Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Publishes CE 3.21-1 #1884

Merged
merged 10 commits into from
Feb 12, 2025
Merged

Publishes CE 3.21-1 #1884

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
a223c82
Publishes Calico Enterprise 3.21-1
ctauchen Feb 6, 2025
c30cccb
DOCS-2457: Adds draft RN for CE 3.21-1
ctauchen Feb 6, 2025
35fb3ad
Updates component versions
ctauchen Feb 10, 2025
ef68531
RN updates
ctauchen Feb 10, 2025
528bba4
RN updates
ctauchen Feb 10, 2025
9d566c8
Restores component verisons
ctauchen Feb 10, 2025
c04b1fa
Fixes typo
ctauchen Feb 10, 2025
1cb763c
Update support and compatibility docs for 3.21 ep1
sabags Feb 10, 2025
79dc1c4
Address PR comments
sabags Feb 10, 2025
cdfe221
update release versions
radTuti Feb 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 3 additions & 17 deletions calico-enterprise/getting-started/compatibility.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,23 +31,23 @@

| $[prodname] version | $[prodname] support |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| 3.18 to current release | - $[prodname] CNI with network policy<br />- Azure CNI with $[prodname] network policy <br />- Azure CNI with $[prodname] network policy |
| 3.19 to current release | - $[prodname] CNI with network policy<br />- Azure CNI with $[prodname] network policy <br />- Azure CNI with $[prodname] network policy |

Check failure on line 34 in calico-enterprise/getting-started/compatibility.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'prodname'?

Raw Output:
{"message": "[Vale.Spelling] Did you really mean 'prodname'?", "location": {"path": "calico-enterprise/getting-started/compatibility.mdx", "range": {"start": {"line": 34, "column": 33}}}, "severity": "ERROR"}

Check failure on line 34 in calico-enterprise/getting-started/compatibility.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'prodname'?

Raw Output:
{"message": "[Vale.Spelling] Did you really mean 'prodname'?", "location": {"path": "calico-enterprise/getting-started/compatibility.mdx", "range": {"start": {"line": 34, "column": 91}}}, "severity": "ERROR"}

Check failure on line 34 in calico-enterprise/getting-started/compatibility.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'prodname'?

Raw Output:
{"message": "[Vale.Spelling] Did you really mean 'prodname'?", "location": {"path": "calico-enterprise/getting-started/compatibility.mdx", "range": {"start": {"line": 34, "column": 141}}}, "severity": "ERROR"}

Check failure on line 34 in calico-enterprise/getting-started/compatibility.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'prodname'?

Raw Output:
{"message": "[Vale.Spelling] Did you really mean 'prodname'?", "location": {"path": "calico-enterprise/getting-started/compatibility.mdx", "range": {"start": {"line": 34, "column": 33}}}, "severity": "ERROR"}

Check failure on line 34 in calico-enterprise/getting-started/compatibility.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'prodname'?

Raw Output:
{"message": "[Vale.Spelling] Did you really mean 'prodname'?", "location": {"path": "calico-enterprise/getting-started/compatibility.mdx", "range": {"start": {"line": 34, "column": 91}}}, "severity": "ERROR"}

Check failure on line 34 in calico-enterprise/getting-started/compatibility.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'prodname'?

Raw Output:
{"message": "[Vale.Spelling] Did you really mean 'prodname'?", "location": {"path": "calico-enterprise/getting-started/compatibility.mdx", "range": {"start": {"line": 34, "column": 141}}}, "severity": "ERROR"}

## EKS

Kubernetes version support aligns with [upstream Kubernetes](#kubernetes-kubeadm) to the latest version if available.

| $[prodname] version | $[prodname] support |
| ----------------------- | -------------------------------------------------------------------------------------- |
| 3.18 to current release | - $[prodname] CNI with network policy<br />- AWS CNI with $[prodname] network policy |
| 3.19 to current release | - $[prodname] CNI with network policy<br />- AWS CNI with $[prodname] network policy |

Check failure on line 42 in calico-enterprise/getting-started/compatibility.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'prodname'?

