[ctauchen]

Starter PR for the Calico Enterprise 3.23.3 patch release. It changes three files in the 3.23-2 version folder:

• releases.json: new v3.23.3 entry
• variables.js: release title, files URL, chart version, and envoyVersion
• release-notes/index.mdx: new 3.23.3 section

The DE team will add the bug fixes, confirm the date, run the autogen version sync, and add any API doc updates.

To check before merge:

• The operator version is v1.42.7, the next tag after v1.42.6. It is not tagged yet, and release-calient-v3.23 still pins v1.42.5.
• envoyVersion moves from 1.8.3 to 1.9.1 to match ENVOY_GATEWAY_VERSION on release-calient-v3.23. The OSS 3.32.3 PR (DOCS-3041: Publish Calico Open Source 3.32.3 #3133) has an Updating note for the same Envoy Gateway bump, which may apply here too.
• The date is the planned date, October 27, 2026.
• The tigera deploy preview fails until the release artifacts are published. The link checker reports 45 dead links, all v3.23.3 files on downloads.tigera.io that return 403 today. The site build itself passes locally. Calico Enterprise latest is 3.23, so these links are checked. 3.23.2 had the same failure until release.

#3158 adds the BGPPeer connectionMode docs that ship in 3.23.3. Merge it with this PR.

Jira: https://tigera.atlassian.net/browse/DOCS-3038

[netlify]

✅ Deploy Preview succeeded!

Name	Link
🔨 Latest commit	c73306f
🔍 Latest deploy log	https://app.netlify.com/projects/tigera/deploys/6ae1cf6ce4ce91bd4b7f03d3
😎 Deploy Preview	https://deploy-preview-3162--tigera.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	1 paths audited Performance: 95 (🟢 up 28 from production) Accessibility: 98 (no change from production) Best Practices: 92 (no change from production) SEO: 100 (no change from production) PWA: - View the detailed breakdown and full score reports
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing. Review the Copilot code review billing settings.

[netlify]

✅ Deploy Preview for calico-docs-preview-next ready!

Name	Link
🔨 Latest commit	c73306f
🔍 Latest deploy log	https://app.netlify.com/projects/calico-docs-preview-next/deploys/6ae1cf6cb7833a98d28dd546
😎 Deploy Preview	https://deploy-preview-3162--calico-docs-preview-next.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[ctauchen]

@rene-dekker, please sign off on the 3.23.3 release notes in this PR, or say what to add or drop.

Preview: the tigera deploy preview fails until the 3.23.3 artifacts publish, so read the notes in the diff: https://github.com/tigera/docs/pull/3162/files

The list covers calico-private PRs merged to release-calient-v3.23 after v3.23.2, and operator release-v1.42 changes after v1.42.5. It leaves out third-party version bumps and CI-only changes, as the 3.22.8 notes did. Each bullet has its source PR in a comment.

Questions:

1. Operator version. The PR uses v1.42.7, which is not tagged yet, and release-calient-v3.23 still pins v1.42.5. Is v1.42.7 right? Five bullets come from operator PRs (5247, 5260, 5319, 5354, 5360) and only belong here if 3.23.3 ships with them.
2. emSign roots (operator 5365). The upgrade note tells users to move any endpoint whose certificate chains to an emSign root to another CA before they upgrade. Is that the right advice, and are external Elasticsearch, identity providers and webhook targets the right examples?
3. calico-private 14157, a cherry-pick of 13499, has TBD as its release note. The notes describe it as a bug fix: concurrent web console endpoint queries could run with another request's credentials. Is that wording right, or does it need handling as a security fix?
4. LoadBalancer IP pools (calico-private 14517). Pools with a namespace selector start matching Services after the upgrade. Is an upgrade note the right place for that?
5. Envoy Gateway 1.9.1 (calico-private 14670). The OSS 3.32.3 notes (DOCS-3041: Publish Calico Open Source 3.32.3 #3133) add an upgrade note for the Gateway API v1.6 breaking changes that come with this bump. Does 3.23.3 need the same note?
6. Release date. The notes say October 27, 2026. Is that still the date?