DOCS-3000: Draft the Calico Enterprise 3.23.2 release notes - #2940
Open
ctauchen wants to merge 1 commit into
Open
DOCS-3000: Draft the Calico Enterprise 3.23.2 release notes#2940ctauchen wants to merge 1 commit into
ctauchen wants to merge 1 commit into
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Drafts Calico Enterprise 3.23.2 release notes content in the versioned docs tree, adding user-facing enhancements and bug-fix bullets for the 3.23.2 patch release.
Changes:
- Added an Enhancements section for 3.23.2 (Manager permissions latency, DatastoreMigration CRD publishing, ECK operator update).
- Replaced the placeholder Bug fixes content with a detailed list of fixes and a security-updates line.
Suppressed comments (1)
calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx:284
- For consistency with other API object references in these release notes, consider formatting TokenReview as inline code. It’s an API type name, and backticks make it clearer it’s not just descriptive text.
* Fixed $[prodname] components, notably Linseed, rejecting valid service account tokens with `bearer token was not issued by a trusted issuer` after the cluster's service account issuer changed. Unrecognized issuers are now validated with a Kubernetes TokenReview.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+278
to
+280
| * Reduced the time the Manager UI takes to calculate a user's permissions. AuthorizationReview now resolves role bindings from one cluster-wide list instead of one list per namespace, which cuts latency on clusters with many namespaces. | ||
| * The DatastoreMigration CRD is now published to the release manifests, so you can install it from a manifest URL instead of a path into the source tree. | ||
| * Updated the ECK (Elastic Cloud on Kubernetes) operator to v3.4.1. |
|
|
||
| * TBD | ||
| * Fixed $[prodname] components, notably Linseed, rejecting valid service account tokens with `bearer token was not issued by a trusted issuer` after the cluster's service account issuer changed. Unrecognized issuers are now validated with a Kubernetes TokenReview. | ||
| * Fixed a HostEndpoint policy blocking UDP return traffic in the eBPF data plane for pod-originated egress that uses NAT-outgoing. Host endpoint egress is no longer bypassed for these flows. |
| * Fixed Felix data plane delays under load that could hold up policy programming for new pods. IP set resyncs are now incremental, and the flow log collector's policy re-evaluation is time-boxed so it no longer blocks conntrack and NFLOG processing. | ||
| * Fixed Felix splitting a flow or DNS log record across a rotation boundary, which made downstream consumers lose a record per rotation. | ||
| * Fixed $[prodname] advertising a Service IP over BGP from a node whose only local endpoint was not Ready, which black-holed traffic for services using `externalTrafficPolicy: Local`. | ||
| * Fixed restarting the `calico-early` container while calico-node was running causing a transient BGP flap, which briefly withdrew pod and egress gateway routes. |
ctauchen
force-pushed
the
DOCS-3000-release-notes
branch
from
August 20, 2026 20:01
edd1537 to
468af7a
Compare
Uses the release-note text the PR authors wrote, with a trailing MDX comment on each item carrying the source pull request numbers. Departures from the author text: 'dataplane' is spelled 'data plane', which the Vale substitution rule requires at error level; the [BPF] and [eBPF] changelog tags are dropped; two imperative notes are made declarative; and the ECK version reads v3.4.1, the version that shipped, rather than the v3.4.0 the original note named. Three items had no author text and are written from the pull request body: the Manager permissions speedup, the Dashboards 403 fix, and the VKS Carvel fix.
ctauchen
force-pushed
the
DOCS-3000-release-notes
branch
from
August 20, 2026 20:16
468af7a to
2e0fc7a
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.
Suppressed comments (3)
calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx:279
- This release note claims the DatastoreMigration CRD is published in the release manifests directory, but the versioned migration guide still says it is not published for this release and points to an upstream raw GitHub URL (calico-enterprise_versioned_docs/version-3.23-2/operations/crd-migration.mdx:72-76). Also, the
kubectl applyexample uses an ellipsis (.../manifests/...) which isn’t a copy/pasteable path.
Please reconcile the docs: either update the migration guide + use a real $[filesUrl]/manifests/... URL here (if it’s truly published), or adjust this bullet to match the current guidance for 3.23-2.
* The DatastoreMigration CRD is now published to the release manifests directory, so it can be installed with `kubectl apply -f .../manifests/migration.projectcalico.org_datastoremigrations.yaml` instead of a path into the source tree. {/* 13002 */}
calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx:298
- In the list of omitted Gateway API CRDs, add a comma after
TLSRoutefor clarity (and to match the backtick formatting already used).
* Fixed the Calico Ingress Gateway control plane crash-looping on clusters whose Gateway API CRD set omits `ListenerSet`, `TLSRoute` or `BackendTLSPolicy`, such as OpenShift. {/* 12959 */}
calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx:297
- For consistency with the surrounding release notes (which format component names as inline code), both occurrences of calico-node should be wrapped in backticks here.
* Fixed a bug where restarting the early-networking (`calico-early`) container while calico-node was still running could cause a transient BGP flap toward the top-of-rack switches, briefly withdrawing pod and egress-gateway routes. Early BGP is now started only when calico-node's BGP is not already established. {/* 12759 */}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Draft release notes for Calico Enterprise 3.23.2. It targets the publishing PR branch so the wording can be reviewed on its own.
The text is the release note each author wrote, taken from the 72 pull requests merged into release-calient-v3.23 since the v3.23.1 tag. Each item ends with an MDX comment holding its source pull request numbers.
Left to do:
Three things to flag: