Calico Enterprise 3.23 release notes

Learn about the new features, bug fixes, and other updates in this release of Calico Enterprise.

This version of Calico Enterprise is based on Calico Open Source 3.32.

New features and enhancements

Less disruptive license expiration

When a Calico Enterprise license expires, dataplane traffic and existing policy enforcement now continue running uninterrupted. The consequences are limited to the management plane: Calico Enterprise resources become read-only, log forwarding and component metrics stop, and the web console becomes read-only.

You can check license condition with kubectl get tigerastatus, which also reports a warning during the 30-day grace period before expiration.

For more information, see License expiration and renewal.

Host policy recommendations

The policy recommendation engine now generates staged global network policies for hosts in your cluster, based on observed flow logs. Calico Enterprise analyzes each host's actual traffic and produces a staged GlobalNetworkPolicy you can review and promote to enforcement once you've confirmed it matches real traffic.

For more information, see Recommend policies for hosts.

Host IP support for egress gateways

You can now configure egress gateways to SNAT outbound traffic to the host node's IP rather than the gateway's pod IP, giving external firewalls and services a stable, well-known set of source IPs to allow. Multiple application pods can multiplex outbound traffic through a small fixed set of gateways without each requiring its own routable IP.

Host IP mode is most useful for on-premises clusters where pod IPs are not routable outside the cluster. On AWS and Azure, it replaces the gateway's native VPC/VNet IP with the host node address.

For more information, see Configure egress gateways with host IP support.

Load balancer node maintenance

When you put a node into maintenance, Calico Enterprise's eBPF data plane can now stop sending new service traffic to the node's local backends while existing connections complete. This lets platform teams drain nodes for upgrades, repairs, or capacity changes without dropping mid-flight sessions or stateful workloads.

For more information, see Mark a load balancer node for maintenance.

Multi-VRF networking (tech preview)

You can now attach pods to one or more virtual routing and forwarding (VRF) domains. Traffic from a VRF-attached pod is routed in a dedicated routing table on the node, peered with a dedicated upstream fabric over BGP, and isolated from pods on other VRFs and from the default flat pod network.

Use this to reach tenant networks that have overlapping external IPs, to enforce an in-cluster routing boundary between tenants, or to map workloads onto an existing multi-tenant fabric. The nftables data plane is required, and a pod can be attached to up to nine VRFs.

For more information, see Configure multi-VRF networking.

Native v3 CRDs (tech preview)

Calico Enterprise now supports installation with native projectcalico.org/v3 CRDs as an alternative to the aggregated API server. The Tigera Operator registers projectcalico.org/v3 resources directly as native Kubernetes CRDs — no host-network pods, no ordering dependencies between CRDs and the API server, and kubectl manages v3 resources without an extra install step. This removes a long-standing source of installation friction on managed Kubernetes platforms like EKS and AKS. For existing clusters, a new DatastoreMigration controller copies resources from the aggregated API server to native CRDs in place; the datastore is briefly locked but workload connectivity is preserved through the migration window.

Native v3 CRDs require Kubernetes 1.34 or later with the MutatingAdmissionPolicy feature gate enabled. The gate is GA and on by default in Kubernetes 1.36; on 1.34 and 1.35 it must be enabled explicitly on the API server.

Native v3 CRDs are the successor to the aggregated API server, and will become the default install mode in a future release.

For more information, see Enable native v3 CRDs and Migrate from API server to native CRDs.

Live migration for KubeVirt VMs

Calico Enterprise now provides first-class networking for KubeVirt virtual machines, including persistent IP addresses and BGP-aware live migration. A VM keeps the same IP address across reboots, pod evictions, and live migrations, and Calico Enterprise uses route priority to steer traffic to the new host as a running VM migrates between nodes without breaking established connections. In single-rack iBGP deployments this works automatically; in multi-rack or eBGP topologies, you configure BGPFilter resources to propagate route priority across AS boundaries.

For more information, see Calico Enterprise networking for KubeVirt and BGP routing for KubeVirt live migration.

Review unused network policies

Find network policies and rules that aren't matching traffic, so you can safely remove them and maintain a least-privilege security posture.

In the web console, the policy edit page now shows a Last Evaluated timestamp on each policy and on each ingress and egress rule. The new calicoctl review unused-policies command lists policies and rules that haven't matched traffic within a time window you choose.

For more information, see Review unused network policies.

