From 77b7b9cdb4a651aa3e25e28cf039af8ea8d79140 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Thu, 20 Aug 2026 20:18:02 +0100 Subject: [PATCH 1/5] Publish Calico Open Source 3.31.7 Add the v3.31.7 release entry, bump the version variables, and add the release notes section for the 3.31.7 patch release. Component versions, the operator version (v1.40.15), and the release notes come from the upstream release pull request, projectcalico/calico#13598, which is still open. The bundled Envoy Gateway moves to v1.8.2, so envoyVersion moves with it. Co-Authored-By: Claude Opus 5 (1M context) --- .../version-3.31/release-notes/index.mdx | 36 ++++++- .../version-3.31/releases.json | 98 +++++++++++++++++++ .../version-3.31/variables.js | 6 +- 3 files changed, 136 insertions(+), 4 deletions(-) diff --git a/calico_versioned_docs/version-3.31/release-notes/index.mdx b/calico_versioned_docs/version-3.31/release-notes/index.mdx index 4909fc2a34..0000052e4c 100644 --- a/calico_versioned_docs/version-3.31/release-notes/index.mdx +++ b/calico_versioned_docs/version-3.31/release-notes/index.mdx @@ -413,4 +413,38 @@ If you use Calico Ingress Gateway, this release bumps the bundled Envoy Gateway If the Tigera Operator manages your Gateway API CRDs (the default), set `crdManagement: Reconcile` on the `GatewayAPI` resource so the operator upgrades the CRDs during the upgrade. If a `safe-upgrades.gateway.networking.k8s.io` ValidatingAdmissionPolicy blocks the upgrade with `Installing experimental CRDs on top of standard channel CRDs is prohibited`, delete that policy and its binding, then let the operator reconcile. The operator recreates the policy afterward. -If you manage the Gateway API CRDs yourself, install the Gateway API v1.5.1 CRDs before upgrading. \ No newline at end of file +If you manage the Gateway API CRDs yourself, install the Gateway API v1.5.1 CRDs before upgrading. + +### Calico Open Source 3.31.7 bug fix release + +August 20, 2026 + +#### Bug fixes + +- ebpf: Fixed IPv6 session affinity entries being randomly deleted (or never expiring) due to a struct layout mismatch when Felix read the affinity timestamp, which could re-balance sticky connections to a different backend. [calico 13460](https://github.com/projectcalico/calico/pull/13460) (@tomastigera) +- Fixes an issue in nftables mode where IP set members could be left unprogrammed after the nftables table was deleted and recreated. [calico 13442](https://github.com/projectcalico/calico/pull/13442) (@caseydavenport) +- Fixes an issue in nftables mode where Felix could panic when reading back an IP set member it could not parse. [calico 13442](https://github.com/projectcalico/calico/pull/13442) (@caseydavenport) +- Fixes an issue where IP sets containing overlapping CIDRs could fail to program correctly in nftables mode after a member was removed. [calico 13441](https://github.com/projectcalico/calico/pull/13441) (@caseydavenport) +- Fixes CALICO_IPV6POOL_VXLAN being ignored in IPv6-only clusters where the IPv4 pool is disabled (CALICO_IPV4POOL_CIDR=none), which left the IPv6 pool without VXLAN encapsulation. [calico 13439](https://github.com/projectcalico/calico/pull/13439) (@caseydavenport) +- [eBPF] Fix a window in which a new connection to a local workload could skip that workload's ingress policy, when the connection was started while the workload's route was still being programmed. [calico 13390](https://github.com/projectcalico/calico/pull/13390) (@tomastigera) +- Fixed the bundled Envoy Gateway crash-looping on clusters whose Gateway API CRD set omits ListenerSet, TLSRoute or BackendTLSPolicy, such as OpenShift or GKE's managed Gateway API addon. [calico 13367](https://github.com/projectcalico/calico/pull/13367) (@electricjesus) +- Fixed a bug where Calico could advertise a Service IP over BGP from a node whose local endpoint was not Ready, causing connection failures. [calico 13255](https://github.com/projectcalico/calico/pull/13255) (@MichalFupso) +- Fixed a kernel dmesg spew ("could not enable bpf_trace_printk events") on eBPF-dataplane nodes running with kernel lockdown=confidentiality (e.g. Talos). [calico 13234](https://github.com/projectcalico/calico/pull/13234) (@tomastigera) +- Fixed a rare start-of-day deadlock that could prevent Felix from restarting when a restart-requiring configuration change (e.g. the node IP being set) arrived while Felix