Tigera Newsletter – October 2026
Welcome to the October 2026 edition of the Tigera newsletter! Here’s what we have in store for you this month…
See you at KubeCon + CloudNativeCon North America 2026
Nov 10-12 | Salt Lake City, UT: Tigera is heading to KubeCon + CloudNativeCon North America in Salt Lake City, November 9–12. Visit booth 150 for live silent-disco Lynx sessions on identifying, governing, and containing AI agents (plus a free t-shirt).
Live Workshop: Discovering and Securing AI Agents on Kubernetes
Nov 9 | 2 p.m. – 5 p.m. MST | In-person or Virtual: Your AI agents are already calling tools, invoking each other, and reaching external models in production, but a Kubernetes service account can’t tell you which agent made a call, who it was acting for, or what it was allowed to do.
Join Peter Kelly, CTO at Tigera on November 9 in Salt Lake City (or virtually) during KubeCon for a vendor-neutral, architecture-first workshop on agent discovery, identity, and governance.
Join us for Happy Hour with Tigera
Nov 9 | 5 p.m.-7 p.m. MST | Salt Lake City: Kick off KubeCon + CloudNativeCon North America with Tigera, the creators of Calico and Lynx, on November 9 at Le Méridien Salt Lake City Downtown. Join peers navigating the future of cloud-native and AI agent security for drinks, bites, and pitch-free conversation.
Lynx: AI agent security on Kubernetes
Lynx secures AI agents running on Kubernetes, giving platform and AI teams the visibility, control and runtime enforcement they need in production.
Calico Cloud Free Trial
Get hands-on access to the full Calico platform, and explore key networking, security, and observability features with guided tutorials. No infrastructure setup; start exploring immediately using a provided demo cluster, or connect your own.
Open Source
Calico v3.33 is here
Calico Open Source v3.33.0 shipped October 1. Highlights:
- Native v3 CRDs are GA: projectcalico.org/v3 resources are now served as native Kubernetes CRDs by default, so new installs no longer need the aggregated API server.
- One image instead of many: Most components now ship in a single quay.io/calico/calico image, and calico-node runs its helper services in one process, saving about 200 MB of memory per node. The separate calicoctl, cni, kube-controllers and typha images are no longer published, so update any pinned image references.
- netkit pod interfaces (opt-in): On Linux 6.7+, the CNI plugin can create netkit devices instead of veth pairs, giving the eBPF data plane a more efficient attach point.
- Pods reachable on the node's subnet (opt-in): With LocalSubnetL2Reachability enabled, Felix answers ARP and NDP for pod and LoadBalancer IPs, so neighbors on the same L2 segment reach them without BGP or an overlay.
- Faster nftables: Flowtable offload (off by default) speeds up established connections on the nftables data plane.
- eBPF connection limits: Per-pod max-connection QoS limits now work on the eBPF data plane, closing the last QoS gap with iptables and nftables.
- Felix programs IPIP routes: Felix, not BIRD, now programs cluster routes for IPIP pools by default. BIRD programming of these routes is deprecated and planned for removal in v3.35.
Before you upgrade: The eBPF data plane now requires kernel 5.10+ with BTF, there's a known issue running eBPF on kernel 5.15, and FIPS mode has been removed. Read the upgrade notes first. Read the v3.33 release notes
Patch releases on the way
Calico v3.32.3 is in final release prep, with Go and Kubernetes patch updates, CVE fixes, and OpenStack fixes. v3.33.1 is expected in mid-November. Still on v3.31? It has reached end of life, so now is a good time to plan your move to v3.32 or v3.33. Watch for the release on GitHub
Want to test and learn cluster network policy, policy tiers, priority evaluation, and default actions in real-time? Check out the interactive Network Policy Editor & Tutorial Playground based on Calico’s policy engine.
Connect with us online:
RECENT RELEASES: CALICO PLATFORM
- Calico Enterprise 3.24.0-2.0 (Early Preview) – September 1, 2026: Early preview of the 3.24 stream with L2 bridge networking and Forklift VM migration as tech preview. Not for production use.. Read the release notes.
- Calico Enterprise 3.22.8 (Bug Fix) – October 8, 2026: Maintenance release with security updates, a fix for calico-node rollouts stalling on EKS and AKS, and a batch of eBPF data plane fixes. Read the release notes.
- Calico Cloud 24.0.0 – October 13, 2026: New policy editor with YAML view, sidecar-free eBPF L7 log collection, and per-route Gateway WAF (tech preview), note the Ingress Gateway namespace change before upgrading. Read the release notes.
IN THE NEWS
Check out this recent Tigera-related coverage.
- Stopping an AI agent mid-task on Kubernetes from SDxCentral
➔ To see all coverage and to read Tigera’s press releases, visit our Newsroom
Blog
- Would You Notice? Five AI Agent Incidents and Who Actually Caught Them
- Meet Tigera at KubeCon + CloudNativeCon North America 2026
- From Merged PR to Governed Pod: Automating AI Agent Deployment on Kubernetes
- Managing Claude Code Sessions Through Lynx
- The Clearinghouse For AI Agents Has A Blind Spot
Guides
AI Agent Governance – A practical playbook for managing agents responsibly at scale: what governance actually means for autonomous agents, how to apply governance across every stage of the agent lifecycle, and the challenges that surface along the way. Read the guide.
White papers
Securing AI Agents on Kubernetes using Tigera Lynx – Learn why the network layer can't govern your agents in production—and how Tigera Lynx secures them at the agent layer with 5 pillars: discovery, posture, identity, enforcement, and behavior. Download the whitepaper.
Help Center
Our Help Center is an important technical resource for users and customers of Calico Cloud and Calico Enterprise. The Help Center contains technical articles to help you install, configure and manage your Calico solution. Access the Help Center here.
Certifications
Certified Calico Operator: Azure Expert
Gain experience using the Calico–Azure integration through hands-on labs. By the end of this course, you will know more about Azure cloud, as well as managed, self-managed, and hybrid cluster deployment using Calico in Azure. Enroll here.
Certified Calico Operator: Level 1 – Understand how Kubernetes networking works, how to configure and manage a Calico network, and how to secure your cluster following today’s best practices. Enroll here.
Certified Calico Operator: AWS Expert – Understand several options for deploying Kubernetes in AWS, examine how the default AWS networking works, and learn how to configure and manage Calico in AWS, and how to secure your AWS Kubernetes cluster. Enroll here.
Certified Calico Operator: eBPF course – By the end of this course, you’ll be able to run and modify simple eBPF programs, understand the deployment options and methods available with Calico’s eBPF data plane, and confidently deploy eBPF across multiple environment types. Enroll here.
➔ Explore all certification courses
PARTNERS
- We’re excited to be at the Red Hat Summit: Connect Austin on November 4 and Montreal on November 10th. Swing by our booth to chat about all things Kubernetes network security and observability. Plus, don’t forget to pick up some exclusive Calico swag.
We hope you found valuable resources and information in this month’s newsletter, and we welcome your feedback. Please let us know how we can make our monthly newsletter a useful source of information that you look forward to each month. Send us your suggestions.
– The Tigera Team
Follow us
© 2026 Tigera, Inc. All rights reserved.
2890 Zanker Rd, Suite 205, San Jose, CA 95134