New Linux distros for non-cluster hosts and VMs

This release adds support for Debian and Ubuntu for non-cluster hosts and VMs.

For more information, see Install Calico Enterprise on non-cluster hosts and VMs.

Ingress Gateway dashboard

The Ingress Gateway L7 dashboard provides a clear view of how your gateways manage traffic, helping you track request speeds and resolve connection errors quickly to keep your applications running smoothly.

For more information, see Dashboards.

Maglev load balancing for services

Calico Enterprise now supports Maglev consistent-hash load balancing for external traffic to services. Maglev enables Calico Enterprise nodes to act as a distributed, horizontally scalable load balancer. When a node goes down — for maintenance or otherwise — external connections can fail over to another node. This is particularly useful when advertising service IPs as ECMP routes to your broader network.

Maglev is enabled per-service via annotation, keeping the memory footprint contained to only the services that need it.

For more information, see Add Maglev load balancing to a service.

Install on vSphere Kubernetes Service (VKS)

You can now install Calico Enterprise on vSphere Kubernetes Service (VKS). You deploy it as an Addon to your guest clusters. Air-gapped installs also work, including relocating the bundle and images to a local registry.

For more information, see vSphere Kubernetes Service (VKS).

Enhancements

• Improved the deterministic selection logic for flow and L7 logs when multiple NetworkSets have overlapping CIDRs. Logs and Service Graph now prioritize namespace-specific matches over GlobalNetworkSets and other namespace matches to ensure more accurate identity attribution.
• User experience improvements to the Flow Summary card.

Technology preview features

This table shows the status of features that were in technology preview at any point in the releases covered here. Technology preview features are for evaluation and feedback only and are not supported for production use. Behavior, APIs, and configuration may change before a feature reaches general availability.

Feature	3.21	3.22	3.23
DNS policy for Windows	TP	TP	TP
Workload WAF	TP	TP	TP
Calico Ingress Gateway	TP	GA	GA
Gateway WAF	–	TP	TP
Istio ambient mode	–	TP	TP
Live migration for KubeVirt VMs	–	–	TP
Multi-VRF networking	–	–	TP
Native v3 CRDs	–	–	TP

TP = technology preview, GA = generally available, – = not available in that release.

Deprecated and removed features

Review the following table to see what features have recently been deprecated or removed. Deprecated features are still present and supported, but they are scheduled for removal. You should consider migrating away from a deprecated feature before it is removed.

Feature	3.21	3.22	3.23
Fortinet integration	Deprecated	Deprecated	Deprecated
Aggregation API server	GA	GA	Deprecated
Application layer policy based on Envoy	GA	GA	Deprecated
Compliance reporting	Deprecated	Deprecated	Deprecated
L7 logging with Envoy	GA	GA	Deprecated

GA = generally available, Deprecated = scheduled for removal, Removed = no longer present, – = not available in that release.

Deprecated and removed features in this release

• Calico Enterprise is moving the projectcalico.org/v3 API from the aggregated API server to native Kubernetes CRDs. Both mechanisms will be supported until native v3 CRDs are compatible with all supported platforms, after which the aggregated API server will be removed.
• Support for Windows 1809 has been removed in this release.
• Support for the x86-64 v2 chip architecture is deprecated and scheduled for removal in an upcoming release.
• Application-layer policy and L7 observability features based on Envoy as a daemonset are deprecated and scheduled for removal in an upcoming release. These are being replaced with similar functionality using Istio Ambient Mode.

Known issues

• In clusters using the eBPF data plane with strict reverse path forwarding (RPF) enabled, link-local discovery packets may be incorrectly dropped. This can interfere with neighbor discovery and local network communication. A fix is planned for an upcoming release.
• The eBPF data plane on EKS with Kubernetes 1.36 is currently not working, including in combination with Bottlerocket; the issue is under investigation.
• On ARM64 with the eBPF data plane, the DNS parser can fail to load, which can result in timeouts.
• On clusters where the Kubernetes API server is reachable only by DNS name and cluster DNS is not yet running — most commonly EKS with the eBPF data plane and kube-proxy disabled — an install or upgrade can deadlock, because calico-node inherits the operator's ClusterFirstWithHostNet DNS policy. As a workaround, set dnsPolicy and dnsConfig in the tigera-operator Helm chart values; calico-node inherits them. A fix is planned for an upcoming release.

Upgrading

Before upgrading to Calico Enterprise 3.23, review Upgrade notes, Deprecated and removed features, and Known issues.

