Release notes

The following table shows component versioning for Calico v3.6.

Use the version selector at the top-right of this page to view a different release.


Release archive with Kubernetes manifests, Docker images and binaries.

1 Jul 2019

Security fixes

Component Version
typha v3.6.4
calicoctl v3.6.4
calico/node v3.6.4
calico/cni v3.6.4
calico/kube-controllers v3.6.4
networking-calico 3.6.0
flannel v0.9.1
calico/dikastes v3.6.4
flexvol v3.6.4


Release archive with Kubernetes manifests, Docker images and binaries.

12 Jun 2019

Bug fixes

  • Fix locking of host-local IPAM directory on upgrade (@maxbischoff) cni-plugin #756
  • Fixed slow memory leak that was noticed with lots of workload churn. felix #2025 (@tmjd)
Component Version
typha v3.6.3
calicoctl v3.6.3
calico/node v3.6.3
calico/cni v3.6.3
calico/kube-controllers v3.6.3
networking-calico 3.6.0
flannel v0.9.1
calico/dikastes v3.6.3
flexvol v3.6.3


Release archive with Kubernetes manifests, Docker images and binaries.

16 May 2019

Bug fixes

  • Fix issues related to apiserver disconnection libcalico-go #1078 (@jpalardy)
  • Fix hash-based calculation of router ID for IPv4 confd #232 (@roshanirathi)
  • Fix panic in CNI plugin migration script cni-plugin #742 (@caseydavenport)
  • Retry on error when configuring IPv6 interfaces (@CallMeFoxie) cni-plugin #732 (@caseydavenport)
  • Fix panic in kube-controllers on node deletion kube-controllers #364 (@caseydavenport)
  • Fix that the Kubernetes API datastore application-layer policy manifest was using host-local IPAM instead of Calico IPAM calico #2562 (@caseydavenport)

Other changes

  • Backport k8st flake fixes to release-v3.6 node #239 (@neiljerram)
  • Use branch version of calico/ctl. confd #248 (@song-jiang)
Component Version
typha v3.6.2
calicoctl v3.6.2
calico/node v3.6.2
calico/cni v3.6.2
calico/kube-controllers v3.6.2
networking-calico 3.6.0
flannel v0.9.1
calico/dikastes v3.6.2
flexvol v3.6.2


Release archive with Kubernetes manifests, Docker images and binaries.

28 Mar 2019

Bug fixes

  • Fix upgrade initialization error when setting IPIP tunnel address cni-plugin #711 (@caseydavenport)
  • Fix unhashable type error when deleting an IP pool felix #1982 (@roshanirathi)
  • Fix that IPv6 router ID calculation change wasn’t included in release node #198 (@fasaxc)
  • Fix that IPv6 BGP peers were stuck in passive mode confd #227 (@fasaxc)
  • Update to CNI plugins v0.7.5 cni-plugin #714 (@lwr20)
Component Version
typha v3.6.1
calicoctl v3.6.1
calico/node v3.6.1
calico/cni v3.6.1
calico/kube-controllers v3.6.1
networking-calico 3.6.0
flannel v0.9.1
calico/dikastes v3.6.1
flexvol v3.6.1


Release archive with Kubernetes manifests, Docker images and binaries.

09 Mar 2019

Calico IPAM for Kubernetes API datastore

You now have full feature parity for Calico IP address management (IPAM) irrespective of the datastore you are using with your Calico deployment. This enables all of Calico’s IP address management features including:

  • Multiple IP address pools
  • Per-pod, per-namespace, and per-node pool specification

Upgrading existing clusters using Calico with host-local IPAM is seamless - simply apply the new v3.6 manifest and you’ll be using Calico IPAM! Note that it is important to use the updated manifests hosted on to ensure upgrade is not disruptive.

GitHub PRs:

OpenStack Enhancements

Calico 3.6 has several enhancements for your OpenStack deployments for better operational efficiency and resiliency. If you have a multi-region OpenStack deployment, you can choose to map all of those regions into a shared Calico datastore, which then allows you to define cross-region Calico policies. We’ve improved our documentation about the labels you can use to define Calico policy in addition to OpenStack security groups, and have added the project parent ID label to facilitate policy between hierarchically organised projects.

GitHub PRs / commits:

Selectors with substring matching

With both Kubernetes and OpenStack, you can now write Calico policy with selectors that match on a label value substring instead of the whole label value. For example you can write “role starts with ‘Security’” or “role contains ‘Engineer’”, whereas previously you could only specify a complete match “role == ‘Security Engineer’”.

GitHub PRs:

  • Selector syntax now supports operators for substring matching: “contains”, “starts with” and “ends with”. libcalico-go #1036 (@fasaxc)

Bug fixes

  • Fix issue in BIRD readiness reporting which can result in multiple nodes restarting at once node #162 (@tathagatachowdhury)
  • Fix kube-controllers performing unnecessary reprogramming of profiles libcalico-go #1012 (@song-jiang)
  • calico/node in route reflector mode now advertises service ClusterIPs to peers outside of the cluster. confd #206 (@roshanirathi)

Other changes

  • Removed unnecessary logging in Dikastes for HTTP requests. app-policy #70 (@song-jiang)
  • Removed support for the K8S_API_TOKEN environment variable libcalico-go #1023 (@tathagatachowdhury)
  • OpenStack VM endpoints now have a label for the parent ID of the VM’s project. calico #2411 (@neiljerram)
  • The CALICO_ROUTER_ID environment variable now supports a special value “hash”, which derives the router ID from the nodename. This is useful for IPv6-only systems. confd #223 (@roshanirathi)
  • Update quickstart guide to use Kubernetes API datastore. calico #2435 (@caseydavenport)
  • Update top-level navigation bar and reorganize existing content to match. calico #2372 (@emanic)
Component Version
typha v3.6.0
calicoctl v3.6.0
calico/node v3.6.0
calico/cni v3.6.0
calico/kube-controllers v3.6.0
networking-calico 3.6.0
flannel v0.9.1
calico/dikastes v3.6.0
flexvol v3.6.0