• https://docs.tigera.io/calico/latest/getting-started/kubernetes/quickstart
• https://github.com/projectcalico/calico/releases

Install Calico¶

Set the version to the latest release from the releases page (v3.29.2 was the version these notes were written against):

CALICO_VERSION=v3.29.2

1. Install the Tigera operator¶

kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/${CALICO_VERSION}/manifests/tigera-operator.yaml

Use kubectl create, not apply. The operator's CRDs are too large for the last-applied-configuration annotation that apply writes, so apply fails.

2. Configure and create the custom resources¶

The stock custom-resources.yaml uses 192.168.0.0/16 as the pod CIDR. Download it and set the CIDR to whatever was passed to kubeadm init --pod-network-cidr:

curl -fsSLO https://raw.githubusercontent.com/projectcalico/calico/${CALICO_VERSION}/manifests/custom-resources.yaml
sed -i 's|cidr: 192.168.0.0/16|cidr: 10.244.0.0/16|' custom-resources.yaml
kubectl create -f custom-resources.yaml

On multi-NIC nodes, also pin the interface Calico uses for node addresses. Otherwise it may autodetect the wrong one; see MetalLB troubleshooting. In the Installation resource:

spec:
  calicoNetwork:
    nodeAddressAutodetectionV4:
      interface: "eth0"        # or: canReach: 10.0.0.1

Verify¶

watch kubectl get tigerastatus
kubectl get pods -n calico-system
kubectl get nodes

All tigerastatus entries should report AVAILABLE=True, and every node should go Ready.

Firewall ports¶

If the nodes run a host firewall, open these between nodes. Which ones you need depends on the encapsulation: