DOCS-3008: Add Calico Cloud 23.0.1 and delist 23.0.0 - #2920
Conversation
Calico Cloud 23.0.1 fixes CI-2032, an upgrade failure that three customers have hit. Upgrading to 23.0.0 moves the cluster DNS policy into the new calico-system tier while the allow-tigera tier remains at the same order with defaultAction Deny, so DNS to kube-dns hits the implicit deny in allow-tigera. Guardian cannot resolve the Calico Cloud address, it crash loops, and the upgrade never finishes. Engineering is removing 23.0.0 as an available version to install, so the docs need to match: - Replace the 23.0.0 image list with 23.0.1 on the private registry page, so air-gapped users mirror the fixed release. - Add a known issue to the 23.0.0 release notes that describes the DNS denial, states that 23.0.0 is no longer available to install, and points to 23.0.1. - Add a 23.0.1 release note with the single bug fix. - Point cloudUserVersion at v23.0.1 so the install and system requirements pages name the installable version. The image list and the release date are placeholders until the staging build is confirmed. The allow-tigera to calico-system rename and the missed breaking change note are DOCS-3007. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The link check in make netlify fails on every pull request, which blocks the deploy preview for the main site. Two links are dead: - calicousers.slack.com returns 403 to the crawler on calico/reference/involved. Every other page links the same host with a trailing slash, and that form is already in the crawler skip list, so this makes the two involved pages consistent instead of adding a skip entry. - Cockroach Labs moved their docs to docs.cockroachlabs.com and dropped the stable alias, so the multi-cluster page linked from use-cases/cluster-mesh returns 404. The page still exists under a pinned version path. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
- Name the affected upgrade path in the bug fix, so the note does not imply that every 23.x upgrade denies cluster DNS. Only upgrades from version 22 to 23.0.0 hit the problem. - Capitalize Guardian, which is how the architecture page names the component. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
- Drop the paragraph that introduced the 23.0.1 section. The bug fix and the known issue already say that 23.0.1 replaces 23.0.0. - Write the bug fix as a full report: name the release that introduced the problem, then state what works again. - Drop the admonition around the known issue and keep plain prose, so it reads as a known issue rather than a banner. - Shorten the known issue to the problem, the cause, and the workaround. The pod-level detail belongs in CI-2032, not here. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
✅ Deploy Preview for calico-docs-preview-next ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview succeeded!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
Carrying over the review trail from #2919, which was on a fork branch and is now closed. Chris Tauchen's review there asked for the following, all applied in d529e19:
Copilot also flagged the vague "version 23" wording and the Guardian capitalization, both fixed in 84f2615. |
There was a problem hiding this comment.
Pull request overview
Updates Calico Cloud documentation to reflect the 23.0.1 release (and 23.0.0 delisting due to an upgrade/DNS regression), and fixes two external links that were failing automated link checks.
Changes:
- Add 23.0.1 release notes and add a 23.0.0 known-issue note pointing users to 23.0.1.
- Update Calico Cloud “installable version” variable from v23.0.0 to v23.0.1.
- Fix two broken external links (Cockroach Labs docs URL change; Slack crawler behavior).
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| use-cases/cluster-mesh.mdx | Updates CockroachDB docs link to the new docs host/versioned path. |
| src/new/data/ccImageLists.js | Switches the “latest” image list key to v23.0.1 (currently with a placeholder TODO). |
| calico/reference/involved.mdx | Adds trailing slash to Slack link to align with crawler skip behavior. |
| calico-cloud_versioned_docs/version-23-2/variables.js | Updates cloudUserVersion to v23.0.1 for versioned Calico Cloud docs. |
| calico-cloud_versioned_docs/version-23-2/release-notes/index.mdx | Adds 23.0.1 release note and 23.0.0 known issue + upgrade guidance. |
| calico_versioned_docs/version-3.32/reference/involved.mdx | Adds trailing slash to Slack link for the v3.32 Calico docs. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| // TODO(DOCS-3008): placeholder copied from the v23.0.0 list. Replace it with | ||
| // the v23.0.1 list once the release is in staging: | ||
| // curl -0 https://installer.calicocloud.io/manifests/<v23.0.1 manifest>/image-list | ||
| 'v23.0.1 (latest)': `quay.io/calico/istio-pilot:v3.32.1 |
There was a problem hiding this comment.
Still a placeholder, and this PR should not merge until it is replaced. Waiting on the staging build for the real v23.0.1 image list.
|
|
||
| # Calico Cloud release notes | ||
|
|
||
| <h2 id="23.0.1">August 14, 2026 (version 23.0.1)</h2> |
There was a problem hiding this comment.
Leaving the id as is. Patch releases in this file already use the version as the id, for example id="22.0.1" and id="22.0.0" further down, and only the feature releases use date ids. The anchor resolves on the deploy preview.
| Version 23.0.0 is no longer available to install. | ||
| Upgrade to [version 23.0.1](#23.0.1), which fixes the problem. |
There was a problem hiding this comment.
No change needed. The id stays 23.0.1, so this link target is correct.
| Our [public slack](https://calicousers.slack.com/) is the quickest way to get | ||
| in touch for help debugging any issues with Calico. |
There was a problem hiding this comment.
