You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Co-authored-by: Saba <saba@tigera.io>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Rene Dekker <rene@tigera.io>
Copy file name to clipboardExpand all lines: calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx
+38-33Lines changed: 38 additions & 33 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,13 +5,6 @@ title: Release notes
5
5
6
6
# Calico Enterprise 3.23 release notes
7
7
8
-
:::info[early preview release]
9
-
10
-
Calico Enterprise 3.23 can be used for previewing and testing purposes only.
11
-
It is not supported for use in production.
12
-
13
-
:::
14
-
15
8
Learn about the new features, bug fixes, and other updates in this release of $[prodname].
16
9
17
10
This version of Calico Enterprise is based on [Calico Open Source $[openSourceVersion]](https://docs.tigera.io/calico/$[openSourceVersion]/release-notes).
@@ -114,47 +107,33 @@ For more information, see [Add Maglev load balancing to a service](../networking
114
107
115
108
{/* End 3.23.0-1.0 features */}
116
109
117
-
### Enhancements
110
+
{/* Start 3.23.1 features */}
118
111
119
-
* Improved the deterministic selection logic for flow and L7 logs when multiple NetworkSets have overlapping CIDRs.
120
-
Logs and Service Graph now prioritize namespace-specific matches over GlobalNetworkSets and other namespace matches to ensure more accurate identity attribution.
121
-
* User experience improvements to the Flow Summary card.
112
+
### Install on VMware Kubernetes Service (VKS)
122
113
123
-
## Technology preview features
114
+
You can now install $[prodname] on VMware Kubernetes Service (VKS). You deploy it as a Supervisor Service to your guest clusters, and can add Windows nodes if you need them.
115
+
Air-gapped installs also work, including relocating the bundle and images to a local registry.
124
116
125
-
The following features are available as technology previews. Tech preview features are for evaluation and feedback only and are **not supported for production use**. Behavior, APIs, and configuration may change before a feature reaches general availability.
117
+
For more information, see [VMware Kubernetes Service (VKS)](#).
126
118
127
-
{/*TODO: verify these rows against the 3.21 and 3.22 release notes and any TP additions in 3.23.0-1.0.*/}
Legend: **TP** = technology preview · **GA** = generally available · **–** = not yet introduced.
123
+
* Improved the deterministic selection logic for flow and L7 logs when multiple NetworkSets have overlapping CIDRs.
124
+
Logs and Service Graph now prioritize namespace-specific matches over GlobalNetworkSets and other namespace matches to ensure more accurate identity attribution.
125
+
* User experience improvements to the Flow Summary card.
139
126
140
127
## Deprecated and removed features
141
128
142
-
* Support for RHEL 8 and Windows 1809 is deprecated and scheduled for removal in an upcoming release.
129
+
* Support for RHEL 8 and Windows 1809 has been removed in this release.
143
130
* Support for the x86-64 v2 chip architecture is deprecated and scheduled for removal in an upcoming release.
144
131
* Application-layer policy and L7 observability features based on Envoy as a daemonset are deprecated and scheduled for removal in an upcoming release. These are being replaced with similar functionality using Istio Ambient Mode.
145
132
146
-
| Feature | 3.21 | 3.22 | 3.23 |
147
-
|---|---|---|---|
148
-
| RHEL 8 and Windows 1809 support | GA | GA | Deprecated |
149
-
| x86-64 v2 chip architecture | GA | GA | Deprecated |
150
-
| Envoy daemonset (application-layer policy, L7 observability) | GA | GA | Deprecated |
151
-
152
-
Legend: **GA** = generally available · **Deprecated** = scheduled for removal · **Removed** = no longer present · **–** = not yet introduced.
153
-
154
133
## Known issues
155
134
156
135
* In clusters using the eBPF data plane with strict reverse path forwarding (RPF) enabled, link-local discovery packets may be incorrectly dropped. This can interfere with neighbor discovery and local network communication. A fix is planned for an upcoming release.
157
-
* The combination of the eBPF data plane on EKS with Bottlerocket is currently not working; the issue is under investigation.
136
+
* The eBPF data plane on EKS with Kubernetes 1.36 is currently not working, including in combination with Bottlerocket; the issue is under investigation.
158
137
* On ARM64 with the eBPF data plane, the DNS parser can fail to load, which can result in timeouts.
159
138
160
139
## Upgrading
@@ -218,3 +197,29 @@ This release is for previewing and testing purposes only. It is not supported fo
218
197
* In clusters using the eBPF data plane with strict reverse path forwarding (RPF) enabled, link-local discovery packets may be incorrectly dropped. This can interfere with neighbor discovery and local network communication.
219
198
* The combination of the eBPF data plane on EKS with Bottlerocket is currently not working; the issue is under investigation.
220
199
* On ARM64 with the eBPF data plane, the DNS parser can fail to load, which can result in timeouts.
200
+
201
+
### Calico Enterprise 3.23.1 general availability release
202
+
203
+
July 6, 2026
204
+
205
+
Calico Enterprise 3.23.1 is now available as a general availability release.
206
+
207
+
This release is supported for use in production.
208
+
209
+
{/* TODO (fill after): add #### Breaking changes, #### Bug fixes, #### Known issues — omit any subsection with no items. */}
210
+
211
+
#### Bug fixes
212
+
213
+
* Fixed an issue where non-cluster hosts could inherit an unsupported data plane mode from the cluster's global FelixConfiguration. The eBPF data plane is now disabled on all non-cluster host packages, and RHEL 8 hosts are forced to use the iptables data plane (its 4.18 kernel does not reliably support nftables). RHEL 9, Debian, and Ubuntu continue to inherit the cluster's data plane choice.
214
+
* Fixed an issue where DNS-policy trusted servers (including `k8s-service:` references such as the default `kube-dns`) were resolved only once at startup and never refreshed. They are now kept up to date as the backing Service changes.
215
+
* Fixed a bug where Felix could permanently lose its DNS-policy NFQUEUE listener after a transient queue reconnect, causing domain-based policy to stop being enforced until Felix restarted.
216
+
217
+
#### Known issues
218
+
219
+
* On clusters using the eBPF data plane, a `HostEndpoint` policy can block UDP return traffic for pod-originated egress that uses NAT-outgoing (SNAT). TCP and ICMP traffic is unaffected. A fix is planned for an upcoming patch release.
220
+
* If the cluster's Kubernetes service account issuer changes (for example, during platform maintenance), $[prodname] components that validate bearer tokens keep using the previous issuer until restarted and reject service account tokens with `bearer token was not issued by a trusted issuer`. Manager UI observability pages (Service Graph, dashboard traffic stats, process info, L7 logs), license details, and log ingestion can fail while `tigerastatuses` still report Available. As a workaround, restart the token-validating components (`tigera-linseed`, `calico-apiserver`, `tigera-manager`, and `compliance-server`) so they re-read the current issuer, then re-create any long-lived Manager login tokens minted before the change. A fix is planned for an upcoming patch release.
221
+
222
+
223
+
#### Upgrading
224
+
225
+
To update an existing installation of Calico Enterprise 3.23, see [Install a patch release](../getting-started/manifest-archive.mdx).
0 commit comments