Requirements

About Calico for Windows

Because the Kubernetes and Calico control components do not run on Windows yet, a hybrid Linux/Windows cluster is required. The Calico for Windows standard installation is distributed as a .zip archive.

What’s supported in this release

✓ Install: Manifest install for Kubernetes clusters

✓ Platforms: Kubernetes, OpenShift, RKE, EKS, AKS

✓ Networking:

  • Kubernetes, on-premises: Calico CNI with BGP or VXLAN
  • OpenShift: Calico CNI with BGP or VXLAN
  • Rancher Kubernetes Engine: Calico CNI with BGP or VXLAN
  • EKS: VPC CNI
  • AKS: Azure CNI

Requirements

CNI and networking options

The following table summarizes the networking options and considerations.

NetworkingComponentsValue/Content
Calico BGPWindows CNI plugin:

calico.exeLinux: Calico for policy and networking		Calico’s native networking approach, supports:
- Auto-configured node-to-node BGP mesh over an L2 fabric
- Peering with external routers for an L3 fabric
- Calico IPAM and IP aggregation (with some limitations)
- Route reflectors (including the new in-cluster route reflector introduced in Calico v3.3). Note: Windows node cannot act as route reflectors.
- Kubernetes API datastore driver

AWS users: If running on AWS, you must disable the source/dest check on your EC2 instances so that hosts can forward traffic on behalf of pods.
Calico VXLANWindows CNI plugin:
calico.exe

Linux: Calico for policy and networking		Calico’s VXLAN overlay, supports:

- VXLAN overlay, which can traverse most networks.
- Auto-configured node-to-node routing
- Calico IPAM and IP aggregation (with some limitations)
- Kubernetes API datastore driver
Note: VXLAN runs on UDP port 4789 (this is the only port supported by Windows), remember to open that port between your Calico hosts in any firewalls / security groups.
Cloud providerWindows CNI plugin: win-bridge.exe

Linux: Calico policy-only		A useful fallback, particularly if you have a Kubernetes cloud provider that automatically installs inter-host routes. Calico has been tested with the standard win-bridge.exe CNI plugin so it should work with any networking provider that ultimately uses win-bridge.exe to network the pod (such as the Azure CNI plugin and cloud provider).

Requirements - 图1note

If Calico CNI with VXLAN is used, BGP must be disabled. See the installation reference.

Datastores

Whether you use etcd or Kubernetes datastore (kdd), the datastore for the Windows node/Kubernetes cluster must be the same as the datastore for the Linux control node. (You cannot mix datastores in Calico for Windows.)

Kubernetes version

See the Kubernetes requirements.

Earlier versions may work, but we do not actively test Calico for Windows against them, and they may have known issues and incompatibilities.

Linux platform requirements

  • At least one Linux Kubernetes worker node to run Calico’s cluster-wide components that meets Linux system requirements, and is installed with Calico v3.12+.
  • VXLAN or BGP without encapsulation is supported if using Calico CNI. IPIP (Calico’s default encapsulation mode) is not supported. Use the following command to turn off IPIP.
  1. calicoctl patch felixconfiguration default -p '{"spec":{"ipipEnabled":false}}'
  • If using Calico IPAM, strict affinity of IPAM configuration must be set to true.
  1. kubectl patch ipamconfigurations default --type merge --patch='{"spec": {"strictAffinity": true}}'

Requirements - 图2note

For operator-managed Linux Calico clusters, three Linux worker nodes are required in order to meet high-availability requirements for Typha.

Windows platform requirements

  • Windows versions:

    • Windows Server 1809 (build 17763.1432 or later)
    • Windows Server 2022 (build 20348.169 or later)

    Requirements - 图3note

    Windows Server version support differs for each Kubernetes version. Review the Windows OS Version Support table for the Windows Server versions supported by each Kubernetes version.

  • Be able to run commands as Administrator using PowerShell.

  • Container runtime: Docker or containerd is installed and running. If containerd is running, it will be used as the container runtime otherwise Docker is assumed.

  • Remote access to the Windows node via Remote Desktop Protocol (RDP) or Windows Remote Management (WinRM)

  • If you are using Calico BGP networking, the RemoteAccess service must be installed for the Windows BGP Router.

  • Windows nodes support only a single IP pool type (so, if using a VXLAN pool, you should only use VXLAN throughout the cluster).

  • TLS v1.2 enabled. For example:

  1. [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

EKS requirements

  • The VPC controllers must be installed to run Windows pods.
  • An instance role on the Windows instance must have permissions to get namespaces and get secrets in the calico-system namespace (or kube-system namespace if you are using a non operator-managed Calico installation.)

AKS requirements

  • Calico for Windows can be enabled only on newly created clusters.
  • Available with Kubernetes version 1.20 or later

Next steps

Install Calico for Windows