From 5325ac424f7d14805a02b0b4a5ae9883d3248984 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Tue, 27 Oct 2026 16:12:57 +0000 Subject: [PATCH 1/9] Prepare for release CE 3.23.3 --- .../version-3.23-2/release-notes/index.mdx | 10 + .../version-3.23-2/releases.json | 292 ++++++++++++++++++ .../version-3.23-2/variables.js | 10 +- 3 files changed, 307 insertions(+), 5 deletions(-) diff --git a/calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx b/calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx index 6c736183fd..2edda5d6e3 100644 --- a/calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx +++ b/calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx @@ -299,3 +299,13 @@ August 27, 2026 * Security updates. To update an existing installation of Calico Enterprise 3.23, see [Install a patch release](../getting-started/manifest-archive.mdx). + +### Calico Enterprise 3.23.3 bug fix release + +October 27, 2026 + +#### Bug fixes + +* TBD + +To update an existing installation of Calico Enterprise 3.23, see [Install a patch release](../getting-started/manifest-archive.mdx). \ No newline at end of file diff --git a/calico-enterprise_versioned_docs/version-3.23-2/releases.json b/calico-enterprise_versioned_docs/version-3.23-2/releases.json index caeceabbe7..eb5239e3d8 100644 --- a/calico-enterprise_versioned_docs/version-3.23-2/releases.json +++ b/calico-enterprise_versioned_docs/version-3.23-2/releases.json @@ -1,4 +1,296 @@ [ + { + "title": "v3.23.3", + "tigera-operator": { + "version": "v1.42.7", + "image": "tigera/operator", + "registry": "quay.io" + }, + "calico": { + "minor_version": "v3.32", + "archive_path": "archive" + }, + "components": { + "alertmanager": { + "version": "v3.23.3", + "image": "tigera/alertmanager" + }, + "apiserver": { + "version": "v3.23.3", + "image": "tigera/apiserver" + }, + "calicoctl": { + "version": "v3.23.3", + "image": "tigera/calicoctl" + }, + "calicoq": { + "version": "v3.23.3", + "image": "tigera/calicoq" + }, + "compliance-benchmarker": { + "version": "v3.23.3", + "image": "tigera/compliance-benchmarker" + }, + "compliance-controller": { + "version": "v3.23.3", + "image": "tigera/compliance-controller" + }, + "compliance-reporter": { + "version": "v3.23.3", + "image": "tigera/compliance-reporter" + }, + "compliance-server": { + "version": "v3.23.3", + "image": "tigera/compliance-server" + }, + "compliance-snapshotter": { + "version": "v3.23.3", + "image": "tigera/compliance-snapshotter" + }, + "coreos-alertmanager": { + "version": "v0.33.1" + }, + "coreos-config-reloader": { + "version": "v0.91.0" + }, + "coreos-dex": { + "version": "v2.45.1" + }, + "coreos-fluentd": { + "version": "1.19.3" + }, + "coreos-prometheus": { + "version": "v3.13.2" + }, + "coreos-prometheus-operator": { + "version": "v0.91.0" + }, + "csi": { + "version": "v3.23.3", + "image": "tigera/csi" + }, + "csi-node-driver-registrar": { + "version": "v3.23.3", + "image": "tigera/node-driver-registrar" + }, + "deep-packet-inspection": { + "version": "v3.23.3", + "image": "tigera/deep-packet-inspection" + }, + "dex": { + "version": "v3.23.3", + "image": "tigera/dex" + }, + "dikastes": { + "version": "v3.23.3", + "image": "tigera/dikastes" + }, + "eck-elasticsearch": { + "version": "8.19.20" + }, + "eck-elasticsearch-operator": { + "version": "3.4.1" + }, + "eck-kibana": { + "version": "8.19.20" + }, + "egress-gateway": { + "version": "v3.23.3", + "image": "tigera/egress-gateway" + }, + "elastic-tsee-installer": { + "version": "v3.23.3", + "image": "tigera/intrusion-detection-job-installer" + }, + "elasticsearch": { + "version": "v3.23.3", + "image": "tigera/elasticsearch" + }, + "elasticsearch-metrics": { + "version": "v3.23.3", + "image": "tigera/elasticsearch-metrics" + }, + "elasticsearch-operator": { + "version": "v3.23.3", + "image": "tigera/eck-operator" + }, + "envoy": { + "version": "v3.23.3", + "image": "tigera/envoy" + }, + "es-gateway": { + "version": "v3.23.3", + "image": "tigera/es-gateway" + }, + "firewall-integration": { + "version": "v3.23.3", + "image": "tigera/firewall-integration" + }, + "flexvol": { + "version": "v3.23.3", + "image": "tigera/pod2daemon-flexvol" + }, + "fluentd": { + "version": "v3.23.3", + "image": "tigera/fluentd" + }, + "fluentd-windows": { + "version": "v3.23.3", + "image": "tigera/fluentd-windows" + }, + "gateway-api-envoy-gateway": { + "version": "v3.23.3", + "image": "tigera/envoy-gateway" + }, + "gateway-api-envoy-proxy": { + "version": "v3.23.3", + "image": "tigera/envoy-proxy" + }, + "gateway-api-envoy-ratelimit": { + "version": "v3.23.3", + "image": "tigera/envoy-ratelimit" + }, + "gateway-l7-collector": { + "version": "v3.23.3", + "image": "tigera/gateway-l7-collector" + }, + "guardian": { + "version": "v3.23.3", + "image": "tigera/guardian" + }, + "ingress-collector": { + "version": "v3.23.3", + "image": "tigera/ingress-collector" + }, + "intrusion-detection-controller": { + "version": "v3.23.3", + "image": "tigera/intrusion-detection-controller" + }, + "istio-install-cni": { + "version": "v3.23.3", + "image": "tigera/istio-install-cni" + }, + "istio-pilot": { + "version": "v3.23.3", + "image": "tigera/istio-pilot" + }, + "istio-proxyv2": { + "version": "v3.23.3", + "image": "tigera/istio-proxyv2" + }, + "istio-ztunnel": { + "version": "v3.23.3", + "image": "tigera/istio-ztunnel" + }, + "key-cert-provisioner": { + "version": "v3.23.3", + "image": "tigera/key-cert-provisioner" + }, + "kibana": { + "version": "v3.23.3", + "image": "tigera/kibana" + }, + "kube-controllers": { + "version": "v3.23.3", + "image": "tigera/kube-controllers" + }, + "l7-admission-controller": { + "version": "v3.23.3", + "image": "tigera/l7-admission-controller" + }, + "l7-collector": { + "version": "v3.23.3", + "image": "tigera/l7-collector" + }, + "license-agent": { + "version": "v3.23.3", + "image": "tigera/license-agent" + }, + "linseed": { + "version": "v3.23.3", + "image": "tigera/linseed" + }, + "manager": { + "version": "v3.23.3", + "image": "tigera/manager" + }, + "node": { + "version": "v3.23.3", + "image": "tigera/node" + }, + "node-windows": { + "version": "v3.23.3", + "image": "tigera/node-windows" + }, + "packetcapture": { + "version": "v3.23.3", + "image": "tigera/packetcapture" + }, + "policy-recommendation": { + "version": "v3.23.3", + "image": "tigera/policy-recommendation" + }, + "prometheus": { + "version": "v3.23.3", + "image": "tigera/prometheus" + }, + "prometheus-config-reloader": { + "version": "v3.23.3", + "image": "tigera/prometheus-config-reloader" + }, + "prometheus-operator": { + "version": "v3.23.3", + "image": "tigera/prometheus-operator" + }, + "queryserver": { + "version": "v3.23.3", + "image": "tigera/queryserver" + }, + "test-signer": { + "version": "v3.23.3", + "image": "tigera/test-signer" + }, + "tigera-cni": { + "version": "v3.23.3", + "image": "tigera/cni" + }, + "tigera-cni-windows": { + "version": "v3.23.3", + "image": "tigera/cni-windows" + }, + "tigera-prometheus-service": { + "version": "v3.23.3", + "image": "tigera/prometheus-service" + }, + "typha": { + "version": "v3.23.3", + "image": "tigera/typha" + }, + "ui-apis": { + "version": "v3.23.3", + "image": "tigera/ui-apis" + }, + "upstream-istio": { + "version": "1.29.6" + }, + "voltron": { + "version": "v3.23.3", + "image": "tigera/voltron" + }, + "waf-http-filter": { + "version": "v3.23.3", + "image": "tigera/waf-http-filter" + }, + "webhooks": { + "version": "v3.23.3", + "image": "tigera/webhooks" + }, + "webhooks-processor": { + "version": "v3.23.3", + "image": "tigera/webhooks-processor" + } + } + }, { "title": "v3.23.2", "tigera-operator": { diff --git a/calico-enterprise_versioned_docs/version-3.23-2/variables.js b/calico-enterprise_versioned_docs/version-3.23-2/variables.js index 7742dda001..62c2fe4dde 100644 --- a/calico-enterprise_versioned_docs/version-3.23-2/variables.js +++ b/calico-enterprise_versioned_docs/version-3.23-2/variables.js @@ -2,14 +2,14 @@ const releases = require('./releases.json'); const componentImage = require('../../src/components/utils/componentImage'); const variables = { - releaseTitle: 'v3.23.2', - helmPre: 'v3.23.2'.includes('-') ? ' --devel' : '', + releaseTitle: 'v3.23.3', + helmPre: 'v3.23.3'.includes('-') ? ' --devel' : '', prodname: 'Calico Enterprise', prodnamedash: 'calico-enterprise', version: 'v3.23', openSourceVersion: releases[0].calico.minor_version.slice(1), baseUrl: '/calico-enterprise/latest', - filesUrl: 'https://downloads.tigera.io/ee/v3.23.2', + filesUrl: 'https://downloads.tigera.io/ee/v3.23.3', rhelPkgUrl: 'https://downloads.tigera.io/ee/rpms/' + releases[0].title.slice(0, 5), debPkgUrl: 'https://downloads.tigera.io/ee/debs/' + releases[0].title.slice(0, 5), tutorialFilesURL: 'https://docs.tigera.io/files', @@ -21,8 +21,8 @@ const variables = { noderunning: 'calico-node', rootDirWindows: 'C:\\TigeraCalico', registry: 'quay.io/', - envoyVersion: '1.8.3', - chart_version_name: 'v3.23.2-0', + envoyVersion: '1.9.1', + chart_version_name: 'v3.23.3-0', tigeraOperator: releases[0]['tigera-operator'], dikastesVersion: releases[0].components.dikastes.version, releases, From 513d20b276bc5fa21e4d5088a0a1985f76df38ec Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Tue, 27 Oct 2026 17:04:18 +0000 Subject: [PATCH 2/9] Add draft 3.23.3 release notes from calico-private and operator Covers calico-private PRs merged to release-calient-v3.23 after v3.23.2, and operator release-v1.42 changes after v1.42.5. Third-party version bumps and CI-only changes are left out. --- .../version-3.23-2/release-notes/index.mdx | 70 ++++++++++++++++++- 1 file changed, 69 insertions(+), 1 deletion(-) diff --git a/calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx b/calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx index 2edda5d6e3..c0bced9748 100644 --- a/calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx +++ b/calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx @@ -304,8 +304,76 @@ To update an existing installation of Calico Enterprise 3.23, see [Install a pat October 27, 2026 +#### Upgrade notes + +* $[prodname] no longer trusts the four emSign (eMudhra) root certificates. The operator removes them from the system CA bundle it mounts into calico-node, Typha, Dex, fluentd, intrusion detection, the webhooks processor and Guardian. Endpoints whose certificates chain to an emSign root, such as an external Elasticsearch, an identity provider or a webhook target, stop being trusted after the upgrade. Before you upgrade, move those endpoints to a certificate from another CA. {/* #5365 */} +* Envoy is updated to 1.39.1 in Calico Ingress Gateway and the L7 log collector. **Compatibility note:** the new Envoy changes how some requests match routes: + * A header sent on more than one line is now matched one value at a time. A route that matches a joined value such as `user,admin` no longer matches when those values arrive as separate header lines. To restore the old behavior, set the runtime flag `envoy.reloadable_features.match_headers_individually` to `false`. + * Paths that carry `..` segments with parameters, such as `/public/..;x=y/admin`, are now normalized before routing, so such a request can match a different route. + * Envoy always enforces RSA key usage on TLS certificates, and the TLS inspector now checks the client's minimum and maximum TLS version. + {/* #14240 */} +* IP pool namespace selectors are now honored when $[prodname] assigns LoadBalancer Service IPs. A LoadBalancer IP pool with a namespace selector starts matching Services in the selected namespaces after the upgrade. {/* #14517 */} +* Selectors with parentheses nested more than 100 deep are now rejected. {/* #14723 */} + +#### Enhancements + +* Added the `connectionMode` field to BGPPeer (`Auto`, `Active` or `Passive`) to control which end initiates the BGP session. Combined with faster reconnect timers on local workload peerings, `Active` reduces the LoadBalancer VIP outage during a nested KubeVirt VM live migration from over 16 seconds to under 2 seconds. Nodes also no longer re-advertise BGP-learned routes they have marked unreachable. {/* #13760 */} +* Added the Helm value `managementCluster.service.createNamespace`, so you can stop the tigera-operator chart from creating the `calico-system` namespace on a management cluster when you manage that namespace yourself. To turn it off on an existing installation, first upgrade with the default (`true`), and then set it to `false` in a later, separate upgrade. If you do both in one upgrade, Helm deletes `calico-system`. {/* #14867 */} +* Application layer policy evaluates rule criteria cheapest-first, which makes evaluation 1.6 to 3.7 times faster for large policy sets. Per-rule warnings from the policy engine are now rate limited. {/* #13806 */} +* Reduced CPU and memory use when converting Kubernetes network policies that contain wide port ranges. {/* #14738 */} +* Dikastes and Felix now report the recurring policy-evaluation conditions "IPSet not found" and "failed to parse source principal" as one aggregated log line per five-minute window. **Compatibility note:** the IP set IDs and principals move out of the message text into the list-valued `ipsets` and `principals` fields, and the `logsSkipped` field is gone. Update any log queries or alerts that parse these lines. {/* #13847 */} + #### Bug fixes -* TBD +* Fixed nested workload traffic, such as a Service VIP or pod CIDR advertised from inside a KubeVirt VM, being black-holed on the node that receives a live-migrated VM. {/* #14038 */} +* Fixed BGPConfiguration, BGPPeer and BGPFilter rejecting 4-byte AS numbers above 2147483647. {/* #14141 */} +* Fixed an IP address leak when a KubeVirt VM allocated an address while its IPAM handle was being freed manually after an earlier failure. {/* #11877 */} +* Fixed pods being unable to restart when their IP pool has no spare addresses, which most often affected egress gateways. A pod now keeps its existing address when its sandbox is rebuilt. {/* #14047 */} +* Fixed KubeVirt VMs with address persistence failing to get an address when their namespace and name together are longer than about 107 characters. {/* #14611 */} +* Fixed Felix retrying an invalid tunnel route forever for a local pod whose IP was borrowed from another node's IPAM block. {/* #13901 */} +* Fixed Felix restarting repeatedly when multiple `routeTableRanges` are set. {/* #13673 */} +* Fixed