From a3194e425be960abf68441f6627761bf30d9c7b2 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Mon, 19 Oct 2026 19:57:49 +0100 Subject: [PATCH 1/4] Publish Calico Open Source 3.32.3 --- .../version-3.32/release-notes/index.mdx | 50 +++++++++- .../version-3.32/releases.json | 98 +++++++++++++++++++ .../version-3.32/variables.js | 6 +- 3 files changed, 150 insertions(+), 4 deletions(-) diff --git a/calico_versioned_docs/version-3.32/release-notes/index.mdx b/calico_versioned_docs/version-3.32/release-notes/index.mdx index 599093fc8f..d285d62c67 100644 --- a/calico_versioned_docs/version-3.32/release-notes/index.mdx +++ b/calico_versioned_docs/version-3.32/release-notes/index.mdx @@ -365,9 +365,57 @@ August 29, 2026 To update a previous version of Calico, see [our upgrade guides](../operations/upgrading/index.mdx). -{/* ### Calico Open Source 3.32.3 bug fix release +October 21, 2026 + +#### Bug fixes + +- KubeVirt VMs with address persistence enabled can now get an address when their namespace and name together are longer than about 107 characters, on both the Kubernetes and etcd datastores. [calico 14260](https://github.com/projectcalico/calico/pull/14260) (@caseydavenport) +- Revert change to suppress empty `source: {}` and `destination: {}` in policy rules, which left GitOps tools such as ArgoCD reporting those policies as permanently out of sync. [calico 14236](https://github.com/projectcalico/calico/pull/14236) (@fasaxc) +- Fixed the tigera-operator Helm chart leaving behind a stale uninstall Job after an interrupted or failed uninstall, which blocked later uninstalls. [calico 14230](https://github.com/projectcalico/calico/pull/14230) (@rene-dekker) +- Fix a data race in Goldmane between flow ingestion and flow streams. [calico 14217](https://github.com/projectcalico/calico/pull/14217) (@caseydavenport) +- Fix Felix restarting with "BUG: Unexpected action" when a newly applied policy with a Pass rule changed the policy match for an active flow while flow logs were sent to Goldmane. [calico 14211](https://github.com/projectcalico/calico/pull/14211) (@fasaxc) +- Fixes policy name migration in calico-kube-controllers never running on clusters installed from the canal manifests. [calico 14206](https://github.com/projectcalico/calico/pull/14206) (@caseydavenport) +- Fix IPv6 eBPF conntrack cleanup for expired NAT reverse entries. [calico 14199](https://github.com/projectcalico/calico/pull/14199) (@fasaxc) +- Fixes calicoctl datastore migrate leaving IPv6 VXLAN and WireGuard tunnel addresses tied to the old node name, and fixes a kube-controllers panic on load balancer IP allocations with no handle. [calico 14156](https://github.com/projectcalico/calico/pull/14156) (@caseydavenport) +- Fixed calico-node repeatedly restarting when IP pool CIDRs overlap and the nftables dataplane is in use. [calico 14097](https://github.com/projectcalico/calico/pull/14097) (@caseydavenport) +- Fix the operator failing to reconcile (and renew Typha certificates) on Rancher-managed clusters by granting it permission to update Namespace pod security labels. [calico 14097](https://github.com/projectcalico/calico/pull/14097) (@caseydavenport) +- CNI plugin will wait for Calico nodename file if there is a delay in creation for any reason. [calico 14091](https://github.com/projectcalico/calico/pull/14091) (@Tamas-Biro1) +- Fix an inotify instance and goroutine leak in confd that occurred whenever the endpoint-status directory could not be watched, which could exhaust the node's per-user inotify instance limit. [calico 14076](https://github.com/projectcalico/calico/pull/14076) (@tomastigera) +- Fixed the BPF dataplane not decrementing TTL/hop limit, and corrupting the Ethernet source address, when redirecting a packet from a layer 3 device such as a WireGuard or IPIP tunnel. [calico 14076](https://github.com/projectcalico/calico/pull/14076) (@tomastigera) +- Fixes pods being unable to restart when their IP pool has no spare addresses, by reusing the address the pod already holds when its sandbox is rebuilt. [calico 14016](https://github.com/projectcalico/calico/pull/14016) (@caseydavenport) +- networking-calico: fix a race in the periodic resync that could delete the LiveMigration resource of an in-flight