Learn Calico - Latest Stable Features (v3.31 & v3.32)

#Introduction

Technology that doesn't evolve gets left behind. Calico regularly ships new versions, and as a practitioner you need to know what features are coming in and what they mean for your cluster. Episode 20 dissects the two latest releases: v3.31 and v3.32.

Our focus isn't a changelog list, but the features that impact day-to-day work: ClusterNetworkPolicy finally standardized, sharper observability, a migration path from Flannel, and VM support that widens Calico's reach.

#Calico v3.31

#Operator and eBPF Refinements

Version v3.31 (released in late 2025) brings refinements to the Tigera Operator — including more stable upgrade management — and improvements to eBPF mode: load balancing stability, support for newer kernels, and better connection handling. For those of you planning to enable eBPF (episode 17), this version lowers the barrier.

#Platform Support

This release also adds broader platform support, especially for non-mainstream Kubernetes distributions, making Calico easier to run in diverse environments.

#How to Verify the Version

Always make sure you know which version is running:

calicoctl version
kubectl get deployment -n tigera-operator tigera-operator -o jsonpath='{.spec.template.spec.containers[0].image}'
kubectl get tigerastatus

kubectl get tigerastatus shows the image version of every running Calico component.

#Calico v3.32 (Spring 2026)

#ClusterNetworkPolicy

The most prominent feature in v3.32 is ClusterNetworkPolicy — a cluster-scope resource that follows the SIG-Network spec for multi-CNI policy standardization. The difference from GlobalNetworkPolicy: its shape follows a community-agreed standard, so the same policy can be carried to another CNI without much rewriting.

apiVersion: projectcalico.org/v3
kind: ClusterNetworkPolicy
metadata:
  name: cluster-default-deny
spec:
  selector: all()
  types:
    - Ingress
    - Egress
  ingress: []
  egress: []

This resource fits a deny baseline you want to carry into clusters with strict policy standardization.

#Observability: Goldmane and Whisker

This release refines observability with a new generation of components called Goldmane and Whisker, which improve how Calico collects and displays flow data. The goal: faster cross-cluster troubleshooting with more complete traces.

Check which observability components are active:

kubectl get pods -n calico-system -o wide
kubectl get tigerastatus | grep -iE "goldmane|whisker|log"

#Migration from Flannel

Many clusters start with Flannel (a simple VXLAN overlay). v3.32 introduces flannel-migration-controller, which helps move Flannel clusters to Calico with minimal downtime: pod IPs stay the same, and the dataplane switchover happens in stages. The technical flow:

install operator + Calico side-by-side -> brief dual dataplane
     -> migrate Flannel IP blocks to the Calico IPPool
     -> disable Flannel -> verify -> done

This controller handles most of the automatic steps that previously had to be done by hand.

#VM Support: Debian and Ubuntu

Calico now also officially supports VMs on Debian and Ubuntu distributions. This means non-container workloads can be managed by Calico network policy too — extending zero trust (episode 13) beyond pods.

#A Strategy for Adopting New Releases

#When to Upgrade

Follow a release pattern: use a stable version that has been out for a while in production, and adopt the latest release after the community validates it. For v3.32, read the official release notes at docs.tigera.io before upgrading from v3.31.

#Verifying Readiness

Before upgrading, run a thorough check:

calicoctl version
kubectl get crd | grep projectcalico.org | wc -l
kubectl get pods -A | grep -v Running | head
calicoctl node status

All nodes Established, no non-Running pods, and a compatible datastore version — three conditions before an upgrade begins.

#Wrap-Up

Episode 20 brings you to the edge of Calico development: v3.31 maturing the operator and eBPF, and v3.32 delivering ClusterNetworkPolicy, the Goldmane and Whisker observability components, Flannel migration, and VM support.

Key takeaways:

• v3.31 matures the operator, eBPF, and platform support.
• v3.32 adds ClusterNetworkPolicy per the SIG-Network spec.
• Goldmane and Whisker improve flow data observability.
• flannel-migration-controller moves Flannel clusters over in stages.
• Debian and Ubuntu VMs are now supported by Calico.
• Always check the release notes and verify the version before upgrading.

Next, in episode 21, we build a production-ready architecture — IPAM planning, a BGP topology with route reflectors, the eBPF versus iptables decision, policy tier design, an upgrade strategy, a GitOps pipeline, observability, node sizing, and an incident runbook.