1 Release published by 1 person

• v3.28.5

  published Jun 12, 2025

12 Pull requests merged by 7 people

• Match all supported protocols in app policy matcher

  #10546 merged Jun 12, 2025

• Update versions and release notes for v3.28.5

  #10549 merged Jun 12, 2025

• [BPF] Support for IPv4 fragmentation

  #10335 merged Jun 11, 2025

• Cleanup ip/nftables when switching modes

  #10530 merged Jun 11, 2025

• Update k8s version

  #10547 merged Jun 11, 2025

• Add delete permission to tigera operator for ANP/BANP CRDs

  #10543 merged Jun 10, 2025

• update go build version for v3.30

  #10542 merged Jun 10, 2025

• [cherry-pick #8685] Add Ubuntu 24.04 noble support for OpenStack

  #10462 merged Jun 9, 2025

• eBPF - Cleanup unused code.

  #10486 merged Jun 9, 2025

• Fix typo: change sims to shims

  #10541 merged Jun 9, 2025

• Update default trusted bundle file path from "tigera-ca-bundle.crt" to "ca.crt"

  #10539 merged Jun 9, 2025

• Add NextHopMode to BGPPeer API

  #10471 merged Jun 9, 2025

11 Pull requests opened by 9 people

• [DO NOT MERGE] CORE-11445: Initial prototype changes

  #10540 opened Jun 9, 2025

• Bump github.com/cloudflare/circl from 1.3.9 to 1.6.1

  #10545 opened Jun 10, 2025

• Added Kind k8st tests for BGP next hop mode

  #10550 opened Jun 11, 2025

• [Release v3.30] Add delete permission to tigera operator for ANP/BANP CRDs

  #10552 opened Jun 12, 2025

• Reduce log level for spammy log

  #10553 opened Jun 12, 2025

• Fix CalicoNodeStatus update stuck in conflict

  #10555 opened Jun 13, 2025

• [Do not merge] Debug kind st cluster setup

  #10556 opened Jun 13, 2025

• eBPF - Change ctmap to lru_hash

  #10557 opened Jun 13, 2025

• [BPF] fix bpfEnforceRPF=Disabled

  #10558 opened Jun 13, 2025

• [release-v3.30] Auto pick #10558: fix bpfEnforceRPF=Disabled

  #10559 opened Jun 13, 2025

• [CORE-11468] BPF: Replace exec calls to 'tc' binary with netlink library calls

  #10561 opened Jun 13, 2025

38 Issues closed by 4 people

• calico ipip tunnel on secondary ipv4 does not work

  #7374 closed Jun 15, 2025

• Calico DefaultEndpointToHostAction is always set to Accept in iptables regardless the configured value

  #7398 closed Jun 15, 2025

• feature request: improve robustness of some pod networking situations in light of control plane failure

  #7403 closed Jun 15, 2025

• Add "disk, network usage metrics" feature to calico Felix Prometheus

  #5803 closed Jun 13, 2025

• TLS handshake problem between calico-node and goldmane pods

  #10522 closed Jun 13, 2025

• dashboards include old metrics

  #9860 closed Jun 13, 2025

• [Bug] Logs are crowded with `HostMetadataV4V6Update` on every calico-node pod.

  #7479 closed Jun 13, 2025

• Allow NATOutgoingAddress to be a range

  #7489 closed Jun 13, 2025

• [windows/k8s/cni] calico cni supports k8s pod of windows hyper-v mode ?

  #7490 closed Jun 13, 2025

• Add ability to log Kubernetes native Network Policies

  #7519 closed Jun 13, 2025

• cannot create resource "serviceaccounts/token" in API group "" in the namespace "kube-system"

  #6378 closed Jun 12, 2025

• Couldn't get resource list for projectcalico.org/v3: the server is currently unable to handle the request

  #7555 closed Jun 12, 2025

• `csiNodeDriverDaemonSet` is not in Installation spec

  #7569 closed Jun 12, 2025

• calico-node: Unable to chown /var/lib/calico/ on EKS when nonPrivileged is Enabled

  #7653 closed Jun 12, 2025

• Dockerhub images for bpftool and bitnami/kubectl on Dockerhub are not multi-arch enabled causing failures on s390x arch

  #7654 closed Jun 12, 2025

• calico-node cannot refresh expired serviceaccount token due to apiserver throttling

