DOCS-2966: Publish Calico Enterprise 3.22.7 - #2917
Merged
Merged
Conversation
✅ Deploy Preview for calico-docs-preview-next ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview succeeded!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
There was a problem hiding this comment.
Pull request overview
Prepares the Calico Enterprise 3.22.7 patch-release documentation (versioned docs for version-3.22-2) by updating release metadata, download/version variables, and adding the new release-notes section stub.
Changes:
- Added a new
v3.22.7entry to the 3.22 release metadata (including Tigera Operatorv1.40.13and component version bumps). - Updated the 3.22 docs variables to point at
v3.22.7artifacts and chart version naming. - Appended a
3.22.7release-notes section (currently with a placeholder bug-fix list).
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| calico-enterprise_versioned_docs/version-3.22-2/variables.js | Bumps displayed release/version strings and download URLs to 3.22.7. |
| calico-enterprise_versioned_docs/version-3.22-2/releases.json | Adds the v3.22.7 release metadata entry at the top of the releases list. |
| calico-enterprise_versioned_docs/version-3.22-2/release-notes/index.mdx | Adds a new 3.22.7 bug-fix release section stub. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+410
to
+412
| #### Bug fixes | ||
|
|
||
| * TBD |
Replaces the TBD bug fix list with the notes for the 20 customer-facing changes in calico-private v3.22.6..v3.22.7 and operator v1.40.13..v1.40.14. Corrects releases.json against operator v1.40.14 enterprise_versions.yml and the calico-private v3.22.7 third-party pins: tigera-operator v1.40.13 -> v1.40.14, the three eck-* pins, and four coreos-* pins. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.
Suppressed comments (1)
calico-enterprise_versioned_docs/version-3.22-2/variables.js:22
- The 3.22.7 release notes state that the bundled Envoy Gateway is updated to v1.8.2, but this versioned-doc variable still pins
envoyVersionto1.7.2. IfenvoyVersionis used to render docs for the bundled Envoy/Envoy Gateway version, it should be updated to match (or renamed/split to distinguish Envoy vs Envoy Gateway so the docs don’t publish conflicting versions).
envoyVersion: '1.7.2',
calico-private release-calient-v3.22 bumped Istio and ztunnel to 1.29.6 (tigera/calico-private#13238). releases.json still carried 1.28.1. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.
Suppressed comments (4)
calico-enterprise_versioned_docs/version-3.22-2/variables.js:22
envoyVersionis still set to1.7.2, but the newly added 3.22.7 release notes explicitly state the bundled Envoy Gateway is updated tov1.8.2. If this variable is used to render the Envoy Gateway version in docs or manifests, it will now be incorrect for 3.22.7. UpdateenvoyVersionto match the 3.22.7 release (or rename/split the variable if it is not meant to track Envoy Gateway).
envoyVersion: '1.7.2',
calico-enterprise_versioned_docs/version-3.22-2/variables.js:5
- These values duplicate the same release identifier in multiple places, which makes patch bumps easy to partially update (e.g., title updated but URL not, or chart version drifting). Consider deriving these fields from a single source of truth (for example
releases[0].title) and computingfilesUrl/chart_version_namefrom it, so future patch updates require fewer manual edits and reduce the chance of mismatches.
releaseTitle: 'v3.22.7',
calico-enterprise_versioned_docs/version-3.22-2/variables.js:11
- These values duplicate the same release identifier in multiple places, which makes patch bumps easy to partially update (e.g., title updated but URL not, or chart version drifting). Consider deriving these fields from a single source of truth (for example
releases[0].title) and computingfilesUrl/chart_version_namefrom it, so future patch updates require fewer manual edits and reduce the chance of mismatches.
filesUrl: 'https://downloads.tigera.io/ee/v3.22.7',
calico-enterprise_versioned_docs/version-3.22-2/variables.js:23
- These values duplicate the same release identifier in multiple places, which makes patch bumps easy to partially update (e.g., title updated but URL not, or chart version drifting). Consider deriving these fields from a single source of truth (for example
releases[0].title) and computingfilesUrl/chart_version_namefrom it, so future patch updates require fewer manual edits and reduce the chance of mismatches.