Raw Output:
{"message": "[Vale.Spelling] Did you really mean 'prodname'?", "location": {"path": "calico-enterprise/getting-started/compatibility.mdx", "range": {"start": {"line": 42, "column": 33}}}, "severity": "ERROR"}

Check failure on line 42 in calico-enterprise/getting-started/compatibility.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'prodname'?

Raw Output:
{"message": "[Vale.Spelling] Did you really mean 'prodname'?", "location": {"path": "calico-enterprise/getting-started/compatibility.mdx", "range": {"start": {"line": 42, "column": 89}}}, "severity": "ERROR"}

Check failure on line 42 in calico-enterprise/getting-started/compatibility.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'prodname'?

Raw Output:
{"message": "[Vale.Spelling] Did you really mean 'prodname'?", "location": {"path": "calico-enterprise/getting-started/compatibility.mdx", "range": {"start": {"line": 42, "column": 33}}}, "severity": "ERROR"}

Check failure on line 42 in calico-enterprise/getting-started/compatibility.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'prodname'?

Raw Output:
{"message": "[Vale.Spelling] Did you really mean 'prodname'?", "location": {"path": "calico-enterprise/getting-started/compatibility.mdx", "range": {"start": {"line": 42, "column": 89}}}, "severity": "ERROR"}

## GKE

Kubernetes version support aligns with [upstream Kubernetes](#kubernetes-kubeadm) to the latest version if available.

| $[prodname] version | $[prodname] support |
| ----------------------- | ------------------------------------------ |
| 3.18 to current release | - GKE CNI with $[prodname] network policy |
| 3.19 to current release | - GKE CNI with $[prodname] network policy |

Check failure on line 50 in calico-enterprise/getting-started/compatibility.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'prodname'?

Raw Output:
{"message": "[Vale.Spelling] Did you really mean 'prodname'?", "location": {"path": "calico-enterprise/getting-started/compatibility.mdx", "range": {"start": {"line": 50, "column": 46}}}, "severity": "ERROR"}

Check failure on line 50 in calico-enterprise/getting-started/compatibility.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'prodname'?

Raw Output:
{"message": "[Vale.Spelling] Did you really mean 'prodname'?", "location": {"path": "calico-enterprise/getting-started/compatibility.mdx", "range": {"start": {"line": 50, "column": 46}}}, "severity": "ERROR"}

## kOps on AWS

Expand All @@ -56,7 +56,6 @@
| 3.21 | 1.29 - 1.31 | - $[prodname] CNI with network policy<br />- AWS CNI with $[prodname] network policy |
| 3.20 | 1.29 - 1.30 | - $[prodname] CNI with network policy<br />- AWS CNI with $[prodname] network policy |
| 3.19 | 1.28 - 1.29 | - $[prodname] CNI with network policy<br />- AWS CNI with $[prodname] network policy |
| 3.18 | 1.26 - 1.28 | - $[prodname] CNI with network policy<br />- AWS CNI with $[prodname] network policy |

## Kubernetes-kubeadm

Expand All @@ -65,7 +64,6 @@
| 3.21 | 1.29 - 1.31 | $[prodname] CNI with network policy |
| 3.20 | 1.29 - 1.31 | $[prodname] CNI with network policy |
| 3.19 | 1.28 - 1.30 | $[prodname] CNI with network policy |
| 3.18 | 1.26 - 1.28 | $[prodname] CNI with network policy |

## MKE

Expand All @@ -74,7 +72,6 @@
| 3.21 | MKE 3.8 | $[prodname] CNI with network policy | 1.31 |
| 3.20 | MKE 3.8 | $[prodname] CNI with network policy | 1.31 |
| 3.19 | MKE 3.7 | $[prodname] CNI with network policy | 1.27 |
| 3.18 | MKE 3.7 | $[prodname] CNI with network policy | 1.27 |

## OpenShift

Expand All @@ -83,7 +80,6 @@
| 3.21 | 4.16 - 4.17 | $[prodname] CNI with network policy |
| 3.20 | 4.15 - 4.17 | $[prodname] CNI with network policy |
| 3.19 | 4.14 - 4.15 | $[prodname] CNI with network policy |
| 3.18 | 4.12 - 4.14 | $[prodname] CNI with network policy |

