projectcalico · coutinhop · Feb 4, 2026 · Feb 3, 2026 · Feb 3, 2026 · Feb 3, 2026
@@ -1,11 +1,16 @@
-.aso_installed
+.aso-installed
+.calico-installed
+.kubeadm-set-up
+.vmss-created
 .sshkey
 .sshkey.pub
-.vmss-created
 cert-manager.yaml
 connect.txt
 infra/manifests/
+EE/manifests/
+OSS/manifests/
 kind-kubeconfig
+kubeadm-config.yaml
 kubeconfig
 operator-crds.yaml
 password.txt

@@ -19,6 +19,7 @@ spec:
     type: Calico
   calicoNetwork:
     bgp: Enabled
+    linuxDataplane: {{$.Env.CALICO_LINUX_DATAPLANE}}
     ipPools:
       - cidr: 192.168.0.0/16
         encapsulation: None

@@ -19,6 +19,7 @@ spec:
     type: Calico
   calicoNetwork:
     bgp: Disabled
+    linuxDataplane: {{$.Env.CALICO_LINUX_DATAPLANE}}
     ipPools:
       - cidr: 192.168.0.0/16
         encapsulation: VXLAN

@@ -10,7 +10,7 @@ KIND_CLUSTER_NAME?=kind
 ###############################################################################
 # ASO management
 ###############################################################################
-ASO_INSTALLED_MARKER:=.aso_installed
+ASO_INSTALLED_MARKER:=.aso-installed
 
 .PHONY: install-aso
 install-aso: $(ASO_INSTALLED_MARKER)
@@ -42,7 +42,7 @@ VMSS_MARKER:=.vmss-created
 .PHONY: create-vmss
 create-vmss: $(VMSS_MARKER)
 
-$(VMSS_MARKER): $(BINDIR)/kubectl $(BINDIR)/gomplate
+$(VMSS_MARKER): $(BINDIR)/kubectl $(BINDIR)/gomplate $(ASO_INSTALLED_MARKER)
 	@echo "Creating azure resources include vmss-linux and vmss-windows ..."
 	./vmss.sh create
 	./vmss.sh confirm-ssh
@@ -52,17 +52,27 @@ $(VMSS_MARKER): $(BINDIR)/kubectl $(BINDIR)/gomplate
 delete-vmss: $(BINDIR)/kubectl
 	@echo "Azure resources for cluster will be deleted..."
 	./vmss.sh delete
-	-rm -f $(VMSS_MARKER)
+	-rm -f $(VMSS_MARKER) $(KUBEADM_MARKER) $(CALICO_MARKER)
+
+KUBEADM_MARKER:=.kubeadm-set-up
 
 .PHONY: setup-kubeadm
-setup-kubeadm: $(ASO_INSTALLED_MARKER) $(VMSS_MARKER)
+setup-kubeadm: $(KUBEADM_MARKER)
+
+$(KUBEADM_MARKER): $(ASO_INSTALLED_MARKER) $(VMSS_MARKER)
 	@echo "Running setup-kubeadm ..."
 	./install-kubeadm.sh
+	touch $@
+
+CALICO_MARKER:=.calico-installed
 
 .PHONY: install-calico
-install-calico:
+install-calico: $(CALICO_MARKER)
+
+$(CALICO_MARKER): $(KUBEADM_MARKER)
 	@echo "Installing Calico ..."
 	./install-calico.sh
+	touch $@
 
 ###############################################################################
 # Utilities management
@@ -116,12 +126,15 @@ clean: delete-vmss uninstall-aso
 	-rm -rf ./report
 	-rm -f .sshkey .sshkey.pub
 	-rm -f $(HELPERS)
+	-rm -f kubeadm-config.yaml
 	-rm -f operator-crds.yaml tigera-operator.yaml tigera-prometheus-operator.yaml cert-manager.yaml
 	-rm -rf infra/manifests/
+	-rm -rf EE/manifests/
+	-rm -rf OSS/manifests/
 	-rm -rf windows/kubeadm/
 	-rm -f windows/config
 
 .PHONY: dist-clean
 dist-clean: clean
 	-rm -rf $(BINDIR)
-	-rm -f $(VMSS_MARKER) $(ASO_INSTALLED_MARKER)
+	-rm -f $(VMSS_MARKER) $(ASO_INSTALLED_MARKER) $(KUBEADM_MARKER) $(CALICO_MARKER)
@@ -10,7 +10,7 @@ spec:
     type: Calico
   calicoNetwork:
     bgp: Disabled
-    linuxDataplane: Iptables
+    linuxDataplane: {{$.Env.CALICO_LINUX_DATAPLANE}}
     ipPools:
       - cidr: 192.168.0.0/16
         encapsulation: VXLAN

