Updates for v3.25.2

Author: mgleung

calico/_data/versions.yml

@@ -1,3 +1,41 @@
+- title: v3.25.2
+  manifests_url: https://raw.githubusercontent.com/projectcalico/calico/v3.25.2
+  chart:
+    version: 0
+  tigera-operator:
+   image: tigera/operator
+   registry: quay.io
+   version: v1.29.6
+  components:
+     typha:
+      version: v3.25.2
+     calicoctl:
+      version: v3.25.2
+     calico/node:
+      version: v3.25.2
+     calico/cni:
+      version: v3.25.2
+     calico/apiserver:
+      version: v3.25.2
+     calico/kube-controllers:
+      version: v3.25.2
+     calico/flannel-migration-controller:
+      version: v3.25.2
+     calico/windows:
+      version: v3.25.2
+     networking-calico:
+      version: v3.25.2
+     flannel:
+      version: v0.16.3
+     calico/dikastes:
+      version: v3.25.2
+     flexvol:
+      version: v3.25.2
+     csi-driver:
+      version: v3.25.2
+     csi-node-driver-registrar:
+      version: v3.25.2
+
 - title: v3.25.1
   manifests_url: https://raw.githubusercontent.com/projectcalico/calico/v3.25.1
   chart:

calico/_includes/release-notes/v3.25.2-release-notes.md

@@ -0,0 +1,16 @@
+5 Sept 2023
+
+#### Bug fixes
+
+ - Typha: move TLS handshake to per-connection goroutine to prevent main goroutine from stalling on an unclean handshake. [calico #7976](https://github.com/projectcalico/calico/pull/7976) (@fasaxc)
+ - Fix panic when running 'calicoctl get nodes' when ASNumber was not present in the default BGPConfiguration. [calico #7861](https://github.com/projectcalico/calico/pull/7861) (@coutinhop)
+ - ebpf: fixes felix panic upon restart in debug mode when there are existing policy counters [calico #7798](https://github.com/projectcalico/calico/pull/7798) (@tomastigera)
+ - ebpf: fix applyOnforward=false in global policies [calico #7725](https://github.com/projectcalico/calico/pull/7725) (@tomastigera)
+ - Update pin to use fixed calico/bird image to fix node ST failures. [calico #7563](https://github.com/projectcalico/calico/pull/7563) (@coutinhop)
+ - Prevents Node kube-controller's internal pod cache from getting out-of-sync thus leaking memory. [calico #7503](https://github.com/projectcalico/calico/pull/7503) (@dilyevsky)
+ - Fix the auto iptables detection if ip_tables.ko preloaded on RHEL/CentOS 8 [calico #7460](https://github.com/projectcalico/calico/pull/7460) (@yankay)
+
+#### Other changes
+
+ - Update Calico VPP to v3.25.1 [calico #7535](https://github.com/projectcalico/calico/pull/7535) (@sknat)
+ - Remove usage of deprecated '--logtostderr' command line flag. [calico #7515](https://github.com/projectcalico/calico/pull/7515) (@coutinhop)

calico/getting-started/kubernetes/self-managed-public-cloud/gce.md

@@ -72,7 +72,7 @@ gcloud compute instances create controller \
     --async \
     --boot-disk-size 200GB \
     --can-ip-forward \
-    --image-family ubuntu-1804-lts \
+    --image-family ubuntu-2004-lts \
     --image-project ubuntu-os-cloud \
     --machine-type n1-standard-2 \
     --private-network-ip 10.240.0.11 \
@@ -90,7 +90,7 @@ for i in 0 1 2; do
     --async \
     --boot-disk-size 200GB \
     --can-ip-forward \
-    --image-family ubuntu-1804-lts \
+    --image-family ubuntu-2004-lts \
     --image-project ubuntu-os-cloud \
     --machine-type n1-standard-2 \
     --private-network-ip 10.240.0.2${i} \

charts/calico/values.yaml

@@ -1,5 +1,5 @@
 # The Calico version to use when generating manifests.
-version: v3.25.1
+version: v3.25.2
 
 # Configure the images to use when generating manifests.
 node:

charts/tigera-operator/values.yaml

@@ -41,8 +41,8 @@ podLabels: {}
 # Image and registry configuration for the tigera/operator pod.
 tigeraOperator:
   image: tigera/operator
-  version: v1.29.3
+  version: v1.29.6
   registry: quay.io
 calicoctl:
   image: docker.io/calico/ctl
-  tag: v3.25.1
+  tag: v3.25.2

hack/release/variables.tf

@@ -29,7 +29,7 @@ variable "disk_type" {
 variable "image" {
   type        = string
   description = "Select which image family to use."
-  default     = "ubuntu-1804-lts"
+  default     = "ubuntu-2004-lts"
 }
 
 variable "google_network" {

manifests/alp/istio-inject-configmap-1.1.0.yaml

@@ -180,7 +180,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.25.1
+        image: calico/dikastes:v3.25.2
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false

manifests/alp/istio-inject-configmap-1.1.1.yaml

@@ -180,7 +180,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.25.1
+        image: calico/dikastes:v3.25.2
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false

manifests/alp/istio-inject-configmap-1.1.10.yaml

@@ -183,7 +183,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.25.1
+        image: calico/dikastes:v3.25.2
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false

manifests/alp/istio-inject-configmap-1.1.11.yaml

@@ -183,7 +183,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.25.1
+        image: calico/dikastes:v3.25.2
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false