IP sets with overlapping CIDRs failing to program correctly in nftables mode after a member was removed. {/* #14266 */} +* Fixed Felix, with IPv6 and the iptables dataplane enabled, creating two IPv6 IP set dataplanes that repeatedly deleted each other's IP sets. {/* #13933 */} +* Fixed a race where a workload's egress gateway maintenance annotations were not applied when the workload endpoint was updated at the same time as the gateway started terminating. {/* #13802 */} +* Fixed Felix on EKS waiting on the EC2 API during startup when TPROXY mode is disabled, which could delay policy enforcement by up to 20 seconds after a restart. {/* #14813 */} +* Fixed calico-noncluster-host-init ignoring the `FELIX_TYPHACAFILE`, `FELIX_TYPHACERTFILE` and `FELIX_TYPHAKEYFILE` overrides in `calico-node.env`, which could stop calico-node from starting on a non-cluster host. {/* #14096 */} +* Fixed a policy program that the kernel verifier rejected with "unreachable insn" when a workload had enough policy rules to need more than one program, which left the node not ready. {/* #14764 */} +* Fixed the BPF DNS parser being rejected by the verifier on newer kernels, which silently disabled cross-node overlay traffic. {/* #13789 */} +* Fixed a regression where traffic on the WireGuard port (51820 by default) arriving at a host interface was dropped unless it came from a known $[prodname] node. This broke user-managed WireGuard overlays, and $[prodname] WireGuard between nodes with different underlay addresses, such as nodes behind NAT. {/* #14183 */} +* Fixed pre-existing connections to a node port with a backend on another node being dropped when the dataplane was switched to eBPF. {/* #13894 */} +* Fixed domain-based policy for pods that resolve through the NodeLocal DNSCache link-local address (169.254.20.10). Clusters whose pods use the kube-dns ClusterIP were not affected. {/* #13710 */} +* Fixed a Felix panic on nodes running NodeLocal DNSCache with IPv6 enabled. {/* #13708 */} +* Fixed IPv6 conntrack cleanup for expired NAT reverse entries. {/* #14430 */} +* Fixed two service affinity bugs: datagrams from an unconnected UDP socket could go to different backends, and a UDP service with `sessionAffinity` had its affinity timeout capped at the much shorter UDP conntrack timeout. {/* #13677 */} +* Fixed a leak that retained per-interface state for every Istio ambient workload torn down on a node. {/* #13682 */} +* Fixed application layer policy never matching rules that reference a named port, which caused Allow rules to deny and Deny rules to have no effect. {/* #13850 */} +* Fixed application layer policy enforcing staged policies as if they were enforced. {/* #13869 */} +* Fixed policy recommendation producing an invalid recommendation for namespaces whose pods call the Kubernetes API, or another Service backed by non-pod endpoints, and then retrying the rejected recommendation every few seconds. {/* #14853 */} +* Reverted the change that suppressed empty `source: {}` and `destination: {}` in policy rules, which left GitOps tools such as Argo CD reporting those policies as permanently out of sync. {/* #14498 */} +* Fixed `calicoctl validate` accepting resources that the API server rejects, including duplicate entries in list fields such as a NetworkSet's addresses. {/* #14142 */} +* Fixed repeated "cannot patch resource tiers" errors from calico-kube-controllers on clusters that use native `projectcalico.org/v3` CRDs. {/* #5360 */} +* Fixed flow logs reporting a staged policy as the enforced verdict, with incorrect packet and byte counts, when a flow's policy path changed mid-flow. {/* #13869 */} +* Fixed flow logs reporting an end-of-tier deny as the staged policy verdict for connections to DNS-resolved destinations, both right after the DNS lookup and after the DNS mapping expires. {/* #14377 */} +* Fixed flow logs reporting an end-of-tier deny as the staged policy verdict for traffic to domain-based network sets or egress domain rules after a Felix restart. Enforcement was not affected. {/* #13945 */} +* Fixed Felix repeatedly emitting stale deny flow logs with zero counters after a policy change allowed the traffic. {/* #13589 */} +* Fixed Felix restarting with "BUG: Unexpected action" when a new policy with a Pass rule changed the policy match for an active flow while flow logs were sent to Goldmane. {/* #14646 */} +* Fixed Goldmane counting a node's flow statistics twice when Felix reconnects to it. {/* #13705 */} +* Fixed premature age-out of flow log entries in the eBPF dataplane, which duplicated packet and byte counts for long-lived ICMP flows. {/* #13680 */} +* Fixed eBPF flow logs attributing traffic to the wrong host endpoint, or leaving the reporting interface out. {/* #14000 */} +* Fixed Service Graph connection rates being wrong on clusters that changed `flowLogsFlushInterval` in FelixConfiguration. {/* #14407 */} +* Fixed a stale packet capture status being written to a PacketCapture after a failed status update was retried. {/* #14074 */} +* Fixed the policy board in the web console rendering empty on managed clusters. {/* #5260 */} +* Fixed concurrent endpoint queries in the web console being able to run with another request's credentials. {/* #14157 */} +* Fixed aborting a datastore migration leaving $[prodname] serving from an empty datastore instead of restoring the aggregated API server. {/* #14517 */} +* Fixed `calicoctl datastore migrate` leaving IPv6 VXLAN and WireGuard tunnel addresses tied to the old node name, and a kube-controllers panic on load balancer IP allocations with no handle. {/* #14517 */} +* Fixed policy name migration never running when the calico-node DaemonSet has a different name. {/* #14517 */} +* Fixed the datastore migration reporting cleanup as complete while v1 CRDs were still being deleted. {/* #14413 */} +* Fixed a datastore migration getting stuck permanently if the calico-kube-controllers pod was lost during the migration. {/* #5319 */} +* Fixed the tigera-operator Helm chart leaving behind a stale uninstall Job after an interrupted or failed uninstall, which blocked later uninstalls. {/* #14472 */} +* Fixed the operator failing to reconcile, and to renew Typha certificates, on Rancher-managed clusters. {/* #14264 */} +* Fixed a deadlock on clusters where the Kubernetes API server is reachable only by name. calico-node now defaults to the node's own DNS resolver. {/* #5247 */} +* Fixed TigeraStatus reporting a StatefulSet-backed component as available before its pods are ready. {/* #5354 */} +* Fixed Felix panicking instead of restarting cleanly when a restart-requiring configuration change arrived while the dataplane was busy, and deadlocking if such a change arrived before startup completed. {/* #13762 */} +* Security updates. {/* #14549 #14634 #14352 #14240 #14189 #14583 */} To update an existing installation of Calico Enterprise 3.23, see [Install a patch release](../getting-started/manifest-archive.mdx). \ No newline at end of file From b1b94821ddc5e55ca2774715a8055cb5b7238b6f Mon Sep 17 00:00:00 2001 From: "Rene Dekker (claude)" Date: Tue, 27 Oct 2026 11:38:58 -0700 Subject: [PATCH 3/9] Shorten emSign upgrade note in 3.23.3 release notes --- .../version-3.23-2/release-notes/index.