10 Nov 2026
Included Calico versions
Calico version: v3.32.4
Calico Enterprise version: v3.23.4
Bug fixes
- Fixed BackendTLSPolicy
wellKnownCACertificates: Systemon Calico Ingress Gateway. The envoy-proxy pods now mount the trusted CA bundle at the path Envoy Gateway expects, and restart when the bundle changes. #5392 (@electricjesus) - Fixes pods failing to start on single-stack clusters with a non-workload IP pool of the other family, and the Istio CR's resources being ignored for istiod, Istio CNI and ztunnel. #5377 (@caseydavenport)
- Fixes the non-cluster-host Typha deployment ignoring the calico-typha container resources and terminationGracePeriodSeconds set in the Installation's spec.typhaDeployment, and having its pods rejected when certificate management is enabled. #5368 (@caseydavenport)
Other changes
- Updated Elasticsearch and Kibana to 8.19.24 and updated their bundled dependencies to address known CVEs. #5388 (@ti-afra)
- With flexVolumePath set to None, a flexvolume driver already installed in the provider's default plugin directory is now updated on upgrade. A driver installed at a custom path before switching to None must be removed manually on each node (rm -rf <custom path>/nodeagent~uds), after draining any pods that mount nodeagent/uds. #5382 (@rene-dekker)