Skip to content

DOCS-3052: Add Calico Cloud 24.0.0 release notes #3101

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ctauchen merged 2 commits into from
Oct 12, 2026
Merged

DOCS-3052: Add Calico Cloud 24.0.0 release notes #3101

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2bf9fda
DOCS-3052: Add Calico Cloud 24.0.0 release notes
ctauchen Oct 12, 2026
816f7d2
DOCS-3052: Correct release-note claims and add the Envoy deprecation
ctauchen Oct 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion calico-cloud/get-started/install-automated.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -125,7 +125,7 @@ For `installer.components`, you should define all your `values.yaml` customizati
```
All editable values are provided in the default values definitions.

1. Add values for the required parameters, `install.clusterName` and `install.calicoCloudVersion`.
1. Add values for the required parameters, `installer.clusterName` and `installer.calicoCloudVersion`.

```yaml title="Example from values.yaml file with clusterName and calicoCloudVersion"
installer:
Expand Down
79 changes: 79 additions & 0 deletions calico-cloud/release-notes/index.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,85 @@

# Calico Cloud release notes

<h2 id="24.0.0">October 13, 2026 (version 24.0.0)</h2>

### New features and enhancements

#### Policy editor improvements

The policy editor in the web console has a redesigned layout and a new YAML view.
You can switch between the form and the YAML for a policy while you create or edit it.

For more information, see [Network policy tutorial](../network-policy/policy-tiers/policy-tutorial-ui.mdx).

#### Gateway WAF for routes and namespaces (tech preview)

You can now attach web application firewall (WAF) protection to an individual Gateway or HTTPRoute behind Calico Ingress Gateway, instead of to every gateway at once, and tune it for each namespace.
Platform teams set a global baseline, application teams tune it for their own namespaces and routes, and you can add custom rules as plugins.

For more information, see [Gateway WAF](../threat/gateway-waf/overview.mdx).

#### New L7 log collectors

$[prodname] can now collect L7 logs with an eBPF collector that captures HTTP and TLS metadata in the kernel, with no proxy or sidecar in the data path.
You enable it once for the cluster, and it works with any data plane.
If you run Istio Ambient Mode, you can also collect L7 logs from waypoint proxies with the new Waypoint collector.

Check warning on line 33 in calico-cloud/release-notes/index.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Terms] Use 'Waypoint' instead of 'waypoint'.

Raw Output:
{"message":"[Vale.Terms] Use 'Waypoint' instead of 'waypoint'.","location":{"path":"calico-cloud/release-notes/index.mdx","range":{"start":{"line":33,"column":66},"end":{"line":33,"column":74}}},"severity":"WARNING","code":{"value":"Vale.Terms"}}

For more information, see [L7 logs](../observability/elastic/l7/overview.mdx).

#### Operator metrics

The Tigera Operator now exposes Prometheus metrics for component status and TLS certificate expiry.
You can use them to alert on degraded components and on TLS certificates that are about to expire.

For more information, see [Operator metrics](../operations/monitor/metrics/operator-metrics.mdx).

#### Selector-scoped Felix configuration (tech preview)

You can now apply a `FelixConfiguration` resource to a set of nodes that you choose with a label selector.

For more information, see [Felix configuration](../reference/resources/felixconfig.mdx#selector-scoped-configuration).

#### Versioned Helm charts

The $[prodname] Helm charts are now released with every $[prodname] release, and you can install a chart by its release version, such as `v24.0.0`.
You still need to set `installer.calicoCloudVersion` when you install with Helm.

### Deprecated and removed features

* The compliance reporting feature is removed from the $[prodname] web console.
The compliance reporting docs, including the `GlobalReport` resource reference, are removed.
* The Envoy collector for L7 logs is deprecated.
Use the eBPF collector or the Waypoint collector instead.
* $[prodname] 21 is no longer supported.

### Updating

* ***Potential breaking change:*** Calico Ingress Gateway now runs each gateway's proxy in the same namespace as its `Gateway` resource, and the gateway controller moves to the `calico-system` namespace.
When you upgrade, existing proxies move out of the `tigera-gateway` namespace into the namespace of each `Gateway`.
Anything that refers to `tigera-gateway` must move with them, including network policy, monitoring, RBAC, and external DNS.
Merged gateways (`mergeGateways: true`) are no longer supported, so each gateway gets its own load balancer.
Migrate in this order:
1. Before you upgrade, if you use a global default deny policy, create a network policy in each `Gateway` namespace that allows the proxy pods, so they can start as soon as they move.
For the policy, see [Create an ingress gateway](../networking/ingress-gateway/create-ingress-gateway.mdx).
2. Upgrade your cluster.
For more information, see [Upgrade $[prodname]](../get-started/upgrade-cluster.mdx).
3. After the upgrade, point monitoring, RBAC, and external DNS at each `Gateway` namespace instead of `tigera-gateway`.
If you used merged gateways, plan for one load balancer, DNS record, and certificate for each gateway.
* If you install from a private registry with the latest Helm chart, add the `cc-operator` image that matches the version you're installing or upgrading to into your registry.
For more information, see [Set up a private registry](../get-started/setup-private-registry.mdx).

### Bug fixes

* Fixed the default `cc-operator` image path in the Helm chart when you configure a private registry.
Previously, if you didn't set `imagePath`, the chart used `calico-cloud-public` as the image path.
If you changed your private registry to put `cc-operator` under a `calico-cloud-public` path to work around this, update your registry to match the image path you set.

### Known issues

* You can't connect a Kubernetes 1.36 cluster to $[prodname] 24.0.0 if Calico Open Source on that cluster was installed with the `projectcalico.org/v3` CRDs.
The installation needs the `admissionregistration.k8s.io/v1beta1` API, which Kubernetes 1.36 doesn't provide.

<h2 id="23.0.2">August 28, 2026 (versions 23.0.2 and 22.5.1)</h2>

Versions 23.0.2 and 22.5.1 are patch releases that bring the same fix to $[prodname] 23 and 22.
Expand Down
Loading