30 Apr 2026

#### Seamless live migration support for KubeVirt VMs

Project Calico now supports seamless live migration for KubeVirt virtual machines, allowing a VM to retain its IP address and continue serving network traffic with minimal disruption as they move between nodes.
Previously, live-migrating a KubeVirt VM with Calico networking could result in dropped connections, IP churn, and a noticeable convergence gap while routing caught up to the new location.

This release introduces a new `LiveMigration` API resource together with a per-workload state machine in Felix (Base → Target → Live → TimeWait → Base) that adjusts route priorities during migration and detects migration completion via GARP/RARP probes.

Calico IPAM has been extended to persist VM IP addresses across reboots, evictions, and migrations using stable VMI-based IPAM handles and dual-owner allocation attributes that allow atomic ownership transfer between source and target pods.
A new `--kubevirt-ip-persistence` flag on `calicoctl ipam configure` lets administrators toggle this behavior cluster-wide.

To propagate the elevated route priority for the migrating VM through BGP, the BIRD configuration generated by confd now translates Calico route priority to and from BGP `LOCAL_PREF` within a contiguous AS, and the `BGPFilter` API has been extended with new match criteria (`PeerType`, `Communities`, `ASPathPrefix`, `Priority`) and route operations (`AddCommunity`, `PrependASPath`, `SetPriority`) so that operators can craft the BGP policies needed for advanced live-migration topologies.

#### Seamless live migration for OpenStack

Calico for OpenStack has been updated to take advantage of the same internal `LiveMigration` API used for KubeVirt, dramatically reducing the latency between when a VM becomes active on the target node and when network traffic can flow successfully to and from it.
Previously, the OpenStack driver would wait until Nova reported live migration as complete before creating the workload endpoint on the target node, which left a window where the VM was running but its security and routing programming was not yet in place.

The driver now declares the migration to Calico at the "pre-live-migration" point, creates the target-side `WorkloadEndpoint` up front, and signals back into Neutron via `live_migration_wait_for_vif_plug` once initial networking and security policy are programmed.
Combined with BIRD's new BGP-based route priority propagation, this delivers a noticeably tighter cutover for VMs migrating across nodes.

For a more in-depth look please see [Live migration for OpenStack VMs](https://docs.tigera.io/calico/latest/networking/openstack/live-migration). 

#### Tech preview: install Calico without the Calico API server

The `projectcalico.org/v3` API can now be served directly as CRDs, with no aggregated API server required. This removes the ordering headaches that GitOps tools have hit, eases install on managed platforms (EKS, AKS), and simplifies HA. Existing clusters continue to use the API server unless explicitly migrated. See [Enable native v3 CRDs](https://docs.tigera.io/calico/latest/operations/native-v3-crds) to try it out, and [Migrate to native v3 CRDs](https://docs.tigera.io/calico/latest/operations/crd-migration) for migrating an existing cluster.

Related issue: [#6412](https://github.com/projectcalico/calico/issues/6412).

Implemented across several PRs:
- [#10447](https://github.com/projectcalico/calico/pull/10447) - v3 CRD definitions and dual-mode support in libcalico-go.
- [#11232](https://github.com/projectcalico/calico/pull/11232) - relaxed policy naming, removing the `<tier>.` prefix requirement.
- [#11493](https://github.com/projectcalico/calico/pull/11493) - migration controller to align underlying policy storage with v3 API names.
- [#11803](https://github.com/projectcalico/calico/pull/11803) - validating admission webhook for tier-based RBAC on policy CRUD.
- [#12062](https://github.com/projectcalico/calico/pull/12062) - manifest-mode install path with standalone webhooks and v1-to-v3 CRD migration.

#### Maglev-style service load balancer (eBPF)

Calico's eBPF data plane now supports Maglev-style consistent-hash load balancing for Kubernetes Services, enabling ingress traffic to fail over to a different load-balancing node without breaking existing connections when a node becomes unavailable.
Maglev produces a stable, deterministic backend selection across all nodes that is preserved as long as the connection's 5-tuple and the backend set are unchanged, with minimal disruption when the backend set churns.
This is based on Google's published [Maglev paper](https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/44824.pdf).

To opt a service into Maglev, annotate it as documented; this is intended for externally-reachable services such as `LoadBalancer`, `ExternalIP`, and reachable `ClusterIP` services.
`NodePort` services are excluded because the client is already tied to a specific node and would not benefit from failover.
New `FelixConfiguration` settings allow administrators to increase the maximum size of the underlying Maglev lookup tables to fit the scale of their deployments. A new Prometheus metric `felix_bpf_conntrack_maglev_entries_total` is exported so operators can observe how many connections are being handled via Maglev.

For more information, please see [Add Maglev load balancing to a service](https://docs.tigera.io/calico/latest/networking/configuring/add-maglev-load-balancing). 

#### Hand off cluster route programming from BIRD to Felix

Introduce ProgramClusterRoutes option in BGPConfiguration to control how a cluster node gets a route to a workload on another node, when that workload's IP comes from an IP Pool with vxlanMode: Never.
When ProgramClusterRoutes is Enabled, confd and BIRD program that route. When ProgramClusterRoutes is Disabled, it is expected that Felix will program that route.