@@ -42,6 +42,9 @@ export SSH_KEY_FILE="${ASO_DIR}/.sshkey"
 export GCR_IO_PULL_SECRET="${GCR_IO_PULL_SECRET:="${HOME}/secrets/docker_cfg.json"}"
 export TSEE_TEST_LICENSE="${TSEE_TEST_LICENSE:="${HOME}/secrets/license.yaml"}"
 
+export CALICO_LINUX_DATAPLANE="${CALICO_LINUX_DATAPLANE:="Iptables"}" # 'Iptables', 'Nftables' or 'BPF'
+export KUBE_PROXY_MODE="${KUBE_PROXY_MODE:="iptables"}" # 'iptables' or 'nftables', use 'nftables' with BPF
+
 export PRODUCT="calico"
 export RELEASE_STREAM="master"
 export HASH_RELEASE="true"
@@ -5,7 +5,6 @@
 {{- $nicName := printf "nic-linux-%d" $nodeNum -}}
 {{- $pipName := printf "pip-linux-%d" $nodeNum -}}
 {{- $extContainerdName := printf "vm-linux-%d-containerd" $nodeNum -}}
-{{- $extDockerName := printf "vm-linux-%d-docker-legacy" $nodeNum -}}
 {{- $computerName := printf "asovm-linux-%d" $nodeNum -}}{{/* NOTE: asovm-linux-%d here would have the l2bridge cni-plugin hang, maybe there's a problem with the name being too short? */}}
 ---
 apiVersion: compute.azure.com/v1api20220301
@@ -65,56 +64,37 @@ spec:
     commandToExecute: |
       /bin/bash -c '
       set -e
-      echo "Installing containerd and Docker..."
-      
+      echo "Installing containerd..."
+
       # Update package list
       apt-get update
-      
+
       # Install prerequisites
       apt-get install -y apt-transport-https ca-certificates curl gnupg lsb-release
-      
-      # Install Docker (includes containerd)
+
+      # Install containerd from the Docker repo
       curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg
       echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null
       apt-get update
-      apt-get install -y docker-ce docker-ce-cli containerd.io
-      
+      apt-get install -y containerd.io
+
       # Configure containerd for Kubernetes
       mkdir -p /etc/containerd
       containerd config default | tee /etc/containerd/config.toml
-      
+
       # Enable systemd cgroup driver (required for Kubernetes)
       sed -i "s/SystemdCgroup = false/SystemdCgroup = true/g" /etc/containerd/config.toml
-      
+
       # Restart containerd
       systemctl restart containerd
       systemctl enable containerd
-
-      # Enable and start Docker
-      systemctl enable docker
-      systemctl start docker
-
+
       # Verify installations
       containerd --version
-      docker --version
-
-      echo "Containerd and Docker installation completed successfully"
+
+      echo "Containerd and installation completed successfully"
       '
 ---
-apiVersion: compute.azure.com/v1api20220301
-kind: VirtualMachinesExtension
-metadata:
-  name: {{$extDockerName}}
-  namespace: aso
-spec:
-  location: {{$.Env.AZURE_LOCATION}}
-  owner:
-    name: {{$nodeName}}
-  publisher: Microsoft.Azure.Extensions
-  type: DockerExtension
-  typeHandlerVersion: "1.0"
-  autoUpgradeMinorVersion: true
----
 apiVersion: network.azure.com/v1api20240301
 kind: NetworkInterface
 metadata:

@@ -24,7 +24,8 @@ set -o pipefail
 trap 'exit_code=$?; if [ $exit_code -ne 0 ]; then echo ""; echo "========================================"; echo "Script failed! Showing pod status for debugging:"; echo "========================================"; ./bin/kubectl get pod -A -o wide --kubeconfig=./kubeconfig 2>/dev/null || true; fi; exit $exit_code' EXIT
 
 # Use kubectl with kubeconfig from install-kubeadm.sh
-: ${KUBECTL:=./bin/kubectl}
+: "${KUBECTL:=./bin/kubectl}"
+: "${GOMPLATE:=./bin/gomplate}"
 
 # Use the kubeconfig that was copied from master node
 KUBECONFIG_FILE="./kubeconfig"
@@ -49,12 +50,21 @@ echo '  RELEASE_STREAM='${RELEASE_STREAM}
 echo '  HASH_RELEASE='${HASH_RELEASE}
 echo '  KUBE_VERSION='${KUBE_VERSION}
 
