Deploy Calico CNI

In this guide you will learn how to set up Calico CNI on Talos in two modes: eBPF and NFTables.

This guide sets up Calico CNI (Container Network Interface) on Talos and Omni. Calico supports two dataplane modes, eBPF and NFTables, and you can optionally enable Calico’s network observability stack to inspect cluster networking and policy behavior.

Step 1: Disable the default CNI

To install Calico, you first need to disable the default CNI. This can be done by applying a patch file during cluster creation.

Talos v1.14+

For Talos v1.14 and later, delete the default Flannel CNI document:

cat <<'EOF' > patch.yaml
apiVersion: v1alpha1
kind: KubeFlannelCNIConfig
$patch: delete
EOF

Talos < v1.14

On Talos versions earlier than v1.14, set the CNI to none:

cat <<'EOF' > patch.yaml
cluster:
  network:
    cni:
      name: none
EOF

You’ll apply this patch along with the rest of the template in Step 2.

talosctl gen config \
    <cluster-name> https://<cluster-endpoint>:6443 \
    --config-patch-control-plane @patch.yaml

Step 2: Install Calico

Calico installs via the Tigera operator. Choose the tab that matches how you manage your cluster.

kubectl

Installing via the Tigera operator manifest keeps all Calico components running and up to date. To install with Helm instead, see the Helm installation guide.

1. Set the Calico version to install:
   export CALICO_VERSION=v3.31.4
   
2. Install the Tigera operator:
   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/${CALICO_VERSION}/manifests/tigera-operator.yaml
   
3. Configure the dataplane. See the Installation reference for all available options.

NFTables

kubectl create -f -<<EOF
apiVersion: operator.tigera.io/v1
kind: Installation
metadata:
  name: default
spec:
  calicoNetwork:
    bgp: Disabled
    linuxDataplane: Nftables
    ipPools:
    - name: default-ipv4-ippool
      blockSize: 26
      cidr: 10.244.0.0/16
      encapsulation: VXLAN
      natOutgoing: Enabled
      nodeSelector: all()
  kubeletVolumePluginPath: None
---
apiVersion: operator.tigera.io/v1
kind: APIServer
metadata:
  name: default
EOF

eBPF

Calico’s eBPF mode mounts cgroups from /sys/fs/cgroup instead of Talos’s default /var path. Set the cgroup path first:

kubectl create -f -<<EOF
apiVersion: crd.projectcalico.org/v1
kind: FelixConfiguration
metadata:
  name: default
spec:
  cgroupV2Path: "/sys/fs/cgroup"
EOF

Then apply the Installation resource. Three fields matter here: set linuxDataplane to BPF, bpfNetworkBootstrap to Enabled, and kubeProxyManagement to Enabled so the operator disables kube-proxy automatically.

kubectl create -f -<<EOF
apiVersion: operator.tigera.io/v1
kind: Installation
metadata:
  name: default
spec:
  calicoNetwork:
    bgp: Disabled
    linuxDataplane: BPF
    bpfNetworkBootstrap: Enabled
    kubeProxyManagement: Enabled
    ipPools:
    - name: default-ipv4-ippool
      blockSize: 26
      cidr: 10.244.0.0/16
      encapsulation: VXLAN
      natOutgoing: Enabled
      nodeSelector: all()
  kubeletVolumePluginPath: None
EOF

Omni manifest sync

Omni installs Calico by referencing manifests in a cluster template, using the manifest sync feature.

1. Set the Calico version to install:
   export CALICO_VERSION=v3.31.4
   
2. Download the Tigera operator manifest:
   curl -Lo tigera-operator.yaml https://raw.githubusercontent.com/projectcalico/calico/${CALICO_VERSION}/manifests/tigera-operator.yaml
   
3. Create an installation.yaml file with your dataplane configuration:

NFTables

apiVersion: operator.tigera.io/v1
kind: Installation
metadata:
  name: default
spec:
  calicoNetwork:
    bgp: Disabled
    linuxDataplane: Nftables
    ipPools:
    - name: default-ipv4-ippool
      blockSize: 26
      cidr: 10.244.0.0/16
      encapsulation: VXLAN
      natOutgoing: Enabled
      nodeSelector: all()
  kubeletVolumePluginPath: None
---
apiVersion: operator.tigera.io/v1
kind: APIServer
metadata:
  name: default

eBPF

Calico’s eBPF mode mounts cgroups from /sys/fs/cgroup instead of Talos’s default /var path, so installation.yaml also needs a FelixConfiguration resource:

apiVersion: crd.projectcalico.org/v1
kind: FelixConfiguration
metadata:
  name: default
spec:
  cgroupV2Path: "/sys/fs/cgroup"
---
apiVersion: operator.tigera.io/v1
kind: Installation
metadata:
  name: default
spec:
  calicoNetwork:
    bgp: Disabled
    linuxDataplane: BPF
    bpfNetworkBootstrap: Enabled
    kubeProxyManagement: Enabled
    ipPools:
    - name: default-ipv4-ippool
      blockSize: 26
      cidr: 10.244.0.0/16
      encapsulation: VXLAN
      natOutgoing: Enabled
      nodeSelector: all()
  kubeletVolumePluginPath: None
---
apiVersion: operator.tigera.io/v1
kind: APIServer
metadata:
  name: default

4. Reference both manifests in your Omni cluster template:

Talos v1.14+

For Talos v1.14 and later, disable the default CNI with the KubeFlannelCNIConfig document:

Talos < v1.14

On Talos versions earlier than v1.14, disable the default CNI with cni.name: none:

5. Apply the cluster template:
   omnictl cluster template sync --file cluster-template.yaml
   

Omni waits until the Kubernetes API is available and the cluster is healthy before applying the manifests. See Sync Kubernetes manifests for more on manifest sync modes and status monitoring.

Step 3: Enable network observability (optional)

Calico’s Whisker stack adds a UI for observing cluster networking and policy behavior. This step works with either installation method above.

1. Deploy the Goldmane flow aggregator and the Whisker UI:

kubectl create -f -<<EOF
apiVersion: operator.tigera.io/v1
kind: Goldmane
metadata:
  name: default
---
apiVersion: operator.tigera.io/v1
kind: Whisker
metadata:
  name: default
EOF

2. Port-forward the Whisker service:

kubectl port-forward -n calico-system service/whisker 8081:8081

3. Open localhost:8081 in a browser to view policies and network flows.

Considerations

In eBPF mode, if you can’t disable kube-proxy, set bpfKubeProxyIptablesCleanupEnabled to false:

kubectl patch felixconfiguration default --patch='{"spec": {"bpfKubeProxyIptablesCleanupEnabled": false}}'

Next steps

• Enable Calico’s Prometheus and Grafana integrations for further observability.