Skip to content

DOCS-2965: Publish Calico Enterprise 3.23.1 #2814

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sujeet-kr merged 17 commits into from
Jul 7, 2026
Merged

DOCS-2965: Publish Calico Enterprise 3.23.1 #2814

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
c505237
Publish Calico Enterprise 3.23.1 (GA)
sabags Jun 30, 2026
a970dfa
Drop EP1 (version-3.23-1) deletion from the publish PR
sabags Jun 30, 2026
03252da
compatibility: update for 3.23.1 GA; drop 3.20
sabags Jun 30, 2026
21281e9
compatibility: add VKS provider (3.23 -> VKS 3.7, k8s 1.36)
sabags Jun 30, 2026
e1355e2
Update release notes for 3.23.1
ctauchen Jul 1, 2026
52a2f07
Add VKS support release note for 3.23.1
ctauchen Jul 6, 2026
cd328ad
release-notes: note eBPF on EKS 1.36 known issue (incl. Bottlerocket)
sabags Jul 6, 2026
a16fb67
Correct 3.23.1 component/operator versions in releases.json
ctauchen Jul 6, 2026
224cf95
Fix dead links breaking the 3.23.1 build
ctauchen Jul 6, 2026
44ea943
Skip the ee/debs/v3.23 directory URL in link check
ctauchen Jul 6, 2026
cd9ee2d
Temporarily skip the 3.23.1 operator-metrics manifest URL
ctauchen Jul 6, 2026
0de5ced
Add 3.23.1 bug fixes: NCH data plane restriction and DNS trusted-serv…
rene-dekker Jul 6, 2026
30c3cdc
Add 3.23.1 known issue: HEP policy blocks UDP return traffic for NAT-…
rene-dekker Jul 6, 2026
01ea130
Remove empty Enhancements section from 3.23.1 release details
rene-dekker Jul 6, 2026
8f13240
Add 3.23.1 bug fix: Felix NFQUEUE reconnect deadlock (CORE-12966)
rene-dekker Jul 6, 2026
46da46a
Correct 3.23.1 coreos/fluentd versions to match shipped release
rene-dekker Jul 6, 2026
f2c592d
Add 3.23.1 known issue: stale trusted-issuer set after SA issuer chan…
rene-dekker Jul 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 11 additions & 11 deletions calico-enterprise/getting-started/compatibility.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@ The following list shows the platforms supported in this release. If you're work
- [OpenShift](#openshift)
- [RKE](#rke)
- [RKE2](#rke2)
- [VKS](#vks)
- [TKG](#tkg)
- [Charmed Kubernetes](#charmed-kubernetes)

Expand Down Expand Up @@ -55,19 +56,17 @@ Kubernetes version support aligns with [upstream Kubernetes](#kubernetes-kubeadm

| $[prodname] version | kOps and Kubernetes versions | $[prodname] support |
| -------------------- | ---------------------------- | -------------------------------------------------------------------------------------- |
| 3.23 | 1.33 - 1.34 | - $[prodname] CNI with network policy<br />- AWS CNI with $[prodname] network policy |
| 3.23 | 1.33 - 1.35 | - $[prodname] CNI with network policy<br />- AWS CNI with $[prodname] network policy |
| 3.22 | 1.31 - 1.34 | - $[prodname] CNI with network policy<br />- AWS CNI with $[prodname] network policy |
| 3.21 | 1.31 - 1.32 | - $[prodname] CNI with network policy<br />- AWS CNI with $[prodname] network policy |
| 3.20 | 1.29 - 1.30 | - $[prodname] CNI with network policy<br />- AWS CNI with $[prodname] network policy |

## Kubernetes-kubeadm

| $[prodname] version | Kubernetes/kubeadm versions | $[prodname] support |
| -------------------- | --------------------------- | ------------------------------------ |
| 3.23 | 1.33 - 1.36 | $[prodname] CNI with network policy |
| 3.23 | 1.34 - 1.36 | $[prodname] CNI with network policy |
| 3.22 | 1.31 - 1.35 | $[prodname] CNI with network policy |
| 3.21 | 1.31 - 1.33 | $[prodname] CNI with network policy |
| 3.20 | 1.29 - 1.31 | $[prodname] CNI with network policy |

## MKE 4k

Expand All @@ -84,16 +83,14 @@ Kubernetes version support aligns with [upstream Kubernetes](#kubernetes-kubeadm
| 3.22 | MKE 3.9 | $[prodname] CNI with network policy | 1.34 |
| 3.22 | MKE 3.8 | $[prodname] CNI with network policy | 1.31 |
| 3.21 | MKE 3.8 | $[prodname] CNI with network policy | 1.31 |
| 3.20 | MKE 3.8 | $[prodname] CNI with network policy | 1.31 |

## OpenShift

| $[prodname] version | OpenShift versions for Kubernetes | $[prodname] support |
| -------------------- | --------------------------------- | ------------------------------------ |
| 3.23 | 4.19 - 4.21 | $[prodname] CNI with network policy |
| 3.23 | 4.19 - 4.22 | $[prodname] CNI with network policy |
| 3.22 | 4.17 - 4.20 | $[prodname] CNI with network policy |
| 3.21 | 4.16 - 4.18 | $[prodname] CNI with network policy |
| 3.20 | 4.15 - 4.17 | $[prodname] CNI with network policy |

## RKE

Expand All @@ -102,16 +99,20 @@ Kubernetes version support aligns with [upstream Kubernetes](#kubernetes-kubeadm
| 3.23 | 1.8 | $[prodname] CNI with network policy | 1.32 |
| 3.22 | 1.8 | $[prodname] CNI with network policy | 1.32 |
| 3.21 | 1.8 | $[prodname] CNI with network policy | 1.32 |
| 3.20 | 1.7 | $[prodname] CNI with network policy | 1.31 |

## RKE2

| $[prodname] version | $[prodname] support | Kubernetes versions |
| -------------------- | ------------------------------------ | ------------------- |
| 3.23 | $[prodname] CNI with network policy | 1.33 - 1.35 |
| 3.23 | $[prodname] CNI with network policy | 1.34 - 1.36 |
| 3.22 | $[prodname] CNI with network policy | 1.31 - 1.34 |
| 3.21 | $[prodname] CNI with network policy | 1.31 - 1.33 |
| 3.20 | $[prodname] CNI with network policy | 1.29 - 1.31 |

## VKS

| $[prodname] version | VKS version | $[prodname] support | Kubernetes versions |
| -------------------- | ----------- | ------------------------------------ | ------------------- |
| 3.23 | VKS 3.7 | $[prodname] CNI with network policy | 1.36 |

## TKG

Expand All @@ -120,7 +121,6 @@ Kubernetes version support aligns with [upstream Kubernetes](#kubernetes-kubeadm
| 3.23 | 2.4 | $[prodname] CNI with network policy | 1.27 |
| 3.22 | 2.4 | $[prodname] CNI with network policy | 1.27 |
| 3.21 | 2.4 | $[prodname] CNI with network policy | 1.27 |
| 3.20 | 2.4 | $[prodname] CNI with network policy | 1.27 |

## Charmed Kubernetes

Expand Down
2 changes: 1 addition & 1 deletion calico-enterprise/reference/resources/network.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,7 +116,7 @@ Exactly one field must be set.
### Status

`Network.status.conditions` reports the observed state of the resource as a
list of standard Kubernetes [conditions](https://kubernetes.io/docs/reference/kubernetes-api/common-definitions/condition/).
list of standard Kubernetes [conditions](https://kubernetes.io/docs/reference/kubernetes-api/definitions/condition-v1-meta/).

## Attaching pods to a Network

Expand Down
2 changes: 1 addition & 1 deletion calico-enterprise_versioned_docs/version-3.22-2/variables.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ const variables = {
prodnamedash: 'calico-enterprise',
version: 'v3.22',
openSourceVersion: releases[0].calico.minor_version.slice(1),
baseUrl: '/calico-enterprise/latest',
baseUrl: '/calico-enterprise/3.22',
filesUrl: 'https://downloads.tigera.io/ee/v3.22.6',
rpmsUrl: 'https://downloads.tigera.io/ee/rpms/' + releases[0].title.slice(0, 5),
tutorialFilesURL: 'https://docs.tigera.io/files',
Expand Down
22 changes: 11 additions & 11 deletions calico-enterprise_versioned_docs/version-3.23-2/getting-started/compatibility.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@ The following list shows the platforms supported in this release. If you're work
- [OpenShift](#openshift)
- [RKE](#rke)
- [RKE2](#rke2)
- [VKS](#vks)
- [TKG](#tkg)
- [Charmed Kubernetes](#charmed-kubernetes)