+
+if [ ${PRODUCT} == 'calient' ]; then
+    rm -rf "${ASO_DIR}/EE/manifests" || true
+    ${GOMPLATE} --input-dir "${ASO_DIR}/EE/templates" --output-dir "${ASO_DIR}/EE/manifests"
+else
+    rm -rf "${ASO_DIR}/OSS/manifests" || true
+    ${GOMPLATE} --input-dir "${ASO_DIR}/OSS/templates" --output-dir "${ASO_DIR}/OSS/manifests"
+fi
+
 if [ ${PRODUCT} == 'calient' ]; then
     # Verify if the required variables are set for Calico EE
     : "${GCR_IO_PULL_SECRET:?Environment variable empty or not defined.}"
     : "${TSEE_TEST_LICENSE:?Environment variable empty or not defined.}"
-    echo '  GCR_IO_PULL_SECRET='${GCR_IO_PULL_SECRET}
-    echo '  TSEE_TEST_LICENSE='${TSEE_TEST_LICENSE}
+    echo '  GCR_IO_PULL_SECRET='"${GCR_IO_PULL_SECRET}"
+    echo '  TSEE_TEST_LICENSE='"${TSEE_TEST_LICENSE}"
 fi
 
 SCRIPT_CURRENT_DIR="$( cd -- "$(dirname "$0")" >/dev/null 2>&1 && pwd -P )"
@@ -86,8 +96,8 @@ fi
 
 # Create a storage class and persistent volume for Calico Enterprise.
 if [ ${PRODUCT} == 'calient' ]; then
-    ${KUBECTL} create -f ./EE/storage-class-azure-file.yaml
-    ${KUBECTL} create -f ./EE/persistent-volume.yaml
+    ${KUBECTL} create -f ./EE/manifests/storage-class-azure-file.yaml
+    ${KUBECTL} create -f ./EE/manifests/persistent-volume.yaml
 fi
 
 # Install Calico on Linux nodes
@@ -124,7 +134,7 @@ if [[ ${PRODUCT} == 'calient' ]]; then
     fi
 
     # Create custom resources
-    ${KUBECTL} create -f ./EE/custom-resources.yaml
+    ${KUBECTL} create -f ./EE/manifests/custom-resources.yaml
 
     # Install Calico EE license (after the Calico apiserver comes up)
     echo "Wait for the Calico apiserver to be ready..."
@@ -134,13 +144,18 @@ if [[ ${PRODUCT} == 'calient' ]]; then
     retry_command 60 "${KUBECTL} create -f ${TSEE_TEST_LICENSE}"
 else
     # Create custom resources
-    ${KUBECTL} create -f ./OSS/custom-resources.yaml
+    ${KUBECTL} create -f ./OSS/manifests/custom-resources.yaml
 fi
 
 echo "Wait for Calico to be ready on Linux nodes..."
 timeout --foreground 300 bash -c "while ! ${KUBECTL} wait pod -l k8s-app=calico-node --for=condition=Ready -n calico-system --timeout=30s; do sleep 5; done"
 echo "Calico is ready on Linux nodes"
 
+if [[ ${CALICO_LINUX_DATAPLANE} == 'BPF' ]]; then
+    echo "Disabling kube-proxy since Calico is running on the BPF dataplane"
+    ${KUBECTL} patch ds -n kube-system kube-proxy -p '{"spec":{"template":{"spec":{"nodeSelector":{"non-calico": "true"}}}}}'
+fi
+
 # Install Calico on Windows nodes
 echo ""
 echo "=========================================="
@@ -152,8 +167,8 @@ ${KUBECTL} patch ipamconfig default --type merge --patch='{"spec": {"strictAffin
 
 echo "Creating kubernetes-services-endpoint ConfigMap..."
 APISERVER=$(${KUBECTL} get configmap -n kube-system kube-proxy -o yaml | awk -F'://' '/server: https:\/\// { print $2 }')
-APISERVER_ADDR=$(echo ${APISERVER} | awk -F':' '{ print $1 }')
-APISERVER_PORT=$(echo ${APISERVER} | awk -F':' '{ print $2 }')
+APISERVER_ADDR=$(echo "${APISERVER}" | awk -F':' '{ print $1 }')
+APISERVER_PORT=$(echo "${APISERVER}" | awk -F':' '{ print $2 }')
 ${KUBECTL} apply -f - << EOF
 kind: ConfigMap
 apiVersion: v1

@@ -22,6 +22,8 @@ set -e
 : "${KUBECTL:=./bin/kubectl}"
 : "${GOMPLATE:=./bin/gomplate}"
 
+: "${KUBE_PROXY_MODE:="iptables"}"
+
 # Reconstruct arrays from exported string variables
 # Bash arrays cannot be exported across shells, so we export them as space-separated strings
 read -ra LINUX_EIPS <<< "${LINUX_EIPS_STR}"
@@ -113,7 +115,42 @@ function setup_kubeadm_cluster() {
   echo "  Pod Network CIDR: 192.168.0.0/16"
   echo "  Service CIDR: 10.96.0.0/12"
 