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx b/calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx index c0bced9748..61a4549e03 100644 --- a/calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx +++ b/calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx @@ -306,7 +306,7 @@ October 27, 2026 #### Upgrade notes -* $[prodname] no longer trusts the four emSign (eMudhra) root certificates. The operator removes them from the system CA bundle it mounts into calico-node, Typha, Dex, fluentd, intrusion detection, the webhooks processor and Guardian. Endpoints whose certificates chain to an emSign root, such as an external Elasticsearch, an identity provider or a webhook target, stop being trusted after the upgrade. Before you upgrade, move those endpoints to a certificate from another CA. {/* #5365 */} +* Removed the emSign (eMudhra) root certificates from the CA bundle that the operator mounts into $[prodname] components, and updated Go to 1.26.10. Endpoints whose certificates chain to an emSign root, such as an external Elasticsearch, an identity provider or a webhook target, are no longer trusted after the upgrade. {/* #5365 */} * Envoy is updated to 1.39.1 in Calico Ingress Gateway and the L7 log collector. **Compatibility note:** the new Envoy changes how some requests match routes: * A header sent on more than one line is now matched one value at a time. A route that matches a joined value such as `user,admin` no longer matches when those values arrive as separate header lines. To restore the old behavior, set the runtime flag `envoy.reloadable_features.match_headers_individually` to `false`. * Paths that carry `..` segments with parameters, such as `/public/..;x=y/admin`, are now normalized before routing, so such a request can match a different route. From 77ed2dc685f6b5203ab28a907cbe4747cd4b8838 Mon Sep 17 00:00:00 2001 From: "Rene Dekker (claude)" Date: Tue, 27 Oct 2026 16:05:31 -0700 Subject: [PATCH 4/9] Move CI-linked fixes to the top of the 3.23.3 bug fixes --- .../version-3.23-2/release-notes/index.mdx | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx b/calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx index 61a4549e03..52dcd94b58 100644 --- a/calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx +++ b/calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx @@ -325,21 +325,24 @@ October 27, 2026 #### Bug fixes +* Fixed Felix restarting repeatedly when multiple `routeTableRanges` are set. {/* #13673 */} +* Fixed Felix, with IPv6 and the iptables dataplane enabled, creating two IPv6 IP set dataplanes that repeatedly deleted each other's IP sets. {/* #13933 */} +* Fixed a race where a workload's egress gateway maintenance annotations were not applied when the workload endpoint was updated at the same time as the gateway started terminating. {/* #13802 */} +* Fixed a policy program that the kernel verifier rejected with "unreachable insn" when a workload had enough policy rules to need more than one program, which left the node not ready. {/* #14764 */} +* Fixed a regression where traffic on the WireGuard port (51820 by default) arriving at a host interface was dropped unless it came from a known $[prodname] node. This broke user-managed WireGuard overlays, and $[prodname] WireGuard between nodes with different underlay addresses, such as nodes behind NAT. {/* #14183 */} +* Reverted the change that suppressed empty `source: {}` and `destination: {}` in policy rules, which left GitOps tools such as Argo CD reporting those policies as permanently out of sync. {/* #14498 */} +* Fixed the policy board in the web console rendering empty on managed clusters. {/* #5260 */} +* Fixed the tigera-operator Helm chart leaving behind a stale uninstall Job after an interrupted or failed uninstall, which blocked later uninstalls. {/* #14472 */} * Fixed nested workload traffic, such as a Service VIP or pod CIDR advertised from inside a KubeVirt VM, being black-holed on the node that receives a live-migrated VM. {/* #14038 */} * Fixed BGPConfiguration, BGPPeer and BGPFilter rejecting 4-byte AS numbers above 2147483647. {/* #14141 */} * Fixed an IP address leak when a KubeVirt VM allocated an address while its IPAM handle was being freed manually after an earlier failure. {/* #11877 */} * Fixed pods being unable to restart when their IP pool has no spare addresses, which most often affected egress gateways. A pod now keeps its existing address when its sandbox is rebuilt. {/* #14047 */} * Fixed KubeVirt VMs with address persistence failing to get an address when their namespace and name together are longer than about 107 characters. {/* #14611 */} * Fixed Felix retrying an invalid tunnel route forever for a local pod whose IP was borrowed from another node's IPAM block. {/* #13901 */} -* Fixed Felix restarting repeatedly when multiple `routeTableRanges` are set. {/* #13673 */} * Fixed IP sets with overlapping CIDRs failing to program correctly in nftables mode after a member was removed. {/* #14266 */} -* Fixed Felix, with IPv6 and the iptables dataplane enabled, creating two IPv6 IP set dataplanes that repeatedly deleted each other's IP sets. {/* #13933 */} -* Fixed a race where a workload's egress gateway maintenance annotations were not applied when the workload endpoint was updated at the same time as the gateway started terminating. {/* #13802 */} * Fixed Felix on EKS waiting on the EC2 API during startup when TPROXY mode is disabled, which could delay policy enforcement by up to 20 seconds after a restart. {/* #14813 */} * Fixed calico-noncluster-host-init ignoring the `FELIX_TYPHACAFILE`, `FELIX_TYPHACERTFILE` and `FELIX_TYPHAKEYFILE` overrides in `calico-node.env`, which could stop calico-node from starting on a non-cluster host. {/* #14096 */} -* Fixed a policy program that the kernel verifier rejected with "unreachable insn" when a workload had enough policy rules to need more than one program, which left the node not ready. {/* #14764 */} * Fixed the BPF DNS parser being rejected by the verifier on newer kernels, which silently disabled cross-node overlay traffic. {/* #13789 */} -* Fixed a regression where traffic on the WireGuard port (51820 by default) arriving at a host interface was dropped unless it came from a known $[prodname] node. This broke user-managed WireGuard overlays, and $[prodname] WireGuard between nodes with different underlay addresses, such as nodes behind NAT. {/* #14183 */} * Fixed pre-existing connections to a node port with a backend on another node being dropped when the dataplane was switched to eBPF. {/* #13894 */} * Fixed domain-based policy for pods that resolve through the NodeLocal DNSCache link-local address (169.254.20.10). Clusters whose pods use the kube-dns ClusterIP were not affected. {/* #13710 */} * Fixed a Felix panic on nodes running NodeLocal DNSCache with IPv6 enabled. {/* #13708 */} @@ -349,7 +352,6 @@ October 27, 2026 * Fixed application layer policy never matching rules that reference a named port, which caused Allow rules to deny and Deny rules to have no effect. {/* #13850 */} * Fixed application layer policy enforcing staged policies