## RKE

Expand All @@ -92,7 +88,6 @@
| 3.21 | 1.7 | $[prodname] CNI with network policy | 1.31 |
| 3.20 | 1.7 | $[prodname] CNI with network policy | 1.31 |
| 3.19 | 1.5 | $[prodname] CNI with network policy | 1.28 |
| 3.18 | 1.4 | $[prodname] CNI with network policy | 1.26 |

## RKE2

Expand All @@ -101,15 +96,6 @@
| 3.21 | $[prodname] CNI with network policy | 1.29 - 1.31 |
| 3.20 | $[prodname] CNI with network policy | 1.29 - 1.31 |
| 3.19 | $[prodname] CNI with network policy | 1.28 - 1.30 |
| 3.18 | $[prodname] CNI with network policy | 1.26 - 1.28 |

## TKG

| $[prodname] version | TKG version | $[prodname] support | Kubernetes versions |
| -------------------- | ----------- | ------------------------------------ | ------------------- |
| 3.20 | 2.4 | $[prodname] CNI with network policy | 1.27 |
| 3.19 | 2.4 | $[prodname] CNI with network policy | 1.27 |
| 3.18 | 2.4 | $[prodname] CNI with network policy | 1.27 |

## Supported browsers

Expand Down
8 changes: 7 additions & 1 deletion calico-enterprise_versioned_docs/version-3.20-2/releases.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,9 @@
"image": "tigera/dex",
"version": "v3.20.1"
},
"coreos-dex": {
"version": "v2.41.1"
},
"fluentd": {
"image": "tigera/fluentd",
"version": "v3.20.1"
Expand All @@ -71,6 +74,9 @@
"image": "tigera/fluentd-windows",
"version": "v3.20.1"
},
"coreos-fluentd": {
"version": "1.17.1"
},
"es-proxy": {
"image": "tigera/es-proxy",
"version": "v3.20.1"
Expand Down Expand Up @@ -1015,4 +1021,4 @@
}
}
}
]
]
20 changes: 3 additions & 17 deletions calico-enterprise_versioned_docs/version-3.21-1/getting-started/compatibility.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,23 +31,23 @@

| $[prodname] version | $[prodname] support |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| 3.18 to current release | - $[prodname] CNI with network policy<br />- Azure CNI with $[prodname] network policy <br />- Azure CNI with $[prodname] network policy |
| 3.19 to current release | - $[prodname] CNI with network policy<br />- Azure CNI with $[prodname] network policy <br />- Azure CNI with $[prodname] network policy |

Check failure on line 34 in calico-enterprise_versioned_docs/version-3.21-1/getting-started/compatibility.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'prodname'?

Raw Output:
{"message": "[Vale.Spelling] Did you really mean 'prodname'?", "location": {"path": "calico-enterprise_versioned_docs/version-3.21-1/getting-started/compatibility.mdx", "range": {"start": {"line": 34, "column": 33}}}, "severity": "ERROR"}

Check failure on line 34 in calico-enterprise_versioned_docs/version-3.21-1/getting-started/compatibility.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'prodname'?

Raw Output:
{"message": "[Vale.Spelling] Did you really mean 'prodname'?", "location": {"path": "calico-enterprise_versioned_docs/version-3.21-1/getting-started/compatibility.mdx", "range": {"start": {"line": 34, "column": 91}}}, "severity": "ERROR"}

Check failure on line 34 in calico-enterprise_versioned_docs/version-3.21-1/getting-started/compatibility.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'prodname'?

Raw Output:
{"message": "[Vale.Spelling] Did you really mean 'prodname'?", "location": {"path": "calico-enterprise_versioned_docs/version-3.21-1/getting-started/compatibility.mdx", "range": {"start": {"line": 34, "column": 141}}}, "severity": "ERROR"}

Check failure on line 34 in calico-enterprise_versioned_docs/version-3.21-1/getting-started/compatibility.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'prodname'?

