What’s New in Calico 3.29

Calico Open Source 3.29 is here, bringing powerful new features and enhancements to simplify networking and security in Kubernetes. In this post, we’ll explore the key highlights of this release and celebrate the contributions of the talented individuals who made it happen.

TL/DR

• Admin Network Policies: Calico 3.29 adds support for this new resource in the Kubernetes network policy API family. AdminNetworkPolicies allow cluster administrators to define network security policies that take precedence over other policies to implement control over your environment.
• Tiered Network Policies: Group policies into tiers for better organization and control. Tiers are unique Calico Open Source resources that ensure multi-team collaboration (RBAC enabled) and security compliance in your environment.
• nftables data plane: Calico now offers native nftables support for Kubernetes.
• Enhancements: Calico 3.29 packs a lot of enhancements, such as faster redirection for Calico eBPF mode, better eBPF dual-stack support and much more…

Upgrade to Calico 3.29 for more robust Kubernetes networking and security! 🚀

Community Shout-Outs 🎉

Similar to our previous releases, this one is also packed with many of your contributions! Here are a few new community members who merged their first contribution to the project:

Thanks to carloslima fixes an issue where CNI plugin might fail to add interfaces when the kernel does not support XFRM (X authenticity protocol), causing pods to become stuck in a ContainerCreating state.

Thanks to cberman for their attention to details and spotting a typo that was used in our project test cases.

Thanks to debasishbsws for updating the map definition in sockops eBPF programs, allowing it to use libbpf 1.0+. The original code was using the deprecated syntax, which caused build errors on some platforms.

Thanks to dimityrmirchev for their contribution that updates the security context of certain Calico components to use a more restrictive seccomp profile.

Thanks to simonostendorf for improving the Tigera operator helm installation experience, specifically with installing the orpeator when using Kubernetes-service-endpoint.

Thanks to jxlwqq for improving the kubelet certification rotation in hybrid environments. This change updates the configuration of the Kubelet service on Windows nodes that have been installed with Calico.

Thanks to kruftik for improving the support for IPv6-only clusters in Calico.

Thanks to lubronzhan for improving the debug procedure while battling with iptables, this change modifies the behavior of Calico’s debug mode to print out the entire failed iptables command that caused an error.

Thanks to scydas for helping our project to stay on an updated version of baseline CNI plugins.

Thanks to looklose for their attention to detail and helping us maintain an error-prone comment section in our project code.

Thanks to Levi080513 for improving the behavior of Calico’s IP address monitoring by instructing it to ignore changes to Kubernetes Node InternalIP when using InternalIP node address autodetection.

These are just a few people who contributed to this release. As always, the full list of changes and people who participated in it can be found in the release notes.

🚨 Major Highlights 🚨

Tech Preview: nftables data plane

nftables is a framework for packet filtering and network address translation (NAT) on Linux. It is intended to replace the older iptables, ip6tables systems. nftables leverages the Linux kernel’s Netfilter subsystem to manage network traffic, offering better performance and future-proofing your environment. nftables uses the new nftables-based kube-proxy implementation (introduced in Kubernetes 1.31) and provides compatibility with new Kernel features and takes advantage of improved security that has been embedded in the new kernel features.

Starting with release 3.29, Calico’s pluggable data plane architecture introduces native support for nftables, enabling Kubernetes users to seamlessly transition their Calico CNI, IPAM, and network policies to Linux distributions that use nftables as the default data plane.

If you’d like to learn more about nftables, watch our KubeCon CNCF Presentation on this subject.

Calico policy tiers are now free and open source

Policy tiers are a hierarchical construct used to group policies and enforce higher-precedence policies that cannot be circumvented by other teams. Policy tiers have built-in features that support workload microsegmentation. Users can now organize and enforce network policies into tiers to prevent conflicts among policies created by different teams, such as development and security.

Calico Open Source 3.29 introduces policy tiers, giving users greater control over the evaluation order of network policies and ensuring that critical policies are enforced with the right priority. By integrating policy tiers with Kubernetes RBAC (Role-Based Access Control), organizations can delegate policy management within specific tiers to teams or stakeholders, promoting shift-left security practices and enhancing operational efficiency.

If you’d like to learn more about policy tiers, click here.

AdminNetworkPolicy support

AdminNetworkPolicy provides a range of new capabilities that are going to be added to the Kubernetes upstream that allow administrators to secure their environments by writing cluster-wide policies (applies to all namespaces). Calico has integrated a range of these capabilities in AdminNetworkPolicy, and support for BaselineAdminNetworkPolicy will be provided with the next release 🤞.

• AdminNetworkPolicy: Cluster administrators can now set strict security policies that cannot be overridden by lower-level policies using these standard Kubernetes security resources.

If you want to learn more, try our interactive workshop (and get a credly badge!).

Enhancements to Improve Performance and User Experience

Improved Felix Logic

• Route programming now resolves conflicts more effectively, prioritizing by route type.
• Optimized CPU and Memory Usage: Felix’s route resync logic now uses 50% less CPU and 80% less memory.

eBPF Enhancements

• Faster redirection of non-NAT traffic from host interfaces to workloads.
• Fixes for dual-stack environments and service loop prevention.

Additional Improvements

• Security enhancements: Containers now run with securityContext.runAsNonRoot=true to minimize the attack surface.
• More granular BGP configurations with prefix length matching.
• Helm updates: New configurations like additionalLabels to provide better customization.

Windows Support

• Added support for non-English versions of Windows.

General Fixes

• Resolved issues with Kubernetes Node InternalIP updates.
• Improved logging performance, reducing overhead and fixing missing log line numbers.

These are just a few changes; check out the full release notes on our website.

Join our community

If you’d like to work on the next anticipated Calico Open Source feature, join our contributor’s Slack channel. Feel free to tell us about your vision and the community will help you achieve it.

You’re also welcome to take part in our next virtual community meeting, where we will discuss the future of Calico Open Source and spotlight community members who might have made some of the favorite features you are currently using.

Did you know we have an ambassador program? Join Calico Big Cats today and help us grow our Calico Open Source community.