Expand Down Expand Up @@ -55,19 +56,17 @@ Kubernetes version support aligns with [upstream Kubernetes](#kubernetes-kubeadm

| $[prodname] version | kOps and Kubernetes versions | $[prodname] support |
| -------------------- | ---------------------------- | -------------------------------------------------------------------------------------- |
| 3.23 | 1.33 - 1.34 | - $[prodname] CNI with network policy<br />- AWS CNI with $[prodname] network policy |
| 3.23 | 1.33 - 1.35 | - $[prodname] CNI with network policy<br />- AWS CNI with $[prodname] network policy |
| 3.22 | 1.31 - 1.34 | - $[prodname] CNI with network policy<br />- AWS CNI with $[prodname] network policy |
| 3.21 | 1.31 - 1.32 | - $[prodname] CNI with network policy<br />- AWS CNI with $[prodname] network policy |
| 3.20 | 1.29 - 1.30 | - $[prodname] CNI with network policy<br />- AWS CNI with $[prodname] network policy |

## Kubernetes-kubeadm

| $[prodname] version | Kubernetes/kubeadm versions | $[prodname] support |
| -------------------- | --------------------------- | ------------------------------------ |
| 3.23 | 1.33 - 1.36 | $[prodname] CNI with network policy |
| 3.23 | 1.34 - 1.36 | $[prodname] CNI with network policy |
| 3.22 | 1.31 - 1.35 | $[prodname] CNI with network policy |
| 3.21 | 1.31 - 1.33 | $[prodname] CNI with network policy |
| 3.20 | 1.29 - 1.31 | $[prodname] CNI with network policy |

## MKE 4k

Expand All @@ -84,16 +83,14 @@ Kubernetes version support aligns with [upstream Kubernetes](#kubernetes-kubeadm
| 3.22 | MKE 3.9 | $[prodname] CNI with network policy | 1.34 |
| 3.22 | MKE 3.8 | $[prodname] CNI with network policy | 1.31 |
| 3.21 | MKE 3.8 | $[prodname] CNI with network policy | 1.31 |
| 3.20 | MKE 3.8 | $[prodname] CNI with network policy | 1.31 |

## OpenShift

| $[prodname] version | OpenShift versions for Kubernetes | $[prodname] support |
| -------------------- | --------------------------------- | ------------------------------------ |
| 3.23 | 4.19 - 4.21 | $[prodname] CNI with network policy |
| 3.23 | 4.19 - 4.22 | $[prodname] CNI with network policy |
| 3.22 | 4.17 - 4.20 | $[prodname] CNI with network policy |
| 3.21 | 4.16 - 4.18 | $[prodname] CNI with network policy |
| 3.20 | 4.15 - 4.17 | $[prodname] CNI with network policy |

## RKE

Expand All @@ -102,16 +99,20 @@ Kubernetes version support aligns with [upstream Kubernetes](#kubernetes-kubeadm
| 3.23 | 1.8 | $[prodname] CNI with network policy | 1.32 |
| 3.22 | 1.8 | $[prodname] CNI with network policy | 1.32 |
| 3.21 | 1.8 | $[prodname] CNI with network policy | 1.32 |
| 3.20 | 1.7 | $[prodname] CNI with network policy | 1.31 |

## RKE2

| $[prodname] version | $[prodname] support | Kubernetes versions |
| -------------------- | ------------------------------------ | ------------------- |
| 3.23 | $[prodname] CNI with network policy | 1.33 - 1.35 |
| 3.23 | $[prodname] CNI with network policy | 1.34 - 1.36 |
| 3.22 | $[prodname] CNI with network policy | 1.31 - 1.34 |
| 3.21 | $[prodname] CNI with network policy | 1.31 - 1.33 |
| 3.20 | $[prodname] CNI with network policy | 1.29 - 1.31 |

