v1.32.8

26 Apr 2024

Included Calico versions

Calico version: v3.27.3
Calico Enterprise version: v3.18.3

Other changes

• Update to golang 1.21.9 via go-build bump to v0.89 #3326 (@rene-dekker)
• Update dependencies #3321 (@Behnam-Shobiri)
• Send the list of all ips to egress gateway to support dual stack #3300 (@mazdakn)

v1.32.7

01 Apr 2024

Included Calico versions

Calico version: v3.27.3
Calico Enterprise version: v3.18.2

Bug fixes

• Fix security-context for apiserver - audit logs are supported only in Enterprise version #2906 (@mihivagyok) this was incorrectly included as fixed in this release but the change was not included

v1.32.6

25 Mar 2024

Included Calico versions

Calico version: v3.27.2
Calico Enterprise version: v3.18.2

Other changes

• Add priorityClassName to EgressGateway CRD #3197/#3246 (@mazdakn / @sridhartigera)
• Disable keep alive for the elasticsearch client #3239 (@Brian-McM)
• Update libs to patch CVEs #3234 (@rene-dekker)
• Decrease the validity of JWTs issued by Dex to 15m #3220 (@rene-dekker)
• Voltron and/or es-proxy should have kibana's certificate in the bundle #3217 (@rene-dekker)
• Update Elasticsearch to use 7.17.18 #3213 (@rene-dekker)
• Filter 'openshift-' namespace from policy reccommendation #3201 (@dimitri-nicolo)
• Add support for TKG 2.4.1 #3180 (@rene-dekker)

v1.30.10

14 Mar 2024

Included Calico versions

Calico version: v3.26.4
Calico Enterprise version: v3.17.4

Other changes

• Decrease the validity of JWTs issued by dex to 15m #3219 (@rene-dekker)
• Update elastic stack to 7.17.18 #3212 (@rene-dekker)
• Filter 'openshift-' namespace from policy rec #3203 (@dimitri-nicolo)
• Add priorityClassName to EgressGateway CRD #3194 (@sridhartigera)
• Support zeroed kube-controllers metric port #3131 (@pasanw)
• Configure Linux OS affinity for policy-recommendation #3046 #3047 (@vara2504)
• Add Linseed RBAC,envvars for eks log forwarding #3039 (@vara2504)

v1.32.5

17 Feb 2024

Included Calico versions

Calico version: v3.27.2
Calico Enterprise version: v3.18.1

Enhancements

• Support zeroed kube-controllers metric port #3133 (@pasanw)

Bug Fixes

• Fix autodetection of current RKE2 #3170 (@nelljerram)

v1.33.0

31 Jan 2024

Included Calico versions

Calico version: v3.27.0
Calico Enterprise version: v3.19.0-1.0

Other changes

• Fix panic that can be caused when removing the logstorage #3129 (@rene-dekker)
• Fix unset linseed url. When missing, clusters with #3122 (@rene-dekker)
• Webhooks-controller should now be rendered on management clusters. #3117 (@bartolini)
• Fix unset linseed url. When missing, clusters with clusterDomain set … #3116 (@rene-dekker)
• run make gen-versions #3108 (@rene-dekker)
• Update coreos stack to reduce CVEs #3107 (@rene-dekker)
• Webhooks should be able to watch config maps and secrets for changes. #3106 (@bartolini)
• Set tenant claim to be the id of the tenant (#3093) #3104 (@asincu)
• Update golang/x/crypto #3100 (@Behnam-Shobiri)
• Set tenant claim to be the id of the tenant #3093 (@asincu)
• Webhooks should be able to watch config maps and secrets for changes. #3092 (@bartolini)
• Avoid endless reconcile loop when image pull secrets are #3084 (@rene-dekker)
• Only watch the monitor CR if the CRD exists. #3082 (@rene-dekker)
• Only watch the monitor CR if the CRD exists. #3081 (@rene-dekker)
• WAF: Revert change from modsecurity to coraza engine #3080 (@mikestephen)
• Break infinite reconciliation loop #3075 (@rene-dekker)
• CSR Image must be instantiated #3072 (@rene-dekker)
• Make gen-files #3070 (@rene-dekker)
• Fix issue where controller is watching a secret that is never #3068 (@rene-dekker)
• Fix issue where controller is watching a secret that is never created #3067 (@rene-dekker)
• Ev 4104 csr controller (#3010) #3065 (@rene-dekker)
• Feature external monitoring #3063 (@rene-dekker)
• PolicyRecommendation needs to access resource within a tenant namespa… #3062 (@asincu)
• fix: missing logging arguments for dikastes #3058 (@electricjesus)
• PolicyRecommendation needs to access resource within a tenant namespace #3052 (@asincu)

v1.32.4

18 Jan 2024

Included Calico versions

Calico version: v3.27.0
Calico Enterprise version: v3.18.1

Other changes

• Fix unset linseed url #3123 (@rene-dekker)
• Update coreos stack to reduce CVEs #3110 (@rene-dekker)
• Update base image and crypto #3099 (@Behnam-Shobiri)

v1.32.3

15 Dec 2023

Included Calico versions

Calico version: v3.27.0
Calico Enterprise version: v3.18.0-2.0

Enhancements

• [Calico Enterprise] Update CoreRuleset payload for dikastes' new WAF engine #2991 (@electricjesus)

Other changes

• Configure Linux OS affinity for policy-recommendation #3046 (@vara2504)
• Add Linseed RBAC,envvars for eks log forwarding #3040 (@vara2504)
• Allow configuration of replicas per-tenant #3033 (@vara2504)
• Added new controller to the operator that can sign CertificateSigningRequests for select TLS assets #3010 (@rene-dekker)
• [Calico Enterprise] Remove usage of ES ConfigMap and PublicCertSecret #2954 (@Josh-Tigera)
• Clean up network policies watches #2888 (@asincu)

v1.32.2

04 Dec 2023

Included Calico versions

Calico Enterprise version: v3.18.0-2.0

Bug Fixes

• Delete Rolebind from toDelete objects (#3028) #3029 (@asincu)

v1.32.1

01 Dec 2023

Included Calico versions

Calico Enterprise version: v3.18.0-2.0

Note: Operator v1.32.0 was never released due to a CI issue, and Operator v1.32.1 is being released to resolve this issue. Thus, the below release notes cover the release which would have been v1.32.0. No changes were introduced in v1.32.1 beyond the CI resolution, which is documented in PR #3034.

Enhancements

• [Calico Enterprise] Add some common content-types expected in micro-service traffic #2839 (@peterkellydev)

