v1.43.0

30 Jul 2026

Included Calico versions

Calico version: v3.32.0
Calico Enterprise version: v3.24.0-1.0

Enhancements

• On BPF clusters where the operator is not managing kube-proxy (e.g. AKS), the operator now defaults FelixConfiguration.BPFKubeProxyHealthzPort to 0 to avoid a port conflict with the platform's kube-proxy. Users can still override the port explicitly. #4768 (@tomastigera)
• Added Installation.spec.calicoNetwork.linuxPodInterfaceType to select between Veth (default) and Netkit for the Calico CNI pod interface. Requires Calico CNI plugin support for device_type (Linux 6.7+ for netkit; older kernels fall back to veth). #4767 (@tomastigera)

Bug fixes

• Fixed an issue where a non-canonical storage quantity in the LogStorage CR (e.g. 1024Gi) caused the Elasticsearch NodeSet to be renamed on every reconcile, repeatedly recreating the Elasticsearch StatefulSet and its PVCs. #5079 (@pasanw)
• Fixed a bug where disabling Gateway WAF left the generated EnvoyExtensionPolicy in place so the gateway kept enforcing WAF. The WAF controller now stays running while disabled so it can tear down what it generated. #4994 (@electricjesus)
• Granted the tigera-network-admin and tigera-ui-user roles RBAC access to the WAF (applicationlayer.projectcalico.org) policy resources. #4965 (@electricjesus)
• Fixes a regression where the Goldmane and Guardian pods were unable to reach DNS or the management cluster, which could break flow visibility (including on Calico Cloud-connected clusters). #4951 (@caseydavenport)
• Remove the deprecated waf-http-filter sidecar from the Enterprise Gateway data plane. WAF is now enforced by the Coraza WASM filter on the envoy-proxy. #4931 (@electricjesus)
• Fixed a bug where the Calico Enterprise gateway WAF CRDs (applicationlayer.projectcalico.org) were not installed on standard aggregated-apiserver installations, making the gateway WAF feature unusable. These CRDs are now installed in both CRD modes. #4921 (@electricjesus)
• Fixed 403 errors on custom dashboards for OIDC users. #4827 (@alexh-tigera)

