DOCS-3008: Add Calico Cloud 23.0.1 and delist 23.0.0 by ctauchen · Pull Request #2919 · tigera/docs

ctauchen · 2026-08-14T17:10:34Z

Calico Cloud 23.0.1 fixes CI-2032, an upgrade failure that three customers have hit: PlaytechIMS, Insight Investment, and the Bain Capital POC. Upgrading to 23.0.0 moves the cluster DNS policy into the new calico-system tier while the allow-tigera tier remains in place at the same order with defaultAction Deny, so DNS to kube-dns hits the implicit deny in allow-tigera. Guardian cannot resolve the Calico Cloud address, it crash loops, and the upgrade never finishes. Where calico-node reaches the API server by domain name, calico-node, calico-apiserver, and calico-kube-controllers fail for the same reason.

Engineering is removing 23.0.0 as an available version to install and shipping 23.0.1 in its place, so the docs need to match.

Changes:

Replace the 23.0.0 image list with 23.0.1 on the private registry page, so air-gapped users mirror the fixed release.
Add a known issue to the 23.0.0 release notes that describes the DNS denial, states that 23.0.0 is no longer available to install, and points to 23.0.1.
Add a 23.0.1 release note with the single bug fix.
Point cloudUserVersion at v23.0.1, so the install and system requirements pages name the installable version.

Two values are placeholders until the staging build is confirmed. Do not merge before they are replaced:

The 23.0.1 image list is copied from 23.0.0 and carries a TODO in src/new/data/ccImageLists.js. Replace it with the output of the v23.0.1 image-list manifest.
The release date is August 14, 2026, which was the target date. Correct it if the release lands on a different day.

The second commit fixes two dead links that were failing the link check in make netlify, which blocked the main site deploy preview on every pull request, including this one:

calicousers.slack.com returns 403 to the crawler on calico/reference/involved. Every other page links that host with a trailing slash, and that form is already in the crawler skip list, so the two involved pages now match instead of growing the skip list.
Cockroach Labs moved their docs to docs.cockroachlabs.com and dropped the stable alias, so the multi-cluster page linked from use-cases/cluster-mesh returned 404. It now points at the pinned version path, which resolves.

Out of scope: the allow-tigera to calico-system rename and the missed breaking change note are DOCS-3007, in #2918.

Reviewers, the deploy preview is up. Please check these pages:

Release notes, for the new 23.0.1 entry and the Known issues section under version 23.0.0: https://deploy-preview-2919--tigera.netlify.app/calico-cloud/release-notes
Private registry, where the version selector should offer v23.0.1 (latest) and no longer offer 23.0.0: https://deploy-preview-2919--tigera.netlify.app/calico-cloud/get-started/setup-private-registry
System requirements, which should name Calico Cloud v23.0.1: https://deploy-preview-2919--tigera.netlify.app/calico-cloud/get-started/system-requirements
The two link fixes: https://deploy-preview-2919--tigera.netlify.app/use-cases/cluster-mesh and https://deploy-preview-2919--tigera.netlify.app/calico/latest/reference/involved

CI-2032: https://tigera.atlassian.net/browse/CI-2032
DOCS-3008: https://tigera.atlassian.net/browse/DOCS-3008

Calico Cloud 23.0.1 fixes CI-2032, an upgrade failure that three customers have hit. Upgrading to 23.0.0 moves the cluster DNS policy into the new calico-system tier while the allow-tigera tier remains at the same order with defaultAction Deny, so DNS to kube-dns hits the implicit deny in allow-tigera. Guardian cannot resolve the Calico Cloud address, it crash loops, and the upgrade never finishes. Engineering is removing 23.0.0 as an available version to install, so the docs need to match: - Replace the 23.0.0 image list with 23.0.1 on the private registry page, so air-gapped users mirror the fixed release. - Add a known issue to the 23.0.0 release notes that describes the DNS denial, states that 23.0.0 is no longer available to install, and points to 23.0.1. - Add a 23.0.1 release note with the single bug fix. - Point cloudUserVersion at v23.0.1 so the install and system requirements pages name the installable version. The image list and the release date are placeholders until the staging build is confirmed. The allow-tigera to calico-system rename and the missed breaking change note are DOCS-3007. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

netlify · 2026-08-14T17:10:40Z

✅ Deploy Preview for calico-docs-preview-next ready!

Name	Link
🔨 Latest commit	`d529e19`
🔍 Latest deploy log	https://app.netlify.com/projects/calico-docs-preview-next/deploys/6a7f551fb20d3f0008238ef0
😎 Deploy Preview	https://deploy-preview-2919--calico-docs-preview-next.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

netlify · 2026-08-14T17:10:41Z

✅ Deploy Preview succeeded!

Built without sensitive environment variables

Name	Link
🔨 Latest commit	`d529e19`
🔍 Latest deploy log	https://app.netlify.com/projects/tigera/deploys/6a7f551f9dd7c00008cead3b
😎 Deploy Preview	https://deploy-preview-2919--tigera.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	1 paths audited Performance: 75 (🟢 up 5 from production) Accessibility: 98 (no change from production) Best Practices: 92 (no change from production) SEO: 100 (no change from production) PWA: - View the detailed breakdown and full score reports
🤖 Make changes	Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

Copilot

Pull request overview

Updates the Calico Cloud 23.2 versioned documentation to reflect that v23.0.1 is the installable release and v23.0.0 is delisted due to an upgrade/DNS regression, including updated release notes and the private-registry image list source.

Changes:

Add 23.0.1 release notes and add a Known issue under 23.0.0 describing the DNS-deny upgrade failure and delisting.
Update cloudUserVersion for Calico Cloud 23.2 docs to v23.0.1 so install/system-requirements pages display the correct installable version.
Replace the “latest” private-registry image-list selector entry from v23.0.0 to v23.0.1 (currently noted as a placeholder list).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
src/new/data/ccImageLists.js	Switch “latest” image-list entry to v23.0.1 (currently placeholder content flagged with TODO).
calico-cloud_versioned_docs/version-23-2/variables.js	Bump `cloudUserVersion` to v23.0.1 for the 23.2 versioned docs set.
calico-cloud_versioned_docs/version-23-2/release-notes/index.mdx	Add 23.0.1 entry and a 23.0.0 Known issue detailing the upgrade/DNS regression and delisting guidance.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+* Fixed a problem that denied cluster DNS traffic during an upgrade to version 23.
+  The Tigera Operator now adds the cluster DNS policy to the `calico-system` tier before it removes the policy from the `allow-tigera` tier, so $[prodname] components can resolve names for the whole upgrade.


ctauchen · 2026-08-14T17:45:55Z

+  // TODO(DOCS-3008): placeholder copied from the v23.0.0 list. Replace it with
+  // the v23.0.1 list once the release is in staging:
+  // curl -0 https://installer.calicocloud.io/manifests/<v23.0.1 manifest>/image-list
+  'v23.0.1 (latest)': `quay.io/calico/istio-pilot:v3.32.1


Left as is. The list itself still needs the real v23.0.1 output before merge.

The link check in make netlify fails on every pull request, which blocks the deploy preview for the main site. Two links are dead: - calicousers.slack.com returns 403 to the crawler on calico/reference/involved. Every other page links the same host with a trailing slash, and that form is already in the crawler skip list, so this makes the two involved pages consistent instead of adding a skip entry. - Cockroach Labs moved their docs to docs.cockroachlabs.com and dropped the stable alias, so the multi-cluster page linked from use-cases/cluster-mesh returns 404. The page still exists under a pinned version path. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

Suppressed comments (3)

src/new/data/ccImageLists.js:5

The v23.0.1 image list is explicitly marked as a placeholder copied from v23.0.0 and still contains a non-actionable manifest URL placeholder (<v23.0.1 manifest>). This will produce incorrect guidance for air-gapped mirroring until it is replaced with the real v23.0.1 image-list output.

  // TODO(DOCS-3008): placeholder copied from the v23.0.0 list. Replace it with
  // the v23.0.1 list once the release is in staging:
  // curl -0 https://installer.calicocloud.io/manifests/<v23.0.1 manifest>/image-list
  'v23.0.1 (latest)': `quay.io/calico/istio-pilot:v3.32.1

calico-cloud_versioned_docs/version-23-2/release-notes/index.mdx:18

The sentence ends with "version 23." which reads as incomplete; it likely should name the specific affected version (23.0.0) or otherwise remove the trailing period fragment.

* Fixed a problem that denied cluster DNS traffic during an upgrade to version 23.

calico-cloud_versioned_docs/version-23-2/release-notes/index.mdx:79

Component name capitalization is inconsistent within this file (elsewhere it uses "Guardian"); this line should also capitalize the component name for clarity.

The guardian pod cannot resolve the address of $[prodname], so it enters `CrashLoopBackOff` and the upgrade does not finish.

- Name the affected upgrade path in the bug fix, so the note does not imply that every 23.x upgrade denies cluster DNS. Only upgrades from version 22 to 23.0.0 hit the problem. - Capitalize Guardian, which is how the architecture page names the component. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

- Drop the paragraph that introduced the 23.0.1 section. The bug fix and the known issue already say that 23.0.1 replaces 23.0.0. - Write the bug fix as a full report: name the release that introduced the problem, then state what works again. - Drop the admonition around the known issue and keep plain prose, so it reads as a known issue rather than a banner. - Shorten the known issue to the problem, the cause, and the workaround. The pod-level detail belongs in CI-2032, not here. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

Suppressed comments (2)

src/new/data/ccImageLists.js:6

This file is still using a placeholder image list copied from v23.0.0 (per the TODO). The PR description explicitly says not to merge until the v23.0.1 manifest image-list output replaces this placeholder (including the manifest version in the curl comment).

  // TODO(DOCS-3008): placeholder copied from the v23.0.0 list. Replace it with
  // the v23.0.1 list once the release is in staging:
  // curl -0 https://installer.calicocloud.io/manifests/<v23.0.1 manifest>/image-list
  'v23.0.1 (latest)': `quay.io/calico/istio-pilot:v3.32.1
quay.io/calico/istio-install-cni:v3.32.1

src/new/data/ccImageLists.js:4

The placeholder curl command uses angle brackets (<...>), which will be interpreted by many shells as input redirection if someone copy/pastes it. Use a non-shell-special placeholder token instead.

  // TODO(DOCS-3008): placeholder copied from the v23.0.0 list. Replace it with
  // the v23.0.1 list once the release is in staging:
  // curl -0 https://installer.calicocloud.io/manifests/<v23.0.1 manifest>/image-list

ctauchen · 2026-08-14T17:42:14Z

+Version 23.0.1 replaces version 23.0.0, which is no longer available to install.
+If a cluster runs version 23.0.0, upgrade it to version 23.0.1.


rm this line

Done in d529e19. Both lines are gone and the section opens on Bug fixes.

Done in d529e19. Removed both lines of that paragraph.

ctauchen · 2026-08-14T17:43:51Z


+### Known issues
+
+:::warning[version 23.0.0 is no longer available to install]


no admonition. Just a known issue that describes the problem, the cause, the workaround (upgrade to 23.0.1).

the short version, more abstract.

Done in d529e19. The admonition is gone. The known issue is now plain prose: the problem, the cause, then the workaround.

Done in d529e19. Cut to two sentences. The kube-dns hop, the Deny default action, the CrashLoopBackOff, and the calico-node by domain name variant are all in CI-2032 for anyone who needs them.

ctauchen · 2026-08-14T17:44:13Z

+
+Version 23.0.0 is no longer available to install.
+Upgrade to [version 23.0.1](#23.0.1) instead, which fixes the problem.
+If a cluster already runs version 23.0.0, upgrade it to version 23.0.1.


drop this paragraph.

Done in d529e19. Dropped. The delisting and the pointer to 23.0.1 survive as two lines, since that is the workaround.

ctauchen · 2026-08-14T17:45:18Z

+
+### Bug fixes
+
+* Fixed a problem that denied cluster DNS traffic during an upgrade to version 23.


'problem introduced in 23.0.0'

finish bug report mentioning normal operation, problems resolved, etc.