Raw Output:
{"message": "[Vale.Spelling] Did you really mean 'prodname'?", "location": {"path": "calico-enterprise_versioned_docs/version-3.21-1/getting-started/compatibility.mdx", "range": {"start": {"line": 34, "column": 33}}}, "severity": "ERROR"}

Check failure on line 34 in calico-enterprise_versioned_docs/version-3.21-1/getting-started/compatibility.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'prodname'?

Raw Output:
{"message": "[Vale.Spelling] Did you really mean 'prodname'?", "location": {"path": "calico-enterprise_versioned_docs/version-3.21-1/getting-started/compatibility.mdx", "range": {"start": {"line": 34, "column": 91}}}, "severity": "ERROR"}

Check failure on line 34 in calico-enterprise_versioned_docs/version-3.21-1/getting-started/compatibility.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'prodname'?

Raw Output:
{"message": "[Vale.Spelling] Did you really mean 'prodname'?", "location": {"path": "calico-enterprise_versioned_docs/version-3.21-1/getting-started/compatibility.mdx", "range": {"start": {"line": 34, "column": 141}}}, "severity": "ERROR"}

## EKS

Kubernetes version support aligns with [upstream Kubernetes](#kubernetes-kubeadm) to the latest version if available.

| $[prodname] version | $[prodname] support |
| ----------------------- | -------------------------------------------------------------------------------------- |
| 3.18 to current release | - $[prodname] CNI with network policy<br />- AWS CNI with $[prodname] network policy |
| 3.19 to current release | - $[prodname] CNI with network policy<br />- AWS CNI with $[prodname] network policy |

## GKE

Kubernetes version support aligns with [upstream Kubernetes](#kubernetes-kubeadm) to the latest version if available.

| $[prodname] version | $[prodname] support |
| ----------------------- | ------------------------------------------ |
| 3.18 to current release | - GKE CNI with $[prodname] network policy |
| 3.19 to current release | - GKE CNI with $[prodname] network policy |

## kOps on AWS

Expand All @@ -56,7 +56,6 @@
| 3.21 | 1.29 - 1.31 | - $[prodname] CNI with network policy<br />- AWS CNI with $[prodname] network policy |
| 3.20 | 1.29 - 1.30 | - $[prodname] CNI with network policy<br />- AWS CNI with $[prodname] network policy |
| 3.19 | 1.28 - 1.29 | - $[prodname] CNI with network policy<br />- AWS CNI with $[prodname] network policy |
| 3.18 | 1.26 - 1.28 | - $[prodname] CNI with network policy<br />- AWS CNI with $[prodname] network policy |

## Kubernetes-kubeadm

Expand All @@ -65,7 +64,6 @@
| 3.21 | 1.29 - 1.31 | $[prodname] CNI with network policy |
| 3.20 | 1.29 - 1.31 | $[prodname] CNI with network policy |
| 3.19 | 1.28 - 1.30 | $[prodname] CNI with network policy |
| 3.18 | 1.26 - 1.28 | $[prodname] CNI with network policy |

## MKE

Expand All @@ -74,7 +72,6 @@
| 3.21 | MKE 3.8 | $[prodname] CNI with network policy | 1.31 |
| 3.20 | MKE 3.8 | $[prodname] CNI with network policy | 1.31 |
| 3.19 | MKE 3.7 | $[prodname] CNI with network policy | 1.27 |
| 3.18 | MKE 3.7 | $[prodname] CNI with network policy | 1.27 |

## OpenShift

Expand All @@ -83,7 +80,6 @@
| 3.21 | 4.16 - 4.17 | $[prodname] CNI with network policy |
| 3.20 | 4.15 - 4.17 | $[prodname] CNI with network policy |
| 3.19 | 4.14 - 4.15 | $[prodname] CNI with network policy |
| 3.18 | 4.12 - 4.14 | $[prodname] CNI with network policy |

