Skip to main content
This documentation is designed to get you up and running with Talos and Calico CNI. Since both Calico and Talos support multiple networking technologies, you will learn how to run your environment with both the Calico eBPF dataplane and NFTables. Optionally, you can also enable Calico’s network observability stack to gain insights into your cluster networking and policy behavior.

​
Configuring Talos

To install Calico, you first need to disable the default CNI. This can be done by applying a patch file during cluster creation. The store the following YAML template in a file (patch.yaml). 
cluster:
  network:
    cni:
      name: none
After generating the patch file add the --config-patch argument to your talosctl gen config. 
talosctl gen config \
    my-cluster https://calico-talos.local:6443 \
    --config-patch @patch.yaml

​
Installing Tigera Operator

Recommended way to install Calico is via Tigera-operator manifest. The operator will make sure that all Calico components are always up and running.
Note: If you’d like to install Calico using Helm, check out the Install using Helm documentation.
Use the following command to install the latest Tigera operator. 
kubectl create -f https://docs.tigera.io/calico/latest/manifests/tigera-operator.yaml

​
Configuring Calico Networking

Calico has a pluggable dataplane architecture that lets you choose the networking technology based on your use case. You can configure the dataplane by setting the linuxDataplane key in the installation manifest.
Note: To learn more about the available Calico configurations, check out the Installation reference documentation.
  • NFTables
  • eBPF
Use the following command to run Calico with NFTables backend.
kubectl create -f -<<EOF
# This section includes base Calico installation configuration.
apiVersion: operator.tigera.io/v1
kind: Installation
metadata:
  name: default
spec:
  calicoNetwork:
    bgp: Disabled
    linuxDataplane: Nftables
    ipPools:
    - name: default-ipv4-ippool
      blockSize: 26
      cidr: 10.244.0.0/16
      encapsulation: VXLAN
      natOutgoing: Enabled
      nodeSelector: all()
  kubeletVolumePluginPath: None
---
apiVersion: operator.tigera.io/v1
kind: APIServer
metadata:
  name: default
EOF

​
Deploy Calico Whisker Network Observability Stack

Use the following command to enable Calico observability stack: 
kubectl create -f -<<EOF
# Configures the Calico Goldmane flow aggregator.
apiVersion: operator.tigera.io/v1
kind: Goldmane
metadata:
  name: default
---
# Configures the Calico Whisker observability UI.
apiVersion: operator.tigera.io/v1
kind: Whisker
metadata:
  name: default
EOF
Use the following command to access Calico Whisker: 
kubectl port-forward -n calico-system service/whisker 8081:8081
Fire up a browser and point it to localhost:8081 to observe your policies and network flows.

​
Next steps

  • Enable Calico Prometheus and Grafana integrations, click here to learn more.

​
Considerations

In eBPF mode, if you cannot disable kube-proxy for any reason please make sure to adjust BPFKubeProxyIptablesCleanupEnabled to false. This can be done with kubectl as follows: 
kubectl patch felixconfiguration default --patch='{"spec": {"bpfKubeProxyIptablesCleanupEnabled": false}}'