Done in d529e19. The bullet now reads "Fixed a problem introduced in version 23.0.0 that denied cluster DNS traffic when a cluster upgraded from version 22", then the operator ordering, then what works again: components keep resolving names, Guardian connects without crash looping, and the upgrade finishes.

ctauchen · 2026-08-14T17:45:55Z

+  // TODO(DOCS-3008): placeholder copied from the v23.0.0 list. Replace it with
+  // the v23.0.1 list once the release is in staging:
+  // curl -0 https://installer.calicocloud.io/manifests/<v23.0.1 manifest>/image-list
+  'v23.0.1 (latest)': `quay.io/calico/istio-pilot:v3.32.1


Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

Suppressed comments (2)

src/new/data/ccImageLists.js:5

The PR description says the v23.0.1 image list in this file is a placeholder and must be replaced before merging, but the code still contains a TODO and a manifest placeholder. Please replace this with the real v23.0.1 image-list output (or update the PR description if the placeholder is now considered acceptable).

  // TODO(DOCS-3008): placeholder copied from the v23.0.0 list. Replace it with
  // the v23.0.1 list once the release is in staging:
  // curl -0 https://installer.calicocloud.io/manifests/<v23.0.1 manifest>/image-list
  'v23.0.1 (latest)': `quay.io/calico/istio-pilot:v3.32.1

calico-cloud_versioned_docs/version-23-2/release-notes/index.mdx:17

This sentence uses “crash looping”, but elsewhere in these release notes the term is written as “crash-loop”/“crash-looping”. Consider hyphenating for consistency and readability.

  $[prodname] components keep resolving names for the whole upgrade, Guardian connects without crash looping, and the upgrade finishes.

ctauchen · 2026-08-14T17:59:22Z

Superseded by #2920, which puts the same commits on publish/cc-23.0.1 in this repo, following the release branching model. Your review comments and the replies are carried over in the description of #2920. Closing this one.

ctauchen requested a review from a team as a code owner August 14, 2026 17:10

Copilot AI lite review requested due to automatic review settings August 14, 2026 17:10

Copilot started reviewing on behalf of ctauchen August 14, 2026 17:11 View session

Copilot AI reviewed Aug 14, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings August 14, 2026 17:31

Copilot started reviewing on behalf of ctauchen August 14, 2026 17:31 View session

Copilot AI reviewed Aug 14, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings August 14, 2026 17:47

Copilot started reviewing on behalf of ctauchen August 14, 2026 17:47 View session

Copilot AI reviewed Aug 14, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings August 14, 2026 17:50

ctauchen commented Aug 14, 2026

View reviewed changes

Copilot started reviewing on behalf of ctauchen August 14, 2026 17:50 View session

Copilot AI reviewed Aug 14, 2026

View reviewed changes

ctauchen closed this Aug 14, 2026

ctauchen mentioned this pull request Aug 14, 2026

DOCS-3008: Add Calico Cloud 23.0.1 and delist 23.0.0 #2920

Merged

ctauchen deleted the DOCS-3008 branch August 14, 2026 18:04

		* Fixed a problem that denied cluster DNS traffic during an upgrade to version 23.
		The Tigera Operator now adds the cluster DNS policy to the `calico-system` tier before it removes the policy from the `allow-tigera` tier, so $[prodname] components can resolve names for the whole upgrade.

		Version 23.0.1 replaces version 23.0.0, which is no longer available to install.
		If a cluster runs version 23.0.0, upgrade it to version 23.0.1.


		### Known issues

		:::warning[version 23.0.0 is no longer available to install]


		### Bug fixes

		* Fixed a problem that denied cluster DNS traffic during an upgrade to version 23.

Uh oh!

Conversation

ctauchen commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify Bot commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for calico-docs-preview-next ready!

Uh oh!

netlify Bot commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview succeeded!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

ctauchen commented Aug 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ctauchen commented Aug 14, 2026 •

edited

Loading

netlify Bot commented Aug 14, 2026 •

edited

Loading

netlify Bot commented Aug 14, 2026 •

edited

Loading