was still starting up. [calico 13215](https://github.com/projectcalico/calico/pull/13215) (@fasaxc) +- Fixed a latent bug where EnsureBlock could allocate an IPv6 block from the wrong IP pool when an explicit IPv6 pool selector was provided (Windows host-local IPAM block reservation). [calico 13215](https://github.com/projectcalico/calico/pull/13215) (@fasaxc) +- eBPF: fix state explosion in the BPF verifier (resulting in programs not loading) caused by debug logs on a certain path. [calico 13215](https://github.com/projectcalico/calico/pull/13215) (@fasaxc) +- eBPF dataplane: fix loss of connectivity to the Kubernetes API server service after the API server is unavailable for a period, when using bpfNetworkBootstrap. Felix no longer clears the API server service's NAT backend when its endpoints transiently empty, so connectivity recovers without a calico-node restart. [calico 13066](https://github.com/projectcalico/calico/pull/13066) (@lucastigera) +- Fixed a bug where Felix's periodic route resync did not detect (and repair) Calico-owned routes that had been modified in place by another process. Fixed unnecessary reprogramming of unchanged IPv6 multi-path routes on resync, and a corner case where removing an IPAM block route could trigger a spurious conntrack cleanup for a workload owning the block's network address. [calico 12959](https://github.com/projectcalico/calico/pull/12959) (@fasaxc) + +#### Other changes + +- Refresh the node-driver-registrar dependency patch to remediate CVEs (grpc v1.82.1, x/net, x/text). [calico 13520](https://github.com/projectcalico/calico/pull/13520) (@skoryk-oleksandr) +- Update bundled Envoy images (envoy-gateway v1.8.2, envoy-proxy v1.38.3) and refresh dependency patches to remediate CVEs. [calico 13502](https://github.com/projectcalico/calico/pull/13502) (@skoryk-oleksandr) +- The default CNI configuration now declares cniVersion 1.0.0 (previously 0.3.1), enabling Calico as a multus delegate on OpenShift 4.23+. Requires containerd v1.6+ or CRI-O v1.24+. [calico 13378](https://github.com/projectcalico/calico/pull/13378) (@sridhartigera) +- calicoctl cluster diags now collects additional cluster state (v3 API resources, Multus network-attachment-definitions, unsupported-annotation usage) and collects eBPF map dumps as machine-parseable JSON, falling back to legacy text output against older calico-node versions. [calico 13020](https://github.com/projectcalico/calico/pull/13020) (@tomastigera) + +#### Updating + +To update a previous version of Calico, see [our upgrade guides](../operations/upgrading/index.mdx). + +This release changes the default CNI configuration to declare `cniVersion` 1.0.0, in place of 0.3.1. Your container runtime must be containerd v1.6 or later, or CRI-O v1.24 or later. Older runtimes do not understand the 1.0.0 configuration and fail to add pods to the network. \ No newline at end of file diff --git a/calico_versioned_docs/version-3.31/releases.json b/calico_versioned_docs/version-3.31/releases.json index b42ba90521..d4707b716b 100644 --- a/calico_versioned_docs/version-3.31/releases.json +++ b/calico_versioned_docs/version-3.31/releases.json @@ -1,4 +1,102 @@ [ + { + "title": "v3.31.7", + "tigera-operator": { + "image": "tigera/operator", + "registry": "quay.io", + "version": "v1.40.15" + }, + "components": { + "calico/typha": { + "version": "v3.31.7", + "registry": "quay.io" + }, + "calico/ctl": { + "version": "v3.31.7", + "registry": "quay.io" + }, + "calico/node": { + "version": "v3.31.7", + "registry": "quay.io" + }, + "calico/node-windows": { + "version": "v3.31.7", + "registry": "quay.io" + }, + "calico/cni": { + "version": "v3.31.7", + "registry": "quay.io" + }, + "calico/cni-windows": { + "version": "v3.31.7", + "registry": "quay.io" + }, + "calico/apiserver": { + "version": "v3.31.7", + "registry": "quay.io" + }, + "calico/kube-controllers": { + "version": "v3.31.7", + "registry": "quay.io" + }, + "calico/envoy-gateway": { + "version": "v3.31.7", + "registry": "quay.io" + }, + "calico/envoy-proxy": { + "version": "v3.31.7", + "registry": "quay.io" + }, + "calico/envoy-ratelimit": { + "version": "v3.31.7", + "registry": "quay.io" + }, + "calico/flannel-migration-controller": { + "version": "v3.31.7", + "registry": "quay.io" + }, + "flannel": { + "version": "v0.24.4", + "registry": "docker.io" + }, + "calico/dikastes": { + "version": "v3.31