## VKS

| $[prodname] version | VKS version | $[prodname] support | Kubernetes versions |
| -------------------- | ----------- | ------------------------------------ | ------------------- |
| 3.23 | VKS 3.7 | $[prodname] CNI with network policy | 1.36 |

## TKG

Expand All @@ -120,7 +121,6 @@ Kubernetes version support aligns with [upstream Kubernetes](#kubernetes-kubeadm
| 3.23 | 2.4 | $[prodname] CNI with network policy | 1.27 |
| 3.22 | 2.4 | $[prodname] CNI with network policy | 1.27 |
| 3.21 | 2.4 | $[prodname] CNI with network policy | 1.27 |
| 3.20 | 2.4 | $[prodname] CNI with network policy | 1.27 |

## Charmed Kubernetes

Expand Down
2 changes: 1 addition & 1 deletion calico-enterprise_versioned_docs/version-3.23-2/reference/resources/network.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,7 +116,7 @@ Exactly one field must be set.
### Status

`Network.status.conditions` reports the observed state of the resource as a
list of standard Kubernetes [conditions](https://kubernetes.io/docs/reference/kubernetes-api/common-definitions/condition/).
list of standard Kubernetes [conditions](https://kubernetes.io/docs/reference/kubernetes-api/definitions/condition-v1-meta/).

## Attaching pods to a Network

Expand Down
71 changes: 38 additions & 33 deletions calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,13 +5,6 @@ title: Release notes

# Calico Enterprise 3.23 release notes

:::info[early preview release]

Calico Enterprise 3.23 can be used for previewing and testing purposes only.
It is not supported for use in production.

:::

Learn about the new features, bug fixes, and other updates in this release of $[prodname].

This version of Calico Enterprise is based on [Calico Open Source $[openSourceVersion]](https://docs.tigera.io/calico/$[openSourceVersion]/release-notes).
Expand Down Expand Up @@ -114,47 +107,33 @@ For more information, see [Add Maglev load balancing to a service](../networking

{/* End 3.23.0-1.0 features */}

### Enhancements
{/* Start 3.23.1 features */}

* Improved the deterministic selection logic for flow and L7 logs when multiple NetworkSets have overlapping CIDRs.
Logs and Service Graph now prioritize namespace-specific matches over GlobalNetworkSets and other namespace matches to ensure more accurate identity attribution.
* User experience improvements to the Flow Summary card.
### Install on VMware Kubernetes Service (VKS)

## Technology preview features
You can now install $[prodname] on VMware Kubernetes Service (VKS). You deploy it as a Supervisor Service to your guest clusters, and can add Windows nodes if you need them.
Air-gapped installs also work, including relocating the bundle and images to a local registry.

The following features are available as technology previews. Tech preview features are for evaluation and feedback only and are **not supported for production use**. Behavior, APIs, and configuration may change before a feature reaches general availability.
For more information, see [VMware Kubernetes Service (VKS)](#).

{/* TODO: verify these rows against the 3.21 and 3.22 release notes and any TP additions in 3.23.0-1.0. */}
{/* End 3.23.1 features */}

| Feature | 3.21 | 3.22 | 3.23 |
|---|---|---|---|
| [Istio Ambient Mode](../compliance/istio/about-istio-ambient.mdx) | – | TP | TP |
| [Built-in observability dashboards](../observability/dashboards.mdx) | – | TP | TP |
| [Calico Ingress Gateway](../networking/ingress-gateway/about-calico-ingress-gateway.mdx) | TP | GA | GA |
| [KubeVirt live migration](../networking/kubevirt/index.mdx) | – | – | TP |
| [Multi-VRF networking](../networking/configuring/multi-vrf.mdx) | – | – | TP |
| [Native v3 CRDs](../operations/native-v3-crds.mdx) | – | – | TP |
### Enhancements

Legend: **TP** = technology preview · **GA** = generally available · **–** = not yet introduced.
* Improved the deterministic selection logic for flow and L7 logs when multiple NetworkSets have overlapping CIDRs.
Logs and Service Graph now prioritize namespace-specific matches over GlobalNetworkSets and other namespace matches to ensure more accurate identity attribution.
* User experience improvements to the Flow Summary card.

## Deprecated and removed features

* Support for RHEL 8 and Windows 1809 is deprecated and scheduled for removal in an upcoming release.
* Support for RHEL 8 and Windows 1809 has been removed in this release.
* Support for the x86-64 v2 chip architecture is deprecated and scheduled for removal in an upcoming release.
* Application-layer policy and L7 observability features based on Envoy as a daemonset are deprecated and scheduled for removal in an upcoming release. These are being replaced with similar functionality using Istio Ambient Mode.

| Feature | 3.21 | 3.22 | 3.23 |
|---|---|---|---|
| RHEL 8 and Windows 1809 support | GA | GA | Deprecated |
| x86-64 v2 chip architecture | GA | GA | Deprecated |
| Envoy daemonset (application-layer policy, L7 observability) | GA | GA | Deprecated |

Legend: **GA** = generally available · **Deprecated** = scheduled for removal · **Removed** = no longer present · **–** = not yet introduced.

## Known issues

* In clusters using the eBPF data plane with strict reverse path forwarding (RPF) enabled, link-local discovery packets may be incorrectly dropped. This can interfere with neighbor discovery and local network communication. A fix is planned for an upcoming release.
* The combination of the eBPF data plane on EKS with Bottlerocket is currently not working; the issue is under investigation.
* The eBPF data plane on EKS with Kubernetes 1.36 is currently not working, including in combination with Bottlerocket; the issue is under investigation.
* On ARM64 with the eBPF data plane, the DNS parser can fail to load, which can result in timeouts.

## Upgrading
Expand Down Expand Up @@ -214,3 +193,29 @@ This release is for previewing and testing purposes only. It is not supported fo
* In clusters using the eBPF data plane with strict reverse path forwarding (RPF) enabled, link-local discovery packets may be incorrectly dropped. This can interfere with neighbor discovery and local network communication.
* The combination of the eBPF data plane on EKS with Bottlerocket is currently not working; the issue is under investigation.
* On ARM64 with the eBPF data plane, the DNS parser can fail to load, which can result in timeouts.

### Calico Enterprise 3.23.1 general availability release

July 6, 2026

Calico Enterprise 3.23.1 is now available as a general availability release.
Comment on lines +197 to +201

This release is supported for use in production.

{/* TODO (fill after): add #### Breaking changes, #### Bug fixes, #### Known issues — omit any subsection with no items. */}

Comment on lines +203 to +206
#### Bug fixes

* Fixed an issue where non-cluster hosts could inherit an unsupported data plane mode from the cluster's global FelixConfiguration. The eBPF data plane is now disabled on all non-cluster host packages, and RHEL 8 hosts are forced to use the iptables data plane (its 4.18 kernel does not reliably support nftables). RHEL 9, Debian, and Ubuntu continue to inherit the cluster's data plane choice.
* Fixed an issue where DNS-policy trusted servers (including `k8s-service:` references such as the default `kube-dns`) were resolved only once at startup and never refreshed. They are now kept up to date as the backing Service changes.
* Fixed a bug where Felix could permanently lose its DNS-policy NFQUEUE listener after a transient queue reconnect, causing domain-based policy to stop being enforced until Felix restarted.

#### Known issues

* On clusters using the eBPF data plane, a `HostEndpoint` policy can block UDP return traffic for pod-originated egress that uses NAT-outgoing (SNAT). TCP and ICMP traffic is unaffected. A fix is planned for an upcoming patch release.
* If the cluster's Kubernetes service account issuer changes (for example, during platform maintenance), $[prodname] components that validate bearer tokens keep using the previous issuer until restarted and reject service account tokens with `bearer token was not issued by a trusted issuer`. Manager UI observability pages (Service Graph, dashboard traffic stats, process info, L7 logs), license details, and log ingestion can fail while `tigerastatuses` still report Available. As a workaround, restart the token-validating components (`tigera-linseed`, `calico-apiserver`, `tigera-manager`, and `compliance-server`) so they re-read the current issuer, then re-create any long-lived Manager login tokens minted before the change. A fix is planned for an upcoming patch release.


#### Upgrading

To update an existing installation of Calico Enterprise 3.23, see [Install a patch release](../getting-started/manifest-archive.mdx).
Loading