Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Publishes CE 3.21-1 #1884

Merged
merged 10 commits into from
Feb 12, 2025
Merged

Publishes CE 3.21-1 #1884

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
a223c82
Publishes Calico Enterprise 3.21-1
ctauchen Feb 6, 2025
c30cccb
DOCS-2457: Adds draft RN for CE 3.21-1
ctauchen Feb 6, 2025
35fb3ad
Updates component versions
ctauchen Feb 10, 2025
ef68531
RN updates
ctauchen Feb 10, 2025
528bba4
RN updates
ctauchen Feb 10, 2025
9d566c8
Restores component verisons
ctauchen Feb 10, 2025
c04b1fa
Fixes typo
ctauchen Feb 10, 2025
1cb763c
Update support and compatibility docs for 3.21 ep1
sabags Feb 10, 2025
79dc1c4
Address PR comments
sabags Feb 10, 2025
cdfe221
update release versions
radTuti Feb 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
86 changes: 29 additions & 57 deletions calico-enterprise_versioned_docs/version-3.21-1/release-notes/index.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,93 +3,65 @@
title: Release notes
---

# Calico Enterprise 3.19 release notes
# Calico Enterprise 3.21 release notes

:::info early preview release

Calico Enterprise 3.19 can be used for previewing and testing purposes only.
Calico Enterprise 3.21 can be used for previewing and testing purposes only.
It is not supported for use in production.

:::

Learn about the new features, bug fixes, and other updates in this release of $[prodname].

## New features and enhancements
### Introducing Calico Ingress Gateway (tech-preview)

### Improved flow log filtering for destination domains
$[prodname] now includes the ability to deploy Calico Ingress Gateway which is an Enterprise hardened, 100% upstream distribution of Envoy Gateway.

Check failure on line 20 in calico-enterprise_versioned_docs/version-3.21-1/release-notes/index.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'prodname'?

Raw Output:
{"message": "[Vale.Spelling] Did you really mean 'prodname'?", "location": {"path": "calico-enterprise_versioned_docs/version-3.21-1/release-notes/index.mdx", "range": {"start": {"line": 20, "column": 3}}}, "severity": "ERROR"}
Envoy Gateway is an implementation of the Kubernetes Gateway API with several extensions that provide advanced security and traffic management features.

We’ve updated the Felix parameter (`dest_domains`) for DNS policy to make it easy to find only domain names that the deployment actually connected to (not all the domain names that got translated to the same IP address).
For more information, see [Flow log data types](../visibility/elastic/flow/datatypes.mdx).
For more information, see [Deploy an ingress gateway](../networking/gateway-api.mdx).

### New flow logs panel on Endpoints page
### IPAM for load balancers

We've updated the Endpoints page in the web console with a new flow logs panel so you can view and filter Endpoints associated with denied traffic. Flow log metadata includes the source, destination, ports, protocols, and other key forms. We've also updated the Policy Board to highlight policies with denied traffic.
$[prodname] now extends its IPAM capabilities to support service LoadBalancer IP allocation, providing a centralized, automated approach to managing LoadBalancer IPs within Kubernetes clusters.

Check failure on line 27 in calico-enterprise_versioned_docs/version-3.21-1/release-notes/index.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'prodname'?

Raw Output:
{"message": "[Vale.Spelling] Did you really mean 'prodname'?", "location": {"path": "calico-enterprise_versioned_docs/version-3.21-1/release-notes/index.mdx", "range": {"start": {"line": 27, "column": 3}}}, "severity": "ERROR"}

Check failure on line 27 in calico-enterprise_versioned_docs/version-3.21-1/release-notes/index.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'IPs'?

Raw Output:
{"message": "[Vale.Spelling] Did you really mean 'IPs'?", "location": {"path": "calico-enterprise_versioned_docs/version-3.21-1/release-notes/index.mdx", "range": {"start": {"line": 27, "column": 163}}}, "severity": "ERROR"}

### Improvements to security events dashboard
For more information, see [Link to documentation](../networking/ipam/service-loadbalancer.mdx)

We've added the following improvements to the [Security events dashboard](../threat/security-event-management.mdx):
### Enhancements

- Jira and Slack webhook integration for security event alerts
* **Control-plane label customization for AKS:**
We added support for control-plane label customization for AKS clusters.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe we can specifically call out that it is for namespaces.

We added support for customizing the namespace labels on AKS clusters. By default we apply a control-plane` label to namespaces so that they are exempt from Azure Policy. If you wish to apply Azure Policy to our namespaces, you can now override this label.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added.

This gives you greater control over how labels are applied during installation.

By [configuring webhooks](../threat/configuring-webhooks.mdx), you can now push alerts from the Security Overview dashboard in the web console to Jira and Slack so incident response and security teams can use native tools to respond to security event alerts.
* **Log levels for api-server component:**
You can now tune the log level for the API server to better support production deployments and troubleshooting scenarios.

- Added threat feed alerts
* **Clusterrolebindings have reduced privileges:**
Clusterrolebindings for the `tigera-operator`, `calico-kube-controller`, and `calico-prometheus-operator` components have been changed to improve $[prodname]'s least-privileged security model.

Check failure on line 41 in calico-enterprise_versioned_docs/version-3.21-1/release-notes/index.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'Clusterrolebindings'?

Raw Output:
{"message": "[Vale.Spelling] Did you really mean 'Clusterrolebindings'?", "location": {"path": "calico-enterprise_versioned_docs/version-3.21-1/release-notes/index.mdx", "range": {"start": {"line": 41, "column": 3}}}, "severity": "ERROR"}

If you have implemented global threat feeds for suspicious activity (domains or suspicious IPs), alerts are now visible in the Security Overview dashboard. For more information on threatfeeds, see [Trace and block suspicious IPs](../threat/suspicious-ips).
## Deprecated and removed features

### Deprecated and removed features
## Bug fixes

* The anomaly detection feature was removed in v3.18.1 If anomaly detection is enabled and you upgrade to $[prodname] 3.18, you will stop receiving anomaly detection alerts.
* [Manual install for Windows](../getting-started/install-on-clusters/windows-calico/manual-install/) will be deprecated in a future release. Starting in v3.18.1, the [standard installation is operator-based](../getting-started/install-on-clusters/windows-calico/operator).

## Technology Preview features

- [Web application firewall](../threat/web-application-firewall)

Protect cloud-native applications from application layer attacks.

- [Security events management](../threat/security-event-management)

Get alerts on security events that may indicate a threat is present in your Kubernetes cluster.

- [DNS policy for Windows](../getting-started/install-on-clusters/windows-calico/limitations#dns-policy-limitations)

Use domain names in policies to identify services outside the cluster, which is often operationally simpler and more robust than using IP addresses.

<!-- ## Bug fixes -->

<!-- Follow this template: Problem-Cause-Fix-Result -->

<!--
* Bug 1.
* Bug 2.
-->
<!--
## Security fixes

* Security fix.
-->
* Bug 1
* Bug 2

## Known issues

* Flow logs for the Windows workloads currently do not display entries with a Deny action.
* Before upgrading a $[prodname] cluster on MKE v3.6 to the latest $[prodname] version: 1) upgrade MKE from 3.6 to 3.7, then 2) upgrade $[prodname].
* L7 logs with source name `pvt` is not visible in Service Graph.
* *Multi-cluster management users only*. If the `manager-tls` and `internal-manager-tls` secrets have overlapping DNS names, components such as `es-calico-kube-controllers` will log certificate errors. If you have previously installed a version older than v3.13.0 and never changed your manager-tls secret from the tigera-operator namespace, you must delete both of these secrets. This applies to you if the following command prints a certificate: `$ kubectl get secret manager-tls -n tigera-operator -o "jsonpath={.data['cert']}"`.
* Upgrading to $[prodname] 3.18.0 on Rancher/RKE from $[prodname] 3.13.0 currently requires manually terminating the calico-node container for an upgrade to proceed.
* Calico panics if kube-proxy or other components are using native `nftables` rules instead of the `iptables-nft` compatibility shim. Until Calico supports native nftables mode, we recommend that you continue to use the iptables-nft compatibility layer for all components. (The compatibility layer was the only option before Kubernetes v1.29 added alpha-level `nftables` support.) Do not run Calico in "legacy" iptables mode on a system that is also using `nftables`. Although this combination does not panic or fail (at least on kernels that support both), the interaction between `iptables` "legacy" mode and `nftables` is confusing: both `iptables` and `nftables` rules can be executed on the same packet, leading to policy verdicts being "overturned".
* Linseed deployment needs to be manually restarted after an upgrade. Without a restart, Linseed can't ingest data because it can't authenticate with Elastic.
* Known issue 1
* Known issue 2

## Release details

### Calico Enterprise 3.19.0 (early preview)
### Calico Enterprise 3.21.0-1.0 (early preview)

January xx, 2024
February DD, 2025

Calico Enterprise 3.19.0 is now available as an early preview release.
Calico Enterprise 3.20.0-1.0 is now available as an early preview release.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Calico Enterprise 3.20.0-1.0 is now available as an early preview release.
Calico Enterprise 3.21.0-1.0 is now available as an early preview release.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done.

This release is for previewing and testing purposes only.
It is not supported for use in production.

<!--
To update an existing installation of Calico Enterprise 3.18, see [Install a patch release](../getting-started/manifest-archive.mdx).
-->
{/*
To update an existing installation of Calico Enterprise 3.21, see [Install a patch release](../getting-started/manifest-archive.mdx).
*/}
2 changes: 1 addition & 1 deletion docusaurus.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -409,7 +409,7 @@ export default async function createAsyncConfig() {
path: 'calico-enterprise',
routeBasePath: 'calico-enterprise',
editCurrentVersion: true,
onlyIncludeVersions: [...nextVersion, '3.20-2', '3.19-2', '3.18-2'],
onlyIncludeVersions: [...nextVersion, '3.21-1', '3.20-2', '3.19-2', '3.18-2'],
lastVersion: '3.20-2',
versions: {
current: {
Expand Down