Upgrade from a previous minor

Calico Enterprise 3.23 supports a direct upgrade from version 3.22 and 3.21. To upgrade from an earlier version, plan an intermediate upgrade.

For upgrade instructions, see Upgrade Calico Enterprise.

Install a patch release

To install a patch release of Calico Enterprise 3.23, see Install a patch release.

Upgrade notes

• Breaking change: The Manager UI deployment has been moved from the tigera-manager namespace to the calico-system namespace and is now called calico-manager. If you expose the deployment via an ingress, load balancer, or node port service, you need to remove those resources and recreate them in the new namespace. The same applies to multi-cluster management users who expose the tunnel port. If you override component resources or limits, we suggest using the new container name by replacing tigera- with calico-, even though backwards compatibility is preserved. For details, see Access the Manager and Create a Management Cluster.

Release details

Calico Enterprise 3.23.0-2.0 (early preview)

June 5, 2026

Early preview — not for production

This release is for previewing and testing purposes only. It is not supported for use in production.

Bug fixes

• Fixed an issue where the non-cluster host Typha deployment could crashloop on clusters where the host-network Kubernetes API server endpoint is not reachable from pod-networked pods (for example, MKE's proxy.local). The pod-network endpoint from the kubernetes-service-endpoint ConfigMap is now used when set.

Known issues

• clusterinformation will incorrectly state calicoVersion as v3.31.0; The correct Calico open-source version this Calico Enterprise release is based on is v3.32.0. This is a purely a cosmetic bug with no user impact and can be ignored.

Calico Enterprise 3.23.0-1.0 (early preview)

February 14, 2026

Early preview — not for production

This release is for previewing and testing purposes only. It is not supported for use in production.

Upgrade notes

• Breaking change: The Manager UI deployment has been moved from the tigera-manager namespace to the calico-system namespace and is now called calico-manager. If you expose the deployment via an ingress, load balancer, or node port service, you need to remove those resources and recreate them in the new namespace. The same applies to multi-cluster management users who expose the tunnel port. If you override component resources or limits, we suggest using the new container name by replacing tigera- with calico-, even though backwards compatibility is preserved. For details, see Access the Manager and Create a Management Cluster.

Enhancements

• Improved the deterministic selection logic for flow and L7 logs when multiple NetworkSets have overlapping CIDRs. Logs and Service Graph now prioritize namespace-specific matches over GlobalNetworkSets and other namespace matches to ensure more accurate identity attribution.
• User experience improvements to the Flow Summary card.

Known issues

• In clusters using the eBPF data plane with strict reverse path forwarding (RPF) enabled, link-local discovery packets may be incorrectly dropped. This can interfere with neighbor discovery and local network communication.
• The combination of the eBPF data plane on EKS with Bottlerocket is currently not working; the issue is under investigation.
• On ARM64 with the eBPF data plane, the DNS parser can fail to load, which can result in timeouts.

Calico Enterprise 3.23.1 general availability release

July 6, 2026

Calico Enterprise 3.23.1 is now available as a general availability release.

This release is supported for use in production.

Bug fixes

• Fixed an issue where non-cluster hosts could inherit an unsupported data plane mode from the cluster's global FelixConfiguration. The eBPF data plane is now disabled on all non-cluster host packages, and RHEL 8 hosts are forced to use the iptables data plane (its 4.18 kernel does not reliably support nftables). RHEL 9, Debian, and Ubuntu continue to inherit the cluster's data plane choice.
• Fixed an issue where DNS-policy trusted servers (including k8s-service: references such as the default kube-dns) were resolved only once at startup and never refreshed. They are now kept up to date as the backing Service changes.
• Fixed a bug where Felix could permanently lose its DNS-policy NFQUEUE listener after a transient queue reconnect, causing domain-based policy to stop being enforced until Felix restarted.

Known issues

• On clusters using the eBPF data plane, a HostEndpoint policy can block UDP return traffic for pod-originated egress that uses NAT-outgoing (SNAT). TCP and ICMP traffic is unaffected. A fix is planned for an upcoming patch release.
• If the cluster's Kubernetes service account issuer changes (for example, during platform maintenance), Calico Enterprise components that validate bearer tokens keep using the previous issuer until restarted and reject service account tokens with bearer token was not issued by a trusted issuer. Manager UI observability pages (Service Graph, dashboard traffic stats, process info, L7 logs), license details, and log ingestion can fail while tigerastatuses still report Available. As a workaround, restart the token-validating components (tigera-linseed, calico-apiserver, tigera-manager, and compliance-server) so they re-read the current issuer, then re-create any long-lived Manager login tokens minted before the change. A fix is planned for an upcoming patch release.
• Windows nodes on VKS are not currently supported due to a known issue where nodes may restart during VKS controller reconciliation. Support will be introduced once an upstream VKS fix is available.

