Bump tigera/operator to v1.42.4

[github-actions]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
tigera/operator	minor	1.37.0 → 1.42.4

---

Release Notes

tigera/operator (tigera/operator)

v1.42.4

Compare Source

04 Jul 2026

Included Calico versions

Calico version: v3.32.1
Calico Enterprise version: v3.23.1

This version of Operator is being released to support Calico Enterprise version v3.23.1 and has no other changes. Please see the release notes for Operator v1.42.3 for recent changes included in this release.

v1.42.3

Compare Source

26 Jun 2026

Included Calico versions

Calico version: v3.32.1
Calico Enterprise version: v3.23.0-2.0

Bug fixes

• Fixes a regression where the Goldmane and Guardian pods were unable to reach DNS or the management cluster, which could break flow visibility (including on Calico Cloud-connected clusters). #​4953 (@​caseydavenport)

v1.42.2

Compare Source

11 Jun 2026

Included Calico versions

Calico version: v3.32.0
Calico Enterprise version: v3.23.0-2.0

Bug fixes

• Fixed 403 errors on custom dashboards for OIDC users. #​4836 (@​alexh-tigera)
• Fixed WAF HTTP filter failing open in clusters installed without the Calico API server (USE_API_SERVER=false / v3-CRDs-only mode). The filter's license check now succeeds regardless of which Calico CRD group is installed, so WAF rule processing engages as intended. #​4812 (@​electricjesus)
• Fixed an operator upgrade that could stall on kind clusters, looping on an unsupported "Kind" kubernetesProvider value instead of completing. #​4882 (@​caseydavenport)
• Fixed a 403 when creating UISettings (e.g. Service Graph layers) as a tigera-network-admin user in v3 CRD / webhooks mode. #​4867 (@​caseydavenport)
• Fixed an issue where Calico Enterprise compliance reports were never scheduled due to a missing RBAC permission on the calico-apiserver ClusterRole. #​4863 (@​caseydavenport)
• Fixed the non-cluster-host Typha deployment crashlooping on clusters where the host-network kube-apiserver endpoint is not reachable from pod-networked pods (e.g. MKE proxy.local). The pod-network endpoint from the kubernetes-service-endpoint ConfigMap is now used when set. #​4842 (@​caseydavenport)
• Fixed a bootstrap deadlock on fresh managed clusters that prevented calico-apiserver from starting and the Guardian tunnel from being established when the management cluster had not yet pushed the calico-apiserver linseed token. #​4799 (@​tianfeng92)
• Fixed a permissions error in calico-kube-controllers that prevented it from reading IPAM configuration. #​4776 (@​caseydavenport)
• Fixed operator reconcile failure on Kubernetes clusters that only serve the v1 (not v1beta1) MutatingAdmissionPolicy API. #​4905 (@​radTuti)

Other changes

• Add a named "https" port on the calico-manager Service and, when the OpenShift IDP is configured, publish a tigera-ca-public Secret in calico-system so OpenShift's Ingress→Route conversion can produce a reencrypt Route fronting the manager. #​4789 (@​rene-dekker)
• Grant operator-managed service accounts update permission on /status subresources for GlobalAlert, PacketCapture, and SecurityEventWebhook. #​4854 (@​caseydavenport)
• Bumped bundled Envoy Gateway from v1.7.2 to v1.8.0. Adds first-class ListenerSet support (enables cert-manager and external-dns integration with Gateway-API), the safe-upgrades ValidatingAdmissionPolicy for CRD version migrations, and pulls in the v1.8.0 security and bug-fix rollup.
  Note: v1.8.0 contains several upstream behavior changes (DirectResponse template interpolation, SecurityPolicy 0s timeout semantics, samplingFraction 100x correction, OIDC filter consolidation) — see Envoy Gateway v1.8.0 release notes. #​4833 (@​electricjesus)
• Bump bundled ECK Kibana/Elasticsearch version constant to 8.19.15. #​4815 (@​tianfeng92)
• Bump golang.org/x/net to v0.54.0 to keep the operator aligned with the calico-private release-calient-v3.23 dependency baseline (mitigates CVE-2026-33814 reporting and picks up subsequent x/net hardening). #​4811 (@​xiumozhan)

v1.42.1

Compare Source

05 Jun 2026

Included Calico versions

Calico version: v3.32.0
Calico Enterprise version: v3.23.0-2.0

Bug fixes

• Fixed 403 errors on custom dashboards for OIDC users. #​4836 (@​alexh-tigera)
• Fix WAF HTTP filter failing open in clusters installed without the Calico API server (USE_API_SERVER=false / v3-CRDs-only mode). The filter's license check now succeeds regardless of which Calico CRD group is installed, so WAF rule processing engages as intended. #​4812 (@​electricjesus)

Other changes

• Fixes an operator upgrade that could stall on kind clusters, looping on an unsupported "Kind" kubernetesProvider value instead of completing. #​4882 (@​caseydavenport)
• Fixes a 403 when creating UISettings (e.g. Service Graph layers) as a tigera-network-admin user in v3 CRD / webhooks mode. #​4867 (@​caseydavenport)
• Fixes an issue where Calico Enterprise compliance reports were never scheduled due to a missing RBAC permission on the calico-apiserver ClusterRole. #​4863 (@​caseydavenport)
• Grant operator-managed service accounts update permission on /status subresources for GlobalAlert, PacketCapture, and SecurityEventWebhook. #​4854 (@​caseydavenport)
• Fixes the non-cluster-host Typha deployment crashlooping on clusters where the host-network kube-apiserver endpoint is not reachable from pod-networked pods (e.g. MKE proxy.local). The pod-network endpoint from the kubernetes-service-endpoint ConfigMap is now used when set. #​4842 (@​caseydavenport)
• Bumped bundled Envoy Gateway from v1.7.2 to v1.8.0. Adds first-class ListenerSet support (enables cert-manager and external-dns integration with Gateway-API), the safe-upgrades ValidatingAdmissionPolicy for CRD version migrations, and pulls in the v1.8.0 security and bug-fix rollup. Note: v1.8.0 contains several upstream behavior changes (DirectResponse template interpolation, SecurityPolicy 0s timeout semantics, samplingFraction 100x correction, OIDC filter consolidation) — see https://gateway.envoyproxy.io/news/releases/notes/v1.8.0/. #​4833 (@​electricjesus)
• Bump bundled ECK Kibana/Elasticsearch version constant to 8.19.15. #​4815 (@​tianfeng92)
• Bump golang.org/x/net to v0.54.0 to keep the operator aligned with the calico-private release-calient-v3.23 dependency baseline (mitigates CVE-2026-33814 reporting and picks up subsequent x/net hardening). #​4811 (@​xiumozhan)
• Fix a bootstrap deadlock on fresh managed clusters that prevented calico-apiserver from starting and the Guardian tunnel from being established when the management cluster had not yet pushed the calico-apiserver linseed token. #​4799 (@​tianfeng92)
• Add a named "https" port on the calico-manager Service and, when the OpenShift IDP is configured, publish a tigera-ca-public Secret in calico-system so OpenShift's Ingress→Route conversion can produce a reencrypt Route fronting the manager. #​4789 (@​rene-dekker)
• Fixes a permissions error in calico-kube-controllers that prevented it from reading IPAM configuration. #​4776 (@​caseydavenport)

v1.42.0

Compare Source

30 Apr 2026

Included Calico versions

Calico version: v3.32.0

Bug fixes

• Fixes configuration of Calico Windows Daemonset Requests and Limits. #​4366 (@​tmjd)

Other changes

• Update bundled Istio version to 1.29.2, including CVE fixes for moby/spdystream, prometheus/prometheus, and opentelemetry-go/otel/sdk. #​4733 (@​radixo)

• Update golang.org/x/* libraries to latest. #​4727 (@​rene-dekker)

• Grant the tigera-noncluster-host ClusterRole create access on linseed.tigera.io/policyactivity so non-cluster host policy activity logs reach Linseed. #​4726 (@​xiumozhan)

• None #​4701 (@​caseydavenport)

• Operator now passes the CA certificate CommonName to Voltron via VOLTRON_CA_SIGNER_NAME, enabling configurable CA issuer identification. #​4673 (@​rene-dekker)

• Always add --tunnelSecretName flag to the apiserver, so it will pick the correct secret for signing tunnel certificates. #​4662 (@​rene-dekker)

• Added label selector for networkpolicies selecting coredns on Canonical Kubernetes clusters. #​4652 (@​rene-dekker)

