Skip to content

DOCS-3041: Publish Calico Open Source 3.32.3 #3133

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
danudey merged 4 commits into from
Oct 28, 2026
Merged

DOCS-3041: Publish Calico Open Source 3.32.3 #3133

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a3194e4
Publish Calico Open Source 3.32.3
ctauchen Oct 19, 2026
7b1b7a2
Add 14331 and the Gateway API v1.6 upgrade note to 3.32.3
ctauchen Oct 20, 2026
0a30d28
Add three late 3.32.3 notes and move the date to October 28
ctauchen Oct 27, 2026
8a8df65
Update release notes
danudey Oct 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
57 changes: 56 additions & 1 deletion calico_versioned_docs/version-3.32/release-notes/index.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -365,9 +365,64 @@

To update a previous version of Calico, see [our upgrade guides](../operations/upgrading/index.mdx).

{/*
### Calico Open Source 3.32.3 bug fix release

October 27, 2026

#### Bug fixes

- OpenStack: networking-calico's background work (resync, leader election and etcd compaction, and agent and port status reporting) now runs in separate neutron-server worker processes, and resync is substantially faster at scale. Fixed live-migration cases where a VM's Neutron port could be left in the wrong status, or its workload endpoint could be transiently deleted. [calico 14381](https://github.com/projectcalico/calico/pull/14381) (@nelljerram)
- Fixed node-to-node mesh BGP sessions failing to establish from a node with its own AS number to a peer node that uses the global AS number. [calico 14371](https://github.com/projectcalico/calico/pull/14371) (@nelljerram)
- eBPF: fixed a policy program that the kernel verifier rejected with "unreachable insn" when a workload had enough policy rules to need more than one program. The node no longer reports not ready because of it. [calico 14355](https://github.com/projectcalico/calico/pull/14355) (@tomastigera)

Check failure on line 376 in calico_versioned_docs/version-3.32/release-notes/index.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'insn'?

Raw Output:
{"message":"[Vale.Spelling] Did you really mean 'insn'?","location":{"path":"calico_versioned_docs/version-3.32/release-notes/index.mdx","range":{"start":{"line":376,"column":84},"end":{"line":376,"column":88}}},"severity":"ERROR","code":{"value":"Vale.Spelling"}}
- KubeVirt VMs with address persistence enabled can now get an address when their namespace and name together are longer than about 107 characters, on both the Kubernetes and etcd datastores. [calico 14260](https://github.com/projectcalico/calico/pull/14260) (@caseydavenport)
- Revert change to suppress empty `source: {}` and `destination: {}` in policy rules, which left GitOps tools such as ArgoCD reporting those policies as permanently out of sync. [calico 14236](https://github.com/projectcalico/calico/pull/14236) (@fasaxc)
- Fixed the tigera-operator Helm chart leaving behind a stale uninstall Job after an interrupted or failed uninstall, which blocked later uninstalls. [calico 14230](https://github.com/projectcalico/calico/pull/14230) (@rene-dekker)

Check warning on line 379 in calico_versioned_docs/version-3.32/release-notes/index.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Terms] Use 'Tigera' instead of 'tigera'.

Raw Output:
{"message":"[Vale.Terms] Use 'Tigera' instead of 'tigera'.","location":{"path":"calico_versioned_docs/version-3.32/release-notes/index.mdx","range":{"start":{"line":379,"column":13},"end":{"line":379,"column":19}}},"severity":"WARNING","code":{"value":"Vale.Terms"}}
- Fix a data race in Goldmane between flow ingestion and flow streams. [calico 14217](https://github.com/projectcalico/calico/pull/14217) (@caseydavenport)
- Fix Felix restarting with "BUG: Unexpected action" when a newly applied policy with a Pass rule changed the policy match for an active flow while flow logs were sent to Goldmane. [calico 14211](https://github.com/projectcalico/calico/pull/14211) (@fasaxc)
- Fixes policy name migration in calico-kube-controllers never running on clusters installed from the canal manifests. [calico 14206](https://github.com/projectcalico/calico/pull/14206) (@caseydavenport)
- Fix IPv6 eBPF conntrack cleanup for expired NAT reverse entries. [calico 14199](https://github.com/projectcalico/calico/pull/14199) (@fasaxc)
- Fixes calicoctl datastore migrate leaving IPv6 VXLAN and WireGuard tunnel addresses tied to the old node name, and fixes a kube-controllers panic on load balancer IP allocations with no handle. [calico 14156](https://github.com/projectcalico/calico/pull/14156) (@caseydavenport)
- Fixed calico-node repeatedly restarting when IP pool CIDRs overlap and the nftables dataplane is in use. Fix the operator failing to reconcile (and renew Typha certificates) on Rancher-managed clusters by granting it permission to update Namespace pod security labels. [calico 14097](https://github.com/projectcalico/calico/pull/14097) (@caseydavenport)