## RKE

Expand All @@ -92,7 +88,6 @@
| 3.21 | 1.7 | $[prodname] CNI with network policy | 1.31 |
| 3.20 | 1.7 | $[prodname] CNI with network policy | 1.31 |
| 3.19 | 1.5 | $[prodname] CNI with network policy | 1.28 |
| 3.18 | 1.4 | $[prodname] CNI with network policy | 1.26 |

## RKE2

Expand All @@ -101,15 +96,6 @@
| 3.21 | $[prodname] CNI with network policy | 1.29 - 1.31 |
| 3.20 | $[prodname] CNI with network policy | 1.29 - 1.31 |
| 3.19 | $[prodname] CNI with network policy | 1.28 - 1.30 |
| 3.18 | $[prodname] CNI with network policy | 1.26 - 1.28 |

## TKG

| $[prodname] version | TKG version | $[prodname] support | Kubernetes versions |
| -------------------- | ----------- | ------------------------------------ | ------------------- |
| 3.20 | 2.4 | $[prodname] CNI with network policy | 1.27 |
| 3.19 | 2.4 | $[prodname] CNI with network policy | 1.27 |
| 3.18 | 2.4 | $[prodname] CNI with network policy | 1.27 |

## Supported browsers

Expand Down
2 changes: 1 addition & 1 deletion calico-enterprise_versioned_docs/version-3.21-1/networking/gateway-api.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
description: Enable support for the Kubernetes Gateway API.
---

# Gateway API
# Configure an ingress gateway

## Big picture

Expand Down
86 changes: 24 additions & 62 deletions calico-enterprise_versioned_docs/version-3.21-1/release-notes/index.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,11 +3,11 @@ description: What's new, and why features provide value for upgrading.
title: Release notes
---

# Calico Enterprise 3.19 release notes
# Calico Enterprise 3.21 release notes

:::info early preview release

Calico Enterprise 3.19 can be used for previewing and testing purposes only.
Calico Enterprise 3.21 can be used for previewing and testing purposes only.
It is not supported for use in production.

:::
Expand All @@ -16,80 +16,42 @@ Learn about the new features, bug fixes, and other updates in this release of $[

## New features and enhancements

### Improved flow log filtering for destination domains
### Introducing Calico Ingress Gateway (tech-preview)

We’ve updated the Felix parameter (`dest_domains`) for DNS policy to make it easy to find only domain names that the deployment actually connected to (not all the domain names that got translated to the same IP address).
For more information, see [Flow log data types](../visibility/elastic/flow/datatypes.mdx).
$[prodname] now includes the ability to deploy Calico Ingress Gateway which is an Enterprise hardened, 100% upstream distribution of Envoy Gateway.
Envoy Gateway is an implementation of the Kubernetes Gateway API with several extensions that provide advanced security and traffic management features.

### New flow logs panel on Endpoints page
For more information, see [Configure an ingress gateway](../networking/gateway-api.mdx).

We've updated the Endpoints page in the web console with a new flow logs panel so you can view and filter Endpoints associated with denied traffic. Flow log metadata includes the source, destination, ports, protocols, and other key forms. We've also updated the Policy Board to highlight policies with denied traffic.
### IPAM for load balancers

### Improvements to security events dashboard
$[prodname] now extends its IPAM capabilities to support service LoadBalancer IP allocation, providing a centralized, automated approach to managing LoadBalancer IPs within Kubernetes clusters.

We've added the following improvements to the [Security events dashboard](../threat/security-event-management.mdx):
For more information, see [LoadBalancer IP address management](../networking/ipam/service-loadbalancer.mdx)

- Jira and Slack webhook integration for security event alerts
### Enhancements

By [configuring webhooks](../threat/configuring-webhooks.mdx), you can now push alerts from the Security Overview dashboard in the web console to Jira and Slack so incident response and security teams can use native tools to respond to security event alerts.
* **Control-plane label customization for AKS:**
We added support for customizing the namespace labels on AKS clusters.
By default we apply a `control-plane` label to namespaces so that they are exempt from Azure Policy.
If you wish to apply Azure Policy to our namespaces, you can now override this label.

- Added threat feed alerts
* **Log levels for api-server component:**
You can now tune the log level for the API server to better support production deployments and troubleshooting scenarios.

