calico

No entries match these filters. Clear filters

1. v3.33.0 Oct 1, 2026 · release notes

   Calico v3.33.0 adds tech-preview for projectcalico.org/v3 CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. and Windows support artifacts.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.33.0 https://github.com/projectcalico/calico.git
   # already have the repo? check out this version:
   $ git checkout v3.33.0

   • Distributes projectcalico.org.v3-v3.33.0.tgz, a tech-preview CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. chart for the projectcalico.org/v3 API group
   • Provides calico-windows-v3.33.0.zip artifact enabling Windows workload support
   • Updates container images, binaries, and Kubernetes manifests via release-v3.33.0.tgz

   3 details in Everything

2. api-docs-74f0efb2ff78 Sep 7, 2026 · issue 067

   Calico adds BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. filter support for fine-grained control over BGP route advertisement and acceptance.

   • Adds BGP filter support, enabling control over which routes are advertised or accepted via BGP peering.

   1 detail in Everything

3. announced Sep 3, 2026 · issue 064

   Calico introduces Mylo, an AI agent layer delivered via the Calico MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. for Kubernetes network diagnostics.

   ⤢ ⤢ ⤢
   • Introduces the Calico MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server, which exposes Mylo's tools and skills to any MCP-compatible AI agent (Claude, Cursor, terminal agents, etc.) without requiring a new chat interface.
   • Adds the diagnose_connectivity tool via the MCP Server, which returns an ordered, opinionated trace of a network path down to the specific Calico policy rule allowing or denying traffic, with a suggested fix — rather than a raw dump.
   • Supports two run modes: live cluster (via existing kubeconfig path, compatible with kubectl and calicoctl) for real-time diagnostics, and fully offline against a Calico diagnostics bundle for air-gapped or post-incident analysis.
   • Packages multi-step troubleshooting workflows (skills) — such as connectivity failure triage, policy review before deployment, and incident triage — as structured agent-callable procedures encoding Tigera's operational expertise.
   • Includes a built-in router that explicitly scopes each agent request to what Mylo can handle, preventing silent CLI fallback when a request is outside its lane.

   5 details in Everything

4. v3.22.0 Jan 30, 2022 · release notes

   Calico v3.22.0 includes calico-windows support and Tigera Operator helm chart update.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.22.0 https://github.com/projectcalico/calico.git
   # already have the repo? check out this version:
   $ git checkout v3.22.0

   • Adds calico-windows-v3.22.0.zip artifact for Windows node support
   • Adds tigera-operator-v3.22.0.tgz Helm chart release

   2 details in Everything

5. v3.0.5 Apr 16, 2018 · release notes

   Calico v3.0.5 adds container IP forwarding config and lowercase hostname auto-detection

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.0.5 https://github.com/projectcalico/calico.git
   # already have the repo? check out this version:
   $ git checkout v3.0.5

   • Add support for configuring container IP forwarding via the CNI configuration file.
   • When auto-detecting a node name, Calico will convert the hostname to lowercase.

   2 details in Everything

6. v3.1.0 Apr 9, 2018 · release notes

   Calico v3.1 adds GlobalNetworkSet resource type, OpenStack integration, IPVS kube-proxy beta support, and IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. ULA generation.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.1.0 https://github.com/projectcalico/calico.git
   # already have the repo? check out this version:
   $ git checkout v3.1.0

   • GlobalNetworkSet resource type: supports a set of CIDRs with associated labels to be matched by global network policies for cross-cluster policy portability.
   • OpenStack integration reintroduced; existing Calico OpenStack clusters can upgrade via the documented procedure.
   • Beta support for IPVS kube-proxy enabling pod ingress, pod egress, and host endpoint network policy with greater scale and performance than iptables.
   • HostEndpoint configuration support for Kubernetes API datastore allows applying network policies to both host machines and pods using Calico global network policies.
   • install-cni container writes calico-kubeconfig with mode 600 by default, configurable via the KUBECONFIG_MODE environment variable.

   5 details in Everything

7. v3.0.1 Dec 23, 2017 · release notes

   Calico v3.0.1 adds calicoctl convert and ApplyOnForward, Windows Felix, etcdv3, and namespace-scoped policies.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.0.1 https://github.com/projectcalico/calico.git
   # already have the repo? check out this version:
   $ git checkout v3.0.1

   └──▷ USE IT
   Migrate legacy Calico manifests stored under version control to the new v3.x resource model before upgrading.
   shell copy

   calicoctl convert -f policy-v2.yaml > policy-v3.yaml

   Apply a new Calico network policy specifically to the production namespace instead of globally.
   shell copy

   calicoctl apply --namespace=production -f netpol.yaml

   • Adds calicoctl convert subcommand to migrate v2.6.x manifests to the v3.x format
   • Adds --namespace=<NS> flag to calicoctl commands including get, apply, create, delete, and replace
   • Adds --all-namespaces and --export flags to the calicoctl get command
   • Adds new BGP Configuration resource support in calicoctl
   • Adds new Felix Configuration resource support in calicoctl

