Updates for v3.22.4

Author: caseydavenport

calico/_data/versions.yml

@@ -1,3 +1,32 @@
+- title: v3.22.4
+  tigera-operator:
+   image: tigera/operator
+   registry: quay.io
+   version: v1.25.11
+  components:
+     typha:
+      version: v3.22.4
+     calicoctl:
+      version: v3.22.4
+     calico/node:
+      version: v3.22.4
+     calico/cni:
+      version: v3.22.4
+     calico/apiserver:
+      version: v3.22.4
+     calico/kube-controllers:
+      version: v3.22.4
+     calico/flannel-migration-controller:
+      version: v3.22.4
+     networking-calico:
+      version: v3.22.4
+     flannel:
+      version: v0.13.0
+     calico/dikastes:
+      version: v3.22.4
+     flexvol:
+      version: v3.22.4
+
 - title: v3.22.3
   tigera-operator:
    image: tigera/operator

calico/_includes/release-notes/v3.22.4-release-notes.md

@@ -0,0 +1,19 @@
+19 Jul 2022
+
+#### Bug fixes
+
+
+ - Update UBI base image to 8.6 [calico #6349](https://github.com/projectcalico/calico/pull/6349) (@caseydavenport)
+ - Update pacakges from UBI repo for CVE fixes [calico #6389](https://github.com/projectcalico/calico/pull/6389) (@caseydavenport)
+ - Fix a bug where the check for treating the 240/4 CIDR like RFC 1918 ranges caught the broadcast address 255.255.255.255 [calico #6389](https://github.com/projectcalico/calico/pull/6389) (@caseydavenport)
+ - Fix race condition in BIRD that could potentially cause missed config updates [calico #6389](https://github.com/projectcalico/calico/pull/6389) (@caseydavenport)
+ - Increase timeout when deleting workloads veth device in order to avoid false positives under heavy load. [calico #6365](https://github.com/projectcalico/calico/pull/6365) (@caseydavenport)
+ - Fix lookups of locally defined hostnames from within Calico containers due to missing nsswitch.conf [calico #6334](https://github.com/projectcalico/calico/pull/6334) (@caseydavenport)
+ - Update the ipset package from 7.1 to 7.11 for ARM builds [calico #6263](https://github.com/projectcalico/calico/pull/6263) (@ScOut3R)
+ - eBPF: Move mount of BPFfs and cgroupv2 to a dedicated init container with elevated privileges; enter the root cgroup namespace to mount cgroupv2 in order to allow the CTLB to be installed system-wide. Reduce the mount privileges of the main calico-node container. [calico #6248](https://github.com/projectcalico/calico/pull/6248) (@mazdakn)
+ - Fix IP address truncation when using autodetection method "k8s-internal-ip" [calico #6233](https://github.com/projectcalico/calico/pull/6233) (@Josh-Tigera)
+ - Fix issue with eBPF verifier rejecting some programs. [calico #6220](https://github.com/projectcalico/calico/pull/6220) (@tomastigera)
+ - Handle errors correctly in wireguard tunnel IP setting on the node [calico #6212](https://github.com/projectcalico/calico/pull/6212) (@robbrockbank)
+ - When there is no allocated Wireguard interface IP and host encryption is enabled the host IP is used as the device IP.  This ensures source IP selection will choose the correct host IP when routing over Wireguard [calico #6212](https://github.com/projectcalico/calico/pull/6212) (@robbrockbank)
+ - Fix that a combination of node deletions and workload IP relocation previously could result in multiple nodes having the same CIDR. [calico #6212](https://github.com/projectcalico/calico/pull/6212) (@robbrockbank)
+ - Don't allocate wireguard device IPs for managed cloud non-calico CNI [calico #6212](https://github.com/projectcalico/calico/pull/6212) (@robbrockbank)