If you have implemented global threat feeds for suspicious activity (domains or suspicious IPs), alerts are now visible in the Security Overview dashboard. For more information on threatfeeds, see [Trace and block suspicious IPs](../threat/suspicious-ips).

### Deprecated and removed features

* The anomaly detection feature was removed in v3.18.1 If anomaly detection is enabled and you upgrade to $[prodname] 3.18, you will stop receiving anomaly detection alerts.
* [Manual install for Windows](../getting-started/install-on-clusters/windows-calico/manual-install/) will be deprecated in a future release. Starting in v3.18.1, the [standard installation is operator-based](../getting-started/install-on-clusters/windows-calico/operator).

## Technology Preview features

- [Web application firewall](../threat/web-application-firewall)

Protect cloud-native applications from application layer attacks.

- [Security events management](../threat/security-event-management)

Get alerts on security events that may indicate a threat is present in your Kubernetes cluster.

- [DNS policy for Windows](../getting-started/install-on-clusters/windows-calico/limitations#dns-policy-limitations)

Use domain names in policies to identify services outside the cluster, which is often operationally simpler and more robust than using IP addresses.

<!-- ## Bug fixes -->

<!-- Follow this template: Problem-Cause-Fix-Result -->

<!--
* Bug 1.
* Bug 2.
-->
<!--
## Security fixes

* Security fix.
-->

## Known issues

* Flow logs for the Windows workloads currently do not display entries with a Deny action.
* Before upgrading a $[prodname] cluster on MKE v3.6 to the latest $[prodname] version: 1) upgrade MKE from 3.6 to 3.7, then 2) upgrade $[prodname].
* L7 logs with source name `pvt` is not visible in Service Graph.
* *Multi-cluster management users only*. If the `manager-tls` and `internal-manager-tls` secrets have overlapping DNS names, components such as `es-calico-kube-controllers` will log certificate errors. If you have previously installed a version older than v3.13.0 and never changed your manager-tls secret from the tigera-operator namespace, you must delete both of these secrets. This applies to you if the following command prints a certificate: `$ kubectl get secret manager-tls -n tigera-operator -o "jsonpath={.data['cert']}"`.
* Upgrading to $[prodname] 3.18.0 on Rancher/RKE from $[prodname] 3.13.0 currently requires manually terminating the calico-node container for an upgrade to proceed.
* Calico panics if kube-proxy or other components are using native `nftables` rules instead of the `iptables-nft` compatibility shim. Until Calico supports native nftables mode, we recommend that you continue to use the iptables-nft compatibility layer for all components. (The compatibility layer was the only option before Kubernetes v1.29 added alpha-level `nftables` support.) Do not run Calico in "legacy" iptables mode on a system that is also using `nftables`. Although this combination does not panic or fail (at least on kernels that support both), the interaction between `iptables` "legacy" mode and `nftables` is confusing: both `iptables` and `nftables` rules can be executed on the same packet, leading to policy verdicts being "overturned".
* Linseed deployment needs to be manually restarted after an upgrade. Without a restart, Linseed can't ingest data because it can't authenticate with Elastic.
* **Clusterrolebindings have reduced privileges:**
Clusterrolebindings for the `tigera-operator`, `calico-kube-controller`, and `calico-prometheus-operator` components have been changed to improve $[prodname]'s least-privileged security model.

## Release details

### Calico Enterprise 3.19.0 (early preview)
### Calico Enterprise 3.21.0-1.0 (early preview)

January xx, 2024
February 11, 2025

Calico Enterprise 3.19.0 is now available as an early preview release.
Calico Enterprise 3.21-1.0 is now available as an early preview release.
This release is for previewing and testing purposes only.
It is not supported for use in production.

<!--
To update an existing installation of Calico Enterprise 3.18, see [Install a patch release](../getting-started/manifest-archive.mdx).
-->
{/*
To update an existing installation of Calico Enterprise 3.21, see [Install a patch release](../getting-started/manifest-archive.mdx).
*/}
Loading
Loading