From c579e494765045f198a427d94b7bb8ea685178d7 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Wed, 19 Aug 2026 15:49:57 +0100 Subject: [PATCH 1/3] Regenerate the 3.22 Installation API reference for operator v1.40.14 The 3.22.7 release notes announce the new spec.cni.specVersion field, but the Installation reference for 3.22 did not document it. Regenerating against the operator version that 3.22.7 ships adds the specVersion row to the CNISpec table and a CNISpecVersion enum section with the Auto, 0.3.1, 0.4.0 and 1.0.0 values. The same run resolves cross-reference links the generator previously left as plain text, for Duration, DSCP, DashboardsJob, Index, TLSPassThroughRoute and TLSTerminatedRoute. Run with make calico-enterprise_versioned_docs/version-3.22-2__operator_reference. Co-Authored-By: Claude Opus 5 (1M context) --- .../reference/installation/_api.mdx | 33 +++++++++++++++---- 1 file changed, 26 insertions(+), 7 deletions(-) diff --git a/calico-enterprise_versioned_docs/version-3.22-2/reference/installation/_api.mdx b/calico-enterprise_versioned_docs/version-3.22-2/reference/installation/_api.mdx index 58c8af5259..3953c9b858 100644 --- a/calico-enterprise_versioned_docs/version-3.22-2/reference/installation/_api.mdx +++ b/calico-enterprise_versioned_docs/version-3.22-2/reference/installation/_api.mdx @@ -610,10 +610,29 @@ _Appears in:_ | --- | --- | | `type` _[CNIPluginType](#cniplugintype)_ | Specifies the CNI plugin that will be used in the Calico or Calico Enterprise installation. * For KubernetesProvider GKE, this field defaults to GKE. * For KubernetesProvider AKS, this field defaults to AzureVNET. * For KubernetesProvider EKS, this field defaults to AmazonVPC. * If aws-node daemonset exists in kube-system when the Installation resource is created, this field defaults to AmazonVPC. * For all other cases this field defaults to Calico. For the value Calico, the CNI plugin binaries and CNI config will be installed as part of deployment, for all other values the CNI plugin binaries and CNI config is a dependency that is expected to be installed separately.
Default: Calico | | `ipam` _[IPAMSpec](#ipamspec)_ | (Optional) IPAM specifies the pod IP address management that will be used in the Calico or Calico Enterprise installation. | +| `specVersion` _[CNISpecVersion](#cnispecversion)_ | (Optional) SpecVersion configures the CNI specification version declared in the CNI configuration ("cniVersion") that the operator generates. Auto (the default) lets the operator choose an appropriate version, which may increase across operator upgrades. Pin an explicit version if a chained CNI plugin or container runtime in your environment requires one. Only relevant when using the Calico CNI plugin.
Default: Auto | | `binDir` _string_ | (Optional) BinDir is the path to the CNI binaries directory. If you have changed the installation directory for CNI binaries in the container runtime configuration, please ensure that this field points to the same directory as specified in the container runtime settings. Default directory depends on the KubernetesProvider. * For KubernetesProvider GKE, this field defaults to "/home/kubernetes/bin". * For KubernetesProvider OpenShift, this field defaults to "/var/lib/cni/bin". * Otherwise, this field defaults to "/opt/cni/bin". | | `confDir` _string_ | (Optional) ConfDir is the path to the CNI config directory. If you have changed the installation directory for CNI configuration in the container runtime configuration, please ensure that this field points to the same directory as specified in the container runtime settings. Default directory depends on the KubernetesProvider. * For KubernetesProvider GKE, this field defaults to "/etc/cni/net.d". * For KubernetesProvider OpenShift, this field defaults to "/var/run/multus/cni/net.d". * Otherwise, this field defaults to "/etc/cni/net.d". | +### CNISpecVersion + +_Underlying type:_ _string_ + +CNISpecVersion is the version of the CNI specification declared in the +CNI configuration generated by the operator. + +_Appears in:_ +- [CNISpec](#cnispec) + +| Value | Description | +| --- | --- | +| `Auto` | CNISpecVersionAuto lets the operator choose the CNI spec version. The chosen version may be raised in future operator versions as older container runtimes fall out of support. | +| `0.3.1` | | +| `0.4.0` | | +| `1.0.0` | | + + ### CRDManagement _Underlying type:_ _string_ @@ -1777,7 +1796,7 @@ _Appears in:_ DashboardsJobSpec defines configuration for the Dashboards job. _Appears in:_ -- DashboardsJob +- [DashboardsJob](#dashboardsjob) | Field | Description | | --- | --- | @@ -1795,7 +1814,7 @@ _Validation:_ _Appears in:_ -- Index +- [Index](#index) | Value | Description | | --- | --- | @@ -2508,8 +2527,8 @@ _Appears in:_ | --- | --- | | `params` _object (keys:string, values:string array)_ | Optional HTTP URL parameters
