Shipped · Observability

What projectcalico/calico shipped

The public repository of Tigera · github.com/projectcalico/calico

Written by FoxPlug from the repository's own releases; not affiliated with Tigera. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/projectcalico/calico; Tigera did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.

Get a weekly update like this for your product, free

Or Use it as a GitHub Action

See the update FoxPlug writes for calico, free

Week of November 2, 2026

What shipped

Why it matters

This week is mostly about stability and correctness: a Felix panic on bad set members and a stuck address removal that blocked dataplane applies are both fixed. Operator users get a status permission fix for IPPool creation and better Istio status reporting after restarts, while release and IPAM internals were cleaned up. A large share of the work is CI and dependency maintenance, including CVE bumps across Istio, Envoy Gateway and Go on the 3.33 branch.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

This week in Calico: Felix no longer panics on malformed nftables set members and no longer gets stuck retrying address removal on deleted interfaces. Operator installs can now update ippools/status, Istio cluster IDs come from clusterGUID, and CVE bumps landed for Istio, Envoy G

Post for LinkedIn

What shipped in Calico this week: Felix now skips malformed nftables set members instead of panicking, and stops retrying link-local address removal on deleted interfaces, which could block later dataplane applies. On operator installs, the calico-crds ClusterRole now grants ippools/status, so creating IPPools through the v3 API no longer hits permission errors. The Istio controller reports the status of a deleting Istio CR after an operator restart, and Istio cluster IDs are set from ClusterInformation clusterGUID for multi-cluster meshes. FlexVolume drivers in the default plugin directory now update on upgrade when flexVolumePath is set to None. IP pool qualification for IPAM requests is consolidated into one module, and selector parsing gained fuzz tests. CVE fixes landed for Istio, ztu

Week of October 26, 2026

What shipped

Why it matters

This week fixed several leaks and reconciliation gaps that could leave IP addresses held or tunnel addresses missing until calico-node restarted. Validation and dry runs now catch malformed input earlier, and v3.32.3 shipped with the fixes. The rest is mostly CI, test and release tooling work.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

This week in Calico: IPAM GC releases addresses of deleted stopped VMs and replaced pod sandboxes, tunnel addresses reconcile on IP pool changes, dry runs of Calico objects are validated, malformed BPFConntrackTimeout values are rejected, and v3.32.3 is out.

Post for LinkedIn

This week in Calico: the IPAM garbage collector now releases the address of a stopped KubeVirt VM after the VM is deleted, and also releases IPs held by replaced pod sandboxes and terminated pods. calico-node reconciles a node's tunnel address when an IP pool's nodeSelector changes or the pool is deleted. Server-side dry runs for projectcalico.org/v3 objects are validated against the Calico datastore, malformed BPFConntrackTimeout durations are rejected, and eBPF conntrack recycles closed NAT reverse entries on SYN. v3.32.3 shipped with container images, binaries and Kubernetes manifests.

Week of October 19, 2026

What shipped

Why it matters

This week's changes touch dataplane behaviour that operators feel directly: VXLAN source port control for environments with flow limits, eBPF policy fixes that could leave nodes not ready, and conntrack autoscaling and metrics correctness on dual-stack nodes. IPAM and OpenStack changes reduce cases where addresses or port status end up attached to the wrong place. Several fixes are backported across release branches, and the AWS VPC CNI annotation is now protected.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

Weekly Calico update: new VXLAN source port range options in FelixConfiguration, an in-process calico-ipam fix so killed CNI ADDs can't move pod addresses later, eBPF policy split and conntrack autoscaling fixes, and protection for the AWS VPC CNI pod IP annotation.

Post for LinkedIn

This week in Calico: FelixConfiguration adds vxlanSrcPortMin and vxlanSrcPortMax so operators can constrain UDP source ports for outgoing VXLAN traffic in kernel and eBPF dataplanes. calico-ipam now runs in-process, so a CNI ADD that kubelet gave up on cannot later move a pod's address onto an abandoned sandbox. eBPF mode gets fixes for unreachable code when splitting policy programs and for conntrack map autoscaling, plus conntrack metrics labelled by IP family. Calico now protects the AWS VPC CNI pod IP annotation. Selector nesting is limited to 100 levels, and fixes are backported to v3.31, v3.32 and v3.33.