Other changes

• Bump Helm to v3.21.3 (drops the containerd dependency) and oras-go to v2.6.2 to clear containerd CVE-2026-50195, CVE-2026-53492, CVE-2026-53489 and oras-go CVE-2026-50163 from the operator image. #5101 (@electricjesus)
• Update the bundled Envoy Gateway to v1.8.2. #5081 (@electricjesus)
• The ECK operator is updated to v3.4.1. #5038 (@alexh-tigera)
• None #5026 (@radixo)
• Restore backwards compatibility for the Monitor CRD alertManager field, which was inadvertently renamed to alertmanager. #4984 (@rene-dekker)
• Add operator render for Gateway API WAF observability (EV-6650): capture the Coraza audit log from the gateway proxy, and enable the Felix + fluentd legs (WAFEventLogsFileEnabled, WAF_LOG_FILE) so WAF block / would-block decisions land in the tigera_secure_ee_waf index. #4976 (@electricjesus)
• Elasticsearch and Kibana are updated to the v8.19.17 release. #4963 (@vara2504)
• Bump ECK operator from 3.3.2 to 3.4.0 #4957 (@vara2504)
• Add L7 log collection for Istio ambient mode waypoint proxies. #4949 (@alexh-tigera)
• Bumped bundled Envoy Gateway from v1.7.2 to v1.8.0. Adds first-class ListenerSet support (enables cert-manager and external-dns integration with Gateway-API), the safe-upgrades ValidatingAdmissionPolicy for CRD version migrations, and pulls in the v1.8.0 security and bug-fix rollup. Note: v1.8.0 contains several upstream behavior changes (DirectResponse template interpolation, SecurityPolicy 0s timeout semantics, samplingFraction 100x correction, OIDC filter consolidation) — see https://gateway.envoyproxy.io/news/releases/notes/v1.8.0/. #4934 (@electricjesus)
• Bump third-party component versions and Go x/ libraries to address CVEs (GO-2026-5026, CVE-2026-42151/42154). #4926 (@vara2504)
• None #4904 (@radixo)
• Bump Kubernetes dependencies to v1.36.1. #4888 (@lucastigera)
• Fixes an operator upgrade that could stall on kind clusters, looping on an unsupported "Kind" kubernetesProvider value instead of completing. #4881 (@caseydavenport)
• The Installation fipsMode field is deprecated. FIPS mode is no longer supported, and setting fipsMode to Enabled marks the installation degraded. #4875 (@caseydavenport)
• Fixes an issue where Calico Enterprise compliance reports were never scheduled due to a missing RBAC permission on the calico-apiserver ClusterRole. #4862 (@caseydavenport)
• Grant operator-managed service accounts update permission on /status subresources for GlobalAlert, PacketCapture, and SecurityEventWebhook. #4853 (@caseydavenport)
• NONE #4851 (@xiumozhan)
• None #4846 (@caseydavenport)
• Fixes the non-cluster-host Typha deployment crashlooping on clusters where the host-network kube-apiserver endpoint is not reachable from pod-networked pods (e.g. MKE's proxy.local). The pod-network endpoint from the kubernetes-service-endpoint ConfigMap is now used when set. #4840 (@caseydavenport)
• Fix operator reconcile failure on Kubernetes clusters that only serve the v1 (not v1beta1) MutatingAdmissionPolicy API. #4837 (@caseydavenport)
• Add operator render for the WAF v3 (Coraza WASM) SecLang validating admission #4821 (@electricjesus)
• webhook — served in-process by calico-kube-controllers — plus the WASM_* env #4821 (@electricjesus)
• vars and serving-cert / RBAC plumbing (paired with tigera/calico-private#11834 #4821 (@electricjesus)
• and #12141). The existing WAF v1 (sidecar / ModSecurity) render path is untouched. #4821 (@electricjesus)
• Calico Typha no longer schedules on cordoned nodes. The apiserver and admission webhook Deployments also respect node cordoning when running in host-network mode. #4820 (@caseydavenport)
• Bump bundled ECK Kibana/Elasticsearch version constant to 8.19.15. #4817 (@tianfeng92)
• Fix WAF HTTP filter failing open in clusters installed without the Calico API server (USE_API_SERVER=false / v3-CRDs-only mode). The filter's license check now succeeds regardless of which Calico CRD group is installed, so WAF rule processing engages as intended. #4808 (@electricjesus)
• Added Installation.Spec.ImagePullPolicy for overriding the pull policy of all operator-managed pods, useful in air-gapped clusters. #4797 (@caseydavenport)
• Mount the operator-managed trusted CA bundle (public roots + Calico CA) on envoy-gateway and provisioned envoy-proxy pods so outbound TLS to public upstreams (e.g. wasm OCI registries, OIDC providers) succeeds without x509: certificate signed by unknown authority. #4796 (@electricjesus)
• Fix 500 errors on the policy list page for managed clusters by trusting the management cluster CA on the calico-apiserver bundle, attaching a Linseed-issued bearer token to the queryserver, and clearing x-cluster-id so voltron rewrites it. #4786 (@tianfeng92)
• Fix operator metrics server starting with an empty client-CA trust pool when the CA Secret is created after the operator pod, which previously broke Prometheus scraping until a restart. #4785 (@rene-dekker)
• Automatically recover Calico pods stranded with stale pod IPs after a node IP change (e.g. KubeVirt node reboot). #4784 (@coutinhop)
• None #4782 (@caseydavenport)
• Fixes a permissions error in calico-kube-controllers that prevented it from reading IPAM configuration. #4775 (@caseydavenport)
• The GatewayAPI resource now permits general patching of the Services that are provisioned for gateways within a custom gateway class, by adding a Patch field in GatewayServiceSpec that is passed through to the corresponding field in EnvoyProxy. #4773 (@nelljerram)
• Stops the intrusion-detection-controller from logging repeated RBAC errors about ManagedClusters on standalone clusters. #4765 (@caseydavenport)
• Add a named "https" port on the calico-manager Service and, when the OpenShift IDP is configured, publish a tigera-ca-public Secret in calico-system so OpenShift's Ingress→Route conversion can produce a reencrypt Route fronting the manager. #4763 (@rene-dekker)
• Fixed a panic caused by concurrent reconcilers racing on an unsynchronized slice used to track handled override fields. #4755 (@Brian-McM)
• Update bundled ECK CRDs to v3.3.2. #4753 (@radixo)
• Avoid incorrectly auto-detecting non-GKE clusters as GKE when they only expose the networking.gke.io API group. #4747 (@officialasishkumar)
• Avoid rendering duplicate tolerations on calico-kube-controllers when matching default tolerations are already configured through Installation controlPlaneTolerations. #4746 (@officialasishkumar)
• Fix Kibana crashloop when upgrading from Calico Enterprise 3.20 or earlier to 3.21+. The orphan ingest_manager_settings saved object left by Fleet 7.17 is now discarded during Kibana 8.x's saved-object migration, allowing the upgrade to complete successfully. #4741 (@tianfeng92)
• Added Installation.Spec.TyphaPodDisruptionBudget to allow configuring the calico-typha PodDisruptionBudget, including unhealthyPodEvictionPolicy. #4729 (@caseydavenport)
• Grant the tigera-noncluster-host ClusterRole create access on linseed.tigera.io/policyactivity so non-cluster host policy activity logs reach Linseed. #4725 (@xiumozhan)
• Operator now surfaces a warning in TigeraStatus when the license is within its grace period. #4692 (@hjiawei)
• Breaking change. The Calico Ingress Gateway controller now runs in #4690 (@radixo)
• calico-system and provisions proxy workloads in the Gateway's own namespace #4690 (@radixo)
• (deploy.type=GatewayNamespace). Existing tigera-gateway-class Gateways #4690 (@radixo)
• keep working without CR edits, but their proxy Pods are relaunched in the #4690 (@radixo)
• Gateway's own namespace; any NetworkPolicy, monitoring, RBAC or external DNS #4690 (@radixo)
• previously pinned to tigera-gateway must be repointed to the Gateway's own #4690 (@radixo)
• namespace. The legacy controller install is removed automatically on upgrade; #4690 (@radixo)
• the tigera-gateway Namespace itself is left in place in case it holds user #4690 (@radixo)
• resources. #4690 (@radixo)
• Adds PrometheusRule alerts for TLS certificate expiry, license expiry and component degraded status. #4663 (@rene-dekker)
• Always add --tunnelSecretName flag to the apiserver, so it will pick the correct secret for signing tunnel certificates. #4660 (@rene-dekker)
• Improve TigeraStatus to include more detailed information when readiness and liveness probes fail. #4644 (@caseydavenport)
• -not-required #4638 (@radixo)
• Add spec.networkPolicy.managePolicies to the Installation resource to enable or disable the NetworkPolicies the operator installs to protect Calico components. #4626 (@caseydavenport)
• Tigera Operator is now built with Go 1.26 and linked against Kubernetes 1.35. #4613 (@hjiawei)
• Add probe timing overrides to Installation API. #4612 (@caseydavenport)
• Reduce calico-node readiness probe period from 30s to 10s, cutting the time for nodes to report ready from ~35-40s to ~15-20s. #4609 (@caseydavenport)
• The operator now deploys OSS Calico components using the combined calico/calico image, reducing the number of per-component images required. #4608 (@caseydavenport)
• Updated ECK operator CRDs from v2.16.1 to v3.3.0. #4596 (@radixo)
• s #4584 (@tianfeng92)
• Linseed now always receives the tenant ID when a tenant is configured, ensuring tenant isolation via the x-tenant-id header for all Elasticsearch backends including internal ES. #4584 (@tianfeng92)
• Breaking: Makes the replica count for Kibana and Alertmanager configurable inside their components own CR, rather than Installation.Spec.ControlPlaneReplicas. 0 replicas means that they will not be rendered at all. #4567 (@rene-dekker)
• When unspecified, alertmanager will default to 0. #4567 (@rene-dekker)
• When unspecified, kibana will default to 1. #4567 (@rene-dekker)
• Bump bundled Envoy Gateway to v1.7.0. #4566 (@pasanw)
• Give Policy Recommendation Controller the necessary RBAC to recommend policies for HostEndpoints. #4565 (@xiumozhan)
• s #4558 (@rene-dekker)
• Adds new prometheus metrics to the operator for managing TLS expiry, License expiry and TigeraStatus monitoring. When METRICS_SCHEME is set to https, the operator will create its own TLS secret, which you can replace with your own, as is possible for all TLS secrets in the operator namespace. #4558 (@rene-dekker)
• Breaking: To enable metrics, you now need to set the METRICS_ENABLED environment variable to true. #4558 (@rene-dekker)
• Added label selector for networkpolicies selecting coredns on Canonical Kubernetes clusters. #4502 (@rene-dekker)
• Istio waypoint Gateways now work on clusters with private registries. The operator passes imagePullSecrets to istiod via Helm values and copies pull secrets to namespaces containing waypoint Gateways. #4483 (@electricjesus)