chart_version_name: 'v3.22.7-0',
Eleven component versions in earlier releases.json entries did not match what those releases shipped. Each correction is corroborated by two sources: the calico-private tag's pinned-version template and, where the key exists there, the operator's config/enterprise_versions.yml at that entry's operator version. v3.22.6 coreos-alertmanager v0.32.0 -> v0.32.1 v3.22.6 coreos-prometheus v3.11.1 -> v3.12.0 v3.22.6 upstream-istio 1.28.1 -> 1.29.2 v3.22.2 coreos-fluentd 1.18.0 -> 1.19.0 v3.22.1 coreos-fluentd 1.18.0 -> 1.19.0 v3.22.0-3.0 coreos-fluentd 1.18.0 -> 1.19.0 v3.22.0-2.0 coreos-fluentd 1.18.0 -> 1.19.0 v3.22.0-2.0 eck-elasticsearch 8.18.4 -> 8.18.8 v3.22.0-2.0 eck-kibana 8.18.4 -> 8.18.8 v3.22.0-1.0 coreos-alertmanager v0.28.1 -> v0.28.0 v3.22.0-1.0 eck-elasticsearch-operator 2.16.1 -> 2.16.0 Four further mismatches are deliberately left alone: eck-elasticsearch and eck-kibana in v3.22.5 (8.19.15) and v3.22.0-3.0 (8.19.8). There the operator agrees with releases.json and only calico-private differs. Since the operator renders the ECK CR, the documented value is the one that was deployed; the disagreement is in those releases, not in these docs. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.
Suppressed comments (4)
calico-enterprise_versioned_docs/version-3.22-2/variables.js:22
envoyVersionremains pinned to1.7.2, but this PR’s 3.22.7 release notes state the bundled Envoy Gateway is updated tov1.8.2. IfenvoyVersionis used to render the Envoy Gateway/Envoy version in these docs, it’s now inconsistent—please update the variable (or split/rename variables) so the rendered docs match the 3.22.7 release notes.
envoyVersion: '1.7.2',
calico-enterprise_versioned_docs/version-3.22-2/releases.json:2525
- These changes downgrade component versions (
v0.28.1→v0.28.0and2.16.1→2.16.0). If this file is used as authoritative release metadata, downgrades are likely incorrect and can mislead operators about what shipped. Please double-check the source-of-truth for these releases and correct the versions (or revert these downgrades) to preserve accurate historical data.
"coreos-alertmanager": {
"version": "v0.28.0"
},
calico-enterprise_versioned_docs/version-3.22-2/releases.json:2566
- These changes downgrade component versions (
v0.28.1→v0.28.0and2.16.1→2.16.0). If this file is used as authoritative release metadata, downgrades are likely incorrect and can mislead operators about what shipped. Please double-check the source-of-truth for these releases and correct the versions (or revert these downgrades) to preserve accurate historical data.
"eck-elasticsearch-operator": {
"version": "2.16.0"
},
calico-enterprise_versioned_docs/version-3.22-2/release-notes/index.mdx:406
- The standalone sentence about a fix being included in 3.22.7 now sits immediately above the dedicated 3.22.7 section, which can read like duplicated or out-of-place content (especially if it belongs to the prior dated entry). Consider moving that sentence into the 3.22.7 section (or rewording it to reference the correct release note entry) to keep the chronology and grouping unambiguous.
A fix is included in Calico Enterprise 3.22.7.
To update an existing installation of Calico Enterprise 3.22, see [Install a patch release](../getting-started/manifest-archive.mdx).
### Calico Enterprise 3.22.7 bug fix release
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
Suppressed comments (3)
calico-enterprise_versioned_docs/version-3.22-2/releases.json:336
- In addition to adding the new
v3.22.7entry, this PR also changes component versions inside existing historical release entries (e.g., thev3.22.6block). That alters the meaning of previously published release metadata and can cause confusion or mismatches with already-released docs/artifacts. If these are intended corrections, consider documenting the correction rationale (e.g., via a comment in the JSON or a short note in release notes), otherwise confine updates to the newly-addedv3.22.7entry.
"coreos-alertmanager": {
"version": "v0.32.1"
},
calico-enterprise_versioned_docs/version-3.22-2/releases.json:348
- In addition to adding the new
v3.22.7entry, this PR also changes component versions inside existing historical release entries (e.g., thev3.22.6block). That alters the meaning of previously published release metadata and can cause confusion or mismatches with already-released docs/artifacts. If these are intended corrections, consider documenting the correction rationale (e.g., via a comment in the JSON or a short note in release notes), otherwise confine updates to the newly-addedv3.22.7entry.
"coreos-prometheus": {
"version": "v3.12.0"
},
calico-enterprise_versioned_docs/version-3.22-2/releases.json:555
- In addition to adding the new
v3.22.7entry, this PR also changes component versions inside existing historical release entries (e.g., thev3.22.6block). That alters the meaning of previously published release metadata and can cause confusion or mismatches with already-released docs/artifacts. If these are intended corrections, consider documenting the correction rationale (e.g., via a comment in the JSON or a short note in release notes), otherwise confine updates to the newly-addedv3.22.7entry.
