From 06bbb258da3fed0b5a76c4b9516bd8524911fbc6 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 10 Sep 2026 16:14:22 +0000 Subject: [PATCH] Add missing 3.23.2 release note for CI-2051 The kube-controllers auto-HostEndpoint controller could panic on a node-deletion event delivered as an informer tombstone, intermittently leaving a rebuilt node without its automatically created host endpoint. The fix (calico-private PR #13434) merged into the release-calient-v3.23 branch ahead of the 3.23.2 cut but its release note was never added to the docsite. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01WrUFpMShh9f91v6geCZ8RQ --- .../version-3.23-2/release-notes/index.mdx | 1 + 1 file changed, 1 insertion(+) diff --git a/calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx b/calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx index 11289dbe27..36f4fe357e 100644 --- a/calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx +++ b/calico-enterprise_versioned_docs/version-3.23-2/release-notes/index.mdx @@ -275,6 +275,7 @@ August 27, 2026 * Fixed Linseed rejecting valid service account tokens after a cluster's service account issuer changed. Unrecognized issuers are now validated via TokenReview. * Fixed a BPF program leak in the iptables dataplane with `flowLogsCollectTcpStats` enabled: on kernels without TCX support, each endpoint update stacked a duplicate `calico_tcp_stats` filter, eventually degrading node performance and Felix startup. Existing duplicates are cleaned up. * Fixed the Calico Ingress Gateway control plane crash-looping on clusters whose Gateway API CRD set omits `ListenerSet`, `TLSRoute`, or `BackendTLSPolicy`, such as OpenShift. The bundled Envoy Gateway is updated to v1.8.2. +* Fixed a panic in the kube-controllers automatic HostEndpoint controller when a node deletion was delivered as an informer tombstone, which could intermittently leave a rebuilt node without its automatically created host endpoint. * Fixed several issues that could stop an egress gateway becoming or staying ready: incorrect egress selector reference counting, the gateway's own health probes and DNS not using its ExternalNetwork in the eBPF dataplane, and ExternalNetwork exit device state being pruned on Felix restart. * Fixed a slow memory leak in the eBPF dataplane, where interface state for deleted egress gateway and egress client pods was retained indefinitely. * Fixed a window in the eBPF dataplane where a new connection could skip a local workload's ingress policy while that workload's route was still being programmed.