Upgrading

To update an existing installation of Calico Enterprise 3.23, see Install a patch release.

Calico Enterprise 3.23.2 bug fix release

August 27, 2026

Upgrade notes

• If you use an admission policy that limits the host paths calico-node can mount, add /sys/kernel/security to the policy before you upgrade. Otherwise, the policy blocks the new calico-node pods and the upgrade does not complete.

Enhancements

• The operator-generated CNI config now declares cniVersion 1.0.0, as Multus requires on OpenShift 4.23 and later. The new spec.cni.specVersion field pins a different version or leaves it operator-managed (Auto).
• Added a startup probe to the calico-node DaemonSet, shortening calico-node rolling updates on large clusters.
• The DatastoreMigration CRD is now published to the release manifests directory, so it can be installed with kubectl apply instead of a path into the source tree.

Bug fixes

• Fixed an upgrade failure on eBPF clusters where ordinary pod egress carried the ext-to-service connmark into the FIB lookup, breaking cross-node connectivity including DNS on nodes that use source-based routing.
• Fixed a deadlock on upgrade where the Calico API server was moved before a deprecated policy blocking it was removed, leaving the projectcalico.org/v3 API permanently unavailable.
• Fixed license-agent failing to serve its Prometheus /metrics endpoint when no certificate and key are configured, and fixed the shipped network policy selecting Prometheus by a label its pods do not carry.
• Fixed Felix splitting a flow or DNS log record across a rotation boundary, causing downstream consumers to drop one record per rotation.
• Fixed Felix dataplane delays under load that could hold up policy programming for new pods: IP set resyncs are now incremental, and the flow log collector's policy re-evaluation is time-boxed so it no longer blocks conntrack and NFLOG processing.
• Fixed eBPF nodes running a kernel with lockdown=confidentiality, such as Talos, spewing could not enable bpf_trace_printk events into dmesg on every BPF program load. To detect lockdown mode, calico-node now mounts the host path /sys/kernel/security. See the upgrade notes for this release.
• Fixed HostEndpoint policy blocking UDP return traffic for SNAT'd pod egress in the eBPF dataplane.
• Fixed Linseed rejecting valid service account tokens after a cluster's service account issuer changed. Unrecognized issuers are now validated via TokenReview.
• Fixed a BPF program leak in the iptables dataplane with flowLogsCollectTcpStats enabled: on kernels without TCX support, each endpoint update stacked a duplicate calico_tcp_stats filter, eventually degrading node performance and Felix startup. Existing duplicates are cleaned up.
• Fixed the Calico Ingress Gateway control plane crash-looping on clusters whose Gateway API CRD set omits ListenerSet, TLSRoute, or BackendTLSPolicy, such as OpenShift. The bundled Envoy Gateway is updated to v1.8.2.
• Fixed a panic in the kube-controllers automatic HostEndpoint controller when a node deletion was delivered as an informer tombstone, which could intermittently leave a rebuilt node without its automatically created host endpoint.
• Fixed several issues that could stop an egress gateway becoming or staying ready: incorrect egress selector reference counting, the gateway's own health probes and DNS not using its ExternalNetwork in the eBPF dataplane, and ExternalNetwork exit device state being pruned on Felix restart.
• Fixed a slow memory leak in the eBPF dataplane, where interface state for deleted egress gateway and egress client pods was retained indefinitely.
• Fixed a window in the eBPF dataplane where a new connection could skip a local workload's ingress policy while that workload's route was still being programmed.
• Fixed stalled connections in the eBPF dataplane between a client pod and a VM workload on the same node.
• Fixed Calico advertising a Service IP over BGP from a node whose only local endpoint was not Ready, black-holing traffic for services using externalTrafficPolicy: Local.
• Fixed restarting the calico-early container while calico-node was running causing a transient BGP flap that briefly withdrew pod and egress gateway routes.
• Fixed managed cluster connection status showing "Disconnected" rather than "Not connected yet" before a cluster has connected for the first time.
• Fixed an Elasticsearch NodeSet being renamed on every reconcile when the LogStorage CR used a non-canonical storage quantity such as 1024Gi, which repeatedly recreated the Elasticsearch StatefulSet and its PVCs.
• Fixed a non-deterministic key and certificate pair selection when a secret holds more than one recognized pair, such as during a certificate-rotation overlap.
• Fixed an "unrecognized format" warning printed by Kubernetes 1.36 when applying the IPReservation CRD.
• Fixed installing Calico Enterprise as a Supervisor Service on vSphere Kubernetes Service (VKS), which could fail to deploy to guest clusters. Relocated bundles now install end to end, including in air-gapped registries.
• Reduced Dikastes CPU and allocation overhead when many policies apply to an endpoint.
• Updated the ECK operator to 3.4.1, fixing Elasticsearch nodes failing to rejoin after a transport CA rotation, which could stall an upgrade.
• Security updates.

To update an existing installation of Calico Enterprise 3.23, see Install a patch release.

Calico Enterprise 3.23.3 bug fix release

October 27, 2026

Upgrade notes

• Removed the emSign (eMudhra) root certificates from the CA bundle that the operator mounts into Calico Enterprise components, and updated Go to 1.26.10. Endpoints whose certificates chain to an emSign root, such as an external Elasticsearch, an identity provider or a webhook target, are no longer trusted after the upgrade.
• Calico Ingress Gateway now bundles Envoy Gateway v1.9.1 (from v1.8.3), and Calico Ingress Gateway and the L7 log collector now use Envoy 1.39.1 (from 1.38.3). Both releases change routing and validation behavior. The new CRDs reject sessionPersistence.idleTimeout in HTTPRoute and an empty clientIPDetection in ClientTrafficPolicy; remove them before you upgrade. For the other changes, see the Envoy Gateway v1.9 release notes and the Envoy 1.39 release notes.
• IP pool namespace selectors are now honored when Calico Enterprise assigns LoadBalancer Service IPs. A LoadBalancer IP pool with a namespace selector starts matching Services in the selected namespaces after the upgrade.
• Selectors with parentheses nested more than 100 deep are now rejected.

Enhancements

• Added the connectionMode field to BGPPeer (Auto, Active or Passive) to control which end initiates the BGP session. Use Active to cut LoadBalancer VIP downtime during a nested KubeVirt VM live migration from over 16 seconds to under 2 seconds.
• Added the Helm value managementCluster.service.createNamespace, so you can stop the tigera-operator chart from creating the calico-system namespace on a management cluster when you manage that namespace yourself. To turn it off on an existing installation, first upgrade with the default (true), and then set it to false in a later, separate upgrade. If you do both in one upgrade, Helm deletes calico-system.
• Application layer policy evaluates rule criteria cheapest-first, which makes evaluation 1.6 to 3.7 times faster for large policy sets. Per-rule warnings from the policy engine are now rate limited.
• Reduced CPU and memory use when converting Kubernetes network policies that contain wide port ranges.
• Dikastes and Felix now aggregate the recurring "IPSet not found" and "failed to parse source principal" log lines into one line per five minutes. Compatibility note: IP set IDs and principals move into the ipsets and principals fields, and logsSkipped is removed. Update any log queries or alerts that parse these lines.