  #7694 closed Jun 12, 2025

• Calico Support TCP-AO ISSUE

  #7708 closed Jun 12, 2025

• Please remove `nat-outgoing` from `crd.projectcalico.org_ippools.yaml`

  #6638 closed Jun 12, 2025

• Uninstall of eBPF Calico breaks networking (on EKS/Bottlerocket)

  #7745 closed Jun 12, 2025

• Document all the supported container registries for the calico components

  #7773 closed Jun 12, 2025

• Support IP fragmentation in eBPF

  #8821 closed Jun 11, 2025

• Allow IPPools to be dedicated to specific workloads by annotation

  #6787 closed Jun 11, 2025

• Documentation on setting up metallb with Calico has incorrect config for metallb

  #6547 closed Jun 10, 2025

• Calico operator fails to read `/var/lib/calico/mtu` because of SELinux

  #7851 closed Jun 9, 2025

• iptablesFilterDenyAction: REJECT -> calio-nodes do not ready

  #7914 closed Jun 9, 2025

• High CPU load on calico-node -felix conntrack

  #7948 closed Jun 9, 2025

• calico-kube-controllers panic (calico 3.26.1)

  #7972 closed Jun 9, 2025

• incorrect name validation/restrictions

  #7990 closed Jun 9, 2025

• in some cases, windows calico node-agent doesnt mark networkUnavailable:false... but sometimes it does ... should agent be modifying this condition, at all?

  #7996 closed Jun 9, 2025

• calico-node CrashLoopBackoff due to permissions issue with non-root user

  #8016 closed Jun 9, 2025

• Support for a bug report or sysdump in calicoctl

  #8020 closed Jun 9, 2025

• calico-node removes no encapsulated routes on startup

  #8071 closed Jun 9, 2025

• Newer istio version support

  #8132 closed Jun 9, 2025

• Error on ebpf migration documentation

  #8141 closed Jun 9, 2025

• Disable hostMTU monitoring if veth_mtu is explicity configured

  #8197 closed Jun 9, 2025

• Allow passing imagePullSecrets in base64

  #8204 closed Jun 9, 2025

• VPP: external access to a dual-stack service doesn't work for IPv6

  #8269 closed Jun 9, 2025

• libcalico-go should improve error handle when use list+watch resource mode to reduce load on apiserver

  #8277 closed Jun 9, 2025

6 Issues opened by 6 people

• calico/node is not ready: bird/confd is not live: exit status 1

  #10560 opened Jun 13, 2025

• Add support for per network/pool IP in annotation

  #10554 opened Jun 13, 2025

• slow addresss allocation when one of the existing ip pools is exhausted

  #10551 opened Jun 12, 2025

• Support FQDN Peers in AdminNetworkPolicy (NPEP-133)

  #10548 opened Jun 11, 2025

• Support loadBalancerClass

  #10544 opened Jun 10, 2025

• calico-node stuck in Not-ready state due to kube-apiserver connectivity timeout

  #10538 opened Jun 9, 2025

75 Unresolved conversations

Sometimes conversations happen on old items that aren’t yet closed. Here is a list of all the Issues and Pull Requests with unresolved conversations.

• IP(XYZ) In use by in use by Node/Workload(XXXX) and in active IPAM pool but has no IPAM allocation.

  #7348 commented on Jun 9, 2025 • 0 new comments

• IP overlapping issue - kubernetes pod cidr and the external NAT

  #7345 commented on Jun 9, 2025 • 0 new comments

• [enhancement] egress gateway for free/OSS

  #7338 commented on Jun 9, 2025 • 0 new comments

• Windows: Network connectivity flakes during Kubernetes prestop exec calls (curl webserver)

  #7332 commented on Jun 9, 2025 • 0 new comments

• FDB entries cannot be deleted when a node is deleted, which will cause FDB entry conflicts

  #7281 commented on Jun 9, 2025 • 0 new comments

• Improvement: Ability to set SecurityContext

  #7282 commented on Jun 9, 2025 • 0 new comments

• Better tigera/operator compatibility with ArgoCD

  #7228 commented on Jun 9, 2025 • 0 new comments

• Uncertain of required open host ports on fresh install for k8s

  #7178 commented on Jun 9, 2025 • 0 new comments

• Turn on tunl0 device pmtudisc attr avoid some kernel version bug on IPIP mode

  #7146 commented on Jun 9, 2025 • 0 new comments

• Calico for Windows - v3.24.5 - CNI plugin fails to reinstall following windows server reboot

  #7136 commented on Jun 9, 2025 • 0 new comments

• Tigera Operator helm chart not working with argo cd when specifying a private registry

  #7121 commented on Jun 9, 2025 • 0 new comments

• [feature request] Support mutliple IPv6 addresses per pod: ULA (cluster-internal) + GUA (no-nat external internet)

  #7096 commented on Jun 9, 2025 • 0 new comments

• Unexpected default behavior of workload to host traffic

  #7056 commented on Jun 9, 2025 • 0 new comments

• How to get the assigned ip in the ippool

  #7046 commented on Jun 9, 2025 • 0 new comments

• Configure log levels for calico-node

  #7018 commented on Jun 9, 2025 • 0 new comments

• BGP Peering unstable if aggressive timers are used (1s/3s)

  #7086 commented on Jun 9, 2025 • 0 new comments

• [feature request] Add docker images to public ECR

  #7000 commented on Jun 10, 2025 • 0 new comments

• Failed configure IPIP tunnel device, retrying... error=message too long

  #6883 commented on Jun 10, 2025 • 0 new comments

• Bird Template - "Skipping ourselves" not considering port

  #6863 commented on Jun 10, 2025 • 0 new comments

• windows: calico-node startup container unable to access kubeadm ConfigMap

  #6829 commented on Jun 10, 2025 • 0 new comments

• How to disable tx-sctp-segmentation for all Pods with calico CNI

  #6756 commented on Jun 10, 2025 • 0 new comments

• calico components can't be run with segfault error

  #10479 commented on Jun 10, 2025 • 0 new comments

• tigera operator pods do not start when bootstrapping okd/openshift on user provisioned infra

  #10509 commented on Jun 10, 2025 • 0 new comments

• Connecting non-cluster hosts to a Kubernetes cluster

  #6722 commented on Jun 10, 2025 • 0 new comments

• Charts repo index file should use github release / git commit date as `created`

  #6747 commented on Jun 10, 2025 • 0 new comments

• Calico unconditionally drops VXLAN packets that are not related to Calico

  #6752 commented on Jun 10, 2025 • 0 new comments

• Wrong Felix docs for IptablesBackend

  #6772 commented on Jun 10, 2025 • 0 new comments

• Feature request: Support AKS with Calico on Windows nodes

  #6846 commented on Jun 10, 2025 • 0 new comments

• Helm "enable metrics" boolean

  #6887 commented on Jun 10, 2025 • 0 new comments

• Expose the length module and others to calico users

  #6599 commented on Jun 10, 2025 • 0 new comments

• Flanneld missing reference to config map kubernetes-services-endpoint in default manifest

  #6597 commented on Jun 10, 2025 • 0 new comments

• Self-managed cluster in Azure with VXLANCrossSubnet

  #6568 commented on Jun 10, 2025 • 0 new comments

• Calico in eBPF mode intermittently sends out packets with same source and destination IP address (a.k.a. Land Attack)

  #6430 commented on Jun 11, 2025 • 0 new comments

• Applying network polices to Calico resources created by the tigera-operator

  #6409 commented on Jun 11, 2025 • 0 new comments

• CRD definition version mismatch causes deployment issues of Custom Resource instances in Flux

  #6406 commented on Jun 11, 2025 • 0 new comments

• UDP connection can get stuck and not reaching a service's pod if initiated during this pod restart

  #6386 commented on Jun 11, 2025 • 0 new comments

• Provide mechanism to modify established connections

  #6399 commented on Jun 11, 2025 • 0 new comments

• CalicoNodeStatus can't be updated when etcd performance is (temporarily) degraded

  #8715 commented on Jun 11, 2025 • 0 new comments

• quota monitor not synced because of calico resources

  #10519 commented on Jun 11, 2025 • 0 new comments

• plugin type="calico" failed (add): error getting ClusterInformation: Get "https://172.20.0.1:443/apis/crd.projectcalico.org/v1/clusterinformations/default": Service Unavailable

  #10352 commented on Jun 12, 2025 • 0 new comments

• K8s service for linux pod is not accessible from windows pod in the same subnet

  #6322 commented on Jun 12, 2025 • 0 new comments

• Felix FV Test Results and Arm64 Support

  #6199 commented on Jun 12, 2025 • 0 new comments

• If WireGuard is disabled, the WireGuard module should not be loaded

  #7833 commented on Jun 12, 2025 • 0 new comments

• Calico-Node logs are flooded with ipv6 related warnings when net.ipv6.conf.all.disable_ipv6=1

  #6318 commented on Jun 12, 2025 • 0 new comments

• feature request: shell completion

  #6312 commented on Jun 12, 2025 • 0 new comments

• Enable routes to the pod/service networks to be added for multi-homed pods

  #6358 commented on Jun 12, 2025 • 0 new comments

• In BGP mode, all Typha instances being unavailable results in eventual network issues

  #6167 commented on Jun 13, 2025 • 0 new comments

• Additional static IP configuration options

  #6148 commented on Jun 13, 2025 • 0 new comments

• Consider enforcing Go code formatting using gofumpt

  #6106 commented on Jun 13, 2025 • 0 new comments

• Add codespell GitHub Action

  #6105 commented on Jun 13, 2025 • 0 new comments

• Random connection timeouts in ebpf mode (Error attaching tc program invalid argument iface="tunl0")

  #6103 commented on Jun 13, 2025 • 0 new comments

• Document Calico's use of upstream CNI plugins

  #6004 commented on Jun 13, 2025 • 0 new comments

• SNAT IP configurable by IP Pool instead of being set globally

  #5895 commented on Jun 13, 2025 • 0 new comments

• Feature: wireguard connect multple clusters and service discovery

  #5839 commented on Jun 13, 2025 • 0 new comments

• Use global network policies for basic isolation of future namespaces

  #6107 commented on Jun 13, 2025 • 0 new comments

• select nodes to expose NodePort service in eBPF mode

  #5495 commented on Jun 13, 2025 • 0 new comments

• Improved insights and troubleshooting

  #6998 commented on Jun 13, 2025 • 0 new comments

• Allow the tigera-operator Helm chart to change where the Calico resources are created

  #5876 commented on Jun 14, 2025 • 0 new comments

• Allow cluster wide service traffic to receive traffic from original IP address

  #5859 commented on Jun 14, 2025 • 0 new comments

• IP tables version auto-detection doesn't always work

  #5760 commented on Jun 14, 2025 • 0 new comments

• IPVS packets are dropped without IPVS conntrack enabled

  #5747 commented on Jun 14, 2025 • 0 new comments

• Missing rpm packages in http://binaries.projectcalico.org/rpm/calico-3.22/

  #5737 commented on Jun 14, 2025 • 0 new comments

• Support pluggable /opt/cni/bin/...

  #5725 commented on Jun 14, 2025 • 0 new comments

• libcaligo-go: retracted module golang.zx2c4.com/wireguard

  #5724 commented on Jun 14, 2025 • 0 new comments

• CNI plugin doesn't retry its Create / Update operations

  #5707 commented on Jun 15, 2025 • 0 new comments

• High load on the API servers on a large Kubernetes cluster using Calico CNI

  #5664 commented on Jun 15, 2025 • 0 new comments

• calicoctl node diags try to use docker but kubernetes runs with containerd

  #5637 commented on Jun 16, 2025 • 0 new comments

• Using ip pool annotations on namespaces and node selectors within the ip pools

  #10502 commented on Jun 16, 2025 • 0 new comments

• [Do not merge] Update vmss scripts for win-cni fv

  #9695 commented on Jun 11, 2025 • 0 new comments

• list ippools with label selector

  #10267 commented on Jun 12, 2025 • 0 new comments

• Fail and retry if mtu file is failed to be written or not found

  #10270 commented on Jun 12, 2025 • 0 new comments

• Proof of concept: Use v3 CRDs directly

  #10447 commented on Jun 12, 2025 • 0 new comments

• Felix programs in-cluster no encapsulation routes

  #10472 commented on Jun 12, 2025 • 0 new comments

• POC Maglev

  #10523 commented on Jun 13, 2025 • 0 new comments

• update registries in operator when using dev/custom registries

  #10524 commented on Jun 12, 2025 • 0 new comments