as if they were enforced. {/* #13869 */} * Fixed policy recommendation producing an invalid recommendation for namespaces whose pods call the Kubernetes API, or another Service backed by non-pod endpoints, and then retrying the rejected recommendation every few seconds. {/* #14853 */} -* Reverted the change that suppressed empty `source: {}` and `destination: {}` in policy rules, which left GitOps tools such as Argo CD reporting those policies as permanently out of sync. {/* #14498 */} * Fixed `calicoctl validate` accepting resources that the API server rejects, including duplicate entries in list fields such as a NetworkSet's addresses. {/* #14142 */} * Fixed repeated "cannot patch resource tiers" errors from calico-kube-controllers on clusters that use native `projectcalico.org/v3` CRDs. {/* #5360 */} * Fixed flow logs reporting a staged policy as the enforced verdict, with incorrect packet and byte counts, when a flow's policy path changed mid-flow. {/* #13869 */} @@ -362,14 +364,12 @@ October 27, 2026 * Fixed eBPF flow logs attributing traffic to the wrong host endpoint, or leaving the reporting interface out. {/* #14000 */} * Fixed Service Graph connection rates being wrong on clusters that changed `flowLogsFlushInterval` in FelixConfiguration. {/* #14407 */} * Fixed a stale packet capture status being written to a PacketCapture after a failed status update was retried. {/* #14074 */} -* Fixed the policy board in the web console rendering empty on managed clusters. {/* #5260 */} * Fixed concurrent endpoint queries in the web console being able to run with another request's credentials. {/* #14157 */} * Fixed aborting a datastore migration leaving $[prodname] serving from an empty datastore instead of restoring the aggregated API server. {/* #14517 */} * Fixed `calicoctl datastore migrate` leaving IPv6 VXLAN and WireGuard tunnel addresses tied to the old node name, and a kube-controllers panic on load balancer IP allocations with no handle. {/* #14517 */} * Fixed policy name migration never running when the calico-node DaemonSet has a different name. {/* #14517 */} * Fixed the datastore migration reporting cleanup as complete while v1 CRDs were still being deleted. {/* #14413 */} * Fixed a datastore migration getting stuck permanently if the calico-kube-controllers pod was lost during the migration. {/* #5319 */} -* Fixed the tigera-operator Helm chart leaving behind a stale uninstall Job after an interrupted or failed uninstall, which blocked later uninstalls. {/* #14472 */} * Fixed the operator failing to reconcile, and to renew Typha certificates, on Rancher-managed clusters. {/* #14264 */} * Fixed a deadlock on clusters where the Kubernetes API server is reachable only by name. calico-node now defaults to the node's own DNS resolver. {/* #5247 */} * Fixed TigeraStatus reporting a StatefulSet-backed component as available before its pods are ready. {/* #5354 */} From c28f7b43c364f15634062ac3ea5cbfa1572f78e3 Mon Sep 17 00:00:00 2001 From: "Rene Dekker (claude)" Date: Tue, 27 Oct 2026 16:13:44 -0700 Subject: [PATCH 5/9] Add CI-2076 web console login fix to 3.23.3 notes --- .../version-3.23-2/release-notes/index.mdx | 1 + 1 file changed, 1 insertion(+) diff --git a/calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx b/calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx index 52dcd94b58..b9584cefd0 100644 --- a/calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx +++ b/calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx @@ -332,6 +332,7 @@ October 27, 2026 * Fixed a regression where traffic on the WireGuard port (51820 by default) arriving at a host interface was dropped unless it came from a known $[prodname] node. This broke user-managed WireGuard overlays, and $[prodname] WireGuard between nodes with different underlay addresses, such as nodes behind NAT. {/* #14183 */} * Reverted the change that suppressed empty `source: {}` and `destination: {}` in policy rules, which left GitOps tools such as Argo CD reporting those policies as permanently out of sync. {/* #14498 */} * Fixed the policy board in the web console rendering empty on managed clusters. {/* #5260 */} +* Fixed web console login failing with "Service Unavailable" for users who are not cluster administrators. {/* #14574 */} * Fixed the tigera-operator Helm chart leaving behind a stale uninstall Job after an interrupted or failed uninstall, which blocked later uninstalls. {/* #14472 */} * Fixed nested workload traffic, such as a Service VIP or pod CIDR advertised from inside a KubeVirt VM, being black-holed on the node that receives a live-migrated VM. {/* #14038 */} * Fixed BGPConfiguration, BGPPeer and BGPFilter rejecting 4-byte AS numbers above 2147483647. {/* #14141 */} From b23ba90773a53ff84ae94914e7bc7c1b4ce5e6ac Mon Sep 17 00:00:00 2001 From: "Rene Dekker (claude)" Date: Tue, 27 Oct 2026 16:20:01 -0700 Subject: [PATCH 6/9] Condense 3.23.3 release notes and group eBPF fixes --- .../version-3.23-2/release-notes/index.mdx | 41 +++++++------------ 1 file changed, 15 insertions(+), 26 deletions(-) diff --git a/calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx b/calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx index b9584cefd0..84ec0ec4c3 100644 --- a/calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx +++ b/calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx @@ -317,11 +317,11 @@ October 27, 2026 #### Enhancements -* Added the `connectionMode` field to BGPPeer (`Auto`, `Active` or `Passive`) to control which end initiates the BGP session. Combined with faster reconnect timers on local workload peerings, `Active` reduces the LoadBalancer VIP outage during a nested KubeVirt VM live migration from over 16 seconds to under 2 seconds. Nodes also no longer re-advertise BGP-learned routes they have marked unreachable. {/* #13760 */} +* Added the `connectionMode` field to BGPPeer (`Auto`, `Active` or `Passive`) to control which end initiates the BGP session. Use `Active` to cut LoadBalancer VIP downtime during a nested KubeVirt VM live migration from over 16 seconds to under 2 seconds. {/* #13760 */} * Added the Helm value `managementCluster.service.createNamespace`, so you can stop the tigera-operator chart from creating the `calico-system` namespace on a management cluster when you manage that namespace yourself. To turn it off on an existing installation, first upgrade with the default (`true`), and then set it to `false` in a later, separate upgrade. If you do both in one upgrade, Helm deletes `calico-system`. {/* #14867 */} * Application layer policy evaluates rule criteria cheapest-first, which makes evaluation 1.6 to 3.7 times faster for large policy sets. Per-rule warnings from the policy engine are now rate limited. {/* #13806 */} * Reduced CPU and memory use when converting Kubernetes network policies that contain wide port ranges. {/* #14738 */} -* Dikastes and Felix now report the recurring policy-evaluation conditions "IPSet not found" and "failed to parse source principal" as one aggregated log line per five-minute window. **Compatibility note:** the IP set IDs and principals move out of the message text into the list-valued `ipsets` and `principals` fields, and