Skip to content

DOCS-2967: Publish Calico Open Source 3.31.7 #2939

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
danudey merged 5 commits into from
Aug 21, 2026
Merged

DOCS-2967: Publish Calico Open Source 3.31.7 #2939

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
77b7b9c
Publish Calico Open Source 3.31.7
ctauchen Aug 20, 2026
1c45d52
Correct the cniVersion note in the 3.31.7 release notes
ctauchen Aug 20, 2026
b7ccf4c
Drop the cniVersion prose from the 3.31.7 Updating section
ctauchen Aug 20, 2026
378d4c0
Regenerate the Calico 3.31 Installation API reference
ctauchen Aug 20, 2026
b29b02e
Keep the DSCP anchor fix in the 3.31 API reference
ctauchen Aug 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions calico_versioned_docs/version-3.31/reference/installation/_api.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -322,10 +322,29 @@ _Appears in:_
| --- | --- |
| `type` _[CNIPluginType](#cniplugintype)_ | Specifies the CNI plugin that will be used in the Calico or Calico Enterprise installation. * For KubernetesProvider GKE, this field defaults to GKE. * For KubernetesProvider AKS, this field defaults to AzureVNET. * For KubernetesProvider EKS, this field defaults to AmazonVPC. * If aws-node daemonset exists in kube-system when the Installation resource is created, this field defaults to AmazonVPC. * For all other cases this field defaults to Calico. For the value Calico, the CNI plugin binaries and CNI config will be installed as part of deployment, for all other values the CNI plugin binaries and CNI config is a dependency that is expected to be installed separately.<br />Default: Calico |
| `ipam` _[IPAMSpec](#ipamspec)_ | (Optional) IPAM specifies the pod IP address management that will be used in the Calico or Calico Enterprise installation. |
| `specVersion` _[CNISpecVersion](#cnispecversion)_ | (Optional) SpecVersion configures the CNI specification version declared in the CNI configuration ("cniVersion") that the operator generates. Auto (the default) lets the operator choose an appropriate version, which may increase across operator upgrades. Pin an explicit version if a chained CNI plugin or container runtime in your environment requires one. Only relevant when using the Calico CNI plugin.<br />Default: Auto |
| `binDir` _string_ | (Optional) BinDir is the path to the CNI binaries directory. If you have changed the installation directory for CNI binaries in the container runtime configuration, please ensure that this field points to the same directory as specified in the container runtime settings. Default directory depends on the KubernetesProvider. * For KubernetesProvider GKE, this field defaults to "/home/kubernetes/bin". * For KubernetesProvider OpenShift, this field defaults to "/var/lib/cni/bin". * Otherwise, this field defaults to "/opt/cni/bin". |
| `confDir` _string_ | (Optional) ConfDir is the path to the CNI config directory. If you have changed the installation directory for CNI configuration in the container runtime configuration, please ensure that this field points to the same directory as specified in the container runtime settings. Default directory depends on the KubernetesProvider. * For KubernetesProvider GKE, this field defaults to "/etc/cni/net.d". * For KubernetesProvider OpenShift, this field defaults to "/var/run/multus/cni/net.d". * Otherwise, this field defaults to "/etc/cni/net.d". |


### CNISpecVersion

_Underlying type:_ _string_

CNISpecVersion is the version of the CNI specification declared in the
CNI configuration generated by the operator.

_Appears in:_
- [CNISpec](#cnispec)

| Value | Description |
| --- | --- |
| `Auto` | CNISpecVersionAuto lets the operator choose the CNI spec version. The chosen version may be raised in future operator versions as older container runtimes fall out of support. |
| `0.3.1` | |
| `0.4.0` | |
| `1.0.0` | |


### CRDManagement

_Underlying type:_ _string_
Expand Down
34 changes: 33 additions & 1 deletion calico_versioned_docs/version-3.31/release-notes/index.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -413,4 +413,36 @@

If the Tigera Operator manages your Gateway API CRDs (the default), set `crdManagement: Reconcile` on the `GatewayAPI` resource so the operator upgrades the CRDs during the upgrade. If a `safe-upgrades.gateway.networking.k8s.io` ValidatingAdmissionPolicy blocks the upgrade with `Installing experimental CRDs on top of standard channel CRDs is prohibited`, delete that policy and its binding, then let the operator reconcile. The operator recreates the policy afterward.