Week of October 12, 2026

What shipped

Why it matters

This week the project moved the CNI plugins it ships onto the upstream containernetworking/plugins repo and backported that to both maintained release branches, and backported a fix for a CNI panic on long KubeVirt VM names. It also fixed overlay reply handling in HostAddress mode, kept Submariner's VXLAN device out of node address autodetection, and upgraded the Envoy Gateway stack. Together these address a panic and address-selection bugs that could hit clusters using KubeVirt, Submariner or BPF overlay mode.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

This week: CNI plugins (host-local, portmap, loopback, tuning) now come from upstream containernetworking/plugins on v3.32 and v3.33. Also a fix for a CNI panic on long KubeVirt VM names, overlay replies fixed in HostAddress mode, and vx-submariner excluded from node address auto

Post for LinkedIn

This week in projectcalico/calico: The CNI plugins the project ships (host-local, portmap, loopback, tuning) now come from the upstream containernetworking/plugins repository instead of the fork, backported to release-v3.32 and release-v3.33. A fix stops a CNI panic when a KubeVirt VM with IP persistence has a namespace and name longer than about 107 characters together. BPF overlay replies are re-encapsulated in HostAddress mode, and vx-submariner was added to the default interfaces to exclude so first-found no longer moves the node address onto the Submariner VXLAN device. Envoy Gateway moved to v1.9.1 and the envoy binary image to v1.39.1.

Week of October 5, 2026

What shipped

Why it matters

This week the project cut the wire size of Typha sync data for large clusters and removed an uninstall hook Job that could block helm uninstall on several maintained branches. It also restored the empty source and destination serialisation behaviour that GitOps tools depend on, and surfaced per flow source and destination IPs to the Whisker backend so operators can see which IPs made up a flow.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

This week in Calico: Typha sync gained zstd compression, cutting a 10k-pod snapshot from 1.17 MB to 561 KB. Empty source and destination rules serialise again. Goldmane flows now carry source and destination IPs. The stale tigera-operator uninstall hook Job is fixed.

Post for LinkedIn

This week in Calico: Typha's sync protocol gained zstd compression alongside snappy, shrinking a 10k-pod snapshot from 1.17 MB to 561 KB at its fastest level. The tigera-operator pre-delete uninstall hook no longer leaves a Job that blocks later helm uninstall runs, with the fix on v3.29 through v3.33. Rule source and destination are back to omitempty, so an explicit empty source or destination is no longer stripped from stored policies. Goldmane flows now carry their distinct source and destination IPs through the API to the Whisker backend. Felix no longer builds raw frames on asymmetric flows with a tunneled reply route, and the CNI plugin retries reading the nodename file during node startup instead of failing with ENOENT.

Week of September 28, 2026

What shipped

Why it matters

V3.33.0 ships with critical eBPF fixes for policy application and tunnel migration, IPAM improvements ensuring consistent pool attribution across tools, and expanded Windows support. These address core reliability issues in network policy enforcement and cluster upgrades.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

Calico v3.33.0 is out. eBPF enhancements for policy correctness, IPAM consistency fixes, IPv6 tunnel migration repair, and Windows Server 2025 support.

Post for LinkedIn

Calico v3.33.0 released. Key improvements: eBPF dataplane now correctly enforces policy on pod-to-service-to-self traffic, IPv6 tunnel handles preserved during migration, IPAM tools agree on pool attribution, and Windows Server 2025 container images added. Download from GitHub.

Week of September 21, 2026

What shipped

Why it matters

Manifest installs were broken across multiple components in recent releases. This week's fixes ensure calico-node, calico-kube-controllers, and calico-apiserver all work correctly on manifest-based deployments. Additionally, bug fixes address connlimit security issues and eBPF flow handling while reducing unnecessary datastore churn.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

Fixed manifest install issues in Calico: calico-node now stages CNI plugins, kube-controllers probes work, and apiserver uses proper certificates. Also fixed connlimit security and upgraded Envoy Gateway to v1.9.1.

Post for LinkedIn

This week we fixed critical issues affecting Calico manifest installations. calico-node now properly stages CNI plugins so pods can network, kube-controllers probes point to the health server, and apiserver uses mounted certificates instead of self-signed certs. We also addressed a connlimit security bypass in BPF where forged RSTs freed connection slots incorrectly. Envoy Gateway upgraded from v1.8.2 to v1.9.1 with Envoy at v1.39.1. Reduced unnecessary datastore writes by only creating tiers when missing.

Week of September 14, 2026

What shipped

Why it matters

This week focused on improving API validation through CRD schemas to catch configuration errors earlier, fixing critical bugs in BPF connection tracking and network flow handling, and making the operator more flexible with TLS configuration. These changes reduce silent failures and make Calico deployments more robust.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

Calico v3.33+ now validates CRD writes, applies field defaults, accepts full 4-byte AS numbers, and fixes BPF connection tracking bugs.

Post for LinkedIn

This week's Calico updates strengthen schema validation to catch misconfigurations early, fix critical BPF bugs in connection tracking and flow handling, add TLS version control to operator deployments, and support pluggable flow sources. CRD schemas now validate peer IPs and enforce the same defaults as the API server, preventing silent failures when using kubectl or GitOps tools directly.

Weeks with too little public activity are left out rather than filled in. Last updated 2026-11-10.

Is this your repo? Ask us to remove this page.