What projectcalico/calico shipped
Generated by FoxPlug from public activity — not affiliated with Tigera.
Week of September 14, 2026
What shipped
- CRD schemas now accept the full range of 4-byte AS numbers defined by RFC 4893, fixing rejection of AS numbers above 2147483647 [4]. Pull request #13979
- CRD schemas now validate peer IPs, network set entries and rule protocols to prevent kubectl and GitOps clients from storing values the API server would reject [19]. Pull request #13913
- CRD schemas now apply the same field defaults as the aggregated API server, so raw kubectl reads see the documented default values [27]. Pull request #13872
- Operator gains optional Installation.spec.tlsMinVersion field to set TLS 1.2 or 1.3 minimum on operator-managed workloads [5]. Pull request #13963
- Bug fix: nftables connection transition log prefix validation now correctly allows prefixes up to 115 characters instead of rejecting 116+ [11]. Pull request #13969
- Bug fix: BPF connection limit no longer incorrectly releases slots when a pod with CAP_NET_RAW forges RST packets [13]. Pull request #13880
- Bug fix: conntrack leg flags are now written atomically to prevent policy approval or TCP state bits from being dropped under concurrent writes [28]. Pull request #13932
- BPF host interface auto-detection now correctly models NICs and VLAN sub-devices attached to Linux bridges [29]. Pull request #13922
- kube-controllers now runs on the host network during datastore migration to prevent the migration from being wedged by pod scheduling issues [30]. Pull request #13871
- Flow backend now supports pluggable flow sources beyond Goldmane while maintaining backward compatibility for existing Calico installations [1]. Pull request #12879
Why it matters
This week focused on improving API validation through CRD schemas to catch configuration errors earlier, fixing critical bugs in BPF connection tracking and network flow handling, and making the operator more flexible with TLS configuration. These changes reduce silent failures and make Calico deployments more robust.
Changelog entry
- Accept the full 4-byte AS number range in the CRD schemas Pull request #13979
- Validate peer IPs, network set entries and rule protocols in the CRD schemas Pull request #13913
- Apply the libcalico-go write defaults in the CRD schemas Pull request #13872
- Add operator TLS minimum version setting Pull request #13963
- Fix the nftables budget for connection transition log prefixes Pull request #13969
- BPF connlimit: RST no longer incorrectly releases a connection slot Pull request #13880
- Write conntrack leg flags atomically Pull request #13932
- Detect bridge-attached interfaces in BPF host interface auto-detection Pull request #13922
- Run kube-controllers on the host network during a datastore migration Pull request #13871
- Make whisker's flow source pluggable Pull request #12879
Calico v3.33+ now validates CRD writes, applies field defaults, accepts full 4-byte AS numbers, and fixes BPF connection tracking bugs.
This week's Calico updates strengthen schema validation to catch misconfigurations early, fix critical BPF bugs in connection tracking and flow handling, add TLS version control to operator deployments, and support pluggable flow sources. CRD schemas now validate peer IPs and enforce the same defaults as the API server, preventing silent failures when using kubectl or GitOps tools directly.