If you manage the Gateway API CRDs yourself, install the Gateway API v1.5.1 CRDs before upgrading.
If you manage the Gateway API CRDs yourself, install the Gateway API v1.5.1 CRDs before upgrading.

### Calico Open Source 3.31.7 bug fix release

August 20, 2026

#### Bug fixes

- ebpf: Fixed IPv6 session affinity entries being randomly deleted (or never expiring) due to a struct layout mismatch when Felix read the affinity timestamp, which could re-balance sticky connections to a different backend. [calico 13460](https://github.com/projectcalico/calico/pull/13460) (@tomastigera)

Check failure on line 424 in calico_versioned_docs/version-3.31/release-notes/index.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'ebpf'?

Raw Output:
{"message":"[Vale.Spelling] Did you really mean 'ebpf'?","location":{"path":"calico_versioned_docs/version-3.31/release-notes/index.mdx","range":{"start":{"line":424,"column":3},"end":{"line":424,"column":7}}},"severity":"ERROR","code":{"value":"Vale.Spelling"}}
- Fixes an issue in nftables mode where IP set members could be left unprogrammed after the nftables table was deleted and recreated. [calico 13442](https://github.com/projectcalico/calico/pull/13442) (@caseydavenport)
- Fixes an issue in nftables mode where Felix could panic when reading back an IP set member it could not parse. [calico 13442](https://github.com/projectcalico/calico/pull/13442) (@caseydavenport)
- Fixes an issue where IP sets containing overlapping CIDRs could fail to program correctly in nftables mode after a member was removed. [calico 13441](https://github.com/projectcalico/calico/pull/13441) (@caseydavenport)
- Fixes CALICO_IPV6POOL_VXLAN being ignored in IPv6-only clusters where the IPv4 pool is disabled (CALICO_IPV4POOL_CIDR=none), which left the IPv6 pool without VXLAN encapsulation. [calico 13439](https://github.com/projectcalico/calico/pull/13439) (@caseydavenport)
- [eBPF] Fix a window in which a new connection to a local workload could skip that workload's ingress policy, when the connection was started while the workload's route was still being programmed. [calico 13390](https://github.com/projectcalico/calico/pull/13390) (@tomastigera)
- Fixed the bundled Envoy Gateway crash-looping on clusters whose Gateway API CRD set omits ListenerSet, TLSRoute or BackendTLSPolicy, such as OpenShift or GKE's managed Gateway API addon. [calico 13367](https://github.com/projectcalico/calico/pull/13367) (@electricjesus)

Check failure on line 430 in calico_versioned_docs/version-3.31/release-notes/index.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'addon'?

Raw Output:
{"message":"[Vale.Spelling] Did you really mean 'addon'?","location":{"path":"calico_versioned_docs/version-3.31/release-notes/index.mdx","range":{"start":{"line":430,"column":183},"end":{"line":430,"column":188}}},"severity":"ERROR","code":{"value":"Vale.Spelling"}}

Check failure on line 430 in calico_versioned_docs/version-3.31/release-notes/index.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'GKE's'?

Raw Output:
{"message":"[Vale.Spelling] Did you really mean 'GKE's'?","location":{"path":"calico_versioned_docs/version-3.31/release-notes/index.mdx","range":{"start":{"line":430,"column":157},"end":{"line":430,"column":162}}},"severity":"ERROR","code":{"value":"Vale.Spelling"}}
- Fixed a bug where Calico could advertise a Service IP over BGP from a node whose local endpoint was not Ready, causing connection failures. [calico 13255](https://github.com/projectcalico/calico/pull/13255) (@MichalFupso)
- Fixed a kernel dmesg spew ("could not enable bpf_trace_printk events") on eBPF-dataplane nodes running with kernel lockdown=confidentiality (e.g. Talos). [calico 13234](https://github.com/projectcalico/calico/pull/13234) (@tomastigera)

Check failure on line 432 in calico_versioned_docs/version-3.31/release-notes/index.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[CalicoStyle.Substitutions] Use 'data plane' instead of 'dataplane'.

Raw Output:
{"message":"[CalicoStyle.Substitutions] Use 'data plane' instead of 'dataplane'.","location":{"path":"calico_versioned_docs/version-3.31/release-notes/index.mdx","range":{"start":{"line":432,"column":82},"end":{"line":432,"column":91}}},"severity":"ERROR","code":{"value":"CalicoStyle.Substitutions"}}

Check failure on line 432 in calico_versioned_docs/version-3.31/release-notes/index.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'bpf_trace_printk'?

Raw Output:
{"message":"[Vale.Spelling] Did you really mean 'bpf_trace_printk'?","location":{"path":"calico_versioned_docs/version-3.31/release-notes/index.mdx","range":{"start":{"line":432,"column":48},"end":{"line":432,"column":64}}},"severity":"ERROR","code":{"value":"Vale.Spelling"}}

Check failure on line 432 in calico_versioned_docs/version-3.31/release-notes/index.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'dmesg'?

Raw Output:
{"message":"[Vale.Spelling] Did you really mean 'dmesg'?","location":{"path":"calico_versioned_docs/version-3.31/release-notes/index.mdx","range":{"start":{"line":432,"column":18},"end":{"line":432,"column":23}}},"severity":"ERROR","code":{"value":"Vale.Spelling"}}
- Fixed a rare start-of-day deadlock that could prevent Felix from restarting when a restart-requiring configuration change (e.g. the node IP being set) arrived while Felix was still starting up. [calico 13215](https://github.com/projectcalico/calico/pull/13215) (@fasaxc)
- Fixed a latent bug where EnsureBlock could allocate an IPv6 block from the wrong IP pool when an explicit IPv6 pool selector was provided (Windows host-local IPAM block reservation). [calico 13215](https://github.com/projectcalico/calico/pull/13215) (@fasaxc)
- eBPF: fix state explosion in the BPF verifier (resulting in programs not loading) caused by debug logs on a certain path. [calico 13215](https://github.com/projectcalico/calico/pull/13215) (@fasaxc)
- eBPF dataplane: fix loss of connectivity to the Kubernetes API server service after the API server is unavailable for a period, when using bpfNetworkBootstrap. Felix no longer clears the API server service's NAT backend when its endpoints transiently empty, so connectivity recovers without a calico-node restart. [calico 13066](https://github.com/projectcalico/calico/pull/13066) (@lucastigera)

Check failure on line 436 in calico_versioned_docs/version-3.31/release-notes/index.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'dataplane'?

Raw Output:
{"message":"[Vale.Spelling] Did you really mean 'dataplane'?","location":{"path":"calico_versioned_docs/version-3.31/release-notes/index.mdx","range":{"start":{"line":436,"column":8},"end":{"line":436,"column":17}}},"severity":"ERROR","code":{"value":"Vale.Spelling"}}

Check failure on line 436 in calico_versioned_docs/version-3.31/release-notes/index.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[CalicoStyle.Substitutions] Use 'data plane' instead of 'dataplane'.

Raw Output:
{"message":"[CalicoStyle.Substitutions] Use 'data plane' instead of 'dataplane'.","location":{"path":"calico_versioned_docs/version-3.31/release-notes/index.mdx","range":{"start":{"line":436,"column":8},"end":{"line":436,"column":17}}},"severity":"ERROR","code":{"value":"CalicoStyle.Substitutions"}}
- Fixed a bug where Felix's periodic route resync did not detect (and repair) Calico-owned routes that had been modified in place by another process. Fixed unnecessary reprogramming of unchanged IPv6 multi-path routes on resync, and a corner case where removing an IPAM block route could trigger a spurious conntrack cleanup for a workload owning the block's network address. [calico 12959](https://github.com/projectcalico/calico/pull/12959) (@fasaxc)

#### Other changes

- Refresh the node-driver-registrar dependency patch to remediate CVEs (grpc v1.82.1, x/net, x/text). [calico 13520](https://github.com/projectcalico/calico/pull/13520) (@skoryk-oleksandr)

Check failure on line 441 in calico_versioned_docs/version-3.31/release-notes/index.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'grpc'?

Raw Output:
{"message":"[Vale.Spelling] Did you really mean 'grpc'?","location":{"path":"calico_versioned_docs/version-3.31/release-notes/index.mdx","range":{"start":{"line":441,"column":73},"end":{"line":441,"column":77}}},"severity":"ERROR","code":{"value":"Vale.Spelling"}}
- Update bundled Envoy images (envoy-gateway v1.8.2, envoy-proxy v1.38.3) and refresh dependency patches to remediate CVEs. [calico 13502](https://github.com/projectcalico/calico/pull/13502) (@skoryk-oleksandr)
- The default CNI configuration now declares cniVersion 1.0.0 (previously 0.3.1), enabling Calico as a multus delegate on OpenShift 4.23+. Requires containerd v1.6+ or CRI-O v1.24+. [calico 13378](https://github.com/projectcalico/calico/pull/13378) (@sridhartigera)

Check warning on line 443 in calico_versioned_docs/version-3.31/release-notes/index.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Terms] Use 'Multus' instead of 'multus'.

