Requirements

What’s supported in this release

✓ Install:

  • Manual install for Kubernetes clusters on Windows nodes
  • Operator install for Kubernetes clusters using hostprocess containers (HPC) on Windows nodes

✓ Platforms: Kubernetes, OpenShift, RKE, EKS, AKS

✓ Networking:

  • Kubernetes, on-premises: Calico CNI with BGP or VXLAN
  • OpenShift: Calico CNI with BGP or VXLAN
  • Rancher Kubernetes Engine: Calico CNI with BGP or VXLAN
  • EKS: VPC CNI
  • AKS: Azure CNI

Requirements

Because the Kubernetes and Calico control components do not run on Windows yet, a hybrid Linux/Windows cluster is required.

CNI and networking options

The following table summarizes the networking options and considerations.

NetworkingComponentsValue/Content
Calico BGPWindows CNI plugin:

calico.exe

Linux: Calico for policy and networking		Calico’s native networking approach, supports:
- Auto-configured node-to-node BGP mesh over an L2 fabric
- Peering with external routers for an L3 fabric
- Calico IPAM and IP aggregation (with some limitations)
- Route reflectors (including the new in-cluster route reflector introduced in Calico v3.3). Note: Windows node cannot act as route reflectors.
- Kubernetes API datastore driver

AWS users: If running on AWS, you must disable the source/dest check on your EC2 instances so that hosts can forward traffic on behalf of pods.
Calico VXLANWindows CNI plugin:
calico.exe

Linux: Calico for policy and networking		Calico’s VXLAN overlay, supports:

- VXLAN overlay, which can traverse most networks.
- Auto-configured node-to-node routing
- Calico IPAM and IP aggregation (with some limitations)
- Kubernetes API datastore driver
Note: VXLAN runs on UDP port 4789 (this is the only port supported by Windows), remember to open that port between your Calico hosts in any firewalls / security groups.
Cloud providerWindows CNI plugin: win-bridge.exe

Linux: Calico policy-only		A useful fallback, particularly if you have a Kubernetes cloud provider that automatically installs inter-host routes. Calico has been tested with the standard win-bridge.exe CNI plugin so it should work with any networking provider that ultimately uses win-bridge.exe to network the pod (such as the Azure CNI plugin and cloud provider).

Requirements - 图1note

If Calico CNI with VXLAN is used, BGP must be disabled. See the installation reference.

Datastores

When using Operator install, only Kubernetes datastore (kdd) is supported. When using the manual install, either kdd or etcd may be used, but the datastore for the Windows node/Kubernetes cluster must be the same as the datastore for the Linux control node. (You cannot mix datastores in Calico for Windows.)

Kubernetes version

See the Kubernetes requirements.

When using Operator install and Windows hostprocess containers (HPC), see here for the additional requirements.

Earlier versions may work, but we do not actively test Calico for Windows against them, and they may have known issues and incompatibilities.

Linux platform requirements

  • At least one Linux Kubernetes worker node to run Calico’s cluster-wide components that meets Linux system requirements, and is installed with Calico. Calico v3.12+ is required for manual installs, and v3.27+ for Operator installs.
  • VXLAN or BGP without encapsulation is supported if using Calico CNI. IPIP (Calico’s default encapsulation mode) is not supported. Use the following command to turn off IPIP on the default IP pool.
  1. kubectl patch ippool default-ipv4-ippool -p '{"spec":{"ipipMode":"Never","vxlanMode":"Always"}}'
  • If using Calico IPAM, strict affinity of IPAM configuration must be set to true.
  1. kubectl patch ipamconfigurations default --type merge --patch='{"spec": {"strictAffinity": true}}'

Requirements - 图2note

For operator-managed Linux Calico clusters, three Linux worker nodes are required to meet the high-availability requirements for Typha, which only runs on Linux nodes.

Windows platform requirements

  • Windows versions:

    • Windows Server 1809 (build 17763.1432 or later)
    • Windows Server 2022 (build 20348.169 or later)

    Requirements - 图3note

    Windows Server version support differs for each Kubernetes version. Review the Windows OS Version Support table for the Windows Server versions supported by each Kubernetes version.

Operator install requirements

Manual install requirements

The Calico for Windows standard manual installation is distributed as a .zip archive.

Requirements - 图4note

The manual method for installing Calico for Windows is deprecated in favor of using the Operator and Windows HostProcess containers (HPC). Support for this method will be dropped in a future Calico version.

  • Be able to run commands as Administrator using PowerShell.
  • Container runtime: Docker or containerd is installed and running. If containerd is running, it will be used as the container runtime otherwise Docker is assumed.
  • Remote access to the Windows node via Remote Desktop Protocol (RDP), Windows Remote Management (WinRM) or ssh.
  • If you are using Calico BGP networking, the RemoteAccess service must be installed for the Windows BGP Router.
  • Windows nodes support only a single IP pool type (so, if using a VXLAN pool, you should only use VXLAN throughout the cluster).
  • TLS v1.2 enabled. For example:
  1. [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

EKS requirements

  • The VPC controllers must be installed to run Windows pods.
  • An instance role on the Windows instance must have permissions to get namespaces and get secrets in the calico-system namespace (or kube-system namespace if you are using a non operator-managed Calico installation.)

AKS requirements

  • Calico for Windows can be enabled only on newly created clusters.
  • Non-HPC Calico for Windows is available with Kubernetes version 1.20 or later

Next steps

Install Calico for Windows using operator Install Calico for Windows using the manual installation method