--- title: "Operations" description: "Day-2 operations for Calico Open Source clusters covering upgrades, calicoctl, certificate management, monitoring, image registries, eBPF, and troubleshooting." product: "Calico Open Source" version: "3.32 (latest)" section: "Operations" canonical_url: "https://docs.tigera.io/calico/latest/operations/" --- # Operations Post-installation tasks for managing Calico. ## Upgrading Calico ##### [Upgrade Calico on Kubernetes](https://docs.tigera.io/calico/latest/operations/upgrading/kubernetes-upgrade.md) [Upgrade Calico Open Source on Kubernetes from v3.15 or later for Helm, operator-managed, and manifest-based installs on both Kubernetes API and etcd datastores.](https://docs.tigera.io/calico/latest/operations/upgrading/kubernetes-upgrade.md) ##### [Upgrade Calico on OpenShift 4](https://docs.tigera.io/calico/latest/operations/upgrading/openshift-upgrade.md) [Upgrade Calico Open Source on OpenShift 4 by reapplying manifests and updating OwnerReferences for projectcalico.org/v3 resources.](https://docs.tigera.io/calico/latest/operations/upgrading/openshift-upgrade.md) ##### [Upgrade Calico on OpenStack](https://docs.tigera.io/calico/latest/operations/upgrading/openstack-upgrade.md) [Upgrade Calico Open Source on OpenStack from v3.0 or later by updating system packages on CentOS or Ubuntu compute and control nodes.](https://docs.tigera.io/calico/latest/operations/upgrading/openstack-upgrade.md) ## calicoctl ##### [Install calicoctl](https://docs.tigera.io/calico/latest/operations/calicoctl/install.md) [Install the calicoctl command-line tool as a binary or container so administrators can manage Calico Open Source resources from any workstation.](https://docs.tigera.io/calico/latest/operations/calicoctl/install.md) ##### [Configure calicoctl](https://docs.tigera.io/calico/latest/operations/calicoctl/configure/overview.md) [Overview reference for configuring calicoctl datastore access in Calico Open Source, comparing config-file, environment-variable, and kubeconfig credential methods.](https://docs.tigera.io/calico/latest/operations/calicoctl/configure/overview.md) ##### [Configure calicoctl to connect to an etcd datastore](https://docs.tigera.io/calico/latest/operations/calicoctl/configure/etcd.md) [Sample calicoctl configuration files for connecting to an etcdv3 datastore in a Calico Open Source cluster, with TLS, endpoints, and authentication settings.](https://docs.tigera.io/calico/latest/operations/calicoctl/configure/etcd.md) ##### [Configure calicoctl to connect to the Kubernetes API datastore](https://docs.tigera.io/calico/latest/operations/calicoctl/configure/kdd.md) [Sample calicoctl configuration files for connecting to the Kubernetes API datastore in a Calico Open Source cluster using kubeconfig credentials.](https://docs.tigera.io/calico/latest/operations/calicoctl/configure/kdd.md) ## Deploy image options ##### [Install images by registry digest](https://docs.tigera.io/calico/latest/operations/image-options/imageset.md) [Pin Calico Open Source operator deployments to immutable image digests with an ImageSet resource so security teams can review and verify each image.](https://docs.tigera.io/calico/latest/operations/image-options/imageset.md) ##### [Configure use of your image registry](https://docs.tigera.io/calico/latest/operations/image-options/alternate-registry.md) [Configure Calico Open Source to pull operator and component images from a public or private container registry, including air-gapped and constrained networks.](https://docs.tigera.io/calico/latest/operations/image-options/alternate-registry.md) ## eBPF ##### [eBPF use cases](https://docs.tigera.io/calico/latest/operations/ebpf/use-cases-ebpf.md) [Guidance on when the Calico Open Source eBPF data plane fits a workload compared to the standard iptables data plane, with trade-offs and feature comparisons.](https://docs.tigera.io/calico/latest/operations/ebpf/use-cases-ebpf.md) ##### [Enabling the eBPF data plane](https://docs.tigera.io/calico/latest/operations/ebpf/enabling-ebpf.md) [Switch a running Calico Open Source cluster to the eBPF data plane through automatic Tigera Operator detection on kubeadm clusters or a manual configuration path.](https://docs.tigera.io/calico/latest/operations/ebpf/enabling-ebpf.md) ##### [Install in eBPF mode](https://docs.tigera.io/calico/latest/operations/ebpf/install.md) [Install Calico Open Source with the eBPF data plane during initial cluster setup as an alternative to the iptables data plane.](https://docs.tigera.io/calico/latest/operations/ebpf/install.md) ##### [Troubleshoot