Check failure on line 385 in calico_versioned_docs/version-3.32/release-notes/index.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'dataplane'?

Raw Output:
{"message":"[Vale.Spelling] Did you really mean 'dataplane'?","location":{"path":"calico_versioned_docs/version-3.32/release-notes/index.mdx","range":{"start":{"line":385,"column":87},"end":{"line":385,"column":96}}},"severity":"ERROR","code":{"value":"Vale.Spelling"}}

Check failure on line 385 in calico_versioned_docs/version-3.32/release-notes/index.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[CalicoStyle.Substitutions] Use 'data plane' instead of 'dataplane'.

Raw Output:
{"message":"[CalicoStyle.Substitutions] Use 'data plane' instead of 'dataplane'.","location":{"path":"calico_versioned_docs/version-3.32/release-notes/index.mdx","range":{"start":{"line":385,"column":87},"end":{"line":385,"column":96}}},"severity":"ERROR","code":{"value":"CalicoStyle.Substitutions"}}
- CNI plugin will wait for Calico nodename file if there is a delay in creation for any reason. [calico 14091](https://github.com/projectcalico/calico/pull/14091) (@Tamas-Biro1)

Check failure on line 386 in calico_versioned_docs/version-3.32/release-notes/index.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'nodename'?

Raw Output:
{"message":"[Vale.Spelling] Did you really mean 'nodename'?","location":{"path":"calico_versioned_docs/version-3.32/release-notes/index.mdx","range":{"start":{"line":386,"column":35},"end":{"line":386,"column":43}}},"severity":"ERROR","code":{"value":"Vale.Spelling"}}
- Fix an inotify instance and goroutine leak in confd that occurred whenever the endpoint-status directory could not be watched, which could exhaust the node's per-user inotify instance limit. Fixed the BPF dataplane not decrementing TTL/hop limit, and corrupting the Ethernet source address, when redirecting a packet from a layer 3 device such as a WireGuard or IPIP tunnel. [calico 14076](https://github.com/projectcalico/calico/pull/14076) (@tomastigera)

Check failure on line 387 in calico_versioned_docs/version-3.32/release-notes/index.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'dataplane'?

Raw Output:
{"message":"[Vale.Spelling] Did you really mean 'dataplane'?","location":{"path":"calico_versioned_docs/version-3.32/release-notes/index.mdx","range":{"start":{"line":387,"column":208},"end":{"line":387,"column":217}}},"severity":"ERROR","code":{"value":"Vale.Spelling"}}

Check failure on line 387 in calico_versioned_docs/version-3.32/release-notes/index.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[CalicoStyle.Substitutions] Use 'data plane' instead of 'dataplane'.

Raw Output:
{"message":"[CalicoStyle.Substitutions] Use 'data plane' instead of 'dataplane'.","location":{"path":"calico_versioned_docs/version-3.32/release-notes/index.mdx","range":{"start":{"line":387,"column":208},"end":{"line":387,"column":217}}},"severity":"ERROR","code":{"value":"CalicoStyle.Substitutions"}}

Check failure on line 387 in calico_versioned_docs/version-3.32/release-notes/index.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'inotify'?