OpenStack live migration, causing the destination host to lose its migration role mid-migration. [calico 13998](https://github.com/projectcalico/calico/pull/13998) (@nelljerram) +- Fixed a data race on the Dikastes policy sync readiness flag, which could report a stale readiness result to health checks. [calico 13965](https://github.com/projectcalico/calico/pull/13965) (@electricjesus) +- Fixes tunnel addresses not being reallocated when a node's labels change, which left IP pool node selectors ineffective until calico-node restarted. [calico 13952](https://github.com/projectcalico/calico/pull/13952) (@caseydavenport) +- Fixes a datastore migration abort leaving the aggregated API service missing, by restoring the saved service in place instead of recreating it. [calico 13952](https://github.com/projectcalico/calico/pull/13952) (@caseydavenport) +- Fixed application layer policy (Dikastes) never matching rules that reference a named port, which caused Allow rules to deny and Deny rules to have no effect. [calico 13891](https://github.com/projectcalico/calico/pull/13891) (@dimitri-nicolo) +- Fixed a bug where pre-existing connections to a node port with a backend on another node were dropped when the dataplane was switched to eBPF mode. [calico 13886](https://github.com/projectcalico/calico/pull/13886) (@tomastigera) +- Fix a node-services crash loop that left a re-registered node without its BGP address annotation for several minutes, preventing BIRD from starting. [calico 13868](https://github.com/projectcalico/calico/pull/13868) (@tomastigera) +- Fix Felix retrying an invalid tunnel route forever for a local pod whose IP was borrowed from another node's IPAM block. [calico 13845](https://github.com/projectcalico/calico/pull/13845) (@tomastigera) +- Fixed BPF conntrack entries for NAT'd (service) connections surviving up to an hour after a client-side TCP RST instead of expiring after two minutes. [calico 13795](https://github.com/projectcalico/calico/pull/13795) (@tomastigera) +- [BPF] Fix eBPF NAT corruption where the Kubernetes API server service could share a NAT service ID with an unrelated service, causing its frontend to load-balance to the wrong backends and intermittently breaking connections to the API server. [calico 13793](https://github.com/projectcalico/calico/pull/13793) (@tomastigera) +- Fixed the eBPF dataplane flagging remote workload routes as tunnelled for an address family that does not have WireGuard enabled, on dual-stack clusters with WireGuard enabled for one family only. [calico 13790](https://github.com/projectcalico/calico/pull/13790) (@tomastigera) +- Fixed a bug where setting multiple routeTableRanges could cause Felix to restart repeatedly. [calico 13771](https://github.com/projectcalico/calico/pull/13771) (@fasaxc) +- Fixed flow logs reporting a staged policy as the enforced verdict, with incorrect packet and byte counts, when a flow's policy path changed mid-flow. [calico 13724](https://github.com/projectcalico/calico/pull/13724) (@fasaxc) +- Fixes repeated "unknown field \"status\"" warnings logged by kube-controllers. [calico 13683](https://github.com/projectcalico/calico/pull/13683) (@caseydavenport) + +#### Other changes + +- Replaced the felix_collector_dataplanestats_update_processing_errors_per_minute gauge, which reported a value unrelated to the real error rate and never decayed, with a felix_collector_dataplanestats_update_processing_errors_total counter. [calico 14305](https://github.com/projectcalico/calico/pull/14305) (@fasaxc) +- Published v1beta1 variants of the native v3 CRD manifests, for use on Kubernetes 1.34 and 1.35, which do not serve MutatingAdmissionPolicy at v1. [calico 14272](https://github.com/projectcalico/calico/pull/14272) (@caseydavenport) +- LoadBalancer controller now supports spec.loadBalancerIP as a fallback when no Calico-specific annotation is set. [calico 14001](https://github.com/projectcalico/calico/pull/14001) (@defo89) +- calico-node -bpf conntrack remove now accepts any protocol name or number, and "any", not just tcp and udp. [calico 13931](https://github.com/projectcalico/calico/pull/13931) (@tomastigera) +- Dikastes and Felix now report the recurring policy-evaluation conditions "IPSet not found" and "failed to parse principal" as one aggregated log line per five-minute window, naming every IP set or principal seen in that window, in place of a rate-limited line per flow. The aggregated lines carry the IP set IDs and principals in list-valued "ipsets" and "principals" fields rather than in the message text, and no longer carry the rate limiter's "logsSkipped" count. [calico 13894](https://github.com/projectcalico/calico/pull/13894) (@dimitri-nicolo) +- Felix/Dikastes performance: evaluate policy rule criteria cheapest-first in the user-mode policy engine, 1.6-3.7x faster evaluation for large policy sets. Rate limit the policy engine's per-rule warnings, which could previously emit tens of thousands of log lines per request. Make the staged-policy scope of ALP policy evaluation explicit, and keep the last known pending rule trace when an evaluation cannot be completed. [calico 13811](https://github.com/projectcalico/calico/pull/13811) (@fasaxc) + +#### Updating + +To update a previous version of Calico, see [our upgrade guides](../operations/upgrading/index.mdx). + +{/* +### Calico Open Source 3.32.4 bug fix release + DD MMMM YYYY #### Bug fixes diff --git a/calico_versioned_docs/version-3.32/releases.json b/calico_versioned_docs/version-3.32/releases.json index 539a8a29e8..bc37f23ab0 100644 --- a/calico_versioned_docs/version-3.32/releases.json +++ b/calico_versioned_docs/version-3.32/releases.json @@ -1,4 +1,102 @@ [ + { + "title": "v3.32.3", + "tigera-operator": { + "image": "tigera/operator", + "registry": "quay.io", + "version": "v1.42.7" + }, + "components": { + "calico/typha": { + "version": "v3.32.3", + "registry": "quay.io" + }, + "calico/ctl": { + "version": "v3.32.3", + "registry": "quay.io" + }, + "calico/node": { + "version": "v3.32.3", + "registry": "quay.io" + }, + "calico/node-windows": { + "version": "v3.32.3", + "registry": "quay.io" + }, + "calico/cni": { + "version": "v3.32.3", + "registry": "quay.io" + }, + "calico/cni-windows": { + "version": "v3.32.3", + "registry": "quay.io" + }, + "calico/apiserver": { + "version": "v3.32.3", + "registry": "quay.io" + }, + "calico/kube-controllers": { + "version": "v3.32.3", + "registry": "quay.io" + }, + "calico/envoy-gateway": { + "version": "v3.32.3", + "registry": "quay.io" + }, + "calico/envoy-proxy": { + "version": "v3.32.3", + "registry": "quay.io" + }, + "calico/envoy-ratelimit": { + "version": "v3.32.3", + "registry": "quay.io" + }, + "calico/flannel-migration-controller": { + "version": "v3.32.3", + "registry": "quay.io" + }, + "flannel": { + "version": "v0.24.4", + "registry": "docker.io" + }, + "calico/dikastes": { + "version": "v3.32.3", + "registry": "quay.io" + }, + "flexvol": { + "version": "v3.32.3", + "registry": "quay.io" + }, + "calico/csi": { + "version": "v3.32.3", + "registry": "quay.io" + }, + "calico/node-driver-registrar": { + "version": "v3.32.3", + "registry": "quay.io" + }, + "calico/pod2daemon-flexvol": { + "version": "v3.32.3", + "registry": "quay.io" + }, + "calico/key-cert-provisioner": { + "version": "v3.32.3", + "registry": "quay.io" + }, + "calico/goldmane": { + "version": "v3.32.3", + "registry": "quay.io" + }, + "calico/whisker": { + "version": "v3.32.3", + "registry": "quay.io" + }, + "calico/whisker-backend": { + "version": "v3.32.3", + "registry": "quay.io" + } + } + }, { "title": "v3.32.2", "tigera-operator": { diff --git a/calico_versioned_docs/version-3.32/variables.js b/calico_versioned_docs/version-3.32/variables.js index f7cb0883b8..6f22cc807f 100644 --- a/calico_versioned_docs/version-3.32/variables.js +++ b/calico_versioned_docs/version-3.32/variables.js @@ -1,7 +1,7 @@ const releases = require('./releases.json'); const variables = { - releaseTitle: 'v3.32.2', + releaseTitle: 'v3.32.3', prodname: 'Calico', prodnamedash: 'calico', version: 'v3.32', @@ -16,11 +16,11 @@ const variables = { noderunning: 'calico-node', rootDirWindows: 'C:\\CalicoWindows', ppa_repo_name: 'calico-3.32', - manifestsUrl: 'https://raw.githubusercontent.com/projectcalico/calico/v3.32.2', + manifestsUrl: 'https://raw.githubusercontent.com/projectcalico/calico/v3.32.3', releases, registry: '', vppbranch: 'v3.32.0', - envoyVersion: '1.8.3', + envoyVersion: '1.9.1', tigeraOperator: releases[0]['tigera-operator'], tigeraOperatorVersionShort: releases[0]['tigera-operator'].version.split('.').slice(0, 2).join('.'), imageNames: { From 7b1b7a2c7b72d89cb589bb140f503aabe096c908 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Tue, 20 Oct 2026 16:34:51 +0100 Subject: [PATCH 2/4] Add 14331 and the Gateway API v1.6 upgrade note to 3.32.3 --- calico_versioned_docs/version-3.32/release-notes/index.mdx | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/calico_versioned_docs/version-3.32/release-notes/index.mdx b/calico_versioned_docs/version-3.32/release-notes/index.mdx index d285d62c67..e1d870b64b 100644 --- a/calico_versioned_docs/version-3.32/release-notes/index.mdx +++ b/calico_versioned_docs/version-3.32/release-notes/index.mdx @@ -402,6 +402,7 @@ October 21, 2026 #### Other changes +- Reduced CPU and memory use when converting Kubernetes network policies that contain wide port ranges. [calico 14331](https://github.com/projectcalico/calico/pull/14331) (@fasaxc) - Replaced the felix_collector_dataplanestats_update_processing_errors_per_minute gauge, which reported a value unrelated to the real error rate and never decayed, with a felix_collector_dataplanestats_update_processing_errors_total counter. [calico 14305](https://github.com/projectcalico/calico/pull/14305) (@fasaxc) - Published v1beta1 variants of the native v3 CRD manifests, for use on Kubernetes 1.34 and 1.35, which do not serve MutatingAdmissionPolicy at v1. [calico 14272](https://github.com/projectcalico/calico/pull/14272) (@caseydavenport) - LoadBalancer controller now supports spec.loadBalancerIP as a fallback when no Calico-specific annotation is set. [calico 14001](https://github.com/projectcalico/calico/pull/14001) (@defo89) @@ -413,6 +414,10 @@ October 21, 2026 To update a previous version of Calico, see [our upgrade guides](../operations/upgrading/index.mdx). +If you use Calico Ingress Gateway, this release bumps the bundled Envoy Gateway to v1.9.1, which takes the bundled Gateway API CRDs from v1.5.1 to v1.6.1. Gateway API v1.6 removes `sessionPersistence.idleTimeout` from `HTTPRoute`, and Envoy Gateway v1.9 rejects an empty `clientIPDetection` in `ClientTrafficPolicy`. A manifest that uses either is rejected once the CRDs are upgraded. + +Before you upgrade, remove `sessionPersistence.idleTimeout` from any `HTTPRoute`, and any empty `clientIPDetection` from any `ClientTrafficPolicy`. + {/* ### Calico Open Source 3.32.4 bug fix release From 0a30d2889ad75c9e16d88a1ccc40d96cf0a439d6 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Tue, 27 Oct 2026 16:12:31 +0000 Subject: [PATCH 3/4] Add three late 3.32.3 notes and move the date to October 28 calico 14371 and 14355 are bug fixes. calico 14381 goes under Other changes. calico 14384 is a CI-only change, so it is left out. --- calico_versioned_docs/version-3.32/release-notes/index.mdx | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/calico_versioned_docs/version-3.32/release-notes/index.mdx b/calico_versioned_docs/version-3.32/release-notes/index.mdx index e1d870b64b..74be6507e9 100644 --- a/calico_versioned_docs/version-3.32/release-notes/index.mdx +++ b/calico_versioned_docs/version-3.32/release-notes/index.mdx @@ -367,10 +367,12 @@ To update a previous version of Calico, see [our upgrade guides](../operations/u ### Calico Open Source 3.32.3 bug fix release -October 21, 2026 +October 28, 2026 #### Bug fixes +- Fixed node-to-node mesh BGP sessions failing to establish from a node with its own AS number to a peer node that uses the global AS number. [calico 14371](https://github.com/projectcalico/calico/pull/14371) (@nelljerram) +- eBPF: fixed a policy program that the kernel verifier rejected with "unreachable insn" when a workload had enough policy rules to need more than one program. The node no longer reports not ready because of it. [calico 14355](https://github.com/projectcalico/calico/pull/14355) (@tomastigera) - KubeVirt VMs with address persistence enabled can now get an address when their namespace and name together are longer than about 107 characters, on both the Kubernetes and etcd datastores. [calico 14260](https://github.com/projectcalico/calico/pull/14260) (@caseydavenport) - Revert change to suppress empty `source: {}` and `destination: {}` in policy rules, which left GitOps tools such as ArgoCD reporting those policies as permanently out of sync. [calico 14236](https://github.com/projectcalico/calico/pull/14236) (@fasaxc) - Fixed the tigera-operator Helm chart leaving behind a stale uninstall Job after an interrupted or failed uninstall, which blocked later uninstalls. [calico 14230](https://github.com/projectcalico/calico/pull/14230) (@rene-dekker) @@ -402,6 +404,7 @@ October 21, 2026 #### Other changes +- OpenStack: networking-calico's background work (resync, leader election and etcd compaction, and agent and port status reporting) now runs in separate neutron-server worker processes, and resync is substantially faster at scale. Fixed live-migration cases where a VM's Neutron port could be left in the wrong status, or its workload endpoint could be transiently deleted. [calico 14381](https://github.com/projectcalico/calico/pull/14381) (@nelljerram) - Reduced CPU and memory use when converting Kubernetes network policies that contain wide port ranges. [calico 14331](https://github.com/projectcalico/calico/pull/14331) (@fasaxc) - Replaced the felix_collector_dataplanestats_update_processing_errors_per_minute gauge, which reported a value unrelated to the real error rate and never decayed, with a felix_collector_dataplanestats_update_processing_errors_total counter. [calico 14305](https://github.com/projectcalico/calico/pull/14305) (@fasaxc) - Published v1beta1 variants of the native v3 CRD manifests, for use on Kubernetes 1.34 and 1.35, which do not serve MutatingAdmissionPolicy at v1. [calico 14272](https://github.com/projectcalico/calico/pull/14272) (@caseydavenport) From 8a8df6518714038de9fd977d746eacf4991bcd89 Mon Sep 17 00:00:00 2001 From: Daniel Fox Date: Tue, 27 Oct 2026 18:04:44 -0700 Subject: [PATCH 4/4] Update release notes --- .../version-3.32/release-notes/index.mdx | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/calico_versioned_docs/version-3.32/release-notes/index.mdx b/calico_versioned_docs/version-3.32/release-notes/index.mdx index 74be6507e9..f74c475ab8 100644 --- a/calico_versioned_docs/version-3.32/release-notes/index.mdx +++ b/calico_versioned_docs/version-3.32/release-notes/index.mdx @@ -367,10 +367,11 @@ To update a previous version of Calico, see [our upgrade guides](../operations/u ### Calico Open Source 3.32.3 bug fix release -October 28, 2026 +October 27, 2026 #### Bug fixes +- OpenStack: networking-calico's background work (resync, leader election and etcd compaction, and agent and port status reporting) now runs in separate neutron-server worker processes, and resync is substantially faster at scale. Fixed live-migration cases where a VM's Neutron port could be left in the wrong status, or its workload endpoint could be transiently deleted. [calico 14381](https://github.com/projectcalico/calico/pull/14381) (@nelljerram) - Fixed node-to-node mesh BGP sessions failing to establish from a node with its own AS number to a peer node that uses the global AS number. [calico 14371](https://github.com/projectcalico/calico/pull/14371) (@nelljerram) - eBPF: fixed a policy program that the kernel verifier rejected with "unreachable insn" when a workload had enough policy rules to need more than one program. The node no longer reports not ready because of it. [calico 14355](https://github.com/projectcalico/calico/pull/14355) (@tomastigera) - KubeVirt VMs with address persistence enabled can now get an address when their namespace and name together are longer than about 107 characters, on both the Kubernetes and etcd datastores. [calico 14260](https://github.com/projectcalico/calico/pull/14260) (@caseydavenport) @@ -381,11 +382,9 @@ October 28, 2026 - Fixes policy name migration in calico-kube-controllers never running on clusters installed from the canal manifests. [calico 14206](https://github.com/projectcalico/calico/pull/14206) (@caseydavenport) - Fix IPv6 eBPF conntrack cleanup for expired NAT reverse entries. [calico 14199](https://github.com/projectcalico/calico/pull/14199) (@fasaxc) - Fixes calicoctl datastore migrate leaving IPv6 VXLAN and WireGuard tunnel addresses tied to the old node name, and fixes a kube-controllers panic on load balancer IP allocations with no handle. [calico 14156](https://github.com/projectcalico/calico/pull/14156) (@caseydavenport) -- Fixed calico-node repeatedly restarting when IP pool CIDRs overlap and the nftables dataplane is in use. [calico 14097](https://github.com/projectcalico/calico/pull/14097) (@caseydavenport) -- Fix the operator failing to reconcile (and renew Typha certificates) on Rancher-managed clusters by granting it permission to update Namespace pod security labels. [calico 14097](https://github.com/projectcalico/calico/pull/14097) (@caseydavenport) +- Fixed calico-node repeatedly restarting when IP pool CIDRs overlap and the nftables dataplane is in use. Fix the operator failing to reconcile (and renew Typha certificates) on Rancher-managed clusters by granting it permission to update Namespace pod security labels. [calico 14097](https://github.com/projectcalico/calico/pull/14097) (@caseydavenport) - CNI plugin will wait for Calico nodename file if there is a delay in creation for any reason. [calico 14091](https://github.com/projectcalico/calico/pull/14091) (@Tamas-Biro1) -- Fix an inotify instance and goroutine leak in confd that occurred whenever the endpoint-status directory could not be watched, which could exhaust the node's per-user inotify instance limit. [calico 14076](https://github.com/projectcalico/calico/pull/14076) (@tomastigera) -- Fixed the BPF dataplane not decrementing TTL/hop limit, and corrupting the Ethernet source address, when redirecting a packet from a layer 3 device such as a WireGuard or IPIP tunnel. [calico 14076](https://github.com/projectcalico/calico/pull/14076) (@tomastigera) +- Fix an inotify instance and goroutine leak in confd that occurred whenever the endpoint-status directory could not be watched, which could exhaust the node's per-user inotify instance limit. Fixed the BPF dataplane not decrementing TTL/hop limit, and corrupting the Ethernet source address, when redirecting a packet from a layer 3 device such as a WireGuard or IPIP tunnel. [calico 14076](https://github.com/projectcalico/calico/pull/14076) (@tomastigera) - Fixes pods being unable to restart when their IP pool has no spare addresses, by reusing the address the pod already holds when its sandbox is rebuilt. [calico 14016](https://github.com/projectcalico/calico/pull/14016) (@caseydavenport) - networking-calico: fix a race in the periodic resync that could delete the LiveMigration resource of an in-flight OpenStack live migration, causing the destination host to lose its migration role mid-migration. [calico 13998](https://github.com/projectcalico/calico/pull/13998) (@nelljerram) - Fixed a data race on the Dikastes policy sync readiness flag, which could report a stale readiness result to health checks. [calico 13965](https://github.com/projectcalico/calico/pull/13965) (@electricjesus) @@ -404,7 +403,7 @@ October 28, 2026 #### Other changes -- OpenStack: networking-calico's background work (resync, leader election and etcd compaction, and agent and port status reporting) now runs in separate neutron-server worker processes, and resync is substantially faster at scale. Fixed live-migration cases where a VM's Neutron port could be left in the wrong status, or its workload endpoint could be transiently deleted. [calico 14381](https://github.com/projectcalico/calico/pull/14381) (@nelljerram) +- CI: run the weekly OpenStack e2e tests on release-v3.32, against its branch-tip packages and images. [calico 14384](https://github.com/projectcalico/calico/pull/14384) (@lwr20) - Reduced CPU and memory use when converting Kubernetes network policies that contain wide port ranges. [calico 14331](https://github.com/projectcalico/calico/pull/14331) (@fasaxc) - Replaced the felix_collector_dataplanestats_update_processing_errors_per_minute gauge, which reported a value unrelated to the real error rate and never decayed, with a felix_collector_dataplanestats_update_processing_errors_total counter. [calico 14305](https://github.com/projectcalico/calico/pull/14305) (@fasaxc) - Published v1beta1 variants of the native v3 CRD manifests, for use on Kubernetes 1.34 and 1.35, which do not serve MutatingAdmissionPolicy at v1. [calico 14272](https://github.com/projectcalico/calico/pull/14272) (@caseydavenport)