Networking

Calico Releases

Track Calico releases, Kubernetes version compatibility, networking mode comparison (BGP, VXLAN, eBPF), Tigera vs open-source features, and upgrade guidance.

Official Site Documentation

—

Total Versions

—

Supported

—

Latest

Version Timeline

All tracked releases with lifecycle status and EOL dates.

Loading version data…

Lifecycle Timeline

Visual overview of active support and maintenance windows.

3.24

3.25

3.26

3.27

3.28

3.29

2022 2023 2024 2025 2026 2027 2028

Active

Maint

Active

Maint

Active

Maint

Active

Maint

Active

Maint

Active

Maint

Active / LTS

Maintenance

Today

Upgrade Paths

Migration guidance between major versions — breaking changes, effort estimates, and tips.

3.24/3.25 3.28+ Medium Difficulty

Est. 1-3 hours per minor version (more for operator migration)

Breaking Changes

Operator-managed installation now default (manifest-based deprecated)
Some GlobalNetworkPolicy fields changed
eBPF dataplane configuration format updated
Felix configuration key renames
IPAM block affinity changes
Typha scaling recommendations updated

Migration Notes

Upgrade one minor at a time. If moving from manifest-based to operator-managed installation, follow the migration guide (this is a one-time change). The operator migration is the most complex part. Once on the operator, subsequent upgrades are simpler (just update the operator version).

3.28 3.29 Low Difficulty

Est. 30-60 minutes

Breaking Changes

Updated eBPF connect-time load balancing defaults
New network policy features (may change evaluation order edge cases)
Felix log format standardization

Migration Notes

For operator-managed installations: update the operator, verify the Installation CR, watch the rollout. For manifest installations: apply new manifests. Zero downtime. Calico is conservative about breaking changes within the 3.x series.

Version Risk Assessment

Evaluate risk factors before choosing a version for production.

Version	EOL Risk	CVE Risk	Ecosystem	Cloud Support	Overall	Recommended Action
Calico 3.25 and older	Critical	High	Unsupported	None	Critical	Past EOL — network policy vulnerabilities possible
Calico 3.26	Critical	Medium	Unsupported	Degrading	Critical	No patches — upgrade to 3.28+
Calico 3.27	High	Low	Maintenance	Full	High	Security-only — plan upgrade
Calico 3.28	Medium	Low	Supported	Full	Medium	Supported — upgrade to 3.29 when convenient
Calico 3.29	None	Low	Active	Full	Low	Current — recommended

Calico supports the latest 3 minor versions. As a CNI, running unsupported versions means network security policy enforcement may have unpatched vulnerabilities. Assessed March 2026.

Calico Version Feature Comparison

Side-by-side feature differences across major versions.

Feature	3.25	3.26	3.27	3.28	3.29
eBPF dataplane	Stable	Stable	Enhanced	Enhanced	Enhanced
Operator management	Default	Default	Default	Default	Default
WireGuard encryption	Beta	Stable	Stable	Stable	Stable
BGP peering	Stable	Stable	Stable	Enhanced	Enhanced
VXLAN encapsulation	Stable	Stable	Stable	Stable	Stable
DNS policy	Enterprise	Enterprise	Enterprise	Enterprise	Enterprise
Windows node support	Beta	Stable	Stable	Stable	Stable
Multi-cluster mesh	Enterprise	Enterprise	Enterprise	Enterprise	Enterprise
K8s version support	1.24-1.28	1.25-1.29	1.26-1.30	1.27-1.31	1.28-1.32

Embed Badges

Add live Calico status badges to your README, docs, or dashboard.

Health Status

Overall support health

![Calico Health Status](https://img.releaserun.com/badge/health/calico.svg)

EOL Countdown

Next end-of-life date

![Calico EOL Countdown](https://img.releaserun.com/badge/eol/calico.svg)

Latest Version

Current stable release

![Calico Latest Version](https://img.releaserun.com/badge/v/calico.svg)

CVE Status

Known vulnerabilities

![Calico CVE Status](https://img.releaserun.com/badge/cve/calico.svg)

Frequently Asked Questions

Common questions about Calico releases and lifecycle.

What is the difference between Calico Open Source and Calico Enterprise?

Calico Open Source provides networking (BGP, VXLAN, eBPF), network policy enforcement, and basic observability. Calico Enterprise (from Tigera) adds a management UI, compliance reporting, DNS policy, deep packet inspection, SIEM integration, and multi-cluster management. For most clusters, open-source Calico provides everything needed for secure networking.

Which networking mode should I use?

BGP mode (default) gives the best performance with no encapsulation overhead. It works when your network infrastructure supports BGP peering (common in on-prem data centers and some cloud VPCs). VXLAN mode adds encapsulation overhead but works anywhere, including environments where BGP is not available. eBPF mode bypasses kube-proxy entirely and offers the best performance on supported kernels (5.8+). For cloud: VXLAN or cloud-specific IPAM. For on-prem: BGP. For performance-critical: eBPF.

How does Calico compare to Cilium?

Both are excellent CNI plugins. Cilium is eBPF-first and has more advanced observability (Hubble) and service mesh features built in. Calico has a longer track record, supports more networking modes (BGP, VXLAN, eBPF), and is the default CNI in many managed Kubernetes services. Cilium is a better choice if you want eBPF-native networking and observability. Calico is a better choice if you need BGP peering or have an existing Calico deployment.

Which Kubernetes versions does Calico support?

Calico typically supports the latest 4-5 Kubernetes minor versions. Calico 3.28+ supports K8s 1.27-1.31. Each Calico release is tested against specific K8s versions documented in the compatibility matrix. Running Calico on unsupported K8s versions may work but is not covered by Tigera support.

How do I upgrade Calico?

Calico supports rolling upgrades with zero downtime. For operator-managed installations (recommended since 3.25): update the TigeraOperator custom resource to the new version. The operator handles the rolling update. For manifest-based installations: apply the new manifests. Calico nodes upgrade one at a time. Network policies remain enforced during the upgrade. Always upgrade one minor version at a time.

What is the Calico operator?

The Tigera Operator is the recommended installation method since Calico 3.25. It manages Calico as a Kubernetes operator: you declare the desired state in an Installation CR, and the operator handles deployment, upgrades, and configuration. It replaces the older manifest-based installation and makes lifecycle management significantly simpler.

Related Tools

Dep EOL Scanner

Check your dependencies for end-of-life packages.

Stack Health Scorecard

Get an overall health grade for your tech stack.

Release Index

Browse all tracked platforms and their release timelines.