"upstream-istio": {
"version": "1.29.2"
},
fasaxc
reviewed
Aug 19, 2026
| * Fixed Felix's periodic route resync not repairing Calico-owned routes modified in place by another process, unnecessary reprogramming of unchanged IPv6 multi-path routes, and a spurious conntrack cleanup when removing an IPAM block route. | ||
| * Fixed Calico advertising a Service IP over BGP from a node whose only local endpoint was not Ready, black-holing traffic for services using `externalTrafficPolicy: Local`. | ||
| * Fixed restarting the `calico-early` container while calico-node was running causing a transient BGP flap that briefly withdrew pod and egress gateway routes. | ||
| * Fixed the Calico Ingress Gateway control plane crash-looping on clusters whose Gateway API CRD set omits `ListenerSet`, `TLSRoute`, or `BackendTLSPolicy`, such as OpenShift. The bundled Envoy Gateway is updated to v1.8.2. |
Member
There was a problem hiding this comment.
the shipped version is v1.8.3, not v1.8.2. here's an inline suggestion to fix that.
my pick (c558ec53d) set 1.8.2 on 29 jul, then the v3.22.7 CVE round (f2b5cb3ff, cp#13094) moved it to 1.8.3 on 7 aug. third_party/envoy-gateway/Makefile at tag v3.22.7 reads ENVOY_GATEWAY_VERSION = v1.8.3.
Suggested change
| * Fixed the Calico Ingress Gateway control plane crash-looping on clusters whose Gateway API CRD set omits `ListenerSet`, `TLSRoute`, or `BackendTLSPolicy`, such as OpenShift. The bundled Envoy Gateway is updated to v1.8.2. | |
| * Fixed the Calico Ingress Gateway control plane crash-looping on clusters whose Gateway API CRD set omits `ListenerSet`, `TLSRoute`, or `BackendTLSPolicy`, such as OpenShift. The bundled Envoy Gateway is updated to v1.8.3. |
Collaborator
Author
There was a problem hiding this comment.
Thanks, I've added that.
The 3.22.7 release notes announce the new spec.cni.specVersion field, but the Installation reference for 3.22 did not document it. Regenerating against the operator version that 3.22.7 ships adds the specVersion row to the CNISpec table and a CNISpecVersion enum section with the Auto, 0.3.1, 0.4.0 and 1.0.0 values. The same run resolves cross-reference links the generator previously left as plain text, for Duration, DSCP, DashboardsJob, Index, TLSPassThroughRoute and TLSTerminatedRoute. Run with make calico-enterprise_versioned_docs/version-3.22-2__operator_reference. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
third_party/envoy-gateway/Makefile at tag v3.22.7 reads ENVOY_GATEWAY_VERSION = v1.8.3. The Ingress Gateway fix set v1.8.2 on 29 July, then the 3.22.7 CVE round moved it to v1.8.3 on 7 August, so the release note was one bump behind. This applies the reviewer's suggestion. The envoyVersion variable was also stale, and renders on the customize an ingress gateway page as the Envoy Gateway version that custom configuration must be valid for. It was still 1.7.2, which was wrong for 3.22.6 as well, where the shipped version was v1.8.0. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The historical version corrections in this PR downgraded coreos-alertmanager from v0.28.1 to v0.28.0 and eck-elasticsearch-operator from 2.16.1 to 2.16.0 in the v3.22.0-1.0 entry. Both downgrades were sourced from the release tooling's pinned version template, which lags what the images are actually built from. The third_party Makefiles at tag v3.22.0-1.0 read ALERTMANAGER_VERSION = v0.28.1 and ECK_OPERATOR_VERSION = v2.16.1, so the original values were right. The same tag's calico/_data/versions.yml agrees with the template, but that file is demonstrably stale at release tags: at tag v3.22.6 it records alertmanager v0.28.1 while the Makefile reads v0.32.1, and the release branch has since been corrected to v0.32.1. The other corrections in this PR are confirmed against the Makefiles at their tags and are kept, including alertmanager v0.32.1 and prometheus v3.12.0 for 3.22.6, istio 1.29.2 for 3.22.6, fluentd 1.19.0 for the earlier entries, and Elasticsearch and Kibana 8.18.8 for 3.22.0-2.0. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.