the `logsSkipped` field is gone. Update any log queries or alerts that parse these lines. {/* #13847 */} +* Dikastes and Felix now aggregate the recurring "IPSet not found" and "failed to parse source principal" log lines into one line per five minutes. **Compatibility note:** IP set IDs and principals move into the `ipsets` and `principals` fields, and `logsSkipped` is removed. Update any log queries or alerts that parse these lines. {/* #13847 */} #### Bug fixes @@ -329,51 +329,40 @@ October 27, 2026 * Fixed Felix, with IPv6 and the iptables dataplane enabled, creating two IPv6 IP set dataplanes that repeatedly deleted each other's IP sets. {/* #13933 */} * Fixed a race where a workload's egress gateway maintenance annotations were not applied when the workload endpoint was updated at the same time as the gateway started terminating. {/* #13802 */} * Fixed a policy program that the kernel verifier rejected with "unreachable insn" when a workload had enough policy rules to need more than one program, which left the node not ready. {/* #14764 */} -* Fixed a regression where traffic on the WireGuard port (51820 by default) arriving at a host interface was dropped unless it came from a known $[prodname] node. This broke user-managed WireGuard overlays, and $[prodname] WireGuard between nodes with different underlay addresses, such as nodes behind NAT. {/* #14183 */} +* Fixed eBPF mode dropping UDP traffic on the WireGuard port (51820 by default) at host interfaces unless it came from a known $[prodname] node. This broke user-managed WireGuard overlays and caused occasional UDP DNS timeouts when a client's ephemeral port was 51820. {/* #14183 */} * Reverted the change that suppressed empty `source: {}` and `destination: {}` in policy rules, which left GitOps tools such as Argo CD reporting those policies as permanently out of sync. {/* #14498 */} * Fixed the policy board in the web console rendering empty on managed clusters. {/* #5260 */} * Fixed web console login failing with "Service Unavailable" for users who are not cluster administrators. {/* #14574 */} * Fixed the tigera-operator Helm chart leaving behind a stale uninstall Job after an interrupted or failed uninstall, which blocked later uninstalls. {/* #14472 */} +* Fixed pods being unable to restart when their IP pool has no spare addresses, which most often affected egress gateways. A pod now keeps its existing address when its sandbox is rebuilt. {/* #14047 */} * Fixed nested workload traffic, such as a Service VIP or pod CIDR advertised from inside a KubeVirt VM, being black-holed on the node that receives a live-migrated VM. {/* #14038 */} * Fixed BGPConfiguration, BGPPeer and BGPFilter rejecting 4-byte AS numbers above 2147483647. {/* #14141 */} * Fixed an IP address leak when a KubeVirt VM allocated an address while its IPAM handle was being freed manually after an earlier failure. {/* #11877 */} -* Fixed pods being unable to restart when their IP pool has no spare addresses, which most often affected egress gateways. A pod now keeps its existing address when its sandbox is rebuilt. {/* #14047 */} * Fixed KubeVirt VMs with address persistence failing to get an address when their namespace and name together are longer than about 107 characters. {/* #14611 */} -* Fixed Felix retrying an invalid tunnel route forever for a local pod whose IP was borrowed from another node's IPAM block. {/* #13901 */} * Fixed IP sets with overlapping CIDRs failing to program correctly in nftables mode after a member was removed. {/* #14266 */} * Fixed Felix on EKS waiting on the EC2 API during startup when TPROXY mode is disabled, which could delay policy enforcement by up to 20 seconds after a restart. {/* #14813 */} * Fixed calico-noncluster-host-init ignoring the `FELIX_TYPHACAFILE`, `FELIX_TYPHACERTFILE` and `FELIX_TYPHAKEYFILE` overrides in `calico-node.env`, which could stop calico-node from starting on a non-cluster host. {/* #14096 */} -* Fixed the BPF DNS parser being rejected by the verifier on newer kernels, which silently disabled cross-node overlay traffic. {/* #13789 */} -* Fixed pre-existing connections to a node port with a backend on another node being dropped when the dataplane was switched to eBPF. {/* #13894 */} -* Fixed domain-based policy for pods that resolve through the NodeLocal DNSCache link-local address (169.254.20.10). Clusters whose pods use the kube-dns ClusterIP were not affected. {/* #13710 */} * Fixed a Felix panic on nodes running NodeLocal DNSCache with IPv6 enabled. {/* #13708 */} -* Fixed IPv6 conntrack cleanup for expired NAT reverse entries. {/* #14430 */} -* Fixed two service affinity bugs: datagrams from an unconnected UDP socket could go to different backends, and a UDP service with `sessionAffinity` had its affinity timeout capped at the much shorter UDP conntrack timeout. {/* #13677 */} -* Fixed a leak that retained per-interface state for every Istio ambient workload torn down on a node. {/* #13682 */} +* Fixed several issues in the eBPF dataplane: + * The BPF DNS parser was rejected by the verifier on newer kernels, which silently disabled cross-node overlay traffic. {/* #13789 */} + * Pre-existing connections to a node port with a backend on another node were dropped when the dataplane was switched to eBPF. {/* #13894 */} + * Domain-based policy did not work for pods that resolve through the NodeLocal DNSCache link-local address. {/* #13710 */} + * Datagrams from one unconnected UDP socket could go to different backends, and UDP `sessionAffinity` timeouts were capped at the UDP conntrack timeout. {/* #13677 */} + * Flow logs duplicated counts for long-lived ICMP flows, and could attribute traffic to the wrong host endpoint. {/* #13680 #14000 */} + * Expired IPv6 NAT conntrack entries were not cleaned up, and per-interface state leaked for Istio ambient workloads. {/* #14430 #13682 */} * Fixed application layer policy never matching rules that reference a named port, which caused Allow rules to deny and Deny rules to have no effect. {/* #13850 */} * Fixed application layer policy enforcing staged policies as if they were enforced. {/* #13869 */} * Fixed policy recommendation producing an invalid recommendation for namespaces whose pods call the Kubernetes API, or another Service backed by non-pod endpoints, and then retrying the rejected recommendation every few seconds. {/* #14853 */} * Fixed `calicoctl validate` accepting resources that the API server rejects, including duplicate entries in list fields such as a NetworkSet's addresses. {/* #14142 */} * Fixed repeated "cannot patch resource tiers" errors from calico-kube-controllers on clusters that use native `projectcalico.org/v3` CRDs. {/* #5360 */} -* Fixed flow logs reporting a staged policy as the enforced verdict, with incorrect packet and byte counts, when a flow's policy path changed mid-flow. {/* #13869 */} -* Fixed flow logs reporting an end-of-tier deny as the staged policy verdict for connections to DNS-resolved destinations, both right after the DNS lookup and after the DNS mapping expires. {/* #14377 */} -* Fixed flow logs reporting an end-of-tier deny as the staged policy verdict for traffic to domain-based network sets or egress domain rules after a Felix restart. Enforcement was not affected. {/* #13945 */} -* Fixed Felix repeatedly emitting stale deny flow logs with zero counters after a policy change allowed the traffic. {/* #13589 */} +* Fixed flow logs reporting the wrong staged policy verdict: a staged policy as the enforced verdict when a flow's policy path changed mid-flow, and an end-of-tier deny for traffic to DNS-resolved destinations or domain-based network sets. Enforcement was not affected. {/* #13869 #14377 #13945 */} +* Fixed wrong flow counts: Felix emitting stale zero-count deny logs after a policy change allowed the traffic, Goldmane counting a node's statistics twice after Felix reconnects, and Service Graph connection rates on clusters that changed `flowLogsFlushInterval`. {/* #13589 #13705 #14407 */} * Fixed Felix restarting with "BUG: Unexpected action" when a new policy with a Pass rule changed the policy match for an active flow while flow logs were sent to Goldmane. {/* #14646 */} -* Fixed Goldmane counting a node's flow statistics twice when Felix reconnects to it. {/* #13705 */} -* Fixed premature age-out of flow log entries in the eBPF dataplane, which duplicated packet and byte counts for long-lived ICMP flows. {/* #13680 */} -* Fixed eBPF flow logs attributing traffic to the wrong host endpoint, or leaving the reporting interface out. {/* #14000 */} -* Fixed Service Graph connection rates being wrong on clusters that changed `flowLogsFlushInterval` in FelixConfiguration. {/* #14407 */} -* Fixed a stale packet capture status being written to a PacketCapture after a failed status update was retried. {/* #14074 */} * Fixed concurrent endpoint queries in the web console being able to run with another request's credentials. {/* #14157 */} -* Fixed aborting a datastore migration leaving $[prodname] serving from an empty datastore instead of restoring the aggregated API server. {/* #14517 */} -* Fixed `calicoctl datastore migrate` leaving IPv6 VXLAN and WireGuard tunnel addresses tied to the old node name, and a kube-controllers panic on load balancer IP allocations with no handle. {/* #14517 */} -* Fixed policy name migration never running when the calico-node DaemonSet has a different name. {/* #14517 */} -* Fixed the datastore migration reporting cleanup as complete while v1 CRDs were still being deleted. {/* #14413 */} -* Fixed a datastore migration getting stuck permanently if the calico-kube-controllers pod was lost during the migration. {/* #5319 */} +* Fixed several datastore migration issues: aborting a migration left $[prodname] serving from an empty datastore, a migration could get stuck permanently if the calico-kube-controllers pod was lost, and cleanup was reported complete while v1 CRDs were still being deleted. {/* #14517 #5319 #14413 */} +* Fixed `calicoctl datastore migrate` leaving IPv6 VXLAN and WireGuard tunnel addresses tied to the old node name, policy name migration never running when the calico-node DaemonSet has a different name, and a kube-controllers panic on load balancer IP allocations with no handle. {/* #14517 */} * Fixed the operator failing to reconcile, and to renew Typha certificates, on Rancher-managed clusters. {/* #14264 */} * Fixed a deadlock on clusters where the Kubernetes API server is reachable only by name. calico-node now defaults to the node's own DNS resolver. {/* #5247 */} -* Fixed TigeraStatus reporting a StatefulSet-backed component as available before its pods are ready. {/* #5354 */} * Fixed Felix panicking instead of restarting cleanly when a restart-requiring configuration change arrived while the dataplane was busy, and deadlocking if such a change arrived before startup completed. {/* #13762 */} * Security updates. {/* #14549 #14634 #14352 #14240 #14189 #14583 */} From aea582a15ceac2b7d4a1d0ae3dea7934707e7171 Mon Sep 17 00:00:00 2001 From: "Rene Dekker (claude)" Date: Tue, 27 Oct 2026 16:45:13 -0700 Subject: [PATCH 7/9] Replace Envoy upgrade note with combined Envoy Gateway 1.9.1 note --- .../version-3.23-2/release-notes/index.mdx | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx b/calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx index 84ec0ec4c3..4d57e34927 100644 --- a/calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx +++ b/calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx @@ -307,11 +307,7 @@ October 27, 2026 #### Upgrade notes * Removed the emSign (eMudhra) root certificates from the CA bundle that the operator mounts into $[prodname] components, and updated Go to 1.26.10. Endpoints whose certificates chain to an emSign root, such as an external Elasticsearch, an identity provider or a webhook target, are no longer trusted after the upgrade. {/* #5365 */} -* Envoy is updated to 1.39.1 in Calico Ingress Gateway and the L7 log collector. **Compatibility note:** the new Envoy changes how some requests match routes: - * A header sent on more than one line is now matched one value at a time. A route that matches a joined value such as `user,admin` no longer matches when those values arrive as separate header lines. To restore the old behavior, set the runtime flag `envoy.reloadable_features.match_headers_individually` to `false`. - * Paths that carry `..` segments with parameters, such as `/public/..;x=y/admin`, are now normalized before routing, so such a request can match a different route. - * Envoy always enforces RSA key usage on TLS certificates, and the TLS inspector now checks the client's minimum and maximum TLS version. - {/* #14240 */} +* Calico Ingress Gateway now bundles Envoy Gateway v1.9.1 (from v1.8.3), and Calico Ingress Gateway and the L7 log collector now use Envoy 1.39.1 (from 1.38.3). Both releases change routing and validation behavior. The new CRDs reject `sessionPersistence.idleTimeout` in `HTTPRoute` and an empty `clientIPDetection` in `ClientTrafficPolicy`; remove them before you upgrade. For the other changes, see the [Envoy Gateway v1.9 release notes](https://gateway.envoyproxy.io/news/releases/notes/v1.9.0/) and the [Envoy 1.39 release notes](https://www.envoyproxy.io/docs/envoy/latest/version_history/v1.39/v1.39.0). {/* #14670 #14240 */} * IP pool namespace selectors are now honored when $[prodname] assigns LoadBalancer Service IPs. A LoadBalancer IP pool with a namespace selector starts matching Services in the selected namespaces after the upgrade. {/* #14517 */} * Selectors with parentheses nested more than 100 deep are now rejected. {/* #14723 */} From 32780a06386d086144a46b00ba4e21b0528925b4 Mon Sep 17 00:00:00 2001 From: "Rene Dekker (claude)" Date: Tue, 27 Oct 2026 16:57:41 -0700 Subject: [PATCH 8/9] Fold 14157 and 13735 into 3.23.3 security updates --- .../version-3.23-2/release-notes/index.mdx | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx b/calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx index 4d57e34927..462d653740 100644 --- a/calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx +++ b/calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx @@ -354,12 +354,11 @@ October 27, 2026 * Fixed flow logs reporting the wrong staged policy verdict: a staged policy as the enforced verdict when a flow's policy path changed