Raw Output:
{"message":"[Vale.Terms] Use 'Multus' instead of 'multus'.","location":{"path":"calico_versioned_docs/version-3.31/release-notes/index.mdx","range":{"start":{"line":443,"column":104},"end":{"line":443,"column":110}}},"severity":"WARNING","code":{"value":"Vale.Terms"}}
- calicoctl cluster diags now collects additional cluster state (v3 API resources, Multus network-attachment-definitions, unsupported-annotation usage) and collects eBPF map dumps as machine-parseable JSON, falling back to legacy text output against older calico-node versions. [calico 13020](https://github.com/projectcalico/calico/pull/13020) (@tomastigera)

#### Updating

To update a previous version of Calico, see [our upgrade guides](../operations/upgrading/index.mdx).
98 changes: 98 additions & 0 deletions calico_versioned_docs/version-3.31/releases.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,102 @@
[
{
"title": "v3.31.7",
"tigera-operator": {
"image": "tigera/operator",
"registry": "quay.io",
"version": "v1.40.15"
},
"components": {
"calico/typha": {
"version": "v3.31.7",
"registry": "quay.io"
},
"calico/ctl": {
"version": "v3.31.7",
"registry": "quay.io"
},
"calico/node": {
"version": "v3.31.7",
"registry": "quay.io"
},
"calico/node-windows": {
"version": "v3.31.7",
"registry": "quay.io"
},
"calico/cni": {
"version": "v3.31.7",
"registry": "quay.io"
},
"calico/cni-windows": {
"version": "v3.31.7",
"registry": "quay.io"
},
"calico/apiserver": {
"version": "v3.31.7",
"registry": "quay.io"
},
"calico/kube-controllers": {
"version": "v3.31.7",
"registry": "quay.io"
},
"calico/envoy-gateway": {
"version": "v3.31.7",
"registry": "quay.io"
},
"calico/envoy-proxy": {
"version": "v3.31.7",
"registry": "quay.io"
},
"calico/envoy-ratelimit": {
"version": "v3.31.7",
"registry": "quay.io"
},
"calico/flannel-migration-controller": {
"version": "v3.31.7",
"registry": "quay.io"
},
"flannel": {
"version": "v0.24.4",
"registry": "docker.io"
},
"calico/dikastes": {
"version": "v3.31.7",
"registry": "quay.io"
},
"flexvol": {
"version": "v3.31.7",
"registry": "quay.io"
},
"calico/csi": {
"version": "v3.31.7",
"registry": "quay.io"
},
"calico/node-driver-registrar": {
"version": "v3.31.7",
"registry": "quay.io"
},
"calico/pod2daemon-flexvol": {
"version": "v3.31.7",
"registry": "quay.io"
},
"calico/key-cert-provisioner": {
"version": "v3.31.7",
"registry": "quay.io"
},
"calico/goldmane": {
"version": "v3.31.7",
"registry": "quay.io"
},
"calico/whisker": {
"version": "v3.31.7",
"registry": "quay.io"
},
"calico/whisker-backend": {
"version": "v3.31.7",
"registry": "quay.io"
}
}
},
{
"title": "v3.31.6",
"tigera-operator": {
Expand Down
6 changes: 3 additions & 3 deletions calico_versioned_docs/version-3.31/variables.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
const releases = require('./releases.json');

const variables = {
releaseTitle: 'v3.31.6',
releaseTitle: 'v3.31.7',
prodname: 'Calico',
prodnamedash: 'calico',
version: 'v3.31',
Expand All @@ -16,11 +16,11 @@ const variables = {
noderunning: 'calico-node',
rootDirWindows: 'C:\\CalicoWindows',
ppa_repo_name: 'calico-3.31',
manifestsUrl: 'https://raw.githubusercontent.com/projectcalico/calico/v3.31.6',
manifestsUrl: 'https://raw.githubusercontent.com/projectcalico/calico/v3.31.7',
releases,
registry: '',
vppbranch: 'v3.31.0',
envoyVersion: '1.8.0',
envoyVersion: '1.8.2',
tigeraOperator: releases[0]['tigera-operator'],
tigeraOperatorVersionShort: releases[0]['tigera-operator'].version.split('.').slice(0, 2).join('.'),
imageNames: {
Expand Down
Loading