters covering calicoctl diagnostics bundles, log severity tuning, common failure patterns, and where to report issues.](https://docs.tigera.io/calico-enterprise/latest/operations/troubleshoot/troubleshooting.md) ##### [Troubleshooting commands](https://docs.tigera.io/calico-enterprise/latest/operations/troubleshoot/commands.md) [Reference of command-line tools and kubectl invocations for verifying cluster, routing, policy, and component health in Calico Enterprise.](https://docs.tigera.io/calico-enterprise/latest/operations/troubleshoot/commands.md) ##### [Component logs](https://docs.tigera.io/calico-enterprise/latest/operations/troubleshoot/component-logs.md) [Reference for locating and collecting Calico Enterprise component logs including calico/node, Felix, Typha, Linseed, and observability stack output.](https://docs.tigera.io/calico-enterprise/latest/operations/troubleshoot/component-logs.md) ## Other operations tasks ##### [Decommission a node](https://docs.tigera.io/calico-enterprise/latest/operations/decommissioning-a-node.md) [Manually decommission a node in a Calico Enterprise cluster, releasing IP allocations and BGP peers from the cluster datastore cleanly.](https://docs.tigera.io/calico-enterprise/latest/operations/decommissioning-a-node.md) ##### [License expiration and renewal](https://docs.tigera.io/calico-enterprise/latest/operations/license-options.md) [Track Calico Enterprise license expiration through tigerastatus and license agent Prometheus metrics to keep observability and management features available.](https://docs.tigera.io/calico-enterprise/latest/operations/license-options.md)