Default: scrape all metrics. | | `bearerTokenSecret` _[SecretKeySelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#secretkeyselector-v1-core)_ | Secret to mount to read bearer token for scraping targets. Recommended: when unset, the operator will create a Secret, a ClusterRole and a ClusterRoleBinding. | -| `interval` _Duration_ | Interval at which metrics should be scraped. If not specified Prometheus' global scrape interval is used. | -| `scrapeTimeout` _Duration_ | Timeout after which the scrape is ended. If not specified, the Prometheus global scrape timeout is used unless it is less than `Interval` in which the latter is used. | +| `interval` _[Duration](#duration)_ | Interval at which metrics should be scraped. If not specified Prometheus' global scrape interval is used. | +| `scrapeTimeout` _[Duration](#duration)_ | Timeout after which the scrape is ended. If not specified, the Prometheus global scrape timeout is used unless it is less than `Interval` in which the latter is used. | | `honorLabels` _boolean_ | HonorLabels chooses the metric's labels on collisions with target labels. | | `honorTimestamps` _boolean_ | HonorTimestamps controls whether Prometheus respects the timestamps present in scraped data. | | `metricRelabelings` _RelabelConfig array_ | MetricRelabelConfigs to apply to samples before ingestion. | @@ -3887,7 +3906,7 @@ _Appears in:_ | `istiod` _[IstiodDeployment](#istioddeployment)_ | (Optional) IstiodDeployment defines the resource requirements and node selector for the Istio deployment. | | `istioCNI` _[IstioCNIDaemonset](#istiocnidaemonset)_ | (Optional) IstioCNIDaemonset defines the resource requirements for the Istio CNI plugin. | | `ztunnel` _[ZTunnelDaemonset](#ztunneldaemonset)_ | (Optional) ZTunnelDaemonset defines the resource requirements for the ZTunnelDaemonset component. | -| `dscpMark` _DSCP_ | (Optional) DSCPMark define the value of the DSCP mark done by Felix and recognised by Istio CNI for Transparent NetworkPolicies. | +| `dscpMark` _[DSCP](#dscp)_ | (Optional) DSCPMark define the value of the DSCP mark done by Felix and recognised by Istio CNI for Transparent NetworkPolicies. | ### IstioStatus @@ -5746,7 +5765,7 @@ _Appears in:_ _Appears in:_ -- TLSPassThroughRoute +- [TLSPassThroughRoute](#tlspassthroughroute) | Field | Description | | --- | --- | @@ -5764,7 +5783,7 @@ _Appears in:_ _Appears in:_ -- TLSTerminatedRoute +- [TLSTerminatedRoute](#tlsterminatedroute) | Field | Description | | --- | --- | From cae18f72cd18f1c1b1adf2dbe609dbb31d5ab883 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Wed, 19 Aug 2026 15:50:21 +0100 Subject: [PATCH 2/3] Correct the Envoy Gateway version for 3.22.7 third_party/envoy-gateway/Makefile at tag v3.22.7 reads ENVOY_GATEWAY_VERSION = v1.8.3. The Ingress Gateway fix set v1.8.2 on 29 July, then the 3.22.7 CVE round moved it to v1.8.3 on 7 August, so the release note was one bump behind. This applies the reviewer's suggestion. The envoyVersion variable was also stale, and renders on the customize an ingress gateway page as the Envoy Gateway version that custom configuration must be valid for. It was still 1.7.2, which was wrong for 3.22.6 as well, where the shipped version was v1.8.0. Co-Authored-By: Claude Opus 5 (1M context) --- .../version-3.22-2/release-notes/index.mdx | 2 +- calico-enterprise_versioned_docs/version-3.22-2/variables.js | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/calico-enterprise_versioned_docs/version-3.22-2/release-notes/index.mdx b/calico-enterprise_versioned_docs/version-3.22-2/release-notes/index.mdx index 88437e7b00..3d9ac4b0a2 100644 --- a/calico-enterprise_versioned_docs/version-3.22-2/release-notes/index.mdx +++ b/calico-enterprise_versioned_docs/version-3.22-2/release-notes/index.mdx @@ -425,7 +425,7 @@ August 19, 2026 * Fixed Felix's periodic route resync not repairing Calico-owned routes modified in place by another process, unnecessary reprogramming of unchanged IPv6 multi-path routes, and a spurious conntrack cleanup when removing an IPAM block route. * Fixed Calico advertising a Service IP over BGP from a node whose only local endpoint was not Ready, black-holing traffic for services using `externalTrafficPolicy: Local`. * Fixed restarting the `calico-early` container while calico-node was running causing a transient BGP flap that briefly withdrew pod and egress gateway routes. -* Fixed the Calico Ingress Gateway control plane crash-looping on clusters whose Gateway API CRD set omits `ListenerSet`, `TLSRoute`, or `BackendTLSPolicy`, such as OpenShift. The bundled Envoy Gateway is updated to v1.8.2. +* Fixed the Calico Ingress Gateway control plane crash-looping on clusters whose Gateway API CRD set omits `ListenerSet`, `TLSRoute`, or `BackendTLSPolicy`, such as OpenShift. The bundled Envoy Gateway is updated to v1.8.3. * Fixed staged policies whose selectors match NetworkSets with `AllowedEgressDomains` incorrectly reporting deny in flow log pending policies. * Fixed misleading deny verdicts in flow log pending policies when an endpoint was deleted mid-flow. * Fixed Felix dataplane delays under load that could hold up policy programming for new pods: IP set resyncs are now incremental, and the flow log collector's policy re-evaluation is time-boxed so it no longer blocks conntrack and NFLOG processing. diff --git a/calico-enterprise_versioned_docs/version-3.22-2/variables.js b/calico-enterprise_versioned_docs/version-3.22-2/variables.js index 931154aa39..a5c0434a9d 100644 --- a/calico-enterprise_versioned_docs/version-3.22-2/variables.js +++ b/calico-enterprise_versioned_docs/version-3.22-2/variables.js @@ -19,7 +19,7 @@ const variables = { noderunning: 'calico-node', rootDirWindows: 'C:\\TigeraCalico', registry: 'quay.io/', - envoyVersion: '1.7.2', + envoyVersion: '1.8.3', chart_version_name: 'v3.22.7-0', tigeraOperator: releases[0]['tigera-operator'], dikastesVersion: releases[0].components.dikastes.version, From 7142dac8191e87a9bb63422154f962441a897e05 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Wed, 19 Aug 2026 15:53:53 +0100 Subject: [PATCH 3/3] Revert two incorrect version downgrades in the 3.22.0-1.0 entry The historical version corrections in this PR downgraded coreos-alertmanager from v0.28.1 to v0.28.0 and eck-elasticsearch-operator from 2.16.1 to 2.16.0 in the v3.22.0-1.0 entry. Both downgrades were sourced from the release tooling's pinned version template, which lags what the images are actually built from. The third_party Makefiles at tag v3.22.0-1.0 read ALERTMANAGER_VERSION = v0.28.1 and ECK_OPERATOR_VERSION = v2.16.1, so the original values were right. The same tag's calico/_data/versions.yml agrees with the template, but that file is demonstrably stale at release tags: at tag v3.22.6 it records alertmanager v0.28.1 while the Makefile reads v0.32.1, and the release branch has since been corrected to v0.32.1. The other corrections in this PR are confirmed against the Makefiles at their tags and are kept, including alertmanager v0.32.1 and prometheus v3.12.0 for 3.22.6, istio 1.29.2 for 3.22.6, fluentd 1.19.0 for the earlier entries, and Elasticsearch and Kibana 8.18.8 for 3.22.0-2.0. Co-Authored-By: Claude Opus 5 (1M context) --- calico-enterprise_versioned_docs/version-3.22-2/releases.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/calico-enterprise_versioned_docs/version-3.22-2/releases.json b/calico-enterprise_versioned_docs/version-3.22-2/releases.json index ae3f61325f..125b1fa3a0 100644 --- a/calico-enterprise_versioned_docs/version-3.22-2/releases.json +++ b/calico-enterprise_versioned_docs/version-3.22-2/releases.json @@ -2522,7 +2522,7 @@ "image": "tigera/compliance-snapshotter" }, "coreos-alertmanager": { - "version": "v0.28.0" + "version": "v0.28.1" }, "coreos-config-reloader": { "version": "v0.84.0" @@ -2563,7 +2563,7 @@ "version": "8.18.4" }, "eck-elasticsearch-operator": { - "version": "2.16.0" + "version": "2.16.1" }, "eck-kibana": { "version": "8.18.4"