Raw Output:
{"message":"[Vale.Spelling] Did you really mean 'inotify'?","location":{"path":"calico_versioned_docs/version-3.32/release-notes/index.mdx","range":{"start":{"line":387,"column":170},"end":{"line":387,"column":177}}},"severity":"ERROR","code":{"value":"Vale.Spelling"}}

Check failure on line 387 in calico_versioned_docs/version-3.32/release-notes/index.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'inotify'?

Raw Output:
{"message":"[Vale.Spelling] Did you really mean 'inotify'?","location":{"path":"calico_versioned_docs/version-3.32/release-notes/index.mdx","range":{"start":{"line":387,"column":10},"end":{"line":387,"column":17}}},"severity":"ERROR","code":{"value":"Vale.Spelling"}}
- Fixes pods being unable to restart when their IP pool has no spare addresses, by reusing the address the pod already holds when its sandbox is rebuilt. [calico 14016](https://github.com/projectcalico/calico/pull/14016) (@caseydavenport)
- networking-calico: fix a race in the periodic resync that could delete the LiveMigration resource of an in-flight OpenStack live migration, causing the destination host to lose its migration role mid-migration. [calico 13998](https://github.com/projectcalico/calico/pull/13998) (@nelljerram)
- Fixed a data race on the Dikastes policy sync readiness flag, which could report a stale readiness result to health checks. [calico 13965](https://github.com/projectcalico/calico/pull/13965) (@electricjesus)
- Fixes tunnel addresses not being reallocated when a node's labels change, which left IP pool node selectors ineffective until calico-node restarted. [calico 13952](https://github.com/projectcalico/calico/pull/13952) (@caseydavenport)
- Fixes a datastore migration abort leaving the aggregated API service missing, by restoring the saved service in place instead of recreating it. [calico 13952](https://github.com/projectcalico/calico/pull/13952) (@caseydavenport)
- Fixed application layer policy (Dikastes) never matching rules that reference a named port, which caused Allow rules to deny and Deny rules to have no effect. [calico 13891](https://github.com/projectcalico/calico/pull/13891) (@dimitri-nicolo)
- Fixed a bug where pre-existing connections to a node port with a backend on another node were dropped when the dataplane was switched to eBPF mode. [calico 13886](https://github.com/projectcalico/calico/pull/13886) (@tomastigera)

Check failure on line 394 in calico_versioned_docs/version-3.32/release-notes/index.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[CalicoStyle.Substitutions] Use 'data plane' instead of 'dataplane'.

Raw Output:
{"message":"[CalicoStyle.Substitutions] Use 'data plane' instead of 'dataplane'.","location":{"path":"calico_versioned_docs/version-3.32/release-notes/index.mdx","range":{"start":{"line":394,"column":114},"end":{"line":394,"column":123}}},"severity":"ERROR","code":{"value":"CalicoStyle.Substitutions"}}
- Fix a node-services crash loop that left a re-registered node without its BGP address annotation for several minutes, preventing BIRD from starting. [calico 13868](https://github.com/projectcalico/calico/pull/13868) (@tomastigera)
- Fix Felix retrying an invalid tunnel route forever for a local pod whose IP was borrowed from another node's IPAM block. [calico 13845](https://github.com/projectcalico/calico/pull/13845) (@tomastigera)
- Fixed BPF conntrack entries for NAT'd (service) connections surviving up to an hour after a client-side TCP RST instead of expiring after two minutes. [calico 13795](https://github.com/projectcalico/calico/pull/13795) (@tomastigera)
- [BPF] Fix eBPF NAT corruption where the Kubernetes API server service could share a NAT service ID with an unrelated service, causing its frontend to load-balance to the wrong backends and intermittently breaking connections to the API server. [calico 13793](https://github.com/projectcalico/calico/pull/13793) (@tomastigera)
- Fixed the eBPF dataplane flagging remote workload routes as tunnelled for an address family that does not have WireGuard enabled, on dual-stack clusters with WireGuard enabled for one family only. [calico 13790](https://github.com/projectcalico/calico/pull/13790) (@tomastigera)
- Fixed a bug where setting multiple routeTableRanges could cause Felix to restart repeatedly. [calico 13771](https://github.com/projectcalico/calico/pull/13771) (@fasaxc)
- Fixed flow logs reporting a staged policy as the enforced verdict, with incorrect packet and byte counts, when a flow's policy path changed mid-flow. [calico 13724](https://github.com/projectcalico/calico/pull/13724) (@fasaxc)
- Fixes repeated "unknown field \"status\"" warnings logged by kube-controllers. [calico 13683](https://github.com/projectcalico/calico/pull/13683) (@caseydavenport)

#### Other changes

- CI: run the weekly OpenStack e2e tests on release-v3.32, against its branch-tip packages and images. [calico 14384](https://github.com/projectcalico/calico/pull/14384) (@lwr20)
- Reduced CPU and memory use when converting Kubernetes network policies that contain wide port ranges. [calico 14331](https://github.com/projectcalico/calico/pull/14331) (@fasaxc)
- Replaced the felix_collector_dataplanestats_update_processing_errors_per_minute gauge, which reported a value unrelated to the real error rate and never decayed, with a felix_collector_dataplanestats_update_processing_errors_total counter. [calico 14305](https://github.com/projectcalico/calico/pull/14305) (@fasaxc)
- Published v1beta1 variants of the native v3 CRD manifests, for use on Kubernetes 1.34 and 1.35, which do not serve MutatingAdmissionPolicy at v1. [calico 14272](https://github.com/projectcalico/calico/pull/14272) (@caseydavenport)
- LoadBalancer controller now supports spec.loadBalancerIP as a fallback when no Calico-specific annotation is set. [calico 14001](https://github.com/projectcalico/calico/pull/14001) (@defo89)
- calico-node -bpf conntrack remove now accepts any protocol name or number, and "any", not just tcp and udp. [calico 13931](https://github.com/projectcalico/calico/pull/13931) (@tomastigera)

Check warning on line 411 in calico_versioned_docs/version-3.32/release-notes/index.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Terms] Use 'UDP' instead of 'udp'.

Raw Output:
{"message":"[Vale.Terms] Use 'UDP' instead of 'udp'.","location":{"path":"calico_versioned_docs/version-3.32/release-notes/index.mdx","range":{"start":{"line":411,"column":106},"end":{"line":411,"column":109}}},"severity":"WARNING","code":{"value":"Vale.Terms"}}

Check warning on line 411 in calico_versioned_docs/version-3.32/release-notes/index.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Terms] Use 'TCP' instead of 'tcp'.

Raw Output:
{"message":"[Vale.Terms] Use 'TCP' instead of 'tcp'.","location":{"path":"calico_versioned_docs/version-3.32/release-notes/index.mdx","range":{"start":{"line":411,"column":98},"end":{"line":411,"column":101}}},"severity":"WARNING","code":{"value":"Vale.Terms"}}
- Dikastes and Felix now report the recurring policy-evaluation conditions "IPSet not found" and "failed to parse principal" as one aggregated log line per five-minute window, naming every IP set or principal seen in that window, in place of a rate-limited line per flow. The aggregated lines carry the IP set IDs and principals in list-valued "ipsets" and "principals" fields rather than in the message text, and no longer carry the rate limiter's "logsSkipped" count. [calico 13894](https://github.com/projectcalico/calico/pull/13894) (@dimitri-nicolo)
- Felix/Dikastes performance: evaluate policy rule criteria cheapest-first in the user-mode policy engine, 1.6-3.7x faster evaluation for large policy sets. Rate limit the policy engine's per-rule warnings, which could previously emit tens of thousands of log lines per request. Make the staged-policy scope of ALP policy evaluation explicit, and keep the last known pending rule trace when an evaluation cannot be completed. [calico 13811](https://github.com/projectcalico/calico/pull/13811) (@fasaxc)

#### Updating

To update a previous version of Calico, see [our upgrade guides](../operations/upgrading/index.mdx).

