DOCS-2968: Publish Calico Open Source 3.32.2 - #2981
Merged
Merged
Conversation
Calico v3.32 changed how policies in the default tier are stored in the etcd datastore. Kubernetes clusters migrate existing data automatically via kube-controllers, but OpenStack clusters do not run kube-controllers as a service, so the migration must be run once by hand after upgrading from a version earlier than v3.32 (projectcalico/calico#13221). Add the procedure to the OpenStack upgrade page: symptoms if skipped, preconditions (all nodes upgraded first; duplicate-pair cleanup), the docker invocation including TLS and username/password auth variants, completion output, idempotency, and verification. The version-3.32 copy differs in using the standalone calico/kube-controllers image (the combined calico/calico image is v3.33+) and in noting that the mode requires v3.32.2 or later.
✅ Deploy Preview for calico-docs-preview-next ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview succeeded!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
There was a problem hiding this comment.
Pull request overview
Publishes Calico Open Source v3.32.2 documentation updates by bumping versioned release metadata/variables, adding the v3.32.2 release notes entry, and documenting the one-time OpenStack policy name migration procedure needed when upgrading from pre-v3.32 etcd clusters.
Changes:
- Add a “migrate policy names” procedure to the OpenStack upgrade guide (unversioned and v3.32 versioned docs).
- Update v3.32 versioned release metadata and variables for v3.32.2 (manifests URL, Envoy Gateway version, operator version reference).
- Publish the Calico Open Source 3.32.2 release notes section in the v3.32 tree.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| calico/operations/upgrading/openstack-upgrade.mdx | Adds a policy data migration callout + procedure for OpenStack upgrades from pre-v3.32. |
| calico_versioned_docs/version-3.32/variables.js | Bumps v3.32 versioned variables to v3.32.2 (title/manifests URL/envoy version). |
| calico_versioned_docs/version-3.32/releases.json | Adds a new v3.32.2 release entry (components + operator) at the top of the releases list. |
| calico_versioned_docs/version-3.32/release-notes/index.mdx | Uncomments and fills in the v3.32.2 bugfix release notes section. |
| calico_versioned_docs/version-3.32/operations/upgrading/openstack-upgrade.mdx | Adds the policy data migration procedure to the v3.32 OpenStack upgrade guide, including a version requirement note. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+240
to
+243
| :::note | ||
|
|
||
| This requires the v3.32.2 (or later) image; it is not present in v3.32.0 or | ||
| v3.32.1. |
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.
Suppressed comments (3)
Previously missed (1) — in code that hasn't changed since the last review.
calico_versioned_docs/version-3.32/release-notes/index.mdx:319
- In the release notes, this bullet starts with "Fix" (imperative) while surrounding bullets use "Fixes/Fixed"; updating it improves grammatical consistency.
This issue also appears on line 321 of the same file.
- Fix VXLAN traffic being dropped when the kernel masqueraded a tunnel flow's source port onto the VXLAN port (default 4789). [calico 13628](https://github.com/projectcalico/calico/pull/13628) (@hengqiali)
calico_versioned_docs/version-3.32/release-notes/index.mdx:321
- This bullet reads awkwardly as "Fix that Felix kept..."; consider rephrasing to "Fixes Felix re-emitting..." to match the tense used elsewhere in the list and improve readability.
- Fix that Felix kept re-emitting stale deny flow logs with zero counters (shown in Whisker as a live deny) after a policy change allowed the traffic. [calico 13573](https://github.com/projectcalico/calico/pull/13573) (@radTuti)
calico_versioned_docs/version-3.32/operations/upgrading/openstack-upgrade.mdx:245
- This note refers to an "image", but the instructions here run the local
calicoctlCLI. It should refer to the required calicoctl version/package rather than an image.
:::note
This requires the v3.32.2 (or later) image; it is not present in v3.32.0 or
v3.32.1.
:::
This was referenced Aug 28, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.
Suppressed comments (4)
Previously missed (2) — in code that hasn't changed since the last review.
calico/operations/upgrading/openstack-upgrade.mdx:213
- The relative link to the calicoctl docs is longer than necessary and inconsistent with the nearby
../calicoctl/...links; using the shorter path reduces the chance of mistakes when editing or moving content.
[`calicoctl`](../../operations/calicoctl/index.mdx) successfully on at least
calico_versioned_docs/version-3.32/operations/upgrading/openstack-upgrade.mdx:213
- The relative link to the calicoctl docs is longer than necessary and inconsistent with the nearby
../calicoctl/...links; using the shorter path reduces the chance of mistakes when editing or moving content.
[`calicoctl`](../../operations/calicoctl/index.mdx) successfully on at least
calico_versioned_docs/version-3.32/release-notes/index.mdx:321
- Release-note bullets should use consistent verb tense; this one starts with "Fix" while surrounding bullets use "Fixes"/"Fixed".
- Fix that Felix kept re-emitting stale deny flow logs with zero counters (shown in Whisker as a live deny) after a policy change allowed the traffic. [calico 13573](https://github.com/projectcalico/calico/pull/13573) (@radTuti)
calico_versioned_docs/version-3.32/release-notes/index.mdx:324
- Release-note bullets should use consistent verb tense; this one starts with "Fix" while surrounding bullets use "Fixes"/"Fixed".
- Fix IPv6 route programming during VM live migration: IPv6 workload routes are now suppressed on the migration target until the VM goes live, and elevated in priority after cutover, as was already the case for IPv4. Previously IPv6 traffic to a migrating VM could black-hole for the duration of the migration on dual-stack clusters. [calico 13481](https://github.com/projectcalico/calico/pull/13481) (@nelljerram)
| #### Bug fixes | ||
|
|
||
| - Fixes a panic in kube-controllers when the informer delivers a tombstone object to a delete handler. [calico 13631](https://github.com/projectcalico/calico/pull/13631) (@hjiawei) | ||
| - Fix VXLAN traffic being dropped when the kernel masqueraded a tunnel flow's source port onto the VXLAN port (default 4789). [calico 13628](https://github.com/projectcalico/calico/pull/13628) (@hengqiali) |
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.
Suppressed comments (2)
Previously missed (2) — in code that hasn't changed since the last review.
calico/operations/upgrading/openstack-upgrade.mdx:213
- The relative link to
calicoctlis incorrect fromcalico/operations/upgrading/;../../operations/...resolves to a non-existentcalico/operations/operations/...path, so this link will be broken.
[`calicoctl`](../../operations/calicoctl/index.mdx) successfully on at least
calico_versioned_docs/version-3.32/operations/upgrading/openstack-upgrade.mdx:213
- The relative link to
calicoctlis incorrect fromoperations/upgrading/;../../operations/...resolves to a non-existentoperations/operations/...path in the versioned docs, so this link will be broken.
[`calicoctl`](../../operations/calicoctl/index.mdx) successfully on at least
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Publishes Calico Open Source 3.32.2: releases.json, variables.js, and the release notes page in version-3.32. Also carries #2851 and #2877, which document a calicoctl command that first ships in this release.
Jira: https://tigera.atlassian.net/browse/DOCS-2968
Preview: https://deploy-preview-2981--tigera-docs.netlify.app/calico/latest/release-notes/
To do:
Flags: