DOCS-2966: Correct the Envoy Gateway version and regenerate the 3.22 Installation API reference

calico-enterprise_versioned_docs/version-3.22-2/reference/installation/_api.mdx

@@ -610,10 +610,29 @@ _Appears in:_
 | --- | --- |
 | `type` _[CNIPluginType](#cniplugintype)_ | Specifies the CNI plugin that will be used in the Calico or Calico Enterprise installation. * For KubernetesProvider GKE, this field defaults to GKE. * For KubernetesProvider AKS, this field defaults to AzureVNET. * For KubernetesProvider EKS, this field defaults to AmazonVPC. * If aws-node daemonset exists in kube-system when the Installation resource is created, this field defaults to AmazonVPC. * For all other cases this field defaults to Calico. For the value Calico, the CNI plugin binaries and CNI config will be installed as part of deployment, for all other values the CNI plugin binaries and CNI config is a dependency that is expected to be installed separately.<br />Default: Calico |
 | `ipam` _[IPAMSpec](#ipamspec)_ | (Optional) IPAM specifies the pod IP address management that will be used in the Calico or Calico Enterprise installation. |
+| `specVersion` _[CNISpecVersion](#cnispecversion)_ | (Optional) SpecVersion configures the CNI specification version declared in the CNI configuration ("cniVersion") that the operator generates. Auto (the default) lets the operator choose an appropriate version, which may increase across operator upgrades. Pin an explicit version if a chained CNI plugin or container runtime in your environment requires one. Only relevant when using the Calico CNI plugin.<br />Default: Auto |
 | `binDir` _string_ | (Optional) BinDir is the path to the CNI binaries directory. If you have changed the installation directory for CNI binaries in the container runtime configuration, please ensure that this field points to the same directory as specified in the container runtime settings. Default directory depends on the KubernetesProvider. * For KubernetesProvider GKE, this field defaults to "/home/kubernetes/bin". * For KubernetesProvider OpenShift, this field defaults to "/var/lib/cni/bin". * Otherwise, this field defaults to "/opt/cni/bin". |
 | `confDir` _string_ | (Optional) ConfDir is the path to the CNI config directory. If you have changed the installation directory for CNI configuration in the container runtime configuration, please ensure that this field points to the same directory as specified in the container runtime settings. Default directory depends on the KubernetesProvider. * For KubernetesProvider GKE, this field defaults to "/etc/cni/net.d". * For KubernetesProvider OpenShift, this field defaults to "/var/run/multus/cni/net.d". * Otherwise, this field defaults to "/etc/cni/net.d". |
 
 
+### CNISpecVersion
+
+_Underlying type:_ _string_
+
+CNISpecVersion is the version of the CNI specification declared in the
+CNI configuration generated by the operator.
+
+_Appears in:_
+- [CNISpec](#cnispec)
+
+| Value | Description |
+| --- | --- |
+| `Auto` | CNISpecVersionAuto lets the operator choose the CNI spec version. The chosen version may be raised in future operator versions as older container runtimes fall out of support.  |
+| `0.3.1` |  |
+| `0.4.0` |  |
+| `1.0.0` |  |
+
+
 ### CRDManagement
 
 _Underlying type:_ _string_
@@ -1777,7 +1796,7 @@ _Appears in:_
 DashboardsJobSpec defines configuration for the Dashboards job.
 
 _Appears in:_
-- DashboardsJob
+- [DashboardsJob](#dashboardsjob)
 
 | Field | Description |
 | --- | --- |
@@ -1795,7 +1814,7 @@ _Validation:_
 
 
 _Appears in:_
-- Index
+- [Index](#index)
 
 | Value | Description |
 | --- | --- |
@@ -2508,8 +2527,8 @@ _Appears in:_
 | --- | --- |
 | `params` _object (keys:string, values:string array)_ | Optional HTTP URL parameters<br />Default: scrape all metrics. |
 | `bearerTokenSecret` _[SecretKeySelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#secretkeyselector-v1-core)_ | Secret to mount to read bearer token for scraping targets. Recommended: when unset, the operator will create a Secret, a ClusterRole and a ClusterRoleBinding. |
-| `interval` _Duration_ | Interval at which metrics should be scraped. If not specified Prometheus' global scrape interval is used. |
-| `scrapeTimeout` _Duration_ | Timeout after which the scrape is ended. If not specified, the Prometheus global scrape timeout is used unless it is less than `Interval` in which the latter is used. |
+| `interval` _[Duration](#duration)_ | Interval at which metrics should be scraped. If not specified Prometheus' global scrape interval is used. |
+| `scrapeTimeout` _[Duration](#duration)_ | Timeout after which the scrape is ended. If not specified, the Prometheus global scrape timeout is used unless it is less than `Interval` in which the latter is used. |
 | `honorLabels` _boolean_ | HonorLabels chooses the metric's labels on collisions with target labels. |
 | `honorTimestamps` _boolean_ | HonorTimestamps controls whether Prometheus respects the timestamps present in scraped data. |
 | `metricRelabelings` _RelabelConfig array_ | MetricRelabelConfigs to apply to samples before ingestion. |
@@ -3887,7 +3906,7 @@ _Appears in:_
 | `istiod` _[IstiodDeployment](#istioddeployment)_ | (Optional) IstiodDeployment defines the resource requirements and node selector for the Istio deployment. |
 | `istioCNI` _[IstioCNIDaemonset](#istiocnidaemonset)_ | (Optional) IstioCNIDaemonset defines the resource requirements for the Istio CNI plugin. |
 | `ztunnel` _[ZTunnelDaemonset](#ztunneldaemonset)_ | (Optional) ZTunnelDaemonset defines the resource requirements for the ZTunnelDaemonset component. |
-| `dscpMark` _DSCP_ | (Optional) DSCPMark define the value of the DSCP mark done by Felix and recognised by Istio CNI for Transparent NetworkPolicies. |
+| `dscpMark` _[DSCP](#dscp)_ | (Optional) DSCPMark define the value of the DSCP mark done by Felix and recognised by Istio CNI for Transparent NetworkPolicies. |
 
 
 ### IstioStatus
@@ -5746,7 +5765,7 @@ _Appears in:_
 
 
 _Appears in:_
-- TLSPassThroughRoute
+- [TLSPassThroughRoute](#tlspassthroughroute)
 
 | Field | Description |
 | --- | --- |
@@ -5764,7 +5783,7 @@ _Appears in:_
 
 
 _Appears in:_
-- TLSTerminatedRoute
+- [TLSTerminatedRoute](#tlsterminatedroute)
 
 | Field | Description |
 | --- | --- |

calico-enterprise_versioned_docs/version-3.22-2/release-notes/index.mdx

@@ -425,7 +425,7 @@ August 19, 2026
 * Fixed Felix's periodic route resync not repairing Calico-owned routes modified in place by another process, unnecessary reprogramming of unchanged IPv6 multi-path routes, and a spurious conntrack cleanup when removing an IPAM block route.
 * Fixed Calico advertising a Service IP over BGP from a node whose only local endpoint was not Ready, black-holing traffic for services using `externalTrafficPolicy: Local`.
 * Fixed restarting the `calico-early` container while calico-node was running causing a transient BGP flap that briefly withdrew pod and egress gateway routes.
-* Fixed the Calico Ingress Gateway control plane crash-looping on clusters whose Gateway API CRD set omits `ListenerSet`, `TLSRoute`, or `BackendTLSPolicy`, such as OpenShift. The bundled Envoy Gateway is updated to v1.8.2.
+* Fixed the Calico Ingress Gateway control plane crash-looping on clusters whose Gateway API CRD set omits `ListenerSet`, `TLSRoute`, or `BackendTLSPolicy`, such as OpenShift. The bundled Envoy Gateway is updated to v1.8.3.
 * Fixed staged policies whose selectors match NetworkSets with `AllowedEgressDomains` incorrectly reporting deny in flow log pending policies.
 * Fixed misleading deny verdicts in flow log pending policies when an endpoint was deleted mid-flow.
 * Fixed Felix dataplane delays under load that could hold up policy programming for new pods: IP set resyncs are now incremental, and the flow log collector's policy re-evaluation is time-boxed so it no longer blocks conntrack and NFLOG processing.

calico-enterprise_versioned_docs/version-3.22-2/releases.json

@@ -2522,7 +2522,7 @@
         "image": "tigera/compliance-snapshotter"
       },
       "coreos-alertmanager": {
-        "version": "v0.28.0"
+        "version": "v0.28.1"
       },
       "coreos-config-reloader": {
         "version": "v0.84.0"
@@ -2563,7 +2563,7 @@
         "version": "8.18.4"
       },
       "eck-elasticsearch-operator": {
-        "version": "2.16.0"
+        "version": "2.16.1"
       },
       "eck-kibana": {
         "version": "8.18.4"

calico-enterprise_versioned_docs/version-3.22-2/variables.js

@@ -19,7 +19,7 @@ const variables = {
   noderunning: 'calico-node',
   rootDirWindows: 'C:\\TigeraCalico',
   registry: 'quay.io/',
-  envoyVersion: '1.7.2',
+  envoyVersion: '1.8.3',
   chart_version_name: 'v3.22.7-0',
   tigeraOperator: releases[0]['tigera-operator'],
   dikastesVersion: releases[0].components.dikastes.version,