• Improve TigeraStatus to include more detailed information when readiness and liveness probes fail. #​4646 (@​caseydavenport)

• Bump bundled Envoy Gateway to v1.7.0. Kubernetes version floor raised to v1.32. #​4637 (@​pasanw)

• Give Policy Recommendation Controller the necessary RBAC to recommend policies for HostEndpoints. #​4594 (@​xiumozhan)

• Fix calico-apiserver RBAC to allow queryserver's authorization review to access tiers, uisettingsgroups, and managedclusters via the aggregated API. #​4568 (@​tianfeng92)

• Istio support is now available for Calico (OSS) installations. Previously, the Istio controller was restricted to Calico Enterprise only. With this change, OSS users can leverage the operator to manage Istio ambient mesh components (istiod, CNI, and ztunnel) alongside their Calico installation. #​4536 (@​radixo)

• Add validation for logstorage node count and replicas setting. #​4529 (@​tianfeng92)

• Allow Calico nodes to create and update BGPConfiguration resources. #​4520 (@​mazdakn)

• Fix pod creation failures during manifest-to-operator migration caused by the calico-cni-plugin #​4514 (@​caseydavenport)

• ClusterRoleBinding losing its kube-system subject before all nodes are migrated. #​4514 (@​caseydavenport)

• Config option to control whether BIRD or Felix manages intra-cluster routing. #​4511 (@​mazdakn)

• Set correct CA_TRUSTED_NODE_ACCOUNTS namespace on OpenShift #​4510 (@​electricjesus)

• Fix calico-apiserver TLS errors on upgrade to v3.31 for long-lived clusters. #​4493 (@​caseydavenport)

• The operator now correctly reissues certificates with updated SANs when the apiserver namespace changes, instead of treating legacy operator-signed certs as user-provided. #​4493 (@​caseydavenport)

• Operator now disables log forwarding and metrics scraping on enterprise license expiry while keeping the dataplane running, and reports license status in TigeraStatus. #​4482 (@​hjiawei)

• Surface certificate metadata (issuer, expiry, DNS SANs, IP SANs) as annotations and add filtering labels (secret-type, signer) on TLS secrets produced by Secret() and CreateSelfSignedSecret(). #​4479 (@​rene-dekker)

• Display the Degraded condition's message when running kubectl get tigerastatus, making it easier to see error details at a glance without needing to describe the resource. #​4479 (@​rene-dekker)

• Users can now override the resources and/or limits on the calico-dashboard-api container in the manager deployment. #​4478 (@​rene-dekker)

• Split kubernetes-services-endpoint configmap into KUBERNETES_SERVICE_HOST/PORT for host-networked pods (previous behaviour) and KUBERNETES_SERVICE_HOST_POD_NETWORK and KUBERNETES_SERVICE_PORT_POD_NETWORK for pod-networked pods. #​4474 (@​coutinhop)

• Fix Istio GKE platform detection: set platform=gke on istiod and ztunnel Helm charts in addition to the CNI chart, enabling the ztunnel ResourceQuota and PLATFORM=gke environment variable on istiod. #​4463 (@​electricjesus)

• Use backwards compatible schema configuration for prometheus endpoints on Openshift. #​4454 (@​rene-dekker)

• ECK certificates are now rotated 30d before expiry just like all certificates that are managed by this operator. #​4453 (@​rene-dekker)

• The Tier allow-tigera has been renamed to calico-system. #​4438 (@​radixo)

• If your Calico installation does not use the Tigera Operator, or if you have created custom Network Policies within this Tier, you must manually update your resources to reference the new Tier name. #​4438 (@​radixo)

• Please review and adjust any affected policies to ensure continued correct behavior. #​4438 (@​radixo)

• • Dropped support to the non-privileged mode and deprecated the Installation.spec.nonPrivileged field. The Operator ignores this setting and will mark Calico as Degraded if it is set to Enabled. #​4433 (@​lucastigera)

• Fixed rendering resource limits and requests for Egress Gateway. #​4427 (@​sridhartigera)

• Register NetworkAttachmentDefinition type in operator scheme for Istio OpenShift support. #​4408 (@​electricjesus)

• Bump Go to 1.25.7 #​4403 (@​alexh-tigera)

• Fix Istio service mesh components (istio-cni, istiod, ztunnel) failing on OpenShift due to missing platform detection. The operator now sets platform=openshift on all embedded Istio Helm charts, activating correct CNI binary paths (/var/lib/cni/bin), Multus provider configuration, SCC RBAC rules, SELinux contexts, and trusted ztunnel namespace settings. #​4402 (@​electricjesus)

• Auto-detect kube-proxy nftables/iptables mode. #​4389 (@​caseydavenport)

• Fix that operator would remove other controllers finalizers from objects it creates. #​4381 (@​caseydavenport)

• Prometheus Operator is updated from v0.84.0 to v0.88.0. #​4379 (@​hjiawei)

• Prometheus is updated from v3.4.1 to v3.9.1. #​4379 (@​hjiawei)

• Prometheus Alertmanager is updated from v0.28.0 to v0.30.1. #​4379 (@​hjiawei)

• Updated Elasticsearch NodeSet name generation to prevent unnecessary recreations of the Elasticsearch StatefulSet. #​4378 (@​pasanw)

• Added a required permission for setting up watches in the calico-apiserver on OCP 4.20 #​4372 (@​rene-dekker)

• Elasticsearch and Kibana are updated to v8.19.10. #​4367 (@​hjiawei)

• Updated the Tigera Operator runtime base image to UBI 9. #​4365 (@​hjiawei)

• Fixed an issue caused by manager_controller and apiserver_controller both writing the calico-management-cluster-connection secret to calico-system causing constant reconciliations. #​4358 (@​rene-dekker)

• Add rule to allow-tigera to allow traffic from intrusion detection controller to voltron #​4350 (@​xiumozhan)

• Update CRDs #​4344 (@​Josh-L)

• Added LINSEED_URL environment variable to tigera-dpi daemonset to fix an issue with forwarding alerts from a managed cluster running DPI to the management cluster. #​4330 (@​Josh-L)

• Fix a stack trace in the kibana logs as a result of timeouts from fleet. #​4328 (@​rene-dekker)

• Set recommended labels as per #​4327 (@​rene-dekker)

• https://kubernetes.io/docs/concepts/overview/working-with-objects/common-labels/ #​4327 (@​rene-dekker)

• Fixed an issue where Guardian was missing the certificate of the Calico API server from it's CA bundle. This issue only impacted clusters that were created using an older version of the Operator that did not use a centralized signer. #​4314 (@​pasanw)

v1.41.1

Compare Source

14 Feb 2026

Included Calico versions

Calico version: v3.31.3
Calico Enterprise version: v3.23.0-1.0

[!NOTE]
This version of Operator fixes an issue that could arise if a cluster using Operator v1.41.0 was migrated from Calico Enterprise to Calico Open Source. There are no other user-visible changes.

Please see the Operator v1.41.0 release notes for information about this Operator release, including potentially breaking changes.

v1.41.0

Compare Source

13 Feb 2026

Included Calico versions

Calico Enterprise version: v3.23.0-1.0

[!CAUTION]
This version of Operator contains breaking changes. If you are upgrading an existing cluster please read the release notes carefully.

Bug Fixes

• Fix Istio service mesh components (istio-cni, istiod, ztunnel) failing on OpenShift due to missing platform detection. The operator now sets platform=openshift on all embedded Istio Helm charts, activating correct CNI binary paths (/var/lib/cni/bin), Multus provider configuration, SCC RBAC rules, SELinux contexts, and trusted ztunnel namespace settings. #​4406 (@​electricjesus)
• Fixed an issue caused by manager_controller and apiserver_controller both writing the calico-management-cluster-connection secret to calico-system causing constant reconciliations. #​4375 (@​rene-dekker)
• Updated Elasticsearch NodeSet name generation to prevent unnecessary recreations of the Elasticsearch StatefulSet. #​4390 (@​pasanw)
• Added a required permission for setting up watches in the calico-apiserver on OCP 4.20 #​4373 (@​rene-dekker)
• Fix a stack trace in the kibana logs as a result of timeouts from fleet. #​4333 (@​rene-dekker)
• Fixed an issue where Guardian was missing the certificate of the Calico API server from it's CA bundle. This issue only impacted clusters that were created using an older version of the Operator that did not use a centralized signer. #​4315 (@​pasanw)
• Fix DPI ClusterRole so it can discover IP via endpointslices #​4258 (@​Dean-Coakley)
• Fixes an issue where the logger was not initialized before log statements were produced. #​4235 (@​rene-dekker)
• Fixed a race condition in tigerastatus monitor where the alertmanager and prometheus statefulsets hadn't been created yet, but the monitor was marked as Available. #​4214 (@​alexh-tigera)
• Fix policy sync check for CIG #​4210 (@​LorcanMcVeigh)
• Add finalizers to Installation CR to try to ensure it is safe to cleanup the CNI permissions #​4207 (@​tmjd)
• Fix that Whisker would not function on nodes with IPv6 support disabled. #​4204 (@​caseydavenport)
• Do not require LoadBalancer pools to have outgoing NAT enabled. #​4183 (@​MichalFupso)
• Improve uninstall stability while waiting for pods to be torn down. #​4179 (@​caseydavenport)
• Fix calico-system Namespace PSS Conflict where, under certain conditions, the calico-system would end up with a PSS value of restricted instead of privileged. This started happening on August 15, 2025 (so we may not have released an Enterprise version since). #​4172 (@​gantony)

Breaking changes

• Fixed the defaulting behavior for Authentication.Spec.OIDC.requestedScopes such that it now includes offline_access as documented in the API. In the unlikely case that your identity provider does not support offline_access and if you did previously not specify requestedScopes, you should set requestedScopes to [profile, openid, email] . #​4173 (@​rene-dekker)
• Contents of tigera-manager namespace have been moved to calico-system namespace on standalone and management clusters (managed clusters were moved in a previous release). Component names prefixed with "tigera-" have been renamed to use prefix "calico-" instead. An ExternalName service has been retained in the tigera-manager namespace to ease migration. Any ingress or gateway API resources that provided external access to the tigera-manager service will need to be updated. #​4153 (@​Josh-L)

Other changes

• Use backwards compatible schema configuration for prometheus endpoints on Openshift. #​4420 (@​rene-dekker)
• Prometheus Operator is updated from v0.84.0 to v0.88.0. Prometheus is updated from v3.4.1 to v3.9.1. Prometheus Alertmanager is updated from v0.28.0 to v0.30.1. #​4397 (@​hjiawei)
• Elasticsearch and Kibana are updated to v8.19.10. #​4368 (@​hjiawei)
• Add rule to allow-tigera to allow traffic from intrusion detection controller to voltron #​4354 (@​xiumozhan)
• Fix Annotation Removal when patching FelixConfiguration #​4306 (@​radixo)
• Update Istio from 1.27.3 to 1.28.1 #​4287 (@​radixo)
• updated RBAC for Gateway stats and logs collector #​4282 (@​electricjesus)
• Use CEL validation for CR names. #​4280 (@​caseydavenport)
• feat: operator.tigera.io/Istio CRD - installs and manages Istio for Calico #​4256 (@​radixo)
• Allow non-cluster hosts to remove failed CSRs before generating new requests. #​4236 (@​hjiawei)
• Tigera Operator is now built with Go 1.25. #​4221 (@​hjiawei)
• Remove unused env vars in l7 sidecar CIG gateway deployment #​4202 (@​LorcanMcVeigh)
• Added support for custom-signed Calico Node certificates on non-cluster hosts. #​4181 (@​hjiawei)
• Use gateway-specific l7 collector image. #​4171 (@​gantony)
• Calico Operator is now build with k8s v1.33 #​4168 (@​MichalFupso)
• add support for developmental builds of operator with custom image paths for components #​4163 (@​radTuti)
• Update RBAC for the new k8s ClusterNetworkPolicy API. #​4155 (@​mazdakn)
• Envoy Gateway updated to v1.5.0. This now includes envoy SecurityPolicy CRD #​4130 (@​electricjesus)
• The impersonation permissions on guardian are made configurable through the ManagementClusterConnection resource. #​4085 (@​rene-dekker)

v1.40.13

Compare Source

18 Jun 2026

Included Calico versions

Calico version: v3.31.6
Calico Enterprise version: v3.22.6

[!NOTE]
This version of Operator is being released to support Calico version v3.31.6 and has no other changes. Please see the release notes for Operator v1.40.12 for recent changes included in this release.

v1.40.12

Compare Source

17 Jun 2026

Included Calico versions

Calico version: v3.31.5
Calico Enterprise version: v3.22.6

Bug fixes

• Fix RBAC error preventing operator from creating secrets in tigera-manager namespace on fresh installs with Authentication CR configured #​4892 (@​vara2504)
• Fixed 403 errors on custom dashboards for OIDC users. #​4856 (@​alexh-tigera)
• Fixes the non-cluster-host Typha deployment crashlooping on clusters where the host-network kube-apiserver endpoint is not reachable from pod-networked pods (e.g. MKE proxy.local). #​4841 (@​caseydavenport)
• Aligned the bundled Envoy Gateway v1.7.2 helm chart / gateway api resources with the controller binary version shipping in this release. #​4831 (@​electricjesus)

v1.40.11

Compare Source

20 May 2026

Included Calico versions

Calico version: v3.31.5
Calico Enterprise version: v3.22.5

Other changes

• Bump bundled ECK Kibana/Elasticsearch version constant to 8.19.15. #​4816 (@​tianfeng92)
• Add a named "https" port on the calico-manager Service and, when the OpenShift IDP is configured, publish a tigera-ca-public Secret in calico-system so OpenShift's Ingress→Route conversion can produce a reencrypt Route fronting the manager. #​4790 (@​rene-dekker)

v1.40.10

Compare Source

05 May 2026

Included Calico versions

Calico version: v3.31.5
Calico Enterprise version: v3.22.4

Other changes

• Remove defaulting to run as privileged #​4757 (@​MichalFupso)

v1.40.9

Compare Source

24 Apr 2026

Included Calico versions

Calico version: v3.31.5
Calico Enterprise version: v3.22.3

Bug fixes

• Fix Kibana crashloop when upgrading frrom Calico Enterprise 3.20 or earlier to 3.22. The orphan ingest_manager_settings saved object left by Fleet 7.17 is now discarded during Kibana 8.x saved-object migration. #​4744 (@​tianfeng92)

Other changes

• Update bundled Istio version to 1.29.2, including CVE fixes for moby/spdystream, prometheus/prometheus, and opentelemetry-go/otel/sdk. #​4735 (@​radixo)
• Update spdystream to v0.5.1 and golang.org/x/* libraries to latest. #​4724 (@​rene-dekker)

v1.40.8

Compare Source

14 Apr 2026

Included Calico versions

Calico version: v3.31.5
Calico Enterprise version: v3.22.2

Other changes

• Operator now passes the CA certificate CommonName to Voltron via VOLTRON_CA_SIGNER_NAME, enabling configurable CA issuer identification. #​4674 (@​rene-dekker)
• Improve TigeraStatus to include more detailed information when readiness and liveness probes fail. #​4648 (@​caseydavenport)
• Remove logstorage validation warning message for node count exceeding replicas by 1. #​4578 (@​tianfeng92)
• Add validation for logstorage node count and replicas setting. #​4555 (@​tianfeng92)
• Fix calico-apiserver TLS errors on upgrade to v3.31 for long-lived clusters.
  The operator now correctly reissues certificates with updated SANs when the
  apiserver namespace changes, instead of treating legacy operator-signed certs
  as user-provided. #​4542 (@​rene-dekker)
• Set correct CA_TRUSTED_NODE_ACCOUNTS namespace on OpenShift #​4538 (@​electricjesus)
• Fix pod creation failures during manifest-to-operator migration caused by the calico-cni-plugin
  ClusterRoleBinding losing its kube-system subject before all nodes are migrated. #​4519 (@​caseydavenport)
• Surface certificate metadata (issuer, expiry, DNS SANs, IP SANs) as annotations and add filtering labels (secret-type, signer) on TLS secrets produced by Secret() and CreateSelfSignedSecret().
  Display the Degraded condition's message when running kubectl get tigerastatus, making it easier to see error details at a glance without needing to describe the resource. #​4506 (@​rene-dekker)
• Bump Elasticsearch and Kibana to 8.19.12. #​4501 (@​tianfeng92)
• ECK certificates are now rotated 30d before expiry just like all certificates that are managed by this operator. #​4484 (@​rene-dekker)
• Dropped support to the non-privileged mode and deprecated the Installation.spec.nonPrivileged field. The Operator ignores this setting and will mark Calico as Degraded if it is set to Enabled. #​4465 (@​lucastigera)

v1.40.7

Compare Source

21 Feb 2026

Included Calico versions

Calico version: v3.31.4
Calico Enterprise version: v3.22.2

Bug fixes

• Fixed rendering resource limits and requests for Egress Gateway. #​4430 (@​sridhartigera)
• Fix Istio service mesh components (istio-cni, istiod, ztunnel) failing on OpenShift due to missing platform detection. The operator now sets platform=openshift on all embedded Istio Helm charts, activating correct CNI binary paths (/var/lib/cni/bin), Multus provider configuration, SCC RBAC rules, SELinux contexts, and trusted ztunnel namespace settings. #​4405 (@​electricjesus)

Other changes

• Update Envoy Gateway from 1.5.6 to 1.5.7 #​4416 (@​nelljerram)

v1.40.6

Compare Source

20 Feb 2026

Included Calico versions

Calico version: v3.31.3
Calico Enterprise version: v3.22.2

[!NOTE]
This version of Operator is being released to support Calico Enterprise hotfix version v3.22.2 and has no other changes.

v1.40.5

Compare Source

26 Jan 2026

Included Calico versions

Calico version: v3.31.3
Calico Enterprise version: v3.22.1

Bug fixes

• Added a required permission for setting up watches in the calico-apiserver on OCP 4.20 #​4371 (@​rene-dekker)
• Added LINSEED_URL environment variable to tigera-dpi daemonset to fix an issue with forwarding alerts from a managed cluster running DPI to the management cluster. #​4335 (@​Josh-L)
• Fix a stack trace in the kibana logs as a result of timeouts from fleet. #​4323 (@​rene-dekker)
• Fixes an issue where the logger was not initialized before log statements were produced. #​4319 (@​rene-dekker)

Other changes

• Update golang to 1.24.12; Update ElasticSearch to 8.19.10; Update Kibana to 8.19.10 #​4364 (@​Josh-L)
• Add rule to allow-tigera to allow traffic from intrusion detection controller to voltron #​4356 (@​xiumozhan)

v1.40.4

Compare Source

22 Dec 2025

Included Calico versions

Calico version: v3.31.3
Calico Enterprise version: v3.22.0-3.0

[!NOTE]
This version of Operator is being released to support Calico Enterprise v3.22.0-3.0 and contains no other user-visible changes.

v1.40.3

Compare Source

19 Dec 2025

Included Calico versions

Calico version: v3.31.3

Enhancements

• add CRDs that install and manage Istio for Calico #​4289 (@​electricjesus)

Bug fixes

• Fix that Whisker would not function on nodes with IPv6 support disabled. #​4265 (@​caseydavenport)

v1.40.2

Compare Source

18 Nov 2025

Included Calico versions

Calico version: v3.31.2
Calico Enterprise version: v3.22.0-2.0

[!NOTE]
Operator v1.40.2 and Calico v3.31.2 are being released to fix a docker image label issue for one image, which was preventing Red Hat Openshift Container Platform certification, and are otherwise identical. If you have already updated to Calico v3.31.1 and are not using Red Hat OCP, there is no need to update your installation. Please see the Operator v1.40.1 release for changes in Operator since v1.40.0.

v1.40.1

Compare Source

14 Nov 2025

Included Calico versions

Calico version: v3.31.1
Calico Enterprise version: v3.22.0-2.0

Bug fixes

• Fix DPI ClusterRole so it can discover IP via endpointslices #​4259 (@​electricjesus)
• Allow non-cluster hosts to remove failed CSRs before generating new requests. #​4238 (@​hjiawei)

v1.40.0

Compare Source

22 Oct 2025

Included Calico versions

Calico version: v3.31.0

Breaking changes

• fixed the defaulting behaviour for Authentication.Spec.OIDC.requestedScopes such that it now includes offline_access as documented in the API. In the unlikely case that your identity provider does not support offline_access and if you did previously not specify requestedScopes, you should set requestedScopes to [profile, openid, email] . #​4159 (@​rene-dekker)

Bug fixes

• Fix calico-system Namespace PSS Conflict where, under certain conditions, the calico-system would end up with a PSS value of restricted instead of privileged. This started happening on August 15, 2025 (so we may not have released an Enterprise version since). #​4217 (@​gantony)
• Do not require LoadBalancer pools to have outgoing NAT enabled. #​4184 (@​MichalFupso)
• Properly provide secrets RBAC when operator is running in an alternative namespace. #​4123 (@​caseydavenport)
• Fixed a race condition when checking if the calico-node DaemonSet has completed its rollout before enabling BPF. #​4079 (@​lucastigera)
• revert Enable ClusterInfo controller in es-kube-controller to fetch ManagedClusters #​4039 (@​vara2504)
• Fix crds #​4037 (@​rene-dekker)
• Fixed an issue that prevented the operator from detecting HTTP proxies set on the Guardian container. #​4031 (@​pasanw)
• Fix security contexts for init containers when certificate management is enabled, so the certificates have the right permissions set on them. #​4025 (@​rene-dekker)
• Fix missing kube-controller secret access for guardian #​4021 (@​vara2504)
• fix digest of images to return correct registry for calico node FIPS image #​4007 (@​radTuti)

Other changes

• Add support for custom-signed Calico Node certificates on non-cluster hosts. #​4226 (@​hjiawei)
• Updates the versions of the ECK Kibana and ECK Elasticsearch components to 8.18.8. #​4225 (@​xiumozhan)
• Add finalizers to Installation CR to try to ensure it is safe to cleanup the CNI permissions #​4208 (@​tmjd)
• Gateway API: Envoy Gateway updated to v1.5.0 #​4206 (@​electricjesus)
• Add log level to l7 collector container #​4205 (@​LorcanMcVeigh)
• Improve uninstall stability while waiting for pods to be torn down. #​4182 (@​caseydavenport)
• Calico Operator is now build with k8s v1.33 #​4169 (@​MichalFupso)
• The impersonation permissions on guardian are made configurable through the ManagementClusterConnection resource. #​4151 (@​rene-dekker)
• Changed default vxlanPort to 8472 for MKE when installing in ebpf mode. MKE already has a vxlan device at port 4789 and vni 4096. Until v3.30, we have been using FDB based vxlan in calico across all dataplanes. Now with 3.31, Calico creates Flow based vxlan for ebpf dataplane. When creating a flow based vxlan, we don't specify the VNI. This results in 2 devices at the same vxlan port causing conflicts. 8472 is/was the port allocated to vxlan before IANA standardized on 4789. #​4144 (@​sridhartigera)
• This change updates the Dex client configuration to support Single Page Applications (SPAs) code flow with PKCE. The 'X-Frame-Options' header was changed from 'DENY' to 'SAMEORIGIN'. #​4137 (@​rene-dekker)
• Setup licensing for waf-http-filter (Enterprise only) #​4135 (@​gantony)
• Added support for Kubernetes SecretProviderClass resources from the secrets-store-csi-driver into the authentication flow, allowing for identity provider (IdP) secrets to be sourced via CSI drivers in addition to standard Kubernetes Secrets. #​4120 (@​xiumozhan)
• BPF dataplane now programs nftables rules as needed instead of iptables rules. #​4116 (@​caseydavenport)
• eBPF dataplane is now enabled by default for clusters using kube-proxy. Calico auto-detects eligible clusters and installs with eBPF mode without user configuration. Kind is added as a new option for KubernetesProvider in Installation CRD. #​4115 (@​lucastigera)
• The operator now pushes the value of felixConfig.CgroupV2Path to the ebpf-bootstrap init container, improving compatibility with immutable OSes like Talos Linux. #​4110 (@​lucastigera)
• Mount host's bpffs and cgroup in calico-node ds for all dataplanes. #​4108 (@​sridhartigera)
• Use a host alias for Felix to resolve goldmane service address, avoiding dependency on kube-dns. #​4104 (@​caseydavenport)
• The operator is now responsible for installing custom dashboard in the Enterprise environment. #​4099 (@​xiumozhan)
• Support for explicit configuration of calico/node DNS policy and DNS configuration. #​4098 (@​caseydavenport)
• In the absence of explicit configuration, calico/node will inherit DNS policy and DNS configuration from tigera/operator #​4098 (@​caseydavenport)
• Export l7 access logs from Ingress Gateway #​4091 (@​LorcanMcVeigh)
• Update apiserver anti-affinity; remove old pods to prevent hostNetwork port conflicts [

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[github-actions]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.