Other changes

• Fix! Delete Rolebind from toDelete objects #3028 (@asincu)
• [cherry-pick][1.32] Allow linseed to read secrets in tigera-operator namespace (#3024) #3027 (@asincu)
• Change rollout settings for Fluentd to speed up rollout. #3026 (@rene-dekker)
• [cherry-pick][v.32] Allow linseed to query managed clusters and set REQUIRE_TENANT_CLAIM #3025 (@asincu)
• Allow linseed to read secrets in tigera-operator namespace #3024 (@asincu)
• Enable REQUIRE_TENANT_CLAIM check for all multi-tenancy setups #3023 (@asincu)
• Allow get managed clusters for a cluster id for tigera-linseed using … #3020 (@asincu)
• A few minor cleanups #3019 (@caseydavenport)
• [RS-1431] Allow tigera-network-admin to create secrets #3017 (@gantony)
• Fix push-manifests Makefile target #3015 (@hjiawei)
• [RS-1431] Allow UI admin user to create and patch webhooks-secret #3014 (@gantony)
• Bump calico/go-build to v0.90 #3013 (@hjiawei)
• [RS-1379] RBAC for securityevernwebhooks for the UI. #3009 (@bartolini)
• Additional external ES changes #3008 (@caseydavenport)
• [cherry-pick][1.32] Enable OIDC for multi-tenant setup (#2989) #3006 (@asincu)
• Cherry-pick ebpf ipv6 #3005 (@sridhartigera)
• Automated cherry pick of #2994: Allow operations on felixconfigurations in tigera #3003 (@rene-dekker)
• Update base image and dependencies #3001 (@Behnam-Shobiri)
• [RS-1446] - Cherry pick delete permission for WAF UI #3000 (@mikestephen)
• [RS-1446] - WAF UI needs permission to delete applicationlayers resources #2999 (@mikestephen)
• Pick to v1.32 [EV-4356] createPredicateForObject should react if the generation isn't set #2998 (@electricjesus)
• Allow operations on felixconfigurations in tigera clusterroles in ord… #2994 (@rene-dekker)
• [release-v1.32] Auto pick #2990: Use trusted bundle with root CAs for multi-tenant manager #2993 (@caseydavenport)
• [EV-4356] createPredicateForObject should react if the generation isn… #2992 (@dimitri-nicolo)
• Use trusted bundle with root CAs for multi-tenant manager pods #2990 (@caseydavenport)
• Enable OIDC for multi-tenant setup #2989 (@asincu)
• EV-4126 Add watch for tenant controller #2987 (@vara2504)
• [cherry-pick][v1.32] Es-proxy reached K8S api via Voltron (#2985) #2986 (@asincu)
• Es-proxy reaches K8S api via Voltron #2985 (@asincu)
• Apiserver render, protect against uninitialized Installation resource #2984 (@tmjd)
• [cherry-pick][1.32] Ability to configure per-tenant index names (#2894) #2982 (@asincu)
• Per-tenant elasticsearch configuration #2981 (@caseydavenport)
• Cherry-pick #2975 Add tenant namespace check for multitenant #2980 (@vara2504)
• [release-v1.32] Auto pick #2978: Remove old controller ref for Voltron secret #2979 (@caseydavenport)
• Remove old controller ref for Voltron secret #2978 (@caseydavenport)
• Fix csi daemonset validation #2977 (@tmjd)
• [RS-1209] Webhooks processor deployment in the operator. #2976 (@bartolini)
• Add tenant namespace check for multitenant #2975 (@vara2504)
• [release 1.32] Update x/net #2971 (@Behnam-Shobiri)
• Bump golang.org/x/net from 0.8.0 to 0.17.0 #2970 (@dependabot[bot])
• Update BGPFilter CRD in OS #2966 (@mazdakn)
• Update EE CRDs #2965 (@coutinhop)
• Update CRDs for OSS and enterprise #2964 (@coutinhop)
• [EV-4308] update kb and elastic to 7.17.14 #2956 (@ti-afra)
• [EV-4308] update kb and elastic to 7.17.14 #2955 (@ti-afra)
• [Release v1.32] Update BGPFitler CRDs #2952 (@mazdakn)
• (master) Management cluster installation fixes #2948 (@pasanw)
• Management cluster installation fixes #2947 (@pasanw)
• [release-v1.32] Auto pick #2944: Include tenant namespaces in DNS access policies #2946 (@caseydavenport)
• Changes to support ebpf and ipv6 #2945 (@sridhartigera)
• Include tenant namespaces in DNS access policies #2944 (@caseydavenport)
• Update CRDs and commit #2943 (@rene-dekker)
• Cherry-pick elastic users cleanup controller #2942 (@Josh-Tigera)
• [cherry-pick][1.32] Various fixes for multi-tenancy (#2936) #2941 (@asincu)
• Automated cherry pick of #2938: Add a label to the prometheus service, so it can be #2939 (@rene-dekker)
• Add a label to the prometheus service, so it can be referenced in Ser… #2938 (@rene-dekker)
• Various fixes for multi-tenancy #2936 (@asincu)
• Add fluentd-windows prometheus metrics support #2931 (@coutinhop)
• Update apiserver controller to handle old voltron cert format #2924 (@tmjd)
• Guard AD PSP deletion #2918 (@pasanw)
• Add Windows HPC EE support #2914 (@coutinhop)
• Code review feedback #2904 (@caseydavenport)
• Downgrade confusing log #2902 (@caseydavenport)
• Update k8s.io/ to newer patch #2901 (@caseydavenport)
• Linseed single index support #2900 (@caseydavenport)
• [CI-1334] update dns svc discovery for rke2 (#2895) #2898 (@ti-afra)
• Ability to configure per-tenant index names #2894 (@asincu)
• Add egressgatewaypolicies to node RBAC #2893 (@mazdakn)
• Add RBAC for DPI when a management cluster is spin up #2884 (@asincu)
• Remove csr rbac creation from wrong controller; intrusiondetection_co… #2880 (@rene-dekker)
• Remove duplicate code #2878 (@rene-dekker)
• Cluster name will be set by Voltron for a managed cluster #2875 (@asincu)
• update kb & elastic to 7.17.13 #2870 (@ti-afra)
• Fix certificate management due to missing volumemount #2866 (@rene-dekker)
• [EV-3914] Set the controller manager cache RESTMapper back to the DynamicRESTMapper (default changed on k8s upgrade) #2861 (@Brian-McM)
• Fix! Tenant CA secrets needs to be rendered #2860 (@asincu)
• Use baseline PSS for tigera-kibana namespace #2859 (@hjiawei)
• Fix! LogStorage name for tigera-...