What projectcalico/calico shipped
Written by FoxPlug from the repository's own releases; not affiliated with Tigera. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/projectcalico/calico; Tigera did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 5, 2026
What shipped
- Typha sync protocol gained zstd compression alongside snappy, cutting a 10k-pod snapshot from 1.17 MB to 561 KB at its fastest level. Pull request #11847
- The tigera-operator pre-delete uninstall Job no longer left behind a stale hook Job that blocked later helm uninstall runs, with the fix cherry-picked to the v3.29 through v3.33 branches. Pull request #14193
- Rule Source and Destination went back to omitempty, so an explicit empty source or destination in a stored policy is no longer stripped by the API server. Pull request #14222
- Goldmane flows now carry the distinct source and destination IP sets through the API to the Whisker backend. Pull request #13063
- A ValidatingAdmissionPolicy named protect-cni-annotations.projectcalico.org denies writes to the Calico CNI pod annotations unless they come from the node. Pull request #14065
- Felix no longer builds raw frames on asymmetric flows whose reply route is tunneled, fixing an incorrect
bpf_redirecton the reply leg. Pull request #13637 - Five Goldmane stream log lines now log the stream ID instead of dropping the field. Pull request #14173
- The CNI plugin retries reading the Calico nodename file during node startup instead of hard-failing with ENOENT, reducing sandbox retry storms. Pull request #14091
- The policy name migrator in calico-kube-controllers reads its DaemonSet name from the environment instead of a hardcoded calico-node, so it runs on canal installs. Pull request #14207
- The stale uninstall hook Job fix landed on the v3.32 branch. Pull request #14230
Why it matters
This week the project cut the wire size of Typha sync data for large clusters and removed an uninstall hook Job that could block helm uninstall on several maintained branches. It also restored the empty source and destination serialisation behaviour that GitOps tools depend on, and surfaced per flow source and destination IPs to the Whisker backend so operators can see which IPs made up a flow.
Changelog entry
- Add zstd compression algorithm support for the Typha sync protocol. Pull request #11847
- Fix the stale tigera-operator uninstall hook Job that blocked helm uninstall. Pull request #14193
- Restore omitempty on Rule Source and Destination so empty rules are kept. Pull request #14222
- Add distinct source and destination IP sets to Goldmane flows. Pull request #13063
- Add a ValidatingAdmissionPolicy to protect Calico CNI pod annotations. Pull request #14065
- Fix the raw frame on asymmetric flows with a tunneled reply route. Pull request #13637
- Log the stream ID in Goldmane stream log lines. Pull request #14173
- Retry reading the Calico nodename file instead of failing with ENOENT on node boot. Pull request #14091
- Read the policy name migrator's DaemonSet name from the environment. Pull request #14207
- Drop the legacy asymmetric IPIP TC programs. Pull request #13982
- Find TCX and netkit preambles when checking whether a workload is ready. Pull request #14133
- Fix the Whisker details panel crash on flows without a service. Pull request #14205
This week in Calico: Typha sync gained zstd compression, cutting a 10k-pod snapshot from 1.17 MB to 561 KB. Empty source and destination rules serialise again. Goldmane flows now carry source and destination IPs. The stale tigera-operator uninstall hook Job is fixed.
This week in Calico: Typha's sync protocol gained zstd compression alongside snappy, shrinking a 10k-pod snapshot from 1.17 MB to 561 KB at its fastest level. The tigera-operator pre-delete uninstall hook no longer leaves a Job that blocks later helm uninstall runs, with the fix on v3.29 through v3.33. Rule source and destination are back to omitempty, so an explicit empty source or destination is no longer stripped from stored policies. Goldmane flows now carry their distinct source and destination IPs through the API to the Whisker backend. Felix no longer builds raw frames on asymmetric flows with a tunneled reply route, and the CNI plugin retries reading the nodename file during node startup instead of failing with ENOENT.