-  ${MASTER_CONNECT_COMMAND} "~/init-cluster.sh ${LOCAL_IP_ENV} 192.168.0.0/16 10.96.0.0/12 ${EXTERNAL_IP_ENV}"
+  echo "Generating kubeadm config yaml..."
+  ADVERTISE_ADDRESS=${LOCAL_IP_ENV}
+  POD_NETWORK_CIDR="192.168.0.0/16"
+  SERVICE_CIDR="10.96.0.0/12"
+  EXTERNAL_IP=${EXTERNAL_IP_ENV}
+  CERT_SANS="${ADVERTISE_ADDRESS}"
+  if [ -n "$EXTERNAL_IP" ]; then
+    CERT_SANS="${CERT_SANS},${EXTERNAL_IP}"
+    echo "  Certificate will include both internal and external IPs"
+  fi
+
+  cat <<EOF > ./kubeadm-config.yaml
+apiVersion: kubeadm.k8s.io/v1beta3
+kind: ClusterConfiguration
+localAPIEndpoint:
+  advertiseAddress: "${ADVERTISE_ADDRESS}"
+apiServer:
+  certSANs:
+$(echo "${CERT_SANS}" | tr ',' '\n' | sed 's/^/  - /')
+networking:
+  podSubnet: "${POD_NETWORK_CIDR}"
+  serviceSubnet: "${SERVICE_CIDR}"
+---
+apiVersion: kubeproxy.config.k8s.io/v1alpha1
+kind: KubeProxyConfiguration
+mode: "${KUBE_PROXY_MODE}"
+EOF
+
+  echo "Copying kubeadm config yaml to Linux node 0 (${LINUX_EIPS[0]})..."
+  scp -i "${SSH_KEY_FILE}" -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no \
+    ./kubeadm-config.yaml "aso@${LINUX_EIPS[0]}:~/" || {
+    echo "ERROR: Failed to copy kubeadm config yaml to Linux node 0"
+    return 1
+  }
+
+  ${MASTER_CONNECT_COMMAND} "~/init-cluster.sh ~/kubeadm-config.yaml"
 
   # Get the API server port (default is 6443 for kubeadm)
   APISERVER_PORT=6443

@@ -3,37 +3,24 @@ set -e
 
 echo "=== Initializing Kubernetes cluster with kubeadm ==="
 
-# Get the advertise address (should be passed as argument)
-ADVERTISE_ADDRESS=${1}
-POD_NETWORK_CIDR=${2:-"192.168.0.0/16"}
-SERVICE_CIDR=${3:-"10.96.0.0/12"}
-EXTERNAL_IP=${4}  # Optional external IP for certificate SANs
-
-if [ -z "$ADVERTISE_ADDRESS" ]; then
-  echo "ERROR: No advertise address provided"
-  echo "Usage: $0 <advertise-address> [pod-network-cidr] [service-cidr] [external-ip]"
+KUBEADM_CONFIG=${1}
+
+if [ -z "${KUBEADM_CONFIG}" ]; then
+  echo "ERROR: No kubeadm config yaml provided"
   exit 1
 fi
 
-echo "Initializing cluster with:"
-echo "  API Server Address: ${ADVERTISE_ADDRESS}"
-echo "  Pod Network CIDR: ${POD_NETWORK_CIDR}"
-echo "  Service CIDR: ${SERVICE_CIDR}"
-echo "  External IP: ${EXTERNAL_IP:-none}"
-
-# Build the cert-extra-sans parameter
-CERT_SANS="${ADVERTISE_ADDRESS}"
-if [ -n "$EXTERNAL_IP" ]; then
-  CERT_SANS="${CERT_SANS},${EXTERNAL_IP}"
-  echo "  Certificate will include both internal and external IPs"
+if [ ! -f "${KUBEADM_CONFIG}" ]; then
+  echo "ERROR: kubeadm config yaml file ${KUBEADM_CONFIG} not found"
+  echo "Usage: $0 <kubeadm-config-yaml>"
+  exit 1
 fi
 
+echo "Initializing cluster with:"
+echo "  kubeadm config yaml: ${KUBEADM_CONFIG}"
+
 # Initialize kubeadm cluster
-sudo kubeadm init \
-  --apiserver-advertise-address=${ADVERTISE_ADDRESS} \
-  --apiserver-cert-extra-sans=${CERT_SANS} \
-  --pod-network-cidr=${POD_NETWORK_CIDR} \
-  --service-cidr=${SERVICE_CIDR}
+sudo kubeadm init --config "${KUBEADM_CONFIG}"
 
 # Set up kubeconfig for current user
 echo "Setting up kubeconfig..."
@@ -43,4 +30,3 @@ sudo chown $(id -u):$(id -g) $HOME/.kube/config
 
 echo "Kubernetes cluster initialized successfully!"
 echo "You can now use kubectl to interact with the cluster."
-