.7", + "registry": "quay.io" + }, + "flexvol": { + "version": "v3.31.7", + "registry": "quay.io" + }, + "calico/csi": { + "version": "v3.31.7", + "registry": "quay.io" + }, + "calico/node-driver-registrar": { + "version": "v3.31.7", + "registry": "quay.io" + }, + "calico/pod2daemon-flexvol": { + "version": "v3.31.7", + "registry": "quay.io" + }, + "calico/key-cert-provisioner": { + "version": "v3.31.7", + "registry": "quay.io" + }, + "calico/goldmane": { + "version": "v3.31.7", + "registry": "quay.io" + }, + "calico/whisker": { + "version": "v3.31.7", + "registry": "quay.io" + }, + "calico/whisker-backend": { + "version": "v3.31.7", + "registry": "quay.io" + } + } + }, { "title": "v3.31.6", "tigera-operator": { diff --git a/calico_versioned_docs/version-3.31/variables.js b/calico_versioned_docs/version-3.31/variables.js index 6ef8812c10..aeceb36f9c 100644 --- a/calico_versioned_docs/version-3.31/variables.js +++ b/calico_versioned_docs/version-3.31/variables.js @@ -1,7 +1,7 @@ const releases = require('./releases.json'); const variables = { - releaseTitle: 'v3.31.6', + releaseTitle: 'v3.31.7', prodname: 'Calico', prodnamedash: 'calico', version: 'v3.31', @@ -16,11 +16,11 @@ const variables = { noderunning: 'calico-node', rootDirWindows: 'C:\\CalicoWindows', ppa_repo_name: 'calico-3.31', - manifestsUrl: 'https://raw.githubusercontent.com/projectcalico/calico/v3.31.6', + manifestsUrl: 'https://raw.githubusercontent.com/projectcalico/calico/v3.31.7', releases, registry: '', vppbranch: 'v3.31.0', - envoyVersion: '1.8.0', + envoyVersion: '1.8.2', tigeraOperator: releases[0]['tigera-operator'], tigeraOperatorVersionShort: releases[0]['tigera-operator'].version.split('.').slice(0, 2).join('.'), imageNames: { From 1c45d5260db17ecf97f7ae5a2859493bc991be98 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Thu, 20 Aug 2026 20:41:41 +0100 Subject: [PATCH 2/5] Correct the cniVersion note in the 3.31.7 release notes The first version of this note said the upgrade requires containerd v1.6 or CRI-O v1.24, and that older runtimes fail to add pods to the network. The second half was not sourced. The operator change, tigera/operator#5126, says the opposite: every runtime the operator supports accepts cniVersion 1.0.0, and existing pod attachments replay the configuration they were created with. The note now says what changed, that both install paths and both platforms are affected, and how to pin the version with spec.cni.specVersion, whose accepted values are Auto, 0.3.1, 0.4.0, and 1.0.0. Co-Authored-By: Claude Opus 5 (1M context) --- calico_versioned_docs/version-3.31/release-notes/index.mdx | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/calico_versioned_docs/version-3.31/release-notes/index.mdx b/calico_versioned_docs/version-3.31/release-notes/index.mdx index 0000052e4c..9b03db95ca 100644 --- a/calico_versioned_docs/version-3.31/release-notes/index.mdx +++ b/calico_versioned_docs/version-3.31/release-notes/index.mdx @@ -447,4 +447,6 @@ August 20, 2026 To update a previous version of Calico, see [our upgrade guides](../operations/upgrading/index.mdx). -This release changes the default CNI configuration to declare `cniVersion` 1.0.0, in place of 0.3.1. Your container runtime must be containerd v1.6 or later, or CRI-O v1.24 or later. Older runtimes do not understand the 1.0.0 configuration and fail to add pods to the network. \ No newline at end of file +This release changes the `cniVersion` that Calico declares in its CNI configuration from 0.3.1 to 1.0.0. The change applies to operator installs and manifest installs, on Linux and Windows. Every container runtime that this release supports accepts 1.0.0, and pods that are already running keep the configuration they were created with. + +If you install with the operator and use the Calico CNI plugin, you can pin the version. Set `specVersion` in the `cni` section of the `Installation` resource to `0.3.1`, `0.4.0`, or `1.0.0`. Pin it if a chained CNI plugin in your cluster needs an earlier version. The default, `Auto`, lets the operator choose, and the version it chooses can rise in later operator releases. \ No newline at end of file From b7ccf4c1c895040a8d8b9b0b42c4c32e9c49cc66 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Thu, 20 Aug 2026 20:53:22 +0100 Subject: [PATCH 3/5] Drop the cniVersion prose from the 3.31.7 Updating section The Updating section is