Felix always programs such routes for IP Pools with vxlanMode: Always or vxlanMode: CrossSubnet. [Default: Enabled]

For more information about the configuration please see [Cluster route programming](https://docs.tigera.io/calico/latest/networking/configuring/vxlan-ipip#cluster-route-programming). 

#### ClusterNetworkPolicy support

Calico now implements the standard fields of upstream Kubernetes [`ClusterNetworkPolicy`](https://github.com/kubernetes-sigs/network-policy-api) API, including the experimental network peers and named ports functionality.
On startup, Calico creates two new static tiers — `kube-admin` (order 1,000) and `kube-baseline` (order 10,000,000) — and `ClusterNetworkPolicy` resources are mapped into the corresponding tier based on whether their `tier` field is `Admin` or `Baseline`.
This gives cluster administrators a standard, portable way to express cluster-wide allow/deny policy that sits above and below the developer-managed `NetworkPolicy` layer.

As part of this work, Calico's previous support for the older `AdminNetworkPolicy` (ANP) and `BaselineAdminNetworkPolicy` (BANP) APIs has been removed in favor of `ClusterNetworkPolicy`, and the corresponding `adminnetworkpolicy` and `baselineadminnetworkpolicy` static tiers are gone.
Existing ANP and BANP resources must be removed or rewritten as `ClusterNetworkPolicy` before upgrading to v3.32, since v3.32 and newer will no longer enforce them.

#### Whisker policy verdict and UI improvements

Whisker, Calico's flow-log UI, has been extended with a richer set of filters and clearer surfacing of policy verdict information so that operators can quickly understand why a flow was allowed, denied, or staged.
New filter dimensions include `Policy`, `Reporter`, `Action`, `Start time`, and a dedicated "pending/staged actions" filter that highlights flows whose verdict came from a staged policy rather than an enforced one.
The UI has been polished with updated tooltips and helper text on the policy filter, taller filter controls so long policy names are readable, refreshed Calico iconography, and several memoization and rendering bug fixes that make the experience faster and more reliable on busy clusters.

The Whisker backend has been refactored alongside the UI: `PolicyMatch` fields now use a structured `StringMatch` type for more flexible matching, and stream de-duplication has moved from the client into the backend so the UI no longer has to filter out duplicate flow events itself.


#### Istio Ambient Mode support

Project Calico now integrates with Istio's Ambient Mesh data plane, bringing the security and observability benefits of a service mesh to clusters running Calico's network policy without requiring sidecar injection.
Two new Felix configuration fields — `istioAmbientMode` and `istioDSCPMark` — control how Felix interoperates with Istio's ztunnel: when ambient mode is enabled, Calico preserves the original destination port of service traffic instead of redirecting it to ztunnel's port 15008, which keeps Calico's microsegmentation `NetworkPolicy` rules accurate end-to-end.


#### Reset TCP connections when a backend pod is deleted (eBPF)

The eBPF data plane now sends a TCP RST to clients whose connection is pinned to a backend pod that has just been deleted, instead of silently leaving the connection in a half-open state until it eventually times out.
This is particularly valuable in combination with the new Maglev load balancer: when a backend disappears, clients are notified immediately and can reconnect, at which point Maglev's consistent-hash selection routes them to a healthy backend.
This release adds a dedicated BPF program for emitting RSTs, a workload-removal scanner that flags conntrack entries belonging to deleted backends, and adjusts the stale-NAT scanner so that TCP NAT entries are preserved long enough for the reset to be sent.
#### Breaking change

- The `tigera-operator` Helm chart no longer includes custom resource definitions for Calico. A new `crd.projectcalico.org.v1` companion Helm chart has been introduced which includes the CRDs instead. [calico 11727](https://github.com/projectcalico/calico/pull/11727) (@caseydavenport)


#### Bug fixes

- Fixes an issue where calico-apiserver generated malformed OpenAPI schema definitions after the Kubernetes 1.35 dependency bump, which could cause ArgoCD and similar tools to fail schema validation. [calico 12637](https://github.com/projectcalico/calico/pull/12637) (@MichalFupso)
- Typha now rejects oversized inbound client gob frames before reading them, preventing a potential denial-of-service caused by excessive memory allocation. [calico 12590](https://github.com/projectcalico/calico/pull/12590) (@Behnam-Shobiri)
- Removed sensitive material (auth tokens, kubeconfig contents, etcd credentials, and inline certificates/keys) from log output. Logs that previously included full client-config or environment-variable dumps now log structured non-secret fields instead. [calico 12588](https://github.com/projectcalico/calico/pull/12588) (@Behnam-Shobiri)
- Fix LoadBalancer IPAM race on kube-controllers startup that could assign multiple addresses to a Service. [calico 12568](https://github.com/projectcalico/calico/pull/12568) (@MichalFupso)
- `calicoctl` no longer logs raw client config on startup, which previously included `K8sAPIToken`, inline kubeconfig, `EtcdPassword`, and inline etcd key/cert material. The replacement log entry reports only non-sensitive fields and boolean "set" indicators for each credential. [calico 12536](https://github.com/projectcalico/calico/pull/12536) (@Behnam-Shobiri)
- app-policy (Dikastes): normalize HTTP request-target before evaluating Application Layer Policy path rules, and reject shapes whose resolved form depends on upstream-specific decoding. Request paths are now RFC 3986 / RFC 7230 normalized (decode percent-escapes once, resolve dot-segments and repeated slashes, fold backslashes, strip matrix parameters per segment) and prefix matches are anchored to path-segment boundaries. Paths whose decoded form still contains percent-encoded path separators (%2e / %2f / %5c), or contains a null byte, are rejected. [calico 12532](https://github.com/projectcalico/calico/pull/12532) (@electricjesus)
- Sanitize CNI plugin log output. [calico 12526](https://github.com/projectcalico/calico/pull/12526) (@Behnam-Shobiri)
- Fixed a Felix eBPF cleanup race condition that could cause a nil-pointer panic when an interface disappeared during TC qdisc cleanup. [calico 12480](https://github.com/projectcalico/calico/pull/12480) (@Behnam-Shobiri)
- Use cryptographically secure random number generator for X.509 certificate serial numbers. [calico 12468](https://github.com/projectcalico/calico/pull/12468) (@Behnam-Shobiri)
- ebpf: Fix  conntrack counter accounting for NAT-outgoing flows where bytes_in and packets_in were always zero. [calico 12323](https://github.com/projectcalico/calico/pull/12323) (@lucastigera)
- Fix a data race in Felix's BPF endpoint manager when comparing HostEndpoint protobuf messages, which could cause flaky race-detector failures or subtle logic errors under concurrent access. [calico 12174](https://github.com/projectcalico/calico/pull/12174) (@fasaxc)
- Fix goroutine leak after nflog reader restart. [calico 12159](https://github.com/projectcalico/calico/pull/12159) (@fasaxc)
- Fix a goroutine leak in Felix's interface monitor that could occur on netlink reconnect. [calico 12139](https://github.com/projectcalico/calico/pull/12139) (@fasaxc)
- Fix memory leak in routing table logic. The "interfaces to ARP" set was not properly cleaned out when an interface was removed, resulting in leaving old interface names in the set. [calico 12138](https://github.com/projectcalico/calico/pull/12138) (@fasaxc)
- Fix dikastes L7 application layer policy enforcement being broken since v3.30.0 due to missing ALPCheckProvider registration. [calico 11986](https://github.com/projectcalico/calico/pull/11986) (@electricjesus)
- ebpf: Fix kernel crash on UDP GSO FRAGLIST packets after partial bpf_skb_pull_data by fully linearizing the packet. Auto-detected via kernel version (fixed in 6.16+), overridable via FeatureDetectOverride. [calico 11920](https://github.com/projectcalico/calico/pull/11920) (@tomastigera)
- Fix advertisement of /32 LB IP addresses when not present in the Service Spec [calico 11917](https://github.com/projectcalico/calico/pull/11917) (@caseydavenport)
- LoadBalancer controller prevent nil pointer dereference in handleBlockUpdate [calico 11913](https://github.com/projectcalico/calico/pull/11913) (@MichalFupso)
- Fix calico-kube-controllers IPAM GC controller getting stuck when cleaning up nodes during rapid scale-down. [calico 11906](https://github.com/projectcalico/calico/pull/11906) (@caseydavenport)
- Fix failure to enable ingress bandwidth QoS controls when a non-default qdisc previously existed on the workload interface (handle != 0). [calico 11899](https://github.com/projectcalico/calico/pull/11899) (@coutinhop)
- Fix CNI delete timeout to start after IPAM lock acquisition, preventing "context deadline exceeded" failures during high pod churn [calico 11824](https://github.com/projectcalico/calico/pull/11824) (@sudheernv)
- Fix API server startup failure when configuring TLS 1.3-only cipher suites. The API server now supports the TLS_MIN_VERSION environment variable (values: "1.2" or "1.3") to control the minimum TLS version. Set TLS_MIN_VERSION=1.3 when using TLS 1.3-only cipher suites to avoid HTTP/2 cipher validation errors. [calico 11812](https://github.com/projectcalico/calico/pull/11812) (@KameHameHa21110)
- Fix BGP syncing on Windows [calico 11748](https://github.com/projectcalico/calico/pull/11748) (@rbrtbnfgl)
- Bugfix: fix rendering of NatPortRange option when using nftables. [calico 11736](https://github.com/projectcalico/calico/pull/11736) (@nelljerram)
- Fix that come components would add square brackets to IPv4s when forming host:port addresses (treating them like IPv6 addresses). [calico 11721](https://github.com/projectcalico/calico/pull/11721) (@fasaxc)
- Fix that the CNI plugin installer generated a malformed URL for IPv4 addresses.  This bug was exposed by a fix to the golang URL parser. [calico 11713](https://github.com/projectcalico/calico/pull/11713) (@fasaxc)
- ebpf: fix - The eBPF dataplane regressed when switching to the flow based vxlan device and the VNI is always 0 regardless of the actual setting [calico 11692](https://github.com/projectcalico/calico/pull/11692) (@tomastigera)