Week of September 28, 2026
What shipped
- Released Calico v3.33.0 with container images, binaries, Kubernetes manifests, and Windows support. Release
- EBPF mode now re-attaches workloads when their preamble globals change, ensuring QoS controls and security settings take effect immediately. Pull request #14121
- Fixed IPv6 tunnel handle migration so VXLAN and WireGuard handles correctly map to nodes after datastore migration. Pull request #14108
- IP address release times in IPAM blocks are now preserved during v1-to-v3 datastore migration, maintaining cooldown periods. Pull request #14140
- EBPF dataplane now correctly applies ingress policy to pods reaching themselves through a service. Pull request #14134
- Calicoctl ipam show now uses the same accounting package as ipam check for consistent pool attribution. Pull request #14111
- Added Windows Server 2025 container images for Calico Windows node and CNI components. Pull request #14118
- CI now tests the manifest-to-operator upgrade path that users perform when adopting the operator. Pull request #14054
- Fixed mesh peering to correctly use the peer node's own AS number instead of falling back to the local AS. Pull request #14116
- Fixed calico node status command to work with the renamed process in v3.33. Pull request #14135
Why it matters
V3.33.0 ships with critical eBPF fixes for policy application and tunnel migration, IPAM improvements ensuring consistent pool attribution across tools, and expanded Windows support. These address core reliability issues in network policy enforcement and cluster upgrades.
Changelog entry
- V3.33.0 released Release
- EBPF: re-attach workloads when preamble globals change Pull request #14121
- Fix IPv6 tunnel handle migration and load balancer controller nil handle panic Pull request #14108
- Preserve IP address release times during v1-to-v3 IPAM block migration Pull request #14140
- EBPF: police pod-to-service-to-self flows against ingress policy Pull request #14134
- Calicoctl ipam show uses shared accounting package for consistency Pull request #14111
- Add Windows Server 2025 container images Pull request #14118
- Fix mesh peer AS fallback when peer node has its own AS Pull request #14116
- Fix calico node status command for v3.33 Pull request #14135
- E2E: add WithAvoidControlPlane and DumpCalicoNodeLogs helpers Pull request #14145
Calico v3.33.0 is out. eBPF enhancements for policy correctness, IPAM consistency fixes, IPv6 tunnel migration repair, and Windows Server 2025 support.
Calico v3.33.0 released. Key improvements: eBPF dataplane now correctly enforces policy on pod-to-service-to-self traffic, IPv6 tunnel handles preserved during migration, IPAM tools agree on pool attribution, and Windows Server 2025 container images added. Download from GitHub.
Week of September 21, 2026
What shipped
- Backported bug fixes to v3.31: fixed epstatusfile watcher leak, kept pre-existing forwarded flows alive when switching to eBPF, and fixed borrowed IP route handling. Pull request #14075
- Manifest installs now stage upstream CNI plugins in the calico-node chart so pod-networked pods can start. Pull request #14041
- Fixed calico-kube-controllers never becoming ready on manifest installs by pointing probes at its health server instead of running a non-existent command. Pull request #14050
- Fixed calico-apiserver on manifest installs to use mounted certificates instead of serving a self-signed localhost cert. Pull request #14059
- Upgraded bundled Envoy Gateway from v1.8.2 to v1.9.1, Envoy to v1.39.1, and Gateway API to v1.6.1. Pull request #14025
- Fixed calico-node crash-loop on canal installs by granting IPAMConfiguration read access regardless of IPAM mode. Pull request #14068
- Fixed BPF connlimit bypass where a forged RST on an idle NAT-outgoing flow incorrectly freed a connection slot. Pull request #14034
- Added ability to list HostEndpoints with field selector spec.node= on both Calico API server and native v3 CRDs. Pull request #14067
- Reduced unnecessary writes to datastore by only creating default tiers when they are missing instead of unconditionally. Pull request #14002
- Improved offline validation in calicoctl to catch duplicate list entries that the API server would reject. Pull request #14058
Why it matters
Manifest installs were broken across multiple components in recent releases. This week's fixes ensure calico-node, calico-kube-controllers, and calico-apiserver all work correctly on manifest-based deployments. Additionally, bug fixes address connlimit security issues and eBPF flow handling while reducing unnecessary datastore churn.
Changelog entry
- Backported epstatusfile watcher leak fix, eBPF forwarded flows fix, and borrowed IP route fix to v3.31 Pull request #14075
- Added upstream CNI plugins staging to calico-node chart for manifest installs Pull request #14041
- Fixed kube-controllers probes on manifest installs to use health server instead of non-existent command Pull request #14050
- Fixed calico-apiserver on manifest installs to use mounted certificates from calico-apiserver-certs secret Pull request #14059
- Upgraded Envoy Gateway to v1.9.1, Envoy to v1.39.1, Gateway API to v1.6.1 Pull request #14025
- Fixed calico-node crash-loop on canal installs by granting IPAMConfiguration read access for policy-only mode Pull request #14068
- Fixed BPF connlimit bypass where forged RST on idle NAT flow incorrectly freed connection slot Pull request #14034
- Added spec.node field selector support for HostEndpoint listing on Calico API server and native CRDs Pull request #14067
- Reduced datastore writes by creating default tiers only when missing instead of unconditionally Pull request #14002
- Improved calicoctl offline validation to catch duplicate list entries rejected by API server Pull request #14058
Fixed manifest install issues in Calico: calico-node now stages CNI plugins, kube-controllers probes work, and apiserver uses proper certificates. Also fixed connlimit security and upgraded Envoy Gateway to v1.9.1.
This week we fixed critical issues affecting Calico manifest installations. calico-node now properly stages CNI plugins so pods can network, kube-controllers probes point to the health server, and apiserver uses mounted certificates instead of self-signed certs. We also addressed a connlimit security bypass in BPF where forged RSTs freed connection slots incorrectly. Envoy Gateway upgraded from v1.8.2 to v1.9.1 with Envoy at v1.39.1. Reduced unnecessary datastore writes by only creating tiers when missing.
Week of September 14, 2026
What shipped
- CRD schemas now accept the full range of 4-byte AS numbers defined by RFC 4893, fixing rejection of AS numbers above 2147483647. Pull request #13979
- CRD schemas now validate peer IPs, network set entries and rule protocols to prevent kubectl and GitOps clients from storing values the API server would reject. Pull request #13913
- CRD schemas now apply the same field defaults as the aggregated API server, so raw kubectl reads see the documented default values. Pull request #13872
- Operator gains optional Installation.spec.tlsMinVersion field to set TLS 1.2 or 1.3 minimum on operator-managed workloads. Pull request #13963
- Bug fix: nftables connection transition log prefix validation now correctly allows prefixes up to 115 characters instead of rejecting 116+. Pull request #13969
- Bug fix: BPF connection limit no longer incorrectly releases slots when a pod with CAP_NET_RAW forges RST packets. Pull request #13880
- Bug fix: conntrack leg flags are now written atomically to prevent policy approval or TCP state bits from being dropped under concurrent writes. Pull request #13932
- BPF host interface auto-detection now correctly models NICs and VLAN sub-devices attached to Linux bridges. Pull request #13922
- Kube-controllers now runs on the host network during datastore migration to prevent the migration from being wedged by pod scheduling issues. Pull request #13871
- Flow backend now supports pluggable flow sources beyond Goldmane while maintaining backward compatibility for existing Calico installations. Pull request #12879
Why it matters
This week focused on improving API validation through CRD schemas to catch configuration errors earlier, fixing critical bugs in BPF connection tracking and network flow handling, and making the operator more flexible with TLS configuration. These changes reduce silent failures and make Calico deployments more robust.
Changelog entry
- Accept the full 4-byte AS number range in the CRD schemas Pull request #13979
- Validate peer IPs, network set entries and rule protocols in the CRD schemas Pull request #13913
- Apply the libcalico-go write defaults in the CRD schemas Pull request #13872
- Add operator TLS minimum version setting Pull request #13963
- Fix the nftables budget for connection transition log prefixes Pull request #13969
- BPF connlimit: RST no longer incorrectly releases a connection slot Pull request #13880
- Write conntrack leg flags atomically Pull request #13932
- Detect bridge-attached interfaces in BPF host interface auto-detection Pull request #13922
- Run kube-controllers on the host network during a datastore migration Pull request #13871
- Make whisker's flow source pluggable Pull request #12879
Calico v3.33+ now validates CRD writes, applies field defaults, accepts full 4-byte AS numbers, and fixes BPF connection tracking bugs.
This week's Calico updates strengthen schema validation to catch misconfigurations early, fix critical BPF bugs in connection tracking and flow handling, add TLS version control to operator deployments, and support pluggable flow sources. CRD schemas now validate peer IPs and enforce the same defaults as the API server, preventing silent failures when using kubectl or GitOps tools directly.