If you use Calico Ingress Gateway, this release bumps the bundled Envoy Gateway to v1.9.1, which takes the bundled Gateway API CRDs from v1.5.1 to v1.6.1. Gateway API v1.6 removes `sessionPersistence.idleTimeout` from `HTTPRoute`, and Envoy Gateway v1.9 rejects an empty `clientIPDetection` in `ClientTrafficPolicy`. A manifest that uses either is rejected once the CRDs are upgraded.

Before you upgrade, remove `sessionPersistence.idleTimeout` from any `HTTPRoute`, and any empty `clientIPDetection` from any `ClientTrafficPolicy`.

{/*
### Calico Open Source 3.32.4 bug fix release

DD MMMM YYYY

#### Bug fixes
Expand Down
98 changes: 98 additions & 0 deletions calico_versioned_docs/version-3.32/releases.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,102 @@
[
{
"title": "v3.32.3",
"tigera-operator": {
"image": "tigera/operator",
"registry": "quay.io",
"version": "v1.42.7"
},
"components": {
"calico/typha": {
"version": "v3.32.3",
"registry": "quay.io"
},
"calico/ctl": {
"version": "v3.32.3",
"registry": "quay.io"
},
"calico/node": {
"version": "v3.32.3",
"registry": "quay.io"
},
"calico/node-windows": {
"version": "v3.32.3",
"registry": "quay.io"
},
"calico/cni": {
"version": "v3.32.3",
"registry": "quay.io"
},
"calico/cni-windows": {
"version": "v3.32.3",
"registry": "quay.io"
},
"calico/apiserver": {
"version": "v3.32.3",
"registry": "quay.io"
},
"calico/kube-controllers": {
"version": "v3.32.3",
"registry": "quay.io"
},
"calico/envoy-gateway": {
"version": "v3.32.3",
"registry": "quay.io"
},
"calico/envoy-proxy": {
"version": "v3.32.3",
"registry": "quay.io"
},
"calico/envoy-ratelimit": {
"version": "v3.32.3",
"registry": "quay.io"
},
"calico/flannel-migration-controller": {
"version": "v3.32.3",
"registry": "quay.io"
},
"flannel": {
"version": "v0.24.4",
"registry": "docker.io"
},
"calico/dikastes": {
"version": "v3.32.3",
"registry": "quay.io"
},
"flexvol": {
"version": "v3.32.3",
"registry": "quay.io"
},
"calico/csi": {
"version": "v3.32.3",
"registry": "quay.io"
},
"calico/node-driver-registrar": {
"version": "v3.32.3",
"registry": "quay.io"
},
"calico/pod2daemon-flexvol": {
"version": "v3.32.3",
"registry": "quay.io"
},
"calico/key-cert-provisioner": {
"version": "v3.32.3",
"registry": "quay.io"
},
"calico/goldmane": {
"version": "v3.32.3",
"registry": "quay.io"
},
"calico/whisker": {
"version": "v3.32.3",
"registry": "quay.io"
},
"calico/whisker-backend": {
"version": "v3.32.3",
"registry": "quay.io"
}
}
},
{
"title": "v3.32.2",
"tigera-operator": {
Expand Down
6 changes: 3 additions & 3 deletions calico_versioned_docs/version-3.32/variables.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
const releases = require('./releases.json');

const variables = {
releaseTitle: 'v3.32.2',
releaseTitle: 'v3.32.3',
prodname: 'Calico',
prodnamedash: 'calico',
version: 'v3.32',
Expand All @@ -16,11 +16,11 @@ const variables = {
noderunning: 'calico-node',
rootDirWindows: 'C:\\CalicoWindows',
ppa_repo_name: 'calico-3.32',
manifestsUrl: 'https://raw.githubusercontent.com/projectcalico/calico/v3.32.2',
manifestsUrl: 'https://raw.githubusercontent.com/projectcalico/calico/v3.32.3',
releases,
registry: '',
vppbranch: 'v3.32.0',
envoyVersion: '1.8.3',
envoyVersion: '1.9.1',
tigeraOperator: releases[0]['tigera-operator'],
tigeraOperatorVersionShort: releases[0]['tigera-operator'].version.split('.').slice(0, 2).join('.'),
imageNames: {
Expand Down
Loading