28 Oct 2026
Included Calico versions
Calico version: v3.32.3
Calico Enterprise version: v3.23.3
Bug fixes
- Fixes repeated "cannot patch resource tiers" errors from calico-kube-controllers on clusters using native projectcalico.org/v3 CRDs, so it can now add its finalizer to tiers. #5360 (@caseydavenport)
- TigeraStatus no longer reports a StatefulSet-backed component as Available before its pods are ready. #5354 (@tianfeng92)
- Fixes a datastore migration becoming permanently stuck if the calico-kube-controllers pod is lost while the migration is in progress. #5319 (@caseydavenport)
- Fixes repeated failed-webhook errors in the Kubernetes API server log on Calico (non-Enterprise) clusters, caused by registering an audit admission webhook whose endpoint only exists in Calico Enterprise. #5301 (@caseydavenport)
- Fixed a deadlock on clusters where the Kubernetes API server is reachable only by name, by defaulting calico-node to the node's own DNS resolver. #5247 (@caseydavenport)
Other changes
- The operator now removes the four emSign (eMudhra) root certificates from the system CA bundle it mounts into node, typha, dex, fluentd, intrusion detection, webhooks-processor and guardian. Endpoints with certificates that chain to an emSign root will no longer be trusted. #5365 (@electricjesus)
- Elasticsearch and Kibana are updated to 8.19.23. #5356 (@alexh-tigera)