Suppressed comments (5)
calico-enterprise_versioned_docs/version-3.22-2/releases.json:336
- The v3.22.6 entry is being modified here (coreos-alertmanager version). For a patch publish PR, previously released metadata should typically remain immutable; otherwise pages that reference 3.22.6 may show incorrect third-party versions. If this is not an intentional historical correction, revert this value back to the prior v3.22.6 version.
"coreos-alertmanager": {
"version": "v0.32.1"
},
calico-enterprise_versioned_docs/version-3.22-2/releases.json:555
- The v3.22.6 entry is being modified here (upstream-istio version). For a patch publish PR, previously released metadata should typically remain immutable; otherwise pages that reference 3.22.6 may show incorrect component versions. If this is not an intentional historical correction, revert this value back to the prior v3.22.6 version.
"upstream-istio": {
"version": "1.29.2"
},
calico-enterprise_versioned_docs/version-3.22-2/releases.json:348
- The v3.22.6 entry is being modified here (coreos-prometheus version). For a patch publish PR, previously released metadata should typically remain immutable; otherwise pages that reference 3.22.6 may show incorrect third-party versions. If this is not an intentional historical correction, revert this value back to the prior v3.22.6 version.
This issue also appears on line 553 of the same file.
"coreos-prometheus": {
"version": "v3.12.0"
},
calico-enterprise_versioned_docs/version-3.22-2/release-notes/index.mdx:409
- This new release notes entry uses an August 19, 2026 date, but the PR description says it is using the August 13 ETA from the ticket. Please confirm which date is correct and align either the PR description or this release note date so the published notes are consistent.
### Calico Enterprise 3.22.7 bug fix release
August 19, 2026
calico-enterprise_versioned_docs/version-3.22-2/reference/installation/_api.mdx:3909
- Grammar: “DSCPMark define” should be “DSCPMark defines”.
| `dscpMark` _[DSCP](#dscp)_ | (Optional) DSCPMark define the value of the DSCP mark done by Felix and recognised by Istio CNI for Transparent NetworkPolicies. |
The Netlify deploy preview for the tigera site fails on the link check with one dead link: https://calicousers.slack.com is dead (403) ==>Origin: http://localhost:4242/calico/latest/reference/involved The skip list already carried this workspace, but as the exact strings https://calicousers.slack.com/ and a channel URL. Entries given as strings are matched exactly, so the bare host on the get involved page was still checked, and Slack returns 403 to datacenter crawlers. Replace both strings with an anchored pattern for the host, which covers the bare host, the trailing slash form and channel links. The 403 is intermittent, so the failure does not reproduce reliably on a local run. This failure is not caused by the 3.22.7 release. Only latest is crawled, and Calico Enterprise latest maps to 3.23, so no page in version-3.22-2 is checked at all. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.
Suppressed comments (4)
calico-enterprise_versioned_docs/version-3.22-2/releases.json:93
- PR description notes the ECK bump is not included in this PR and would be picked up by the third-party pin sync, but this change set already pins ECK (e.g., eck-elasticsearch-operator 3.4.1) for v3.22.7. Please reconcile the PR description with the actual content (or revert these pins if they are not meant to land here).
"eck-elasticsearch": {
"version": "8.19.20"
},
"eck-elasticsearch-operator": {
"version": "3.4.1"
},
calico-enterprise_versioned_docs/version-3.22-2/release-notes/index.mdx:409
- The PR description says this PR uses an August 13 ETA for the release date, but the release notes here list August 19, 2026. Please confirm the intended release date and update either the PR description or the release notes so they match.
### Calico Enterprise 3.22.7 bug fix release
August 19, 2026
calico-enterprise_versioned_docs/version-3.22-2/release-notes/index.mdx:432
- There are two spaces after the period before "The application layer policy daemon", which looks like an accidental extra space.
* Significantly reduced Felix pending policy calculation CPU and allocation overhead when many policies apply to an endpoint. The application layer policy daemon (Dikastes) also benefits.
calico-enterprise_versioned_docs/version-3.22-2/releases.json:555
- This PR changes component pins for already-released entries (for example, v3.22.6 upstream-istio is now 1.29.2, and v3.22.6 also has third-party version bumps earlier in the same entry). If this PR is intended only to add v3.22.7, consider reverting changes to older release entries; otherwise, please call out these retroactive pin changes explicitly in the PR description so reviewers know they are intentional.
"upstream-istio": {
"version": "1.29.2"
},
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Starter PR for the Calico Enterprise 3.22.7 patch release. Sets the version strings in releases.json, variables.js, and the release notes. Tracked by https://tigera.atlassian.net/browse/DOCS-2966.
Still to do:
To discuss: