v1.34.0

10 May 2024

Included Calico versions

Calico version: v3.28.0
Calico Enterprise version: v3.19.0-2.0

Enhancements

• Prototype: IP pool controller #3253 (@caseydavenport)
• IP pool controller for more powerful IP pool UX #2658 (@caseydavenport)

Bug fixes

• Fix autodetection of current RKE2 #3168 (@nelljerram)

Other changes

• Update prometheus operator permissions to v0.73.2 #3338 (@rene-dekker)
• Update ILM policy when warm index readonly setting changes #3336 (@gantony)
• Name Packet capture operator v1 CRD as PacketCaptureAPI #3335 (@vara2504)
• Update ILM policy to keep warm tigera_secure_ee_events indices writable #3330 (@gantony)
• Fix annotation data ordering issues from k8s listing in #3328 (@Brian-McM)
• move packet capture watch inside enterpriseCRD exist check #3324 (@vara2504)
• Rev Go to v1.22, Kubernetes to v1.28.9 #3317 (@fasaxc)
• Fix annotations for voltron tls route configuration (too long #3315 (@Brian-McM)
• Remove cloud-controller references #3312 (@gantony)
• Fix security-context for apiserver - audit logs are supported only in Enterprise version #3310 (@mihivagyok)
• Added Add HSTS header to dex and upgrade to 2.39 #3305 (@vara2504)
• Fix broken policy rec req limit reconcilation #3303 (@vara2504)
• Send the list of all ips to egress gateway to support dual stack #3301 (@mazdakn)
• The dashboard name has changed in the installer repo, change #3297 (@rene-dekker)
• Add egress rule to allow dashboards to connect to external Kibana #3295 (@asincu)
• Remove elastic secrets dependency for compliance and only deploy server in a multi-tenant environment #3289 (@asincu)
• Deprecate AWS SG integeration #3279 (@vara2504)
• Remove special key-cert-provisioner image code #3278 (@rene-dekker)
• Make monitor controller aware that there are multi tenant options #3274 (@asincu)
• Switch the backoff to use Ticker #3273 (@tmjd)
• Move Encapsulation validation into IP pool controller #3268 (@caseydavenport)
• Fix secret not available messages #3263 (@rene-dekker)
• Allow intrusion-detection-controller to read alert exceptions #3257 (@gantony)
• Fix setting of resources for the CSI node driver #3255 (@caseydavenport)
• Add container name in comments for Deployments,daemonset and other resources #3250 (@vara2504)
• Disable keep alive for the elasticsearch client #3238 (@Brian-McM)
• Cleanups based on move from coreruleset 3.3.5 to 4.x #3237 (@electricjesus)
• Remove bpf dual stack validation #3236 (@sridhartigera)
• Update libs to patch CVEs #3232 (@rene-dekker)
• Enable Dashboards Controller to know when running in external or internal elastic mode #3231 (@asincu)
• Grant es-kube-controller access managed service per tenant #3230 (@asincu)
• Make resource requests/limits configurable for tigera-guardian #3225 (@vara2504)
• Make resource requests/limits configurable for KB, prometheus, Alert Manager #3224 (@vara2504)
• Fix features annotations #3222 (@lwr20)
• Make resource requests/limits configurable for Application Layer #3216 (@vara2504)
• Set tenant ID for intrusion detection #3214 (@asincu)
• Update elastic stack versions #3211 (@rene-dekker)
• Update the CRDs #3210 (@rene-dekker)
• Make resource requests/limits configurable for compliance components #3209 (@vara2504)
• Move test utilities to test package from utils folder to move ginkgo v1 import #3208 (@Brian-McM)
• Make resource requests/limits configurable for logstorage components #3207 (@vara2504)
• Make resource requests/limits configurable for Logcollector #3206 (@vara2504)
• Make resource request/limits configurable for dex,IDC #3205 (@vara2504)
• Configure voltron routes with TLS Route CRs #3199 (@Brian-McM)
• Filter 'openshift-' namespace from policy recommendation #3196 (@dimitri-nicolo)
• PolicyRecommendation controller overwrites tigera-ca bundle per tenant #3191 (@asincu)
• Add priorityClassName to EgressGateway CRD #3190 (@mazdakn)
• Fix expected files for waf #3189 (@electricjesus)
• Namespace migration - Fix potential namespace migration problem with one node cluster #3188 (@mihivagyok)
• Adds PolicySetupTimeoutSeconds option to CalicoNetwork #3186 (@aaaaaaaalex)
• Sort logstorage secrets map to ensure consistent order #3185 (@tmjd)
• Remove auth that was not supported since ee v3.4 #3184 (@rene-dekker)
• Enable BPF without disruption #3183 (@song-jiang)
• Add support for TKG 2.4.1 #3179 (@rene-dekker)
• Include Windows nodes in image list command #3177 (@tmjd)
• Decrease the validity of JWTs issued by Dex to 15m #3175 (@rene-dekker)
• Add back esgateway certificate to the trusted bundle #3174 (@asincu)
• Report dashboard status #3173 (@asincu)
• Refactor to set kube network based on cni type instead of provider #3166 (@davidgiga1993)
• Fix static files check failure #3163 (@electricjesus)
• Fixes for ES Gateway #3162 (@tmjd)
• Disable packetcapture-api in multitenant environment #3160 (@vara2504)
• WAF integration fixes / improvements #3158 (@electricjesus)
• Do not ignore non-migrated nodes for typha scheduling #3156 (@mihivagyok)
• Update copyrights #3149 (@Brian-McM)
• Update K8s pins to 0.27.9 and controller-runtime to 0.15.3 / fix incompatibilities #3146 (@Brian-McM)
• Fix the Compliance namespace in Voltron's proxy targets #3145 (@rene-dekker)
• Update envoy config template #3144 (@hjiawei)
• Dex binary changed location inside of Dockerfile #3143 (@rene-dekker)
• Deploy es-kube-controllers in a multi-tenant environment #3142 (@asincu)
• Ensure degraded status is cleared for tiers controller #3139 (@pasanw)
• Migrate job installer to run inside elasticsearch namespace #3137 (@asincu)
• Fix trusted-bundle conflict in ES secret controller #3135 (@caseydavenport)
• Report TigeraStatus for tiers #3130 (@pasanw)
• Fix panic that can be caused when removing the logstorage resource. #3128 (@rene-dekker)
• Add tigera operator scheme to the unit tests for authn. #3127 (@rene-dekker)
• Bump Elasticsearch and Kibana versions to v7.17.16 #3126 (@hjiawei)
• Support zeroed kube-controllers metric port #3120 (@pasanw)
• Consolidate tigera status for all log storage controllers #3118 (@vara2504)
• Webhooks-controller should now be rendered on management clusters. #3115 (@bartolini)
• Automated cherry pick of #3107: Update coreos stack to reduce CVEs #3109 (@rene-dekker)
• Update tigera-apiserver probes #3102 (@pasanw)
• Update golang/x/crypto #3101 (@Behnam-Shobiri)
• Intrusion detection forwarder needs permission to snapshot its state #3096 (@caseydavenport)
• Update CRDs: FelixConfigurations #3094 (@tmjd)
• Fix FLOW_LOG_FILE fluentd env var for Windows #3090 (@coutinhop)
• Fix CNI plugin configuration issue #3087 (@Tamas-Biro1)
• Fix host port validation to properly respect 'disabled' #3085 (@caseydavenport)
• Update CRDs #3083 (@rene-dekker)
• Use common calico base and unify Dockerfiles #3079 (@hjiawei)
• Automated cherry pick of #3072: CSR Image must be instantiated #3073 (@rene-dekker)
• Add extra LDAP secret validation #3069 (@rene-dekker)
• Fix felix crds #3066 (@vara2504)
• Resource config for Manager and PolicyRec #3061 (@vara2504)
• Add design / code guidelines document #3057 (@caseydavenport)
• Fix missing logging arguments for dikastes #3056 (@electricjesus)
• Linseed cluster id is no longer required. #3055 (@bartolini)
• Remove curator #3054 (@Josh-Tigera)
• Linseed misconfiguration for Webhooks in MCM configuration #3053 (@bartolini)
• Add linseedDeployment in Tenant CR #3051 (@vara2504)
• Configure manager to properly impersonate when communicating with managed clusters #3050 (@caseydavenport)
• Update kibanaURL name in tenant CR #3048 (@vara2504)
• Fix kubefwd URL #3043 (@binarysta)
• Configure Linux OS affinity for policy-recommendation #3042 (@vara2504)
• Remove some RBAC resources that are unused in multi-tenant envs #3041 (@caseydavenport)
• Fix release by preventing overwriting IMAGE_REGISTRY #3037 (@rene-dekker)
• Update release documentation to clarify github milestone creation #3036 (@tmjd)
• Change rollout settings for Fluentd to speed up rollout, while avoiding too much contention on huge clusters #3032 (@rene-dekker)
• Allow linseed to read secrets in tigera-operator namespace #3024 (@asincu)