Good catch, fixed in f4f56f1 for the 3.29, 3.30, and 3.31 involved pages. The community-tested pages mention the host as plain text with no scheme, so the crawler never extracts those. Coverage is latest only today, so those three were not failing, but they would if coverage widens.
|
@tmjd Erik, two things here need the staging build before this can merge:
Also worth a check: the bug fix wording says the Tigera Operator now adds the cluster DNS policy to the calico-system tier before it removes the policy from allow-tigera. Correct that against what actually shipped. Sebastien Le Liepvre, this covers the release notes you asked for: 23.0.0 is marked as no longer available to install, with a known issue and a pointer to 23.0.1. The allow-tigera to calico-system rename you also raised is in #2918. |
|
|
||
| ### Bug fixes | ||
|
|
||
| * Fixed a problem introduced in version 23.0.0 that denied cluster DNS traffic when a cluster upgraded from version 22. |
There was a problem hiding this comment.
It would be a problem when upgrading from any previous Calico Cloud version to v23
There was a problem hiding this comment.
Fixed in f4f56f1. The bullet now says "during an upgrade to version 23", with a second line: "Clusters upgrading from any earlier version of Calico Cloud could hit it." The known issue below says the same.
| ### Bug fixes | ||
|
|
||
| * Fixed a problem introduced in version 23.0.0 that denied cluster DNS traffic when a cluster upgraded from version 22. | ||
| The Tigera Operator now adds the cluster DNS policy to the `calico-system` tier before it removes the policy from the `allow-tigera` tier. |
There was a problem hiding this comment.
This is incorrect, it is the installer that has corrected policy during the upgrade. (the policy after the upgrade didn't need any changes)
There was a problem hiding this comment.
ok will change this
There was a problem hiding this comment.
Fixed in f4f56f1. It now reads "The installer now corrects the cluster DNS policy while the upgrade runs". The claim about the operator reordering tiers is gone, and nothing implies the post-upgrade policy changed.
|
|
||
| ### Known issues | ||
|
|
||
| Upgrading from version 22 to version 23.0.0 can deny cluster DNS traffic and leave the upgrade unfinished. |
There was a problem hiding this comment.
As mentioned above, it isn't only when upgrading from v22 but from any previous CC version.
There was a problem hiding this comment.
Fixed in f4f56f1. Now "Upgrading to version 23.0.0 from any earlier version of Calico Cloud".
| The Tigera Operator moves the cluster DNS policy into the new `calico-system` tier while the `allow-tigera` tier is still in place, so $[prodname] components lose name resolution partway through the upgrade. | ||
|
|
||
| Version 23.0.0 is no longer available to install. | ||
| Upgrade to [version 23.0.1](#23.0.1), which fixes the problem. |
There was a problem hiding this comment.
If someone upgraded to v23.0.0 and is experiencing the problem, I don't think running the v23.0.1 upgrade would fix the problem. I think they'd need to reach out to CS for help to get the cluster into a healthy state and then they could upgrade.
There was a problem hiding this comment.
I'll add a note saying this.
There was a problem hiding this comment.
Added in f4f56f1: "If a cluster upgraded to version 23.0.0 and hit this problem, upgrading it to version 23.0.1 does not repair it. Contact Support to return the cluster to a healthy state first, and then upgrade it." The link points at the Calico Cloud support page. Correct me if Support would rather have people come through a specific channel for this one.
- The problem hits upgrades to version 23 from any earlier Calico Cloud version, not only from version 22. - The installer corrects the cluster DNS policy during the upgrade. The policy needed no changes after the upgrade, so the earlier description of the operator reordering tiers was wrong. - Upgrading to 23.0.1 does not repair a cluster that already hit the problem. Say so, and send those users to Support first. - Add the trailing slash to the Calico Users Slack link in the 3.29, 3.30, and 3.31 involved pages, so the crawler skip rule covers them if version coverage widens. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 9 out of 9 changed files in this pull request and generated no new comments.
Suppressed comments (1)
calico-cloud_versioned_docs/version-23-2/release-notes/index.mdx:17
- The 23.0.1 bullet says the DNS denial happened "during an upgrade to version 23", but the sentence immediately before attributes it specifically to 23.0.0. Clarifying that the issue occurs when upgrading to 23.0.0 (and tightening "crash looping" → "crash-looping") will make the fix description unambiguous.
* Fixed a problem introduced in version 23.0.0 that denied cluster DNS traffic during an upgrade to version 23.
Clusters upgrading from any earlier version of $[prodname] could hit it.
The installer now corrects the cluster DNS policy while the upgrade runs, so $[prodname] components keep resolving names, Guardian connects without crash looping, and the upgrade finishes.
Calico Cloud 23.0.1 fixes CI-2032, an upgrade failure that three customers have hit: PlaytechIMS, Insight Investment, and the Bain Capital POC. Upgrading to 23.0.0 moves the cluster DNS policy into the new calico-system tier while the allow-tigera tier remains in place at the same order with defaultAction Deny, so DNS to kube-dns hits the implicit deny in allow-tigera. Guardian cannot resolve the Calico Cloud address, it crash loops, and the upgrade never finishes. Where calico-node reaches the API server by domain name, calico-node, calico-apiserver, and calico-kube-controllers fail for the same reason.
Engineering is removing 23.0.0 as an available version to install and shipping 23.0.1 in its place, so the docs need to match.
Changes:
Two values are placeholders until the staging build is confirmed. Do not merge before they are replaced:
The second commit fixes two dead links that were failing the link check in make netlify, which blocked the main site deploy preview on every pull request, including this one:
Out of scope: the allow-tigera to calico-system rename and the missed breaking change note are DOCS-3007, in #2918.
Reviewers, the deploy preview is up. Please check these pages:
CI-2032: https://tigera.atlassian.net/browse/CI-2032
DOCS-3008: https://tigera.atlassian.net/browse/DOCS-3008