for actions a reader must take to upgrade. This release needs none. Every runtime it supports accepts cniVersion 1.0.0 and existing pods keep the configuration they were created with, so there is nothing to do. The two paragraphs also documented spec.cni.specVersion, which is a new Installation field, not an upgrade step. That field belongs in the Installation API reference, which needs regenerating against the operator this release ships. The default change itself is already in Other changes, in the upstream note for calico 13378. Co-Authored-By: Claude Opus 5 (1M context) --- calico_versioned_docs/version-3.31/release-notes/index.mdx | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/calico_versioned_docs/version-3.31/release-notes/index.mdx b/calico_versioned_docs/version-3.31/release-notes/index.mdx index 9b03db95ca..3255a06180 100644 --- a/calico_versioned_docs/version-3.31/release-notes/index.mdx +++ b/calico_versioned_docs/version-3.31/release-notes/index.mdx @@ -445,8 +445,4 @@ August 20, 2026 #### Updating -To update a previous version of Calico, see [our upgrade guides](../operations/upgrading/index.mdx). - -This release changes the `cniVersion` that Calico declares in its CNI configuration from 0.3.1 to 1.0.0. The change applies to operator installs and manifest installs, on Linux and Windows. Every container runtime that this release supports accepts 1.0.0, and pods that are already running keep the configuration they were created with. - -If you install with the operator and use the Calico CNI plugin, you can pin the version. Set `specVersion` in the `cni` section of the `Installation` resource to `0.3.1`, `0.4.0`, or `1.0.0`. Pin it if a chained CNI plugin in your cluster needs an earlier version. The default, `Auto`, lets the operator choose, and the version it chooses can rise in later operator releases. \ No newline at end of file +To update a previous version of Calico, see [our upgrade guides](../operations/upgrading/index.mdx). \ No newline at end of file From 378d4c06f8d23b34b0d4a388454c37276aabcbab Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Thu, 20 Aug 2026 21:01:40 +0100 Subject: [PATCH 4/5] Regenerate the Calico 3.31 Installation API reference Generated with the repo's operator reference target against tigera/operator v1.40.14, which is the tip of release-v1.40 and the line that v1.40.15 will be cut from. Calico 3.31.7 pins v1.40.15. Adds spec.cni.specVersion and the CNISpecVersion enum, which the operator gained in v1.40.14. Also links the dscpMark type, which the older generated file left as plain text. Co-Authored-By: Claude Opus 5 (1M context) --- .../reference/installation/_api.mdx | 21 ++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/calico_versioned_docs/version-3.31/reference/installation/_api.mdx b/calico_versioned_docs/version-3.31/reference/installation/_api.mdx index c46ac58e78..3dac39a647 100644 --- a/calico_versioned_docs/version-3.31/reference/installation/_api.mdx +++ b/calico_versioned_docs/version-3.31/reference/installation/_api.mdx @@ -322,10 +322,29 @@ _Appears in:_ | --- | --- | | `type` _[CNIPluginType](#cniplugintype)_ | Specifies the CNI plugin that will be used in the Calico or Calico Enterprise installation. * For KubernetesProvider GKE, this field defaults to GKE. * For KubernetesProvider AKS, this field defaults to AzureVNET. * For KubernetesProvider EKS, this field defaults to AmazonVPC. * If aws-node daemonset exists in kube-system when the Installation resource is created, this field defaults to AmazonVPC. * For all other cases this field defaults to Calico. For the value Calico, the CNI plugin binaries and CNI config will be installed as part of deployment, for all other values the CNI plugin binaries and CNI config is a dependency that is expected to be installed separately.
Default: Calico | | `ipam` _[IPAMSpec](#ipamspec)_ | (Optional) IPAM specifies the pod IP address management that will be used in the Calico or Calico Enterprise installation. | +| `specVersion` _[CNISpecVersion](#cnispecversion)_ | (Optional) SpecVersion configures the CNI specification version declared in the CNI configuration ("cniVersion") that the operator generates. Auto (the default) lets the operator choose an appropriate version, which may increase across operator upgrades. Pin an explicit version if a chained CNI plugin or container runtime in your environment requires one. Only relevant when using the Calico CNI plugin.