eBPF mode](https://docs.tigera.io/calico/latest/operations/ebpf/troubleshoot-ebpf.md) [Troubleshooting guide for the Calico Open Source eBPF data plane covering verification logs, service connectivity, BPF map inspection, and common failure modes.](https://docs.tigera.io/calico/latest/operations/ebpf/troubleshoot-ebpf.md) ## Monitoring ##### [Monitor Calico component metrics](https://docs.tigera.io/calico/latest/operations/monitor/monitor-component-metrics.md) [Scrape Calico Open Source Felix, Typha, and kube-controllers metrics with open-source Prometheus and configure alerting rules from time-series data.](https://docs.tigera.io/calico/latest/operations/monitor/monitor-component-metrics.md) ##### [Visualizing metrics via Grafana](https://docs.tigera.io/calico/latest/operations/monitor/monitor-component-visual.md) [Visualize Calico Open Source component metrics scraped by Prometheus on Grafana dashboards to spot anomalies in Felix, Typha, and node performance.](https://docs.tigera.io/calico/latest/operations/monitor/monitor-component-visual.md) ## Troubleshooting ##### [Troubleshooting and diagnostics](https://docs.tigera.io/calico/latest/operations/troubleshoot/troubleshooting.md) [Troubleshooting guide for Calico Open Source clusters covering diagnostics, common failure patterns, log severity tuning, and where to file upstream issues.](https://docs.tigera.io/calico/latest/operations/troubleshoot/troubleshooting.md) ##### [Troubleshooting commands](https://docs.tigera.io/calico/latest/operations/troubleshoot/commands.md) [Reference of command-line tools and kubectl invocations for verifying cluster, routing, and component health in a Calico Open Source installation.](https://docs.tigera.io/calico/latest/operations/troubleshoot/commands.md) ##### [Component logs](https://docs.tigera.io/calico/latest/operations/troubleshoot/component-logs.md) [Reference for locating and collecting Calico Open Source component logs including calico/node, Felix, Typha, kube-controllers, and CNI plugin output.](https://docs.tigera.io/calico/latest/operations/troubleshoot/component-logs.md) ##### [VPP data plane troubleshooting](https://docs.tigera.io/calico/latest/operations/troubleshoot/vpp.md) [Troubleshooting guide for the Calico Open Source VPP data plane covering log collection, diagnostic helpers, and recovery from common VPP failure modes.](https://docs.tigera.io/calico/latest/operations/troubleshoot/vpp.md) ## Other operations tasks ##### [Migrate Calico data from an etcdv3 datastore to a Kubernetes datastore](https://docs.tigera.io/calico/latest/operations/datastore-migration.md) [Migrate a Calico Open Source cluster from the etcdv3 datastore to the Kubernetes API datastore with calicoctl, preserving network and policy state on a live cluster.](https://docs.tigera.io/calico/latest/operations/datastore-migration.md) ##### [Migrate Calico to an operator-managed installation](https://docs.tigera.io/calico/latest/operations/operator-migration.md) [Migrate a Calico Open Source installation from manifest-based resources to an operator-managed install for automatic platform detection, simpler upgrades, and lifecycle management.](https://docs.tigera.io/calico/latest/operations/operator-migration.md) ##### [Enable kubectl to manage Calico APIs](https://docs.tigera.io/calico/latest/operations/install-apiserver.md) [Install the Calico Open Source aggregated API server on an existing cluster so kubectl can manage projectcalico.org/v3 resources without calicoctl.](https://docs.tigera.io/calico/latest/operations/install-apiserver.md) ##### [Decommission a node](https://docs.tigera.io/calico/latest/operations/decommissioning-a-node.md) [Manually decommission a node in a self-managed Calico Open Source cluster with calicoctl, releasing IP allocations and BGP peers from the datastore cleanly.](https://docs.tigera.io/calico/latest/operations/decommissioning-a-node.md) ##### [FIPS mode](https://docs.tigera.io/calico/latest/operations/fips.md) [Run Calico Open Source in FIPS 140-2 compliant mode using NIST-validated cryptographic modules and FIPS-approved algorithms across all data plane components.](https://docs.tigera.io/calico/latest/operations/fips.md) ##### [Manage TLS certificates used by Calico](https://docs.tigera.io/calico/latest/operations/certificate-management.md) [Manage TLS certificates for Calico Open Source components by controlling the certificate issuer through the Kubernetes Certificates API and operator configuration.](https://docs.tigera.io/calico/latest/operations/certificate-management.md)