mid-flow, and an end-of-tier deny for traffic to DNS-resolved destinations or domain-based network sets. Enforcement was not affected. {/* #13869 #14377 #13945 */} * Fixed wrong flow counts: Felix emitting stale zero-count deny logs after a policy change allowed the traffic, Goldmane counting a node's statistics twice after Felix reconnects, and Service Graph connection rates on clusters that changed `flowLogsFlushInterval`. {/* #13589 #13705 #14407 */} * Fixed Felix restarting with "BUG: Unexpected action" when a new policy with a Pass rule changed the policy match for an active flow while flow logs were sent to Goldmane. {/* #14646 */} -* Fixed concurrent endpoint queries in the web console being able to run with another request's credentials. {/* #14157 */} * Fixed several datastore migration issues: aborting a migration left $[prodname] serving from an empty datastore, a migration could get stuck permanently if the calico-kube-controllers pod was lost, and cleanup was reported complete while v1 CRDs were still being deleted. {/* #14517 #5319 #14413 */} * Fixed `calicoctl datastore migrate` leaving IPv6 VXLAN and WireGuard tunnel addresses tied to the old node name, policy name migration never running when the calico-node DaemonSet has a different name, and a kube-controllers panic on load balancer IP allocations with no handle. {/* #14517 */} * Fixed the operator failing to reconcile, and to renew Typha certificates, on Rancher-managed clusters. {/* #14264 */} * Fixed a deadlock on clusters where the Kubernetes API server is reachable only by name. calico-node now defaults to the node's own DNS resolver. {/* #5247 */} * Fixed Felix panicking instead of restarting cleanly when a restart-requiring configuration change arrived while the dataplane was busy, and deadlocking if such a change arrived before startup completed. {/* #13762 */} -* Security updates. {/* #14549 #14634 #14352 #14240 #14189 #14583 */} +* Security updates. {/* #14549 #14634 #14352 #14240 #14189 #14583 #14157 #13735 */} To update an existing installation of Calico Enterprise 3.23, see [Install a patch release](../getting-started/manifest-archive.mdx). \ No newline at end of file From c73306f89e87023ce4a179e8e89e5ad9739e3dc4 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Fri, 23 Oct 2026 12:55:13 +0100 Subject: [PATCH 9/9] Document BGPPeer connectionMode for Calico Enterprise 3.23.3 Ports the connectionMode reference row and the live-migration reconvergence section from the next tree to version-3.23-2, where the field first ships. --- .../configuring/bgp-to-workload.mdx | 47 +++++++++++++++++++ .../reference/resources/bgppeer.mdx | 1 + 2 files changed, 48 insertions(+) diff --git a/calico-enterprise_versioned_docs/version-3.23-2/networking/configuring/bgp-to-workload.mdx b/calico-enterprise_versioned_docs/version-3.23-2/networking/configuring/bgp-to-workload.mdx index 42832cba9b..40fe41fbfb 100644 --- a/calico-enterprise_versioned_docs/version-3.23-2/networking/configuring/bgp-to-workload.mdx +++ b/calico-enterprise_versioned_docs/version-3.23-2/networking/configuring/bgp-to-workload.mdx @@ -265,6 +265,53 @@ In the child cluster, asNumber: ``` +### Speed up BGP reconvergence for live migration + +When a workload (such as a KubeVirt VM) is live-migrated to a new node, its BGP session to the +host must re-establish on the new node, during which the workload's advertised routes are +unreachable. By default the workload is the active initiator of this session, so after a migration +the workload — the side that just moved — must redial through BGP's reconnect back-off before +routes recover. + +You can shorten this window with the [`connectionMode`](../../reference/resources/bgppeer.mdx) +field, by making the **host node** the active initiator instead of the workload. Because the host +node is stable across the migration, it re-establishes the session promptly, while the +**workload** waits passively. Set it on both peerings: + +- In the parent cluster, set `connectionMode: Active` on the `localWorkloadSelector` peer: + + ```yaml + apiVersion: projectcalico.org/v3 + kind: BGPPeer + metadata: + name: peer-to-workloads + spec: + localWorkloadSelector: color == 'red' + asNumber: + connectionMode: Active + filters: + - no-export + - accept-nested-ip-pools + ``` + +- In the nested cluster, set `connectionMode: Passive` on the peer(s) to the parent cluster: + + ```yaml + apiVersion: projectcalico.org/v3 + kind: BGPPeer + metadata: + name: peer-to-parent-cluster + spec: + peerIP: 169.254.0.179 + asNumber: + connectionMode: Passive + ``` + +We recommend configuring `connectionMode` as shown above for any deployment where workloads are +live-migrated. Both ends must be set together — the parent peer `Active` and the nested peer +`Passive`; setting only one end does not produce the intended behavior. If you leave the field +unset, it defaults to `Auto`, which preserves the previous behavior. + ### Configure more than one nested cluster You can configure more than one nested cluster by: diff --git a/calico-enterprise_versioned_docs/version-3.23-2/reference/resources/bgppeer.mdx b/calico-enterprise_versioned_docs/version-3.23-2/reference/resources/bgppeer.mdx index dac5fbb712..45cd7a3f39 100644 --- a/calico-enterprise_versioned_docs/version-3.23-2/reference/resources/bgppeer.mdx +++ b/calico-enterprise_versioned_docs/version-3.23-2/reference/resources/bgppeer.mdx @@ -63,6 +63,7 @@ spec: | reachableBy | Adds a static route that may be needed to connect to a peer. In some cases, not having a static route for BGP peering results in route flapping. By adding the address of the gateway that the peer is connected to, a static route is added to prevent route flapping. | The address of the gateway that the peer is connected to | string | | | nextHopMode | Specifies the method of calculating the next hop attribute for received routes. This replaces and expands the deprecated KeepOriginalNextHop field. Users should use this setting to control the next hop attribute for a BGP peer. When this is set, the value of the keepOriginalNextHop field is ignored. If neither keepOriginalNextHop or nextHopMode is specified, BGP's default behavior is used. Default value “Auto” means to apply BGP’s default behavior. "Self" means to configure "next hop self;" in "bird.cfg". "Keep" means to configure "next hop keep;" in "bird.cfg". | "Auto", "Self", "Keep" | string | "Auto" | | reversePeering | Specifies whether Calico automatically generates reverse peerings for nodes selected by the peerSelector. If set to Manual, a separate BGPPeer must be created for the reverse peering. | "Auto", "Manual" | string | "Auto" | +| connectionMode | Controls which end initiates the BGP connection for the peerings generated by this resource, from the perspective of the node(s) selected by `node`/`nodeSelector`. "Auto" uses $[prodname]'s built-in selection. "Active" makes the selected node(s) initiate the connection; "Passive" makes them wait for the far end to initiate. "Active" and "Passive" are only valid for an explicit-`peerIP` or `localWorkloadSelector` peer; a `peerSelector` peer must be "Auto". | "Auto", "Active", "Passive" | string | "Auto" | :::tip