   +8 more show less

   • Splits calicoctl policy resources into distinct networkpolicy and globalnetworkpolicy types
   • Allows namespaceSelector expressions in network and global network policy rules to select entire namespaces
   • Enables policy rules on host/workload endpoint ports to be named and referenced by name
   • Permits 0 value for ICMP entries in policy resources to enable ping responses
   • Introduces the ApplyOnForward flag to apply host endpoint policies to forwarded traffic
   • Enables Felix compilation and execution on Windows in policy-only mode
   • Changes datastore storage to etcd version 3
   • Adds optional CNI_OLD_CONF_NAME environment variable for CNI plugin configuration cleanup

   13 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !calicoctl no longer accepts the --node, --orchestrator, --workload, and --scope flags in get commands; these are now part of individual resources.
   • !calicoctl removes the config command entirely.
   • !The ETCD_AUTHORITY and ETCD_SCHEME environment variables are no longer read; users must transition to ETCD_ENDPOINTS.
8. v2.6.0 Sep 28, 2017 · release notes

   Calico v2.6.0 adds types field for policy scope, LOG_LEVEL env var for install-cni, and egress rule enforcement.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.6.0 https://github.com/projectcalico/calico.git
   # already have the repo? check out this version:
   $ git checkout v2.6.0

   • Adds a types field to Calico policies to explicitly specify ingress/egress scope
   • Enforces egress rules and ipBlock selectors in Kubernetes network policies
   • Sets converted Kubernetes policies as ingress only instead of appending an egress allow-all rule
   • Removes default egress allow for pods selected by a Kubernetes NetworkPolicyNetworkPolicyA Kubernetes API object that defines which pods may send or receive traffic, enforced by the cluster's CNI plugin to give cyber tools namespace-level network segmentation without host firewall rules.
   • Adds LOG_LEVEL environment variable support to the install-cni container

   +2 more show less

   • Adds UPDATE_CNI_BINARIES environment variable to control binary overwrite behavior in install-cni.sh
   • Makes nodename in CNI configuration properly respected for node affinity

   7 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Policies no longer insert a default egress allow for all pods selected by a Kubernetes NetworkPolicy
   • !Calico no longer configures deprecated tags in the profiles created for Kubernetes Namespaces
   • !The policy controller options CONFIGURE_ETC_HOSTS and K8S_API are no longer supported; use KUBECONFIG instead
   • !If you included the nodename parameter in your CNI config when using etcd mode, it was ignored previously and will now be respected, potentially changing affinity behavior
9. v2.4.0 Jul 31, 2017 · release notes

   Calico v2.4.0 adds Pre-DNAT policy enforcement, per-node BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. configuration via K8s API, calicoctl multi-document YAML support, and new config/CLI surfaces.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.4.0 https://github.com/projectcalico/calico.git
   # already have the repo? check out this version:
   $ git checkout v2.4.0

   └──▷ TRY IT
   Prevent the CNI container from installing unnecessary binaries to reduce attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. and image size
   copy

   $ env SKIP_CNI_BINARIES='veth,lame-duck' calico/node

   Configure per-node BGP peers directly via Kubernetes API for dynamic peering without etcd-only configs
   copy

   $ cat <<EOF | kubectl apply -f -
   apiVersion: projectcalico.org/v3
   kind: BGPPeer
   metadata:
     name: node-bgp-peer
   spec:
     nodeSelector: all()
     peerIP: 192.168.1.100
   EOF

   Apply multiple Calico resources in one go without splitting into separate files
   copy

   $ cat calico-resources.yaml | calicoctl apply -f -

   • SkipCniBinaries environment variable now lets the CNI container skip installation of specific binaries during startup
   • calicoctl version now reports CalicoVersion and ClusterType fields from the datastore output
   • calicoctl can now process multiple YAML documents in a single file or stdin, separated by --- document markers
   • Felix supports an optional environment variable to enable/disable outgoing NAT on the default IP Pool
   • New interface regex matching options for IP auto-detection allow skipping and selecting interfaces during node startup

   +4 more show less

   • Policy objects now support arbitrary key/value annotations (libcalico-go API update)
   • Rule Source.Nets and Destination.Nets fields (and their negated counterparts) are now available to match multiple CIDRs per rule, replacing deprecated Net fields
   • Pre-DNAT Policy enforcement mode is available for securing cluster perimeters against incoming traffic before DNAT rules apply
   • Typha health endpoints implemented for monitoring and liveness checks

   9 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Calico now implements standard Kubernetes networking.k8s.io/NetworkPolicy semantics with etcd datastore, changing how existing policies are enforced (Namespaces without DefaultDeny may need policy deletion; those with it may need equivalent deny-all policies)