- ebpf: fixed performance for UDP (QUIC/HTTP3) nodeports [calico 11653](https://github.com/projectcalico/calico/pull/11653) (@tomastigera)
- eBPF: fix that local workload with borrowed IPs lose connectivity [calico 11640](https://github.com/projectcalico/calico/pull/11640) (@fasaxc)
- ebpf - Fixed routing of fragmented packets from a pod with multiple host interfaces. [calico 11616](https://github.com/projectcalico/calico/pull/11616) (@sridhartigera)
- Don't uninstall CNI and kube-proxy service when using non-Calico CNI on Windows with operator install. [calico 11614](https://github.com/projectcalico/calico/pull/11614) (@coutinhop)
- Fix possible segmentation fault in IP address parsing code [calico 11602](https://github.com/projectcalico/calico/pull/11602) (@majiayu000)
- Restrict Calico ML2 leader election participation to the parent Neutron server process, preventing API and worker processes from becoming leader and reducing contention under high API load. [calico 11580](https://github.com/projectcalico/calico/pull/11580) (@chaowang987)
- ebpf: fix bug where ingress and egress policy program indexes were confused, resulting in cleaning up the wrong policy program. [calico 11565](https://github.com/projectcalico/calico/pull/11565) (@fasaxc)
- bpf: Fix IP fragment reassembly between 8,000 and 16,000 bytes.  Offsets were miscalculated due to incorrect order of operations. [calico 11557](https://github.com/projectcalico/calico/pull/11557) (@fasaxc)
- Fix potential HEP / WEP chain name conflicts in IPVS mode. [calico 11541](https://github.com/projectcalico/calico/pull/11541) (@terror96)
- Fix race in EndpointSlice logic for BGP service advertisement [calico 11503](https://github.com/projectcalico/calico/pull/11503) (@sergeimonakhov)
- eBPF - Fixed map operations for older kernels. [calico 11482](https://github.com/projectcalico/calico/pull/11482) (@sridhartigera)
- Fix kube-controllers watch handling to avoid leaking watchers when the configuration watch is recreated. [calico 11433](https://github.com/projectcalico/calico/pull/11433) (@fusidic)
- eBPF - Fixed loading connecttime load balancer program in 6.12 kernel [calico 11399](https://github.com/projectcalico/calico/pull/11399) (@sridhartigera)
- Fix: IPPool CIDR Validation Fails on Semantically-Identical IPv6 CIDRs [calico 11385](https://github.com/projectcalico/calico/pull/11385) (@skoryk-oleksandr)
- OpenStack: don't force the MTU to 1500 in IPv6 router advertisements [calico 11380](https://github.com/projectcalico/calico/pull/11380) (@kristiangronas)
- Fix startup failure when using etcdv3 storage without any Kubernetes API server. [calico 11361](https://github.com/projectcalico/calico/pull/11361) (@Nativu5)
- Felix now explicitly sets priority 1024 for IPv6 routes instead of relying on kernel default, ensuring routes round-trip correctly when read from the kernel. [calico 11356](https://github.com/projectcalico/calico/pull/11356) (@Copilot)
- Re-create and swap out Calico ipsets that are not possible to list due to different failures like user-space/kernel incompatibility. [calico 11340](https://github.com/projectcalico/calico/pull/11340) (@mazdakn)
- Fix AllowSpoofedSourcePrefixes for dual stack clusters. [calico 11338](https://github.com/projectcalico/calico/pull/11338) (@sknat)
- OpenStack bugfix: request etcd compaction periodically regardless of how long resync takes, or if periodic resync is disabled. [calico 11306](https://github.com/projectcalico/calico/pull/11306) (@nelljerram)
- Fixes pending policy evaluation race post endpoint deletion [calico 11281](https://github.com/projectcalico/calico/pull/11281) (@dimitri-nicolo)
- ebpf: kube-proxy binds service health probes to node IPs instead of "any" [calico 11280](https://github.com/projectcalico/calico/pull/11280) (@tomastigera)
- Fixed a race in flow log generation that could mis-report service traffic as denied when a backing pod was deleted while the packet was being processed. [calico 11276](https://github.com/projectcalico/calico/pull/11276) (@dimitri-nicolo)
- fix (release-tool): include image tarballs in release archive file [calico 11253](https://github.com/projectcalico/calico/pull/11253) (@radTuti)
- ebpf: Do not adjust gso_size after nodeport tunnel vxlan decap. There is no guarantee that there would be enough data after removing tunnel headers. The packet is shrunk by 50 bytes while the gso_size would grow. Kernel would drop the packet if the original gso packet is too small. [calico 11252](https://github.com/projectcalico/calico/pull/11252) (@juliantaylor)
- Fix BGP advertisement of externalIP addresses on Services with type=ClusterIP. [calico 11204](https://github.com/projectcalico/calico/pull/11204) (@caseydavenport)
- CNI plugin: double-check the IPv6 LL address on the host side of the veth and refresh it if it seems wrong.  Sometimes the kernel uses a stale MAC to calculate it. [calico 11182](https://github.com/projectcalico/calico/pull/11182) (@fasaxc)
- Fix IPAM block leak of older blocks when deleting IP pools. [calico 11179](https://github.com/projectcalico/calico/pull/11179) (@caseydavenport)
- ebpf: do not blindly redirect back to the same host iface - fixed regression from 3.29 to 3.30 [calico 11117](https://github.com/projectcalico/calico/pull/11117) (@tomastigera)
- Fix that empty source/destination EntityRules would serialize as '{}' instead of being omitted. Due to change of JSON library, this makes the errors reported for unexpected fields slightly less clear. [calico 11116](https://github.com/projectcalico/calico/pull/11116) (@fasaxc)
- Fix potential nil pointer dereference in load balancer IP allocation controller [calico 11092](https://github.com/projectcalico/calico/pull/11092) (@caseydavenport)
- Bugfix: reinstate support for VMs that are configured not to respond to ARP requests. [calico 11052](https://github.com/projectcalico/calico/pull/11052) (@nelljerram)
- Add missing staged policy permissions to apiserver.yaml [calico 11022](https://github.com/projectcalico/calico/pull/11022) (@caseydavenport)
- Various fixes for 32bit architectures. [calico 11009](https://github.com/projectcalico/calico/pull/11009) (@twz123)
- Fix slow IPAM release performance when releasing IPs from disabled or deleted pools (especially for bulk deletions like those done by IPAM GC). Consider disabled pools as potential IP owners and cache any loaded blocks for fast access. [calico 10973](https://github.com/projectcalico/calico/pull/10973) (@fasaxc)

#### Other changes

- Update bundled Istio version to 1.29.2, including CVE fixes for moby/spdystream, prometheus/prometheus, and opentelemetry-go/otel/sdk. [calico 12581](https://github.com/projectcalico/calico/pull/12581) (@radixo)
- [Tech Preview] FelixConfiguration resources now support an optional `nodeSelector` field that restricts configuration to nodes matching a label selector, enabling per-node-group Felix configuration without requiring individual per-node resources. At most one selector-scoped FelixConfiguration should match any given node; if multiple match, the oldest by creation time wins to avoid disrupting existing working configuration. Overlapping selectors are treated as a misconfiguration and this behavior may change in future releases. [calico 12497](https://github.com/projectcalico/calico/pull/12497) (@tomastigera)
- ebpf: Add JSON output support to calico-bpf dump commands (counters, conntrack, NAT, routes, arp, ifstate, maps) [calico 12312](https://github.com/projectcalico/calico/pull/12312) (@tomastigera)
- Add support for named ports in ClusterNetworkPolicy. [calico 12227](https://github.com/projectcalico/calico/pull/12227) (@mazdakn)
- Calico's BIRD configuration (generated by the confd subcomponent of calico-node) has been enhanced to propagate route priorities within a contiguous AS (autonomous system).  This is one of a set of changes needed for seamless live migration of VMs. [calico 12089](https://github.com/projectcalico/calico/pull/12089) (@nelljerram)
- Make live migration more seamless in Calico for OpenStack; specifically in that there should be much less latency after the VM becomes active on the target node, before network traffic can be successfully sent to and from that VM. [calico 12064](https://github.com/projectcalico/calico/pull/12064) (@nelljerram)
- Added manifest-mode support for deploying Calico with native v3 CRDs (projectcalico.org/v3) without the operator, including a standalone webhooks manifest and v1-to-v3 CRD migration support. [calico 12062](https://github.com/projectcalico/calico/pull/12062) (@caseydavenport)
- calico-bpf policy dump: Improved output readability with hierarchical indentation, human-readable rule actions, and resolved IP set members instead of opaque hex IDs. [calico 12050](https://github.com/projectcalico/calico/pull/12050) (@sridhartigera)
- Calico now builds and publishes its own customized Istio images (`pilot`, `proxyv2`, `install-cni`, and `ztunnel`) with Calico-specific patches applied (DSCP magic-mark for transparent networking, plus CVE-fix dependency bumps). These were previously available only in Calico Enterprise. [calico 12039](https://github.com/projectcalico/calico/pull/12039) (@radixo)
- Support live migration for KubeVirt VMs. [calico 12038](https://github.com/projectcalico/calico/pull/12038) (@nelljerram)
- ebpf: Allow disabling BPF kube-proxy health check by setting port to 0 [calico 12033](https://github.com/projectcalico/calico/pull/12033) (@tomastigera)
- `calico-bpf nat dump` now accepts optional `<ip> <port> <proto>` arguments to scope output to a single service (including all sibling frontends sharing the same service ID), and a new `--group-by-service` flag groups frontends with their shared backend list printed once per service. [calico 12021](https://github.com/projectcalico/calico/pull/12021) (@Copilot)
- BGPFilter: Add new match criteria (PeerType, Communities, ASPathPrefix, Priority) and route operations (AddCommunity, PrependASPath, SetPriority) to BGPFilter rules, enabling advanced BGP policy use cases such as route priority propagation for KubeVirt live migration. [calico 12002](https://github.com/projectcalico/calico/pull/12002) (@song-jiang)
- [Tech Preview] FelixConfiguration resources now support an optional `nodeSelector` field that restricts configuration to nodes matching a label selector, enabling per-node-group Felix configuration without requiring individual per-node resources. At most one selector-scoped FelixConfiguration should match any given node; if multiple match, the oldest by creation time wins to avoid disrupting existing working configuration. Overlapping selectors are treated as a misconfiguration and this behavior may change in future releases. [calico 11977](https://github.com/projectcalico/calico/pull/11977) (@tomastigera)
- `calicoctl ipam configure` now accepts `--kubevirt-ip-persistence=<Enabled|Disabled>` to toggle whether KubeVirt VMs retain a persistent IP across reboots, live migrations, and pod evictions. Pairs with the IPAM-side support added in [#11865](https://github.com/projectcalico/calico/pull/11865). [calico 11971](https://github.com/projectcalico/calico/pull/11971) (@skoryk-oleksandr)
- Introduces istioAmbientMode and istioDSCPMark to felix for integration with Calico Istio compilation. [calico 11880](https://github.com/projectcalico/calico/pull/11880) (@radixo)
- Calico IPAM now supports persistent IP addresses for KubeVirt VMs, allowing VMs to retain their IPs across reboots, live migrations, and pod evictions. [calico 11865](https://github.com/projectcalico/calico/pull/11865) (@song-jiang)
- Applied code modernization with "go fix", this had a small impact on the Calico v1 APIs due to removing some invalid "omitempty" annotations on JSON fields. [calico 11864](https://github.com/projectcalico/calico/pull/11864) (@fasaxc)
- calico-node: base image bumped from UBI 8 to UBI 9 [calico 11860](https://github.com/projectcalico/calico/pull/11860) (@lucastigera)
- Felix now keeps a cache of recently computed interned label maps.  This reduces memory usage, particularly with large deployments or large numbers of namespaces. [calico 11854](https://github.com/projectcalico/calico/pull/11854) (@fasaxc)
- Skip unnecessary calls to nft when running in iptables mode. [calico 11848](https://github.com/projectcalico/calico/pull/11848) (@haojiwu)
- Felix now defers calculation of selector label restrictions until they are needed, saving RAM when many selectors are active. [calico 11846](https://github.com/projectcalico/calico/pull/11846) (@fasaxc)
- Introduce ProgramClusterRoutes option in BGPConfiguration to control how a cluster node gets a route to a workload on another node, when that workload's IP comes from an IP Pool with vxlanMode: Never. When ProgramClusterRoutes is Enabled, confd and BIRD program that route. When ProgramClusterRoutes is Disabled, it is expected that Felix will program that route. Felix always programs such routes for IP Pools with vxlanMode: Always or vxlanMode: CrossSubnet. [Default: Enabled] [calico 11845](https://github.com/projectcalico/calico/pull/11845) (@mazdakn)
- The Tier allow-tigera has been renamed to calico-system.  If your Calico installation does not use the Tigera Operator, or if you have created custom Network Policies within this Tier, you must manually update your resources to reference the new Tier name.  Please review and adjust any affected policies to ensure continued correct behavior. [calico 11842](https://github.com/projectcalico/calico/pull/11842) (@radixo)
- Use indexer for EndpointSlice lookups to avoid O(n) scans in confd [calico 11838](https://github.com/projectcalico/calico/pull/11838) (@haojiwu)
- Improve resource consumption when IP_AUTODETECTION_METHOD is set to cidr on Linux instances with many addresses. [calico 11834](https://github.com/projectcalico/calico/pull/11834) (@imbstack)
- Update Envoy Gateway from v1.5.6 to v1.5.7. [calico 11820](https://github.com/projectcalico/calico/pull/11820) (@electricjesus)
- calicoctl cluster diags now collects Multus network-attachment-definitions. [calico 11816](https://github.com/projectcalico/calico/pull/11816) (@Copilot)
- Adds a validating admission webhook that enforces tier-based RBAC on `(Global)NetworkPolicy` and staged-policy CRUD operations. This makes tier permissions enforceable in manifest-mode (no-API-server) installs by checking that the requesting user has rights on the policy's tier before allowing the write. [calico 11803](https://github.com/projectcalico/calico/pull/11803) (@caseydavenport)
- ebpf - Reset the tcp connection when the backend is deleted. [calico 11762](https://github.com/projectcalico/calico/pull/11762) (@sridhartigera)
- ebpf:  Added support to Kubernetes Service Traffic Distribution for Services and for the `service.kubernetes.io/topology-mode` annotation, replacing the deprecated `service.kubernetes.io/topology-aware-hints` behavior. [calico 11751](https://github.com/projectcalico/calico/pull/11751) (@lucastigera)
- We continue testing Calico against OpenStack Caracal, but have stopped testing Calico against OpenStack Yoga.  This is because Yoga has now been "unmaintained" for over a year, and is not compatible with current CI platforms based on Ubuntu 22.04. [calico 11742](https://github.com/projectcalico/calico/pull/11742) (@nelljerram)
- The tigera-operator `Installation` CRD now accepts `node`, `felix`, and `confd` as Windows container names (in addition to the legacy `calico-node-windows`), and adds `NodeWindows`, `FelixWindows`, and `ConfdWindows` as `componentResources` keys, allowing per-container resource overrides on Windows nodes. [calico 11735](https://github.com/projectcalico/calico/pull/11735) (@tmjd)
- BREAKING: The `tigera-operator` Helm chart no longer includes custom resource definitions for Calico. A new `crd.projectcalico.org.v1` companion Helm chart has been introduced which includes the CRDs instead. [calico 11727](https://github.com/projectcalico/calico/pull/11727) (@caseydavenport)
- Support custom qps and burst for Kubernetes client in calico and calico-ipam CNI plugins. [calico 11674](https://github.com/projectcalico/calico/pull/11674) (@renyunkang)
- ebpf: update BPFExtToServiceConnmark to work with fib lookup with kernel 6.10+ The mark allows steering response packet via different route than ingress traffic. [calico 11665](https://github.com/projectcalico/calico/pull/11665) (@tomastigera)
- [BPF] Adds new Prometheus metric: `felix_bpf_conntrack_maglev_entries_total` for maglev connection count. [calico 11660](https://github.com/projectcalico/calico/pull/11660) (@aaaaaaaalex)
- Support auto-detection of nftables or iptables based on kube-proxy configuration. [calico 11629](https://github.com/projectcalico/calico/pull/11629) (@caseydavenport)
- feat: push helm charts to OCI registry (`quay.io/calico/charts`) fix: use accurate created date for chart entry in helm index [calico 11626](https://github.com/projectcalico/calico/pull/11626) (@radTuti)
- eBPF: implement allowedSourcePrefixes functionality [calico 11615](https://github.com/projectcalico/calico/pull/11615) (@turkmenkaan)
- Update flow log policy hit syntax used by Felix so that it explicitly includes the policy kind. [calico 11603](https://github.com/projectcalico/calico/pull/11603) (@caseydavenport)
- Add support for configurable dnsPolicy in tigera-operator deployment to fix DNS circular dependency issues on AWS EKS. Users can now override the default ClusterFirstWithHostNet behavior by setting dnsPolicy: Default in values.yaml. This change maintains backward compatibility with existing deployments. [calico 11595](https://github.com/projectcalico/calico/pull/11595) (@kalavt)
- Adds configurable field `resync_max_interval_secs` that defines the max time allowed between successful periodic resyncs. Logs an error message if the interval exceeds the threshold. [calico 11577](https://github.com/projectcalico/calico/pull/11577) (@LeoBJenkins)
- Restrict LogPrefix in FelixConfiguration to alphanumeric, :, %, /, _, - and space characters. [calico 11566](https://github.com/projectcalico/calico/pull/11566) (@mazdakn)
- Whisker:  Added new filtering capabilities including "Reporter" filter, "pending/staged actions" filter [calico 11556](https://github.com/projectcalico/calico/pull/11556) (@skoryk-oleksandr)
- Bump bundled Envoy Gateway to v1.5.6 [calico 11527](https://github.com/projectcalico/calico/pull/11527) (@nelljerram)
- Introduce logActionRateLimit and logActionRateLimitBurst in FelixConfiguration to rate limit the number of hitting a rule with LOG action. [calico 11514](https://github.com/projectcalico/calico/pull/11514) (@mazdakn)
- Define specifiers to allow users include policy details in system logs generated from rules with LOG action. %t: Tier name where policy is placed. %k: Policy or profile kind. Short names are used. For example, gnp for GlobalNetworkPolicy. %n: Policy name. %p: Namespaced policy name. Either namespace/name for namespaced kinds or just name for non namespaced ones. [calico 11496](https://github.com/projectcalico/calico/pull/11496) (@mazdakn)
- Add controller to migrate underlying policy storage to use v3 API names. [calico 11493](https://github.com/projectcalico/calico/pull/11493) (@caseydavenport)
- Rotated log files are now compressed to reduce host disk usage. [calico 11467](https://github.com/projectcalico/calico/pull/11467) (@hjiawei)
- Adjust JSON parsing logic to give unique stack trace per resource type.  Makes memory profiles a lot more descriptive. [calico 11342](https://github.com/projectcalico/calico/pull/11342) (@fasaxc)
- Calico Windows container images have been updated to use Nano Server LTSC 2019 instead of 1809. [calico 11330](https://github.com/projectcalico/calico/pull/11330) (@hjiawei)
- Remove deprecated iptablesLockTimeout parameter and associated function.  Modern versions of iptables-restore always take the lock on their own so using it would cause immediate deadlock. [calico 11326](https://github.com/projectcalico/calico/pull/11326) (@fasaxc)
- Rev etcd client to v3.6.5.  Rev server used in tests to v3.5.24. [calico 11288](https://github.com/projectcalico/calico/pull/11288) (@fasaxc)
- Deprecated the "L2Only" value for BPFRedirectToPeer. BPFRedirectToPeer="Enabled" now explicitly allows direct redirection to the peer side from both L2 and L3 host devices (e.g. IPIP/WireGuard). [calico 11279](https://github.com/projectcalico/calico/pull/11279) (@sridhartigera)
- updated tigera-operator RBAC: create mutatingwebhooks, and update mutatingwebhooks. update restricted to specific resourceNames: envoy-gateway-topology-injector.tigera-gateway [calico 11257](https://github.com/projectcalico/calico/pull/11257) (@electricjesus)
- Default KubeControllersConfiguration.LoadBalancer when not set to AllServices [calico 11251](https://github.com/projectcalico/calico/pull/11251) (@MichalFupso)
- Naming restrictions for NetworkPolicy, GlobalNetworkPolicy, and all staged policy variants have been relaxed to no longer require the policy tier prefix for policies in non-default tiers. Calico will perform an automatic upgrade of existing policies to be compatible with this change on upgrade. [calico 11232](https://github.com/projectcalico/calico/pull/11232) (@caseydavenport)
- Enabled FIB for IPIP so that we can redirect packets in eBPF. [calico 11230](https://github.com/projectcalico/calico/pull/11230) (@sridhartigera)
- ebpf: start only a single kube-proxy health-server in dual stack mode [calico 11223](https://github.com/projectcalico/calico/pull/11223) (@tomastigera)
- kube-controllers: improve logs around load balancer IPAM. [calico 11184](https://github.com/projectcalico/calico/pull/11184) (@fasaxc)
- BPF: Adds support for Maglev-style service loadbalancer, which enables service traffic failover to another loadbalancer in case of a failure. [calico 11159](https://github.com/projectcalico/calico/pull/11159) (@aaaaaaaalex)
- IPAM: when a pool is full, try to reclaim empty blocks from other nodes before giving up. Helps the most with special-purpose block-size-/32 pools; prevents blocks from getting stranded on nodes that can't use them. [calico 11149](https://github.com/projectcalico/calico/pull/11149) (@fasaxc)
- Removing AdminNetworkPolicy and BaselineAdminNetworkPolicy API support in favor of ClusterNetworkPolicy. These resources must be removed or replaced by ClusterNetworkPolicy before upgrade, since Calico v3.32 and newer won't enforce them. Static tiers named adminnetworkpolicy and baselineadminnetworkpolicy are removed. [calico 11144](https://github.com/projectcalico/calico/pull/11144) (@mazdakn)
- Openstack: Stop compressing DWARF debugging information with dwz because Golang 1.25 has moved to the unsupported DWARF 5 [calico 11074](https://github.com/projectcalico/calico/pull/11074) (@matthewdupre)
- ebpf: calico-node -bpf policy dump prints the End of (Rule | Policy | Tier) in the default concise output [calico 11071](https://github.com/projectcalico/calico/pull/11071) (@tomastigera)
- ebpf: Felix now disables BPF JIT hardening for its own privileged BPF programs by default, because hardening can slow large-policy programming by 10–20x on systems where it is forced on (e.g. Bottlerocket). The new `BPFJITHardening` Felix config option overrides this: set it to `Strict` to honour the system-wide setting instead. [calico 11024](https://github.com/projectcalico/calico/pull/11024) (@Copilot)
- Make Calico's backing CRDs optional. Calico will no longer fail to start if a CRD is missing. [calico 11023](https://github.com/projectcalico/calico/pull/11023) (@caseydavenport)
- ebpf: BPFKubeProxyHealtzPort allows to change the kube-proxy healthz server port [calico 11011](https://github.com/projectcalico/calico/pull/11011) (@Copilot)
- Add keepalive time to BGPPeer API [calico 10998](https://github.com/projectcalico/calico/pull/10998) (@lgYanami)
- Calico is now built with Kubernetes v1.33.5. [calico 10994](https://github.com/projectcalico/calico/pull/10994) (@dependabot[bot])
- Envoy Gateway version updated to v1.5.4 [calico 10984](https://github.com/projectcalico/calico/pull/10984) (@electricjesus)
- OpenStack: support IPv6 subnets using SLAAC [calico 10876](https://github.com/projectcalico/calico/pull/10876) (@kristiangronas)
- Add support for the standard and experimental (networks peers and named ports) functionalities of the new k8s ClusterNetworkPolicy API. Two new static tiers named kube-admin(order 1,000) and kube-baseline(order 10,000,000) are created at startup where ClusterNetworkPolicy resources in Admin tier, and ClusterNetworkPolicy in Baseline resources in Baseline tier are enforced respectively. [calico 10810](https://github.com/projectcalico/calico/pull/10810) (@mazdakn)
- Support for TLS on Felix Prometheus metrics endpoint. [calico 10495](https://github.com/projectcalico/calico/pull/10495) (@peppi-lotta)
- Tech-preview support for using the projectcalico.org/v3 API directly as CRDs, without the need for an extension API server. [calico 10447](https://github.com/projectcalico/calico/pull/10447) (@caseydavenport)
- The tigera-operator helm chart no longer includes crd.projectcalico.org CRDs. They must be created / updated prior to running the chart. [calico 10447](https://github.com/projectcalico/calico/pull/10447) (@caseydavenport)
