Skip to main content
Version: 3.28 (latest)

Install Calico networking and network policy for on-premises deployments

Big picture

Install Calico to provide both networking and network policy for self-managed on-premises deployments.


Calico networking and network policy are a powerful choice for a CaaS implementation. If you have the networking infrastructure and resources to manage Kubernetes on-premises, installing the full Calico product provides the most customization and control.


Calico operator

Calico is installed by an operator which manages the installation, upgrade, and general lifecycle of a Calico cluster. The operator is installed directly on the cluster as a Deployment, and is configured through one or more custom Kubernetes API resources.

Calico manifests

Calico can also be installed using raw manifests as an alternative to the operator. The manifests contain the necessary resources for installing Calico on each node in your Kubernetes cluster. Using manifests is not recommended as they cannot automatically manage the lifecycle of the Calico as the operator does. However, manifests may be useful for clusters that require highly specific modifications to the underlying Kubernetes resources.

Before you begin...

How to

Install Calico

  1. Install the operator on your cluster.

    kubectl create -f
  2. Download the custom resources necessary to configure Calico.

    curl -O

    If you wish to customize the Calico install, customize the downloaded custom-resources.yaml manifest locally.

  3. Create the manifest to install Calico.

    kubectl create -f custom-resources.yaml
  4. Verify Calico installation in your cluster.

    watch kubectl get pods -n calico-system

    You should see a result similar to the below.

    NAMESPACE     NAME                READY   STATUS                  RESTARTS         AGE
    kube-system calico-node-txngh 1/1 Running 0 54s

Next steps


Recommended - Networking

  • If you are using the default BGP networking with full-mesh node-to-node peering with no encapsulation, go to Configure BGP peering to get traffic flowing between pods.
  • If you are unsure about networking options, or want to implement encapsulation (overlay networking), see Determine best networking option.

Recommended - Security