Default: Auto | | `binDir` _string_ | (Optional) BinDir is the path to the CNI binaries directory. If you have changed the installation directory for CNI binaries in the container runtime configuration, please ensure that this field points to the same directory as specified in the container runtime settings. Default directory depends on the KubernetesProvider. * For KubernetesProvider GKE, this field defaults to "/home/kubernetes/bin". * For KubernetesProvider OpenShift, this field defaults to "/var/lib/cni/bin". * Otherwise, this field defaults to "/opt/cni/bin". | | `confDir` _string_ | (Optional) ConfDir is the path to the CNI config directory. If you have changed the installation directory for CNI configuration in the container runtime configuration, please ensure that this field points to the same directory as specified in the container runtime settings. Default directory depends on the KubernetesProvider. * For KubernetesProvider GKE, this field defaults to "/etc/cni/net.d". * For KubernetesProvider OpenShift, this field defaults to "/var/run/multus/cni/net.d". * Otherwise, this field defaults to "/etc/cni/net.d". | +### CNISpecVersion + +_Underlying type:_ _string_ + +CNISpecVersion is the version of the CNI specification declared in the +CNI configuration generated by the operator. + +_Appears in:_ +- [CNISpec](#cnispec) + +| Value | Description | +| --- | --- | +| `Auto` | CNISpecVersionAuto lets the operator choose the CNI spec version. The chosen version may be raised in future operator versions as older container runtimes fall out of support. | +| `0.3.1` | | +| `0.4.0` | | +| `1.0.0` | | + + ### CRDManagement _Underlying type:_ _string_ @@ -1822,7 +1841,7 @@ _Appears in:_ | `istiod` _[IstiodDeployment](#istioddeployment)_ | (Optional) IstiodDeployment defines the resource requirements and node selector for the Istio deployment. | | `istioCNI` _[IstioCNIDaemonset](#istiocnidaemonset)_ | (Optional) IstioCNIDaemonset defines the resource requirements for the Istio CNI plugin. | | `ztunnel` _[ZTunnelDaemonset](#ztunneldaemonset)_ | (Optional) ZTunnelDaemonset defines the resource requirements for the ZTunnelDaemonset component. | -| `dscpMark` _DSCP_ | (Optional) DSCPMark define the value of the DSCP mark done by Felix and recognised by Istio CNI for Transparent NetworkPolicies. | +| `dscpMark` _[DSCP](#dscp)_ | (Optional) DSCPMark define the value of the DSCP mark done by Felix and recognised by Istio CNI for Transparent NetworkPolicies. | ### IstioStatus From b29b02ef3ca4339bd530c1171d38993226aa59d7 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Thu, 20 Aug 2026 21:10:36 +0100 Subject: [PATCH 5/5] Keep the DSCP anchor fix in the 3.31 API reference The regeneration relinked dscpMark to #dscp, an anchor the generator emits no section for. Commit ec7d2902 unlinked it on purpose, for DOCS-2979. Restoring that leaves this PR purely additive. The generator will keep relinking it on every run, so the durable fix belongs in the templates or a post-processing step. Co-Authored-By: Claude Opus 5 (1M context) --- .../version-3.31/reference/installation/_api.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/calico_versioned_docs/version-3.31/reference/installation/_api.mdx b/calico_versioned_docs/version-3.31/reference/installation/_api.mdx index 3dac39a647..26fcd94c14 100644 --- a/calico_versioned_docs/version-3.31/reference/installation/_api.mdx +++ b/calico_versioned_docs/version-3.31/reference/installation/_api.mdx @@ -1841,7 +1841,7 @@ _Appears in:_ | `istiod` _[IstiodDeployment](#istioddeployment)_ | (Optional) IstiodDeployment defines the resource requirements and node selector for the Istio deployment. | | `istioCNI` _[IstioCNIDaemonset](#istiocnidaemonset)_ | (Optional) IstioCNIDaemonset defines the resource requirements for the Istio CNI plugin. | | `ztunnel` _[ZTunnelDaemonset](#ztunneldaemonset)_ | (Optional) ZTunnelDaemonset defines the resource requirements for the ZTunnelDaemonset component. | -| `dscpMark` _[DSCP](#dscp)_ | (Optional) DSCPMark define the value of the DSCP mark done by Felix and recognised by Istio CNI for Transparent NetworkPolicies. | +| `dscpMark` _DSCP_ | (Optional) DSCPMark define the value of the DSCP mark done by Felix and recognised by Istio CNI for Transparent NetworkPolicies. | ### IstioStatus