Bug fixes

• Fixed Felix restarting repeatedly when multiple routeTableRanges are set.
• Fixed Felix, with IPv6 and the iptables dataplane enabled, creating two IPv6 IP set dataplanes that repeatedly deleted each other's IP sets.
• Fixed a race where a workload's egress gateway maintenance annotations were not applied when the workload endpoint was updated at the same time as the gateway started terminating.
• Fixed a policy program that the kernel verifier rejected with "unreachable insn" when a workload had enough policy rules to need more than one program, which left the node not ready.
• Fixed eBPF mode dropping UDP traffic on the WireGuard port (51820 by default) at host interfaces unless it came from a known Calico Enterprise node. This broke user-managed WireGuard overlays and caused occasional UDP DNS timeouts when a client's ephemeral port was 51820.
• Reverted the change that suppressed empty source: {} and destination: {} in policy rules, which left GitOps tools such as Argo CD reporting those policies as permanently out of sync.
• Fixed the policy board in the web console rendering empty on managed clusters.
• Fixed web console login failing with "Service Unavailable" for users who are not cluster administrators.
• Fixed the tigera-operator Helm chart leaving behind a stale uninstall Job after an interrupted or failed uninstall, which blocked later uninstalls.
• Fixed pods being unable to restart when their IP pool has no spare addresses, which most often affected egress gateways. A pod now keeps its existing address when its sandbox is rebuilt.
• Fixed nested workload traffic, such as a Service VIP or pod CIDR advertised from inside a KubeVirt VM, being black-holed on the node that receives a live-migrated VM.
• Fixed BGPConfiguration, BGPPeer and BGPFilter rejecting 4-byte AS numbers above 2147483647.
• Fixed an IP address leak when a KubeVirt VM allocated an address while its IPAM handle was being freed manually after an earlier failure.
• Fixed KubeVirt VMs with address persistence failing to get an address when their namespace and name together are longer than about 107 characters.
• Fixed IP sets with overlapping CIDRs failing to program correctly in nftables mode after a member was removed.
• Fixed Felix on EKS waiting on the EC2 API during startup when TPROXY mode is disabled, which could delay policy enforcement by up to 20 seconds after a restart.
• Fixed calico-noncluster-host-init ignoring the FELIX_TYPHACAFILE, FELIX_TYPHACERTFILE and FELIX_TYPHAKEYFILE overrides in calico-node.env, which could stop calico-node from starting on a non-cluster host.
• Fixed a Felix panic on nodes running NodeLocal DNSCache with IPv6 enabled.
• Fixed several issues in the eBPF dataplane:
  • The BPF DNS parser was rejected by the verifier on newer kernels, which silently disabled cross-node overlay traffic.
  • Pre-existing connections to a node port with a backend on another node were dropped when the dataplane was switched to eBPF.
  • Domain-based policy did not work for pods that resolve through the NodeLocal DNSCache link-local address.
  • Datagrams from one unconnected UDP socket could go to different backends, and UDP sessionAffinity timeouts were capped at the UDP conntrack timeout.
  • Flow logs duplicated counts for long-lived ICMP flows, and could attribute traffic to the wrong host endpoint.
  • Expired IPv6 NAT conntrack entries were not cleaned up, and per-interface state leaked for Istio ambient workloads.
• Fixed application layer policy never matching rules that reference a named port, which caused Allow rules to deny and Deny rules to have no effect.
• Fixed application layer policy enforcing staged policies as if they were enforced.
• Fixed policy recommendation producing an invalid recommendation for namespaces whose pods call the Kubernetes API, or another Service backed by non-pod endpoints, and then retrying the rejected recommendation every few seconds.
• Fixed calicoctl validate accepting resources that the API server rejects, including duplicate entries in list fields such as a NetworkSet's addresses.
• Fixed repeated "cannot patch resource tiers" errors from calico-kube-controllers on clusters that use native projectcalico.org/v3 CRDs.
• Fixed flow logs reporting the wrong staged policy verdict: a staged policy as the enforced verdict when a flow's policy path changed mid-flow, and an end-of-tier deny for traffic to DNS-resolved destinations or domain-based network sets. Enforcement was not affected.
• Fixed wrong flow counts: Felix emitting stale zero-count deny logs after a policy change allowed the traffic, Goldmane counting a node's statistics twice after Felix reconnects, and Service Graph connection rates on clusters that changed flowLogsFlushInterval.
• Fixed Felix restarting with "BUG: Unexpected action" when a new policy with a Pass rule changed the policy match for an active flow while flow logs were sent to Goldmane.
• Fixed several datastore migration issues: aborting a migration left Calico Enterprise serving from an empty datastore, a migration could get stuck permanently if the calico-kube-controllers pod was lost, and cleanup was reported complete while v1 CRDs were still being deleted.
• Fixed calicoctl datastore migrate leaving IPv6 VXLAN and WireGuard tunnel addresses tied to the old node name, policy name migration never running when the calico-node DaemonSet has a different name, and a kube-controllers panic on load balancer IP allocations with no handle.
• Fixed the operator failing to reconcile, and to renew Typha certificates, on Rancher-managed clusters.
• Fixed a deadlock on clusters where the Kubernetes API server is reachable only by name. calico-node now defaults to the node's own DNS resolver.
• Fixed Felix panicking instead of restarting cleanly when a restart-requiring configuration change arrived while the dataplane was busy, and deadlocking if such a change arrived before startup completed.
• Security updates.

To update an existing installation of Calico Enterprise 3.23, see Install a patch release.