From c5905b0c16bee3f0071b49a0037a65d127bc904a Mon Sep 17 00:00:00 2001 From: Alex O'Regan Date: Mon, 2 Nov 2026 14:06:16 +0000 Subject: [PATCH 01/17] [DOCS#CORE-13910]: State Multus v4.3.1 floor for L2 bridge The L2 bridge prerequisites now ask for Multus v4.3.1 or later, matching the Forklift install page. Co-Authored-By: Claude Opus 5.5 --- calico-enterprise/networking/l2-bridge/connect-vlan.mdx | 2 +- calico-enterprise/reference/l2-bridge-support.mdx | 2 +- .../version-3.24-2/networking/l2-bridge/connect-vlan.mdx | 2 +- .../version-3.24-2/reference/l2-bridge-support.mdx | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/calico-enterprise/networking/l2-bridge/connect-vlan.mdx b/calico-enterprise/networking/l2-bridge/connect-vlan.mdx index 80eeb67250..47b19340a8 100644 --- a/calico-enterprise/networking/l2-bridge/connect-vlan.mdx +++ b/calico-enterprise/networking/l2-bridge/connect-vlan.mdx @@ -39,7 +39,7 @@ The failures they cause are cheaper to avoid than to diagnose. That arrived upstream in 5.18, but some distributions backport it: RHEL 9 and RHCOS report 5.14 and meet the requirement. See [Platform requirements](../../reference/l2-bridge-support.mdx#platform-requirements). - An active $[prodname] license. -- [Multus](../configuring/multiple-networks.mdx) installed. +- [Multus](../configuring/multiple-networks.mdx) v4.3.1 or later installed. Every procedure on this page attaches the L2 network as an additional interface, which is what Multus does, so it is required here. A workload taking an L2 network as its primary interface is configured with annotations instead and does not need Multus; see [Primary and secondary interfaces](../../reference/l2-bridge-support.mdx#primary-and-secondary-interfaces). OpenShift includes Multus by default. diff --git a/calico-enterprise/reference/l2-bridge-support.mdx b/calico-enterprise/reference/l2-bridge-support.mdx index c4a6f75ce7..b4fb8d9ee1 100644 --- a/calico-enterprise/reference/l2-bridge-support.mdx +++ b/calico-enterprise/reference/l2-bridge-support.mdx @@ -68,7 +68,7 @@ All of these must be in place before you create a `Network`. - An active $[prodname] license. - The eBPF data plane, enabled cluster-wide. -- [Multus](../networking/configuring/multiple-networks.mdx), for attaching an L2 network to a workload as an additional interface. +- [Multus](../networking/configuring/multiple-networks.mdx) v4.3.1 or later, for attaching an L2 network to a workload as an additional interface. OpenShift includes Multus by default; on other platforms it is a third-party component that $[prodname] does not ship. A workload that takes an L2 network as its primary interface does not use Multus. See [Primary and secondary interfaces](#primary-and-secondary-interfaces). diff --git a/calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/connect-vlan.mdx b/calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/connect-vlan.mdx index 80eeb67250..47b19340a8 100644 --- a/calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/connect-vlan.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/connect-vlan.mdx @@ -39,7 +39,7 @@ The failures they cause are cheaper to avoid than to diagnose. That arrived upstream in 5.18, but some distributions backport it: RHEL 9 and RHCOS report 5.14 and meet the requirement. See [Platform requirements](../../reference/l2-bridge-support.mdx#platform-requirements). - An active $[prodname] license. -- [Multus](../configuring/multiple-networks.mdx) installed. +- [Multus](../configuring/multiple-networks.mdx) v4.3.1 or later installed. Every procedure on this page attaches the L2 network as an additional interface, which is what Multus does, so it is required here. A workload taking an L2 network as its primary interface is configured with annotations instead and does not need Multus; see [Primary and secondary interfaces](../../reference/l2-bridge-support.mdx#primary-and-secondary-interfaces). OpenShift includes Multus by default. diff --git a/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx b/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx index c4a6f75ce7..b4fb8d9ee1 100644 --- a/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx @@ -68,7 +68,7 @@ All of these must be in place before you create a `Network`. - An active $[prodname] license. - The eBPF data plane, enabled cluster-wide. -- [Multus](../networking/configuring/multiple-networks.mdx), for attaching an L2 network to a workload as an additional interface. +- [Multus](../networking/configuring/multiple-networks.mdx) v4.3.1 or later, for attaching an L2 network to a workload as an additional interface. OpenShift includes Multus by default; on other platforms it is a third-party component that $[prodname] does not ship. A workload that takes an L2 network as its primary interface does not use Multus. See [Primary and secondary interfaces](#primary-and-secondary-interfaces). From 22122b5ce9c6e00ebbbf2af2acf3e420447c29b5 Mon Sep 17 00:00:00 2001 From: Alex O'Regan Date: Mon, 2 Nov 2026 15:46:53 +0000 Subject: [PATCH 02/17] [DOCS#CORE-13910]: Cover BYO bridge, OpenShift and pinned images in the Multus floor The BYO bridge prerequisites now ask for Multus v4.3.1 or later too. The L2 bridge reference lists the OpenShift releases whose bundled Multus frees a workload's IP address on delete (4.20.40, 4.21.35, 4.22.14 and later). The VLAN, BYO bridge and Forklift-on-OpenShift pages point to it or state the same releases. The upstream Multus manifests use a floating snapshot image, so the reference now says to set the images to the release being installed. Co-Authored-By: Claude Opus 5.5 --- .../networking/kubevirt/install-forklift-openshift.mdx | 1 + calico-enterprise/networking/l2-bridge/byo-bridge.mdx | 3 ++- calico-enterprise/networking/l2-bridge/connect-vlan.mdx | 3 ++- calico-enterprise/reference/l2-bridge-support.mdx | 4 +++- .../networking/kubevirt/install-forklift-openshift.mdx | 1 + .../version-3.24-2/networking/l2-bridge/byo-bridge.mdx | 3 ++- .../version-3.24-2/networking/l2-bridge/connect-vlan.mdx | 3 ++- .../version-3.24-2/reference/l2-bridge-support.mdx | 4 +++- 8 files changed, 16 insertions(+), 6 deletions(-) diff --git a/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx b/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx index 8e259efa8c..fbc6d2d721 100644 --- a/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx +++ b/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx @@ -24,6 +24,7 @@ Install the Tigera fork of Forklift on an OpenShift cluster and connect it to a - Cluster admin access, and `kubectl` or `oc`. - A cluster running $[prodname] as the CNI, and Multus for secondary-NIC attachments, with your Installation's [`spec.calicoNetwork.multiInterfaceMode`](../l2-bridge/connect-vlan.mdx) set to `Multus`. +- OpenShift 4.20.40, 4.21.35, 4.22.14 or later. The Multus in OpenShift 4.19 and in earlier 4.20 to 4.22 releases does not free a VM's IP address when the VM is deleted. - The BPF data plane enabled: `bpfEnabled: true` in the default `FelixConfiguration`. See [Enable eBPF on an existing cluster](../../operations/ebpf/enabling-ebpf.mdx). - OpenShift Virtualization (KubeVirt and CDI) installed, with `HyperConverged` Available. - A StorageClass for the migrated VM disks. diff --git a/calico-enterprise/networking/l2-bridge/byo-bridge.mdx b/calico-enterprise/networking/l2-bridge/byo-bridge.mdx index 78dd2a7fc1..ae9aa5382f 100644 --- a/calico-enterprise/networking/l2-bridge/byo-bridge.mdx +++ b/calico-enterprise/networking/l2-bridge/byo-bridge.mdx @@ -51,7 +51,8 @@ They are quick to check, and any one of them not being true means the bridge you That arrived upstream in 5.18, but some distributions backport it: RHEL 9 and RHCOS report 5.14 and meet the requirement. See [Platform requirements](../../reference/l2-bridge-support.mdx#platform-requirements). - An active $[prodname] license. -- [Multus](../configuring/multiple-networks.mdx) installed, unless your workloads will take the L2 network as their primary interface. +- [Multus](../configuring/multiple-networks.mdx) v4.3.1 or later installed, unless your workloads will take the L2 network as their primary interface. + See [Prerequisites](../../reference/l2-bridge-support.mdx#prerequisites) for the OpenShift releases that include a suitable Multus. See [Primary and secondary interfaces](../../reference/l2-bridge-support.mdx#primary-and-secondary-interfaces). - KubeVirt installed, if you are attaching VMs. diff --git a/calico-enterprise/networking/l2-bridge/connect-vlan.mdx b/calico-enterprise/networking/l2-bridge/connect-vlan.mdx index 47b19340a8..d7db4fcc7a 100644 --- a/calico-enterprise/networking/l2-bridge/connect-vlan.mdx +++ b/calico-enterprise/networking/l2-bridge/connect-vlan.mdx @@ -42,8 +42,9 @@ The failures they cause are cheaper to avoid than to diagnose. - [Multus](../configuring/multiple-networks.mdx) v4.3.1 or later installed. Every procedure on this page attaches the L2 network as an additional interface, which is what Multus does, so it is required here. A workload taking an L2 network as its primary interface is configured with annotations instead and does not need Multus; see [Primary and secondary interfaces](../../reference/l2-bridge-support.mdx#primary-and-secondary-interfaces). - OpenShift includes Multus by default. + OpenShift includes Multus by default, but only some OpenShift releases include a suitable version. On other platforms it is a third-party component that $[prodname] does not ship. + See [Prerequisites](../../reference/l2-bridge-support.mdx#prerequisites) for the OpenShift releases and for installing a fixed Multus release from the upstream manifests. - KubeVirt installed, if you are attaching VMs. - On each node, an interface cabled to a switch port configured as a trunk carrying your workload VLANs. $[prodname] attaches to the trunk you already have: it does not configure the switch, and it cannot turn an access port into a trunk. diff --git a/calico-enterprise/reference/l2-bridge-support.mdx b/calico-enterprise/reference/l2-bridge-support.mdx index b4fb8d9ee1..511380672a 100644 --- a/calico-enterprise/reference/l2-bridge-support.mdx +++ b/calico-enterprise/reference/l2-bridge-support.mdx @@ -69,7 +69,9 @@ All of these must be in place before you create a `Network`. - An active $[prodname] license. - The eBPF data plane, enabled cluster-wide. - [Multus](../networking/configuring/multiple-networks.mdx) v4.3.1 or later, for attaching an L2 network to a workload as an additional interface. - OpenShift includes Multus by default; on other platforms it is a third-party component that $[prodname] does not ship. + OpenShift includes Multus by default. You need OpenShift 4.20.40, 4.21.35, 4.22.14 or a later release: the Multus in OpenShift 4.19 and in earlier 4.20 to 4.22 releases does not free a workload's IP address when the workload is deleted. + On other platforms Multus is a third-party component that $[prodname] does not ship. + The upstream Multus manifests use a floating `snapshot` image, so set the Multus images to the release tag you are installing. A workload that takes an L2 network as its primary interface does not use Multus. See [Primary and secondary interfaces](#primary-and-secondary-interfaces). - `multiInterfaceMode: Multus` set in the `calicoNetwork` section of the [Installation](installation/api.mdx) resource, for the same case. diff --git a/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx b/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx index 8e259efa8c..fbc6d2d721 100644 --- a/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx @@ -24,6 +24,7 @@ Install the Tigera fork of Forklift on an OpenShift cluster and connect it to a - Cluster admin access, and `kubectl` or `oc`. - A cluster running $[prodname] as the CNI, and Multus for secondary-NIC attachments, with your Installation's [`spec.calicoNetwork.multiInterfaceMode`](../l2-bridge/connect-vlan.mdx) set to `Multus`. +- OpenShift 4.20.40, 4.21.35, 4.22.14 or later. The Multus in OpenShift 4.19 and in earlier 4.20 to 4.22 releases does not free a VM's IP address when the VM is deleted. - The BPF data plane enabled: `bpfEnabled: true` in the default `FelixConfiguration`. See [Enable eBPF on an existing cluster](../../operations/ebpf/enabling-ebpf.mdx). - OpenShift Virtualization (KubeVirt and CDI) installed, with `HyperConverged` Available. - A StorageClass for the migrated VM disks. diff --git a/calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/byo-bridge.mdx b/calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/byo-bridge.mdx index 78dd2a7fc1..ae9aa5382f 100644 --- a/calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/byo-bridge.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/byo-bridge.mdx @@ -51,7 +51,8 @@ They are quick to check, and any one of them not being true means the bridge you That arrived upstream in 5.18, but some distributions backport it: RHEL 9 and RHCOS report 5.14 and meet the requirement. See [Platform requirements](../../reference/l2-bridge-support.mdx#platform-requirements). - An active $[prodname] license. -- [Multus](../configuring/multiple-networks.mdx) installed, unless your workloads will take the L2 network as their primary interface. +- [Multus](../configuring/multiple-networks.mdx) v4.3.1 or later installed, unless your workloads will take the L2 network as their primary interface. + See [Prerequisites](../../reference/l2-bridge-support.mdx#prerequisites) for the OpenShift releases that include a suitable Multus. See [Primary and secondary interfaces](../../reference/l2-bridge-support.mdx#primary-and-secondary-interfaces). - KubeVirt installed, if you are attaching VMs. diff --git a/calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/connect-vlan.mdx b/calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/connect-vlan.mdx index 47b19340a8..d7db4fcc7a 100644 --- a/calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/connect-vlan.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/connect-vlan.mdx @@ -42,8 +42,9 @@ The failures they cause are cheaper to avoid than to diagnose. - [Multus](../configuring/multiple-networks.mdx) v4.3.1 or later installed. Every procedure on this page attaches the L2 network as an additional interface, which is what Multus does, so it is required here. A workload taking an L2 network as its primary interface is configured with annotations instead and does not need Multus; see [Primary and secondary interfaces](../../reference/l2-bridge-support.mdx#primary-and-secondary-interfaces). - OpenShift includes Multus by default. + OpenShift includes Multus by default, but only some OpenShift releases include a suitable version. On other platforms it is a third-party component that $[prodname] does not ship. + See [Prerequisites](../../reference/l2-bridge-support.mdx#prerequisites) for the OpenShift releases and for installing a fixed Multus release from the upstream manifests. - KubeVirt installed, if you are attaching VMs. - On each node, an interface cabled to a switch port configured as a trunk carrying your workload VLANs. $[prodname] attaches to the trunk you already have: it does not configure the switch, and it cannot turn an access port into a trunk. diff --git a/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx b/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx index b4fb8d9ee1..511380672a 100644 --- a/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx @@ -69,7 +69,9 @@ All of these must be in place before you create a `Network`. - An active $[prodname] license. - The eBPF data plane, enabled cluster-wide. - [Multus](../networking/configuring/multiple-networks.mdx) v4.3.1 or later, for attaching an L2 network to a workload as an additional interface. - OpenShift includes Multus by default; on other platforms it is a third-party component that $[prodname] does not ship. + OpenShift includes Multus by default. You need OpenShift 4.20.40, 4.21.35, 4.22.14 or a later release: the Multus in OpenShift 4.19 and in earlier 4.20 to 4.22 releases does not free a workload's IP address when the workload is deleted. + On other platforms Multus is a third-party component that $[prodname] does not ship. + The upstream Multus manifests use a floating `snapshot` image, so set the Multus images to the release tag you are installing. A workload that takes an L2 network as its primary interface does not use Multus. See [Primary and secondary interfaces](#primary-and-secondary-interfaces). - `multiInterfaceMode: Multus` set in the `calicoNetwork` section of the [Installation](installation/api.mdx) resource, for the same case. From 9a5800549c335738790a9874847c32f61190afa3 Mon Sep 17 00:00:00 2001 From: Alex O'Regan Date: Mon, 2 Nov 2026 15:57:13 +0000 Subject: [PATCH 03/17] [DOCS#CORE-13910]: Describe affected OpenShift releases without stating support Co-Authored-By: Claude Opus 5.5 --- .../networking/kubevirt/install-forklift-openshift.mdx | 2 +- calico-enterprise/networking/l2-bridge/byo-bridge.mdx | 2 +- calico-enterprise/networking/l2-bridge/connect-vlan.mdx | 4 ++-- calico-enterprise/reference/l2-bridge-support.mdx | 2 +- .../networking/kubevirt/install-forklift-openshift.mdx | 2 +- .../version-3.24-2/networking/l2-bridge/byo-bridge.mdx | 2 +- .../version-3.24-2/networking/l2-bridge/connect-vlan.mdx | 4 ++-- .../version-3.24-2/reference/l2-bridge-support.mdx | 2 +- 8 files changed, 10 insertions(+), 10 deletions(-) diff --git a/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx b/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx index fbc6d2d721..31d3f6cdde 100644 --- a/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx +++ b/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx @@ -24,7 +24,7 @@ Install the Tigera fork of Forklift on an OpenShift cluster and connect it to a - Cluster admin access, and `kubectl` or `oc`. - A cluster running $[prodname] as the CNI, and Multus for secondary-NIC attachments, with your Installation's [`spec.calicoNetwork.multiInterfaceMode`](../l2-bridge/connect-vlan.mdx) set to `Multus`. -- OpenShift 4.20.40, 4.21.35, 4.22.14 or later. The Multus in OpenShift 4.19 and in earlier 4.20 to 4.22 releases does not free a VM's IP address when the VM is deleted. + The Multus in OpenShift 4.19, and in 4.20, 4.21 and 4.22 releases before 4.20.40, 4.21.35 and 4.22.14, does not free a VM's IP address when the VM is deleted. - The BPF data plane enabled: `bpfEnabled: true` in the default `FelixConfiguration`. See [Enable eBPF on an existing cluster](../../operations/ebpf/enabling-ebpf.mdx). - OpenShift Virtualization (KubeVirt and CDI) installed, with `HyperConverged` Available. - A StorageClass for the migrated VM disks. diff --git a/calico-enterprise/networking/l2-bridge/byo-bridge.mdx b/calico-enterprise/networking/l2-bridge/byo-bridge.mdx index ae9aa5382f..63fb934f5b 100644 --- a/calico-enterprise/networking/l2-bridge/byo-bridge.mdx +++ b/calico-enterprise/networking/l2-bridge/byo-bridge.mdx @@ -52,7 +52,7 @@ They are quick to check, and any one of them not being true means the bridge you See [Platform requirements](../../reference/l2-bridge-support.mdx#platform-requirements). - An active $[prodname] license. - [Multus](../configuring/multiple-networks.mdx) v4.3.1 or later installed, unless your workloads will take the L2 network as their primary interface. - See [Prerequisites](../../reference/l2-bridge-support.mdx#prerequisites) for the OpenShift releases that include a suitable Multus. + See [Prerequisites](../../reference/l2-bridge-support.mdx#prerequisites) for the OpenShift releases whose Multus does not free IP addresses on delete. See [Primary and secondary interfaces](../../reference/l2-bridge-support.mdx#primary-and-secondary-interfaces). - KubeVirt installed, if you are attaching VMs. diff --git a/calico-enterprise/networking/l2-bridge/connect-vlan.mdx b/calico-enterprise/networking/l2-bridge/connect-vlan.mdx index d7db4fcc7a..b8666a08a5 100644 --- a/calico-enterprise/networking/l2-bridge/connect-vlan.mdx +++ b/calico-enterprise/networking/l2-bridge/connect-vlan.mdx @@ -42,9 +42,9 @@ The failures they cause are cheaper to avoid than to diagnose. - [Multus](../configuring/multiple-networks.mdx) v4.3.1 or later installed. Every procedure on this page attaches the L2 network as an additional interface, which is what Multus does, so it is required here. A workload taking an L2 network as its primary interface is configured with annotations instead and does not need Multus; see [Primary and secondary interfaces](../../reference/l2-bridge-support.mdx#primary-and-secondary-interfaces). - OpenShift includes Multus by default, but only some OpenShift releases include a suitable version. + OpenShift includes Multus by default. On other platforms it is a third-party component that $[prodname] does not ship. - See [Prerequisites](../../reference/l2-bridge-support.mdx#prerequisites) for the OpenShift releases and for installing a fixed Multus release from the upstream manifests. + See [Prerequisites](../../reference/l2-bridge-support.mdx#prerequisites) for the OpenShift releases whose Multus does not free IP addresses on delete, and for installing a fixed Multus release from the upstream manifests. - KubeVirt installed, if you are attaching VMs. - On each node, an interface cabled to a switch port configured as a trunk carrying your workload VLANs. $[prodname] attaches to the trunk you already have: it does not configure the switch, and it cannot turn an access port into a trunk. diff --git a/calico-enterprise/reference/l2-bridge-support.mdx b/calico-enterprise/reference/l2-bridge-support.mdx index 511380672a..ec631dab0e 100644 --- a/calico-enterprise/reference/l2-bridge-support.mdx +++ b/calico-enterprise/reference/l2-bridge-support.mdx @@ -69,7 +69,7 @@ All of these must be in place before you create a `Network`. - An active $[prodname] license. - The eBPF data plane, enabled cluster-wide. - [Multus](../networking/configuring/multiple-networks.mdx) v4.3.1 or later, for attaching an L2 network to a workload as an additional interface. - OpenShift includes Multus by default. You need OpenShift 4.20.40, 4.21.35, 4.22.14 or a later release: the Multus in OpenShift 4.19 and in earlier 4.20 to 4.22 releases does not free a workload's IP address when the workload is deleted. + OpenShift includes Multus by default. The Multus in OpenShift 4.19, and in 4.20, 4.21 and 4.22 releases before 4.20.40, 4.21.35 and 4.22.14, does not free a workload's IP address when the workload is deleted. On other platforms Multus is a third-party component that $[prodname] does not ship. The upstream Multus manifests use a floating `snapshot` image, so set the Multus images to the release tag you are installing. A workload that takes an L2 network as its primary interface does not use Multus. diff --git a/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx b/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx index fbc6d2d721..31d3f6cdde 100644 --- a/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx @@ -24,7 +24,7 @@ Install the Tigera fork of Forklift on an OpenShift cluster and connect it to a - Cluster admin access, and `kubectl` or `oc`. - A cluster running $[prodname] as the CNI, and Multus for secondary-NIC attachments, with your Installation's [`spec.calicoNetwork.multiInterfaceMode`](../l2-bridge/connect-vlan.mdx) set to `Multus`. -- OpenShift 4.20.40, 4.21.35, 4.22.14 or later. The Multus in OpenShift 4.19 and in earlier 4.20 to 4.22 releases does not free a VM's IP address when the VM is deleted. + The Multus in OpenShift 4.19, and in 4.20, 4.21 and 4.22 releases before 4.20.40, 4.21.35 and 4.22.14, does not free a VM's IP address when the VM is deleted. - The BPF data plane enabled: `bpfEnabled: true` in the default `FelixConfiguration`. See [Enable eBPF on an existing cluster](../../operations/ebpf/enabling-ebpf.mdx). - OpenShift Virtualization (KubeVirt and CDI) installed, with `HyperConverged` Available. - A StorageClass for the migrated VM disks. diff --git a/calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/byo-bridge.mdx b/calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/byo-bridge.mdx index ae9aa5382f..63fb934f5b 100644 --- a/calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/byo-bridge.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/byo-bridge.mdx @@ -52,7 +52,7 @@ They are quick to check, and any one of them not being true means the bridge you See [Platform requirements](../../reference/l2-bridge-support.mdx#platform-requirements). - An active $[prodname] license. - [Multus](../configuring/multiple-networks.mdx) v4.3.1 or later installed, unless your workloads will take the L2 network as their primary interface. - See [Prerequisites](../../reference/l2-bridge-support.mdx#prerequisites) for the OpenShift releases that include a suitable Multus. + See [Prerequisites](../../reference/l2-bridge-support.mdx#prerequisites) for the OpenShift releases whose Multus does not free IP addresses on delete. See [Primary and secondary interfaces](../../reference/l2-bridge-support.mdx#primary-and-secondary-interfaces). - KubeVirt installed, if you are attaching VMs. diff --git a/calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/connect-vlan.mdx b/calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/connect-vlan.mdx index d7db4fcc7a..b8666a08a5 100644 --- a/calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/connect-vlan.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/connect-vlan.mdx @@ -42,9 +42,9 @@ The failures they cause are cheaper to avoid than to diagnose. - [Multus](../configuring/multiple-networks.mdx) v4.3.1 or later installed. Every procedure on this page attaches the L2 network as an additional interface, which is what Multus does, so it is required here. A workload taking an L2 network as its primary interface is configured with annotations instead and does not need Multus; see [Primary and secondary interfaces](../../reference/l2-bridge-support.mdx#primary-and-secondary-interfaces). - OpenShift includes Multus by default, but only some OpenShift releases include a suitable version. + OpenShift includes Multus by default. On other platforms it is a third-party component that $[prodname] does not ship. - See [Prerequisites](../../reference/l2-bridge-support.mdx#prerequisites) for the OpenShift releases and for installing a fixed Multus release from the upstream manifests. + See [Prerequisites](../../reference/l2-bridge-support.mdx#prerequisites) for the OpenShift releases whose Multus does not free IP addresses on delete, and for installing a fixed Multus release from the upstream manifests. - KubeVirt installed, if you are attaching VMs. - On each node, an interface cabled to a switch port configured as a trunk carrying your workload VLANs. $[prodname] attaches to the trunk you already have: it does not configure the switch, and it cannot turn an access port into a trunk. diff --git a/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx b/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx index 511380672a..ec631dab0e 100644 --- a/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx @@ -69,7 +69,7 @@ All of these must be in place before you create a `Network`. - An active $[prodname] license. - The eBPF data plane, enabled cluster-wide. - [Multus](../networking/configuring/multiple-networks.mdx) v4.3.1 or later, for attaching an L2 network to a workload as an additional interface. - OpenShift includes Multus by default. You need OpenShift 4.20.40, 4.21.35, 4.22.14 or a later release: the Multus in OpenShift 4.19 and in earlier 4.20 to 4.22 releases does not free a workload's IP address when the workload is deleted. + OpenShift includes Multus by default. The Multus in OpenShift 4.19, and in 4.20, 4.21 and 4.22 releases before 4.20.40, 4.21.35 and 4.22.14, does not free a workload's IP address when the workload is deleted. On other platforms Multus is a third-party component that $[prodname] does not ship. The upstream Multus manifests use a floating `snapshot` image, so set the Multus images to the release tag you are installing. A workload that takes an L2 network as its primary interface does not use Multus. From c69e9e77c5ee996afb747abf4702b266d329ff5f Mon Sep 17 00:00:00 2001 From: Alex O'Regan Date: Mon, 2 Nov 2026 16:01:37 +0000 Subject: [PATCH 04/17] [DOCS#CORE-13910]: Reword the affected OpenShift releases Co-Authored-By: Claude Opus 5.5 --- .../networking/kubevirt/install-forklift-openshift.mdx | 3 ++- calico-enterprise/reference/l2-bridge-support.mdx | 3 ++- .../networking/kubevirt/install-forklift-openshift.mdx | 3 ++- .../version-3.24-2/reference/l2-bridge-support.mdx | 3 ++- 4 files changed, 8 insertions(+), 4 deletions(-) diff --git a/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx b/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx index 31d3f6cdde..27af35d30e 100644 --- a/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx +++ b/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx @@ -24,7 +24,8 @@ Install the Tigera fork of Forklift on an OpenShift cluster and connect it to a - Cluster admin access, and `kubectl` or `oc`. - A cluster running $[prodname] as the CNI, and Multus for secondary-NIC attachments, with your Installation's [`spec.calicoNetwork.multiInterfaceMode`](../l2-bridge/connect-vlan.mdx) set to `Multus`. - The Multus in OpenShift 4.19, and in 4.20, 4.21 and 4.22 releases before 4.20.40, 4.21.35 and 4.22.14, does not free a VM's IP address when the VM is deleted. + On OpenShift 4.19, the bundled Multus does not free a VM's IP address when the VM is deleted. + The same bug affects 4.20 before 4.20.40, 4.21 before 4.21.35, and 4.22 before 4.22.14. - The BPF data plane enabled: `bpfEnabled: true` in the default `FelixConfiguration`. See [Enable eBPF on an existing cluster](../../operations/ebpf/enabling-ebpf.mdx). - OpenShift Virtualization (KubeVirt and CDI) installed, with `HyperConverged` Available. - A StorageClass for the migrated VM disks. diff --git a/calico-enterprise/reference/l2-bridge-support.mdx b/calico-enterprise/reference/l2-bridge-support.mdx index ec631dab0e..89ccab9c0b 100644 --- a/calico-enterprise/reference/l2-bridge-support.mdx +++ b/calico-enterprise/reference/l2-bridge-support.mdx @@ -69,7 +69,8 @@ All of these must be in place before you create a `Network`. - An active $[prodname] license. - The eBPF data plane, enabled cluster-wide. - [Multus](../networking/configuring/multiple-networks.mdx) v4.3.1 or later, for attaching an L2 network to a workload as an additional interface. - OpenShift includes Multus by default. The Multus in OpenShift 4.19, and in 4.20, 4.21 and 4.22 releases before 4.20.40, 4.21.35 and 4.22.14, does not free a workload's IP address when the workload is deleted. + OpenShift includes Multus by default. On OpenShift 4.19, that Multus does not free a workload's IP address when the workload is deleted. + The same bug affects 4.20 before 4.20.40, 4.21 before 4.21.35, and 4.22 before 4.22.14. On other platforms Multus is a third-party component that $[prodname] does not ship. The upstream Multus manifests use a floating `snapshot` image, so set the Multus images to the release tag you are installing. A workload that takes an L2 network as its primary interface does not use Multus. diff --git a/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx b/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx index 31d3f6cdde..27af35d30e 100644 --- a/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx @@ -24,7 +24,8 @@ Install the Tigera fork of Forklift on an OpenShift cluster and connect it to a - Cluster admin access, and `kubectl` or `oc`. - A cluster running $[prodname] as the CNI, and Multus for secondary-NIC attachments, with your Installation's [`spec.calicoNetwork.multiInterfaceMode`](../l2-bridge/connect-vlan.mdx) set to `Multus`. - The Multus in OpenShift 4.19, and in 4.20, 4.21 and 4.22 releases before 4.20.40, 4.21.35 and 4.22.14, does not free a VM's IP address when the VM is deleted. + On OpenShift 4.19, the bundled Multus does not free a VM's IP address when the VM is deleted. + The same bug affects 4.20 before 4.20.40, 4.21 before 4.21.35, and 4.22 before 4.22.14. - The BPF data plane enabled: `bpfEnabled: true` in the default `FelixConfiguration`. See [Enable eBPF on an existing cluster](../../operations/ebpf/enabling-ebpf.mdx). - OpenShift Virtualization (KubeVirt and CDI) installed, with `HyperConverged` Available. - A StorageClass for the migrated VM disks. diff --git a/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx b/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx index ec631dab0e..89ccab9c0b 100644 --- a/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx @@ -69,7 +69,8 @@ All of these must be in place before you create a `Network`. - An active $[prodname] license. - The eBPF data plane, enabled cluster-wide. - [Multus](../networking/configuring/multiple-networks.mdx) v4.3.1 or later, for attaching an L2 network to a workload as an additional interface. - OpenShift includes Multus by default. The Multus in OpenShift 4.19, and in 4.20, 4.21 and 4.22 releases before 4.20.40, 4.21.35 and 4.22.14, does not free a workload's IP address when the workload is deleted. + OpenShift includes Multus by default. On OpenShift 4.19, that Multus does not free a workload's IP address when the workload is deleted. + The same bug affects 4.20 before 4.20.40, 4.21 before 4.21.35, and 4.22 before 4.22.14. On other platforms Multus is a third-party component that $[prodname] does not ship. The upstream Multus manifests use a floating `snapshot` image, so set the Multus images to the release tag you are installing. A workload that takes an L2 network as its primary interface does not use Multus. From d90cabe535875076d58873cb4329e0322ebd1e17 Mon Sep 17 00:00:00 2001 From: Alex O'Regan Date: Mon, 2 Nov 2026 16:02:58 +0000 Subject: [PATCH 05/17] [DOCS#CORE-13910]: Simplify the OpenShift Multus note Co-Authored-By: Claude Opus 5.5 --- .../networking/kubevirt/install-forklift-openshift.mdx | 3 +-- calico-enterprise/reference/l2-bridge-support.mdx | 3 +-- .../networking/kubevirt/install-forklift-openshift.mdx | 3 +-- .../version-3.24-2/reference/l2-bridge-support.mdx | 3 +-- 4 files changed, 4 insertions(+), 8 deletions(-) diff --git a/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx b/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx index 27af35d30e..0f1345ff7e 100644 --- a/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx +++ b/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx @@ -24,8 +24,7 @@ Install the Tigera fork of Forklift on an OpenShift cluster and connect it to a - Cluster admin access, and `kubectl` or `oc`. - A cluster running $[prodname] as the CNI, and Multus for secondary-NIC attachments, with your Installation's [`spec.calicoNetwork.multiInterfaceMode`](../l2-bridge/connect-vlan.mdx) set to `Multus`. - On OpenShift 4.19, the bundled Multus does not free a VM's IP address when the VM is deleted. - The same bug affects 4.20 before 4.20.40, 4.21 before 4.21.35, and 4.22 before 4.22.14. + Older OpenShift releases bundle a Multus that does not free a VM's IP address when the VM is deleted; the latest patch releases in v4.20+ fix the issue. - The BPF data plane enabled: `bpfEnabled: true` in the default `FelixConfiguration`. See [Enable eBPF on an existing cluster](../../operations/ebpf/enabling-ebpf.mdx). - OpenShift Virtualization (KubeVirt and CDI) installed, with `HyperConverged` Available. - A StorageClass for the migrated VM disks. diff --git a/calico-enterprise/reference/l2-bridge-support.mdx b/calico-enterprise/reference/l2-bridge-support.mdx index 89ccab9c0b..6d14da8c1e 100644 --- a/calico-enterprise/reference/l2-bridge-support.mdx +++ b/calico-enterprise/reference/l2-bridge-support.mdx @@ -69,8 +69,7 @@ All of these must be in place before you create a `Network`. - An active $[prodname] license. - The eBPF data plane, enabled cluster-wide. - [Multus](../networking/configuring/multiple-networks.mdx) v4.3.1 or later, for attaching an L2 network to a workload as an additional interface. - OpenShift includes Multus by default. On OpenShift 4.19, that Multus does not free a workload's IP address when the workload is deleted. - The same bug affects 4.20 before 4.20.40, 4.21 before 4.21.35, and 4.22 before 4.22.14. + OpenShift includes Multus by default. Older OpenShift releases bundle a Multus that does not free a workload's IP address when the workload is deleted; the latest patch releases in v4.20+ fix the issue. On other platforms Multus is a third-party component that $[prodname] does not ship. The upstream Multus manifests use a floating `snapshot` image, so set the Multus images to the release tag you are installing. A workload that takes an L2 network as its primary interface does not use Multus. diff --git a/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx b/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx index 27af35d30e..0f1345ff7e 100644 --- a/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx @@ -24,8 +24,7 @@ Install the Tigera fork of Forklift on an OpenShift cluster and connect it to a - Cluster admin access, and `kubectl` or `oc`. - A cluster running $[prodname] as the CNI, and Multus for secondary-NIC attachments, with your Installation's [`spec.calicoNetwork.multiInterfaceMode`](../l2-bridge/connect-vlan.mdx) set to `Multus`. - On OpenShift 4.19, the bundled Multus does not free a VM's IP address when the VM is deleted. - The same bug affects 4.20 before 4.20.40, 4.21 before 4.21.35, and 4.22 before 4.22.14. + Older OpenShift releases bundle a Multus that does not free a VM's IP address when the VM is deleted; the latest patch releases in v4.20+ fix the issue. - The BPF data plane enabled: `bpfEnabled: true` in the default `FelixConfiguration`. See [Enable eBPF on an existing cluster](../../operations/ebpf/enabling-ebpf.mdx). - OpenShift Virtualization (KubeVirt and CDI) installed, with `HyperConverged` Available. - A StorageClass for the migrated VM disks. diff --git a/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx b/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx index 89ccab9c0b..6d14da8c1e 100644 --- a/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx @@ -69,8 +69,7 @@ All of these must be in place before you create a `Network`. - An active $[prodname] license. - The eBPF data plane, enabled cluster-wide. - [Multus](../networking/configuring/multiple-networks.mdx) v4.3.1 or later, for attaching an L2 network to a workload as an additional interface. - OpenShift includes Multus by default. On OpenShift 4.19, that Multus does not free a workload's IP address when the workload is deleted. - The same bug affects 4.20 before 4.20.40, 4.21 before 4.21.35, and 4.22 before 4.22.14. + OpenShift includes Multus by default. Older OpenShift releases bundle a Multus that does not free a workload's IP address when the workload is deleted; the latest patch releases in v4.20+ fix the issue. On other platforms Multus is a third-party component that $[prodname] does not ship. The upstream Multus manifests use a floating `snapshot` image, so set the Multus images to the release tag you are installing. A workload that takes an L2 network as its primary interface does not use Multus. From 1dfb023a8321dd838b63533b5a73bcb13e29df95 Mon Sep 17 00:00:00 2001 From: Alex O'Regan Date: Mon, 2 Nov 2026 16:04:25 +0000 Subject: [PATCH 06/17] [DOCS#CORE-13910]: List an up-to-date OpenShift as the requirement Co-Authored-By: Claude Opus 5.5 --- .../networking/kubevirt/install-forklift-openshift.mdx | 1 + calico-enterprise/reference/l2-bridge-support.mdx | 4 +++- .../networking/kubevirt/install-forklift-openshift.mdx | 1 + .../version-3.24-2/reference/l2-bridge-support.mdx | 4 +++- 4 files changed, 8 insertions(+), 2 deletions(-) diff --git a/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx b/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx index 0f1345ff7e..a681e09549 100644 --- a/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx +++ b/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx @@ -24,6 +24,7 @@ Install the Tigera fork of Forklift on an OpenShift cluster and connect it to a - Cluster admin access, and `kubectl` or `oc`. - A cluster running $[prodname] as the CNI, and Multus for secondary-NIC attachments, with your Installation's [`spec.calicoNetwork.multiInterfaceMode`](../l2-bridge/connect-vlan.mdx) set to `Multus`. +- An up-to-date version of OpenShift. Older OpenShift releases bundle a Multus that does not free a VM's IP address when the VM is deleted; the latest patch releases in v4.20+ fix the issue. - The BPF data plane enabled: `bpfEnabled: true` in the default `FelixConfiguration`. See [Enable eBPF on an existing cluster](../../operations/ebpf/enabling-ebpf.mdx). - OpenShift Virtualization (KubeVirt and CDI) installed, with `HyperConverged` Available. diff --git a/calico-enterprise/reference/l2-bridge-support.mdx b/calico-enterprise/reference/l2-bridge-support.mdx index 6d14da8c1e..1407a6b5f9 100644 --- a/calico-enterprise/reference/l2-bridge-support.mdx +++ b/calico-enterprise/reference/l2-bridge-support.mdx @@ -68,8 +68,10 @@ All of these must be in place before you create a `Network`. - An active $[prodname] license. - The eBPF data plane, enabled cluster-wide. +- On OpenShift, an up-to-date version of OpenShift. + Older OpenShift releases bundle a Multus that does not free a workload's IP address when the workload is deleted; the latest patch releases in v4.20+ fix the issue. - [Multus](../networking/configuring/multiple-networks.mdx) v4.3.1 or later, for attaching an L2 network to a workload as an additional interface. - OpenShift includes Multus by default. Older OpenShift releases bundle a Multus that does not free a workload's IP address when the workload is deleted; the latest patch releases in v4.20+ fix the issue. + OpenShift includes Multus by default. On other platforms Multus is a third-party component that $[prodname] does not ship. The upstream Multus manifests use a floating `snapshot` image, so set the Multus images to the release tag you are installing. A workload that takes an L2 network as its primary interface does not use Multus. diff --git a/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx b/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx index 0f1345ff7e..a681e09549 100644 --- a/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx @@ -24,6 +24,7 @@ Install the Tigera fork of Forklift on an OpenShift cluster and connect it to a - Cluster admin access, and `kubectl` or `oc`. - A cluster running $[prodname] as the CNI, and Multus for secondary-NIC attachments, with your Installation's [`spec.calicoNetwork.multiInterfaceMode`](../l2-bridge/connect-vlan.mdx) set to `Multus`. +- An up-to-date version of OpenShift. Older OpenShift releases bundle a Multus that does not free a VM's IP address when the VM is deleted; the latest patch releases in v4.20+ fix the issue. - The BPF data plane enabled: `bpfEnabled: true` in the default `FelixConfiguration`. See [Enable eBPF on an existing cluster](../../operations/ebpf/enabling-ebpf.mdx). - OpenShift Virtualization (KubeVirt and CDI) installed, with `HyperConverged` Available. diff --git a/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx b/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx index 6d14da8c1e..1407a6b5f9 100644 --- a/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx @@ -68,8 +68,10 @@ All of these must be in place before you create a `Network`. - An active $[prodname] license. - The eBPF data plane, enabled cluster-wide. +- On OpenShift, an up-to-date version of OpenShift. + Older OpenShift releases bundle a Multus that does not free a workload's IP address when the workload is deleted; the latest patch releases in v4.20+ fix the issue. - [Multus](../networking/configuring/multiple-networks.mdx) v4.3.1 or later, for attaching an L2 network to a workload as an additional interface. - OpenShift includes Multus by default. Older OpenShift releases bundle a Multus that does not free a workload's IP address when the workload is deleted; the latest patch releases in v4.20+ fix the issue. + OpenShift includes Multus by default. On other platforms Multus is a third-party component that $[prodname] does not ship. The upstream Multus manifests use a floating `snapshot` image, so set the Multus images to the release tag you are installing. A workload that takes an L2 network as its primary interface does not use Multus. From d4b3fbb29c3ca568eccdcb840ae9492139d2e3ad Mon Sep 17 00:00:00 2001 From: Alex O'Regan Date: Mon, 2 Nov 2026 16:05:47 +0000 Subject: [PATCH 07/17] [DOCS#CORE-13910]: Fold the OpenShift note into the requirement Co-Authored-By: Claude Opus 5.5 --- .../networking/kubevirt/install-forklift-openshift.mdx | 3 +-- calico-enterprise/reference/l2-bridge-support.mdx | 3 +-- .../networking/kubevirt/install-forklift-openshift.mdx | 3 +-- .../version-3.24-2/reference/l2-bridge-support.mdx | 3 +-- 4 files changed, 4 insertions(+), 8 deletions(-) diff --git a/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx b/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx index a681e09549..eb171ca291 100644 --- a/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx +++ b/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx @@ -24,8 +24,7 @@ Install the Tigera fork of Forklift on an OpenShift cluster and connect it to a - Cluster admin access, and `kubectl` or `oc`. - A cluster running $[prodname] as the CNI, and Multus for secondary-NIC attachments, with your Installation's [`spec.calicoNetwork.multiInterfaceMode`](../l2-bridge/connect-vlan.mdx) set to `Multus`. -- An up-to-date version of OpenShift. - Older OpenShift releases bundle a Multus that does not free a VM's IP address when the VM is deleted; the latest patch releases in v4.20+ fix the issue. +- An up-to-date version of OpenShift: releases prior to v4.20 bundle a Multus that does not free a VM's IP address when the VM is deleted; the latest patch releases in v4.20+ fix the issue. - The BPF data plane enabled: `bpfEnabled: true` in the default `FelixConfiguration`. See [Enable eBPF on an existing cluster](../../operations/ebpf/enabling-ebpf.mdx). - OpenShift Virtualization (KubeVirt and CDI) installed, with `HyperConverged` Available. - A StorageClass for the migrated VM disks. diff --git a/calico-enterprise/reference/l2-bridge-support.mdx b/calico-enterprise/reference/l2-bridge-support.mdx index 1407a6b5f9..d360596c7f 100644 --- a/calico-enterprise/reference/l2-bridge-support.mdx +++ b/calico-enterprise/reference/l2-bridge-support.mdx @@ -68,8 +68,7 @@ All of these must be in place before you create a `Network`. - An active $[prodname] license. - The eBPF data plane, enabled cluster-wide. -- On OpenShift, an up-to-date version of OpenShift. - Older OpenShift releases bundle a Multus that does not free a workload's IP address when the workload is deleted; the latest patch releases in v4.20+ fix the issue. +- On OpenShift, an up-to-date version of OpenShift: releases prior to v4.20 bundle a Multus that does not free a workload's IP address when the workload is deleted; the latest patch releases in v4.20+ fix the issue. - [Multus](../networking/configuring/multiple-networks.mdx) v4.3.1 or later, for attaching an L2 network to a workload as an additional interface. OpenShift includes Multus by default. On other platforms Multus is a third-party component that $[prodname] does not ship. diff --git a/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx b/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx index a681e09549..eb171ca291 100644 --- a/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx @@ -24,8 +24,7 @@ Install the Tigera fork of Forklift on an OpenShift cluster and connect it to a - Cluster admin access, and `kubectl` or `oc`. - A cluster running $[prodname] as the CNI, and Multus for secondary-NIC attachments, with your Installation's [`spec.calicoNetwork.multiInterfaceMode`](../l2-bridge/connect-vlan.mdx) set to `Multus`. -- An up-to-date version of OpenShift. - Older OpenShift releases bundle a Multus that does not free a VM's IP address when the VM is deleted; the latest patch releases in v4.20+ fix the issue. +- An up-to-date version of OpenShift: releases prior to v4.20 bundle a Multus that does not free a VM's IP address when the VM is deleted; the latest patch releases in v4.20+ fix the issue. - The BPF data plane enabled: `bpfEnabled: true` in the default `FelixConfiguration`. See [Enable eBPF on an existing cluster](../../operations/ebpf/enabling-ebpf.mdx). - OpenShift Virtualization (KubeVirt and CDI) installed, with `HyperConverged` Available. - A StorageClass for the migrated VM disks. diff --git a/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx b/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx index 1407a6b5f9..d360596c7f 100644 --- a/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx @@ -68,8 +68,7 @@ All of these must be in place before you create a `Network`. - An active $[prodname] license. - The eBPF data plane, enabled cluster-wide. -- On OpenShift, an up-to-date version of OpenShift. - Older OpenShift releases bundle a Multus that does not free a workload's IP address when the workload is deleted; the latest patch releases in v4.20+ fix the issue. +- On OpenShift, an up-to-date version of OpenShift: releases prior to v4.20 bundle a Multus that does not free a workload's IP address when the workload is deleted; the latest patch releases in v4.20+ fix the issue. - [Multus](../networking/configuring/multiple-networks.mdx) v4.3.1 or later, for attaching an L2 network to a workload as an additional interface. OpenShift includes Multus by default. On other platforms Multus is a third-party component that $[prodname] does not ship. From f840aebdad9fc90b91d491e6a306feb604a481ad Mon Sep 17 00:00:00 2001 From: Alex O'Regan Date: Mon, 2 Nov 2026 16:08:43 +0000 Subject: [PATCH 08/17] [DOCS#CORE-13910]: Simplify the BYO bridge Multus prerequisite Co-Authored-By: Claude Opus 5.5 --- calico-enterprise/networking/l2-bridge/byo-bridge.mdx | 3 +-- .../version-3.24-2/networking/l2-bridge/byo-bridge.mdx | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/calico-enterprise/networking/l2-bridge/byo-bridge.mdx b/calico-enterprise/networking/l2-bridge/byo-bridge.mdx index 63fb934f5b..1bb9b01bfe 100644 --- a/calico-enterprise/networking/l2-bridge/byo-bridge.mdx +++ b/calico-enterprise/networking/l2-bridge/byo-bridge.mdx @@ -51,8 +51,7 @@ They are quick to check, and any one of them not being true means the bridge you That arrived upstream in 5.18, but some distributions backport it: RHEL 9 and RHCOS report 5.14 and meet the requirement. See [Platform requirements](../../reference/l2-bridge-support.mdx#platform-requirements). - An active $[prodname] license. -- [Multus](../configuring/multiple-networks.mdx) v4.3.1 or later installed, unless your workloads will take the L2 network as their primary interface. - See [Prerequisites](../../reference/l2-bridge-support.mdx#prerequisites) for the OpenShift releases whose Multus does not free IP addresses on delete. +- [Multus](../configuring/multiple-networks.mdx) v4.3.1 or later installed, or for OpenShift, see [Prerequisites](../../reference/l2-bridge-support.mdx#prerequisites) for the recommended versions. See [Primary and secondary interfaces](../../reference/l2-bridge-support.mdx#primary-and-secondary-interfaces). - KubeVirt installed, if you are attaching VMs. diff --git a/calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/byo-bridge.mdx b/calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/byo-bridge.mdx index 63fb934f5b..1bb9b01bfe 100644 --- a/calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/byo-bridge.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/byo-bridge.mdx @@ -51,8 +51,7 @@ They are quick to check, and any one of them not being true means the bridge you That arrived upstream in 5.18, but some distributions backport it: RHEL 9 and RHCOS report 5.14 and meet the requirement. See [Platform requirements](../../reference/l2-bridge-support.mdx#platform-requirements). - An active $[prodname] license. -- [Multus](../configuring/multiple-networks.mdx) v4.3.1 or later installed, unless your workloads will take the L2 network as their primary interface. - See [Prerequisites](../../reference/l2-bridge-support.mdx#prerequisites) for the OpenShift releases whose Multus does not free IP addresses on delete. +- [Multus](../configuring/multiple-networks.mdx) v4.3.1 or later installed, or for OpenShift, see [Prerequisites](../../reference/l2-bridge-support.mdx#prerequisites) for the recommended versions. See [Primary and secondary interfaces](../../reference/l2-bridge-support.mdx#primary-and-secondary-interfaces). - KubeVirt installed, if you are attaching VMs. From 87a13bfa4871bbe1f982e23834124bc0f05e059a Mon Sep 17 00:00:00 2001 From: Alex O'Regan Date: Mon, 2 Nov 2026 16:10:05 +0000 Subject: [PATCH 09/17] [DOCS#CORE-13910]: Say when the BYO bridge needs Multus Co-Authored-By: Claude Opus 5.5 --- calico-enterprise/networking/l2-bridge/byo-bridge.mdx | 2 +- .../version-3.24-2/networking/l2-bridge/byo-bridge.mdx | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/calico-enterprise/networking/l2-bridge/byo-bridge.mdx b/calico-enterprise/networking/l2-bridge/byo-bridge.mdx index 1bb9b01bfe..614b0279d8 100644 --- a/calico-enterprise/networking/l2-bridge/byo-bridge.mdx +++ b/calico-enterprise/networking/l2-bridge/byo-bridge.mdx @@ -51,7 +51,7 @@ They are quick to check, and any one of them not being true means the bridge you That arrived upstream in 5.18, but some distributions backport it: RHEL 9 and RHCOS report 5.14 and meet the requirement. See [Platform requirements](../../reference/l2-bridge-support.mdx#platform-requirements). - An active $[prodname] license. -- [Multus](../configuring/multiple-networks.mdx) v4.3.1 or later installed, or for OpenShift, see [Prerequisites](../../reference/l2-bridge-support.mdx#prerequisites) for the recommended versions. +- [Multus](../configuring/multiple-networks.mdx) v4.3.1 or later installed if you plan to attach secondary interfaces, or for OpenShift, see [Prerequisites](../../reference/l2-bridge-support.mdx#prerequisites) for the recommended versions. See [Primary and secondary interfaces](../../reference/l2-bridge-support.mdx#primary-and-secondary-interfaces). - KubeVirt installed, if you are attaching VMs. diff --git a/calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/byo-bridge.mdx b/calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/byo-bridge.mdx index 1bb9b01bfe..614b0279d8 100644 --- a/calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/byo-bridge.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/byo-bridge.mdx @@ -51,7 +51,7 @@ They are quick to check, and any one of them not being true means the bridge you That arrived upstream in 5.18, but some distributions backport it: RHEL 9 and RHCOS report 5.14 and meet the requirement. See [Platform requirements](../../reference/l2-bridge-support.mdx#platform-requirements). - An active $[prodname] license. -- [Multus](../configuring/multiple-networks.mdx) v4.3.1 or later installed, or for OpenShift, see [Prerequisites](../../reference/l2-bridge-support.mdx#prerequisites) for the recommended versions. +- [Multus](../configuring/multiple-networks.mdx) v4.3.1 or later installed if you plan to attach secondary interfaces, or for OpenShift, see [Prerequisites](../../reference/l2-bridge-support.mdx#prerequisites) for the recommended versions. See [Primary and secondary interfaces](../../reference/l2-bridge-support.mdx#primary-and-secondary-interfaces). - KubeVirt installed, if you are attaching VMs. From c6a238a08a97233e7be2c86a06c929df0916989e Mon Sep 17 00:00:00 2001 From: Alex O'Regan Date: Mon, 2 Nov 2026 16:11:38 +0000 Subject: [PATCH 10/17] [DOCS#CORE-13910]: Point the VLAN page to the recommended Multus versions Co-Authored-By: Claude Opus 5.5 --- calico-enterprise/networking/l2-bridge/connect-vlan.mdx | 2 +- .../version-3.24-2/networking/l2-bridge/connect-vlan.mdx | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/calico-enterprise/networking/l2-bridge/connect-vlan.mdx b/calico-enterprise/networking/l2-bridge/connect-vlan.mdx index b8666a08a5..214c77f2af 100644 --- a/calico-enterprise/networking/l2-bridge/connect-vlan.mdx +++ b/calico-enterprise/networking/l2-bridge/connect-vlan.mdx @@ -44,7 +44,7 @@ The failures they cause are cheaper to avoid than to diagnose. A workload taking an L2 network as its primary interface is configured with annotations instead and does not need Multus; see [Primary and secondary interfaces](../../reference/l2-bridge-support.mdx#primary-and-secondary-interfaces). OpenShift includes Multus by default. On other platforms it is a third-party component that $[prodname] does not ship. - See [Prerequisites](../../reference/l2-bridge-support.mdx#prerequisites) for the OpenShift releases whose Multus does not free IP addresses on delete, and for installing a fixed Multus release from the upstream manifests. + See [Prerequisites](../../reference/l2-bridge-support.mdx#prerequisites) for the recommended versions. - KubeVirt installed, if you are attaching VMs. - On each node, an interface cabled to a switch port configured as a trunk carrying your workload VLANs. $[prodname] attaches to the trunk you already have: it does not configure the switch, and it cannot turn an access port into a trunk. diff --git a/calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/connect-vlan.mdx b/calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/connect-vlan.mdx index b8666a08a5..214c77f2af 100644 --- a/calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/connect-vlan.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/connect-vlan.mdx @@ -44,7 +44,7 @@ The failures they cause are cheaper to avoid than to diagnose. A workload taking an L2 network as its primary interface is configured with annotations instead and does not need Multus; see [Primary and secondary interfaces](../../reference/l2-bridge-support.mdx#primary-and-secondary-interfaces). OpenShift includes Multus by default. On other platforms it is a third-party component that $[prodname] does not ship. - See [Prerequisites](../../reference/l2-bridge-support.mdx#prerequisites) for the OpenShift releases whose Multus does not free IP addresses on delete, and for installing a fixed Multus release from the upstream manifests. + See [Prerequisites](../../reference/l2-bridge-support.mdx#prerequisites) for the recommended versions. - KubeVirt installed, if you are attaching VMs. - On each node, an interface cabled to a switch port configured as a trunk carrying your workload VLANs. $[prodname] attaches to the trunk you already have: it does not configure the switch, and it cannot turn an access port into a trunk. From 28aa98ab41623e695c2a21839c5c9527a2de2e14 Mon Sep 17 00:00:00 2001 From: Alex O'Regan Date: Mon, 2 Nov 2026 16:13:04 +0000 Subject: [PATCH 11/17] [DOCS#CORE-13910]: Reword the OpenShift prerequisite Co-Authored-By: Claude Opus 5.5 --- calico-enterprise/reference/l2-bridge-support.mdx | 2 +- .../version-3.24-2/reference/l2-bridge-support.mdx | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/calico-enterprise/reference/l2-bridge-support.mdx b/calico-enterprise/reference/l2-bridge-support.mdx index d360596c7f..254c7c5b01 100644 --- a/calico-enterprise/reference/l2-bridge-support.mdx +++ b/calico-enterprise/reference/l2-bridge-support.mdx @@ -68,7 +68,7 @@ All of these must be in place before you create a `Network`. - An active $[prodname] license. - The eBPF data plane, enabled cluster-wide. -- On OpenShift, an up-to-date version of OpenShift: releases prior to v4.20 bundle a Multus that does not free a workload's IP address when the workload is deleted; the latest patch releases in v4.20+ fix the issue. +- If using OpenShift, an up-to-date version: releases prior to v4.20 bundle a Multus that does not free a workload's IP address when the workload is deleted; the latest patch releases in v4.20+ fix the issue. - [Multus](../networking/configuring/multiple-networks.mdx) v4.3.1 or later, for attaching an L2 network to a workload as an additional interface. OpenShift includes Multus by default. On other platforms Multus is a third-party component that $[prodname] does not ship. diff --git a/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx b/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx index d360596c7f..254c7c5b01 100644 --- a/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx @@ -68,7 +68,7 @@ All of these must be in place before you create a `Network`. - An active $[prodname] license. - The eBPF data plane, enabled cluster-wide. -- On OpenShift, an up-to-date version of OpenShift: releases prior to v4.20 bundle a Multus that does not free a workload's IP address when the workload is deleted; the latest patch releases in v4.20+ fix the issue. +- If using OpenShift, an up-to-date version: releases prior to v4.20 bundle a Multus that does not free a workload's IP address when the workload is deleted; the latest patch releases in v4.20+ fix the issue. - [Multus](../networking/configuring/multiple-networks.mdx) v4.3.1 or later, for attaching an L2 network to a workload as an additional interface. OpenShift includes Multus by default. On other platforms Multus is a third-party component that $[prodname] does not ship. From 7b2e90455740c59e09f6c72f06d157bebb0dfb39 Mon Sep 17 00:00:00 2001 From: Alex O'Regan Date: Mon, 2 Nov 2026 16:15:06 +0000 Subject: [PATCH 12/17] [DOCS#CORE-13910]: Split the Multus prerequisite into OpenShift and other platforms Co-Authored-By: Claude Opus 5.5 --- calico-enterprise/reference/l2-bridge-support.mdx | 9 ++++----- .../version-3.24-2/reference/l2-bridge-support.mdx | 9 ++++----- 2 files changed, 8 insertions(+), 10 deletions(-) diff --git a/calico-enterprise/reference/l2-bridge-support.mdx b/calico-enterprise/reference/l2-bridge-support.mdx index 254c7c5b01..ff348a7ecd 100644 --- a/calico-enterprise/reference/l2-bridge-support.mdx +++ b/calico-enterprise/reference/l2-bridge-support.mdx @@ -68,13 +68,12 @@ All of these must be in place before you create a `Network`. - An active $[prodname] license. - The eBPF data plane, enabled cluster-wide. -- If using OpenShift, an up-to-date version: releases prior to v4.20 bundle a Multus that does not free a workload's IP address when the workload is deleted; the latest patch releases in v4.20+ fix the issue. -- [Multus](../networking/configuring/multiple-networks.mdx) v4.3.1 or later, for attaching an L2 network to a workload as an additional interface. - OpenShift includes Multus by default. - On other platforms Multus is a third-party component that $[prodname] does not ship. - The upstream Multus manifests use a floating `snapshot` image, so set the Multus images to the release tag you are installing. +- [Multus](../networking/configuring/multiple-networks.mdx), for attaching an L2 network to a workload as an additional interface. A workload that takes an L2 network as its primary interface does not use Multus. See [Primary and secondary interfaces](#primary-and-secondary-interfaces). + - If using OpenShift, an up-to-date version, which includes Multus: releases prior to v4.20 bundle a Multus that does not free a workload's IP address when the workload is deleted; the latest patch releases in v4.20+ fix the issue. + - On other platforms, Multus v4.3.1 or later. Multus is a third-party component that $[prodname] does not ship. + The upstream Multus manifests use a floating `snapshot` image, so set the Multus images to the release tag you are installing. - `multiInterfaceMode: Multus` set in the `calicoNetwork` section of the [Installation](installation/api.mdx) resource, for the same case. Installing Multus is not enough on its own, and nothing reports the omission until a workload fails to get connectivity. - A `NetworkAttachmentDefinition` that delegates to $[prodname] must declare `cniVersion` 1.0.0 or lower. diff --git a/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx b/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx index 254c7c5b01..ff348a7ecd 100644 --- a/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx @@ -68,13 +68,12 @@ All of these must be in place before you create a `Network`. - An active $[prodname] license. - The eBPF data plane, enabled cluster-wide. -- If using OpenShift, an up-to-date version: releases prior to v4.20 bundle a Multus that does not free a workload's IP address when the workload is deleted; the latest patch releases in v4.20+ fix the issue. -- [Multus](../networking/configuring/multiple-networks.mdx) v4.3.1 or later, for attaching an L2 network to a workload as an additional interface. - OpenShift includes Multus by default. - On other platforms Multus is a third-party component that $[prodname] does not ship. - The upstream Multus manifests use a floating `snapshot` image, so set the Multus images to the release tag you are installing. +- [Multus](../networking/configuring/multiple-networks.mdx), for attaching an L2 network to a workload as an additional interface. A workload that takes an L2 network as its primary interface does not use Multus. See [Primary and secondary interfaces](#primary-and-secondary-interfaces). + - If using OpenShift, an up-to-date version, which includes Multus: releases prior to v4.20 bundle a Multus that does not free a workload's IP address when the workload is deleted; the latest patch releases in v4.20+ fix the issue. + - On other platforms, Multus v4.3.1 or later. Multus is a third-party component that $[prodname] does not ship. + The upstream Multus manifests use a floating `snapshot` image, so set the Multus images to the release tag you are installing. - `multiInterfaceMode: Multus` set in the `calicoNetwork` section of the [Installation](installation/api.mdx) resource, for the same case. Installing Multus is not enough on its own, and nothing reports the omission until a workload fails to get connectivity. - A `NetworkAttachmentDefinition` that delegates to $[prodname] must declare `cniVersion` 1.0.0 or lower. From c9515bc390748662d15d1e5f284ea1e0e31c3d68 Mon Sep 17 00:00:00 2001 From: Alex O'Regan Date: Mon, 2 Nov 2026 16:17:26 +0000 Subject: [PATCH 13/17] [DOCS#CORE-13910]: Drop the Multus image-tag note Co-Authored-By: Claude Opus 5.5 --- calico-enterprise/reference/l2-bridge-support.mdx | 1 - .../version-3.24-2/reference/l2-bridge-support.mdx | 1 - 2 files changed, 2 deletions(-) diff --git a/calico-enterprise/reference/l2-bridge-support.mdx b/calico-enterprise/reference/l2-bridge-support.mdx index ff348a7ecd..dea445880d 100644 --- a/calico-enterprise/reference/l2-bridge-support.mdx +++ b/calico-enterprise/reference/l2-bridge-support.mdx @@ -73,7 +73,6 @@ All of these must be in place before you create a `Network`. See [Primary and secondary interfaces](#primary-and-secondary-interfaces). - If using OpenShift, an up-to-date version, which includes Multus: releases prior to v4.20 bundle a Multus that does not free a workload's IP address when the workload is deleted; the latest patch releases in v4.20+ fix the issue. - On other platforms, Multus v4.3.1 or later. Multus is a third-party component that $[prodname] does not ship. - The upstream Multus manifests use a floating `snapshot` image, so set the Multus images to the release tag you are installing. - `multiInterfaceMode: Multus` set in the `calicoNetwork` section of the [Installation](installation/api.mdx) resource, for the same case. Installing Multus is not enough on its own, and nothing reports the omission until a workload fails to get connectivity. - A `NetworkAttachmentDefinition` that delegates to $[prodname] must declare `cniVersion` 1.0.0 or lower. diff --git a/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx b/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx index ff348a7ecd..dea445880d 100644 --- a/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx @@ -73,7 +73,6 @@ All of these must be in place before you create a `Network`. See [Primary and secondary interfaces](#primary-and-secondary-interfaces). - If using OpenShift, an up-to-date version, which includes Multus: releases prior to v4.20 bundle a Multus that does not free a workload's IP address when the workload is deleted; the latest patch releases in v4.20+ fix the issue. - On other platforms, Multus v4.3.1 or later. Multus is a third-party component that $[prodname] does not ship. - The upstream Multus manifests use a floating `snapshot` image, so set the Multus images to the release tag you are installing. - `multiInterfaceMode: Multus` set in the `calicoNetwork` section of the [Installation](installation/api.mdx) resource, for the same case. Installing Multus is not enough on its own, and nothing reports the omission until a workload fails to get connectivity. - A `NetworkAttachmentDefinition` that delegates to $[prodname] must declare `cniVersion` 1.0.0 or lower. From ce80490ed514a045754dff0ea949af1b4b1b2c12 Mon Sep 17 00:00:00 2001 From: Alex O'Regan Date: Tue, 3 Nov 2026 09:36:56 +0000 Subject: [PATCH 14/17] Specifically call out ocp 4.19 as the problem version for Multus IP leakage --- .../networking/kubevirt/install-forklift-openshift.mdx | 2 +- calico-enterprise/reference/l2-bridge-support.mdx | 2 +- .../networking/kubevirt/install-forklift-openshift.mdx | 2 +- .../version-3.24-2/reference/l2-bridge-support.mdx | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx b/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx index eb171ca291..c68daa9d6a 100644 --- a/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx +++ b/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx @@ -24,7 +24,7 @@ Install the Tigera fork of Forklift on an OpenShift cluster and connect it to a - Cluster admin access, and `kubectl` or `oc`. - A cluster running $[prodname] as the CNI, and Multus for secondary-NIC attachments, with your Installation's [`spec.calicoNetwork.multiInterfaceMode`](../l2-bridge/connect-vlan.mdx) set to `Multus`. -- An up-to-date version of OpenShift: releases prior to v4.20 bundle a Multus that does not free a VM's IP address when the VM is deleted; the latest patch releases in v4.20+ fix the issue. +- An up-to-date version of OpenShift: a Multus bug shipped in OpenShift 4.19 leads to a VM's IP address not being freed when the VM is deleted; the latest patch releases in v4.20+ fix the issue. - The BPF data plane enabled: `bpfEnabled: true` in the default `FelixConfiguration`. See [Enable eBPF on an existing cluster](../../operations/ebpf/enabling-ebpf.mdx). - OpenShift Virtualization (KubeVirt and CDI) installed, with `HyperConverged` Available. - A StorageClass for the migrated VM disks. diff --git a/calico-enterprise/reference/l2-bridge-support.mdx b/calico-enterprise/reference/l2-bridge-support.mdx index dea445880d..0d83719ebf 100644 --- a/calico-enterprise/reference/l2-bridge-support.mdx +++ b/calico-enterprise/reference/l2-bridge-support.mdx @@ -71,7 +71,7 @@ All of these must be in place before you create a `Network`. - [Multus](../networking/configuring/multiple-networks.mdx), for attaching an L2 network to a workload as an additional interface. A workload that takes an L2 network as its primary interface does not use Multus. See [Primary and secondary interfaces](#primary-and-secondary-interfaces). - - If using OpenShift, an up-to-date version, which includes Multus: releases prior to v4.20 bundle a Multus that does not free a workload's IP address when the workload is deleted; the latest patch releases in v4.20+ fix the issue. + - If using OpenShift, an up-to-date version, which includes Multus: a Multus bug shipped in OpenShift 4.19 leads to a workload's IP address never being freed when the workload is deleted; the latest patch releases in v4.20+ fix the issue. - On other platforms, Multus v4.3.1 or later. Multus is a third-party component that $[prodname] does not ship. - `multiInterfaceMode: Multus` set in the `calicoNetwork` section of the [Installation](installation/api.mdx) resource, for the same case. Installing Multus is not enough on its own, and nothing reports the omission until a workload fails to get connectivity. diff --git a/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx b/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx index eb171ca291..c68daa9d6a 100644 --- a/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx @@ -24,7 +24,7 @@ Install the Tigera fork of Forklift on an OpenShift cluster and connect it to a - Cluster admin access, and `kubectl` or `oc`. - A cluster running $[prodname] as the CNI, and Multus for secondary-NIC attachments, with your Installation's [`spec.calicoNetwork.multiInterfaceMode`](../l2-bridge/connect-vlan.mdx) set to `Multus`. -- An up-to-date version of OpenShift: releases prior to v4.20 bundle a Multus that does not free a VM's IP address when the VM is deleted; the latest patch releases in v4.20+ fix the issue. +- An up-to-date version of OpenShift: a Multus bug shipped in OpenShift 4.19 leads to a VM's IP address not being freed when the VM is deleted; the latest patch releases in v4.20+ fix the issue. - The BPF data plane enabled: `bpfEnabled: true` in the default `FelixConfiguration`. See [Enable eBPF on an existing cluster](../../operations/ebpf/enabling-ebpf.mdx). - OpenShift Virtualization (KubeVirt and CDI) installed, with `HyperConverged` Available. - A StorageClass for the migrated VM disks. diff --git a/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx b/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx index dea445880d..0d83719ebf 100644 --- a/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx @@ -71,7 +71,7 @@ All of these must be in place before you create a `Network`. - [Multus](../networking/configuring/multiple-networks.mdx), for attaching an L2 network to a workload as an additional interface. A workload that takes an L2 network as its primary interface does not use Multus. See [Primary and secondary interfaces](#primary-and-secondary-interfaces). - - If using OpenShift, an up-to-date version, which includes Multus: releases prior to v4.20 bundle a Multus that does not free a workload's IP address when the workload is deleted; the latest patch releases in v4.20+ fix the issue. + - If using OpenShift, an up-to-date version, which includes Multus: a Multus bug shipped in OpenShift 4.19 leads to a workload's IP address never being freed when the workload is deleted; the latest patch releases in v4.20+ fix the issue. - On other platforms, Multus v4.3.1 or later. Multus is a third-party component that $[prodname] does not ship. - `multiInterfaceMode: Multus` set in the `calicoNetwork` section of the [Installation](installation/api.mdx) resource, for the same case. Installing Multus is not enough on its own, and nothing reports the omission until a workload fails to get connectivity. From 9ee1dc7284e4283f7ceaf5ec41b421363b26e758 Mon Sep 17 00:00:00 2001 From: Alex O Regan Date: Tue, 3 Nov 2026 10:02:35 +0000 Subject: [PATCH 15/17] Update calico-enterprise/reference/l2-bridge-support.mdx Co-authored-by: Lance Robson --- calico-enterprise/reference/l2-bridge-support.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/calico-enterprise/reference/l2-bridge-support.mdx b/calico-enterprise/reference/l2-bridge-support.mdx index 0d83719ebf..63681895f6 100644 --- a/calico-enterprise/reference/l2-bridge-support.mdx +++ b/calico-enterprise/reference/l2-bridge-support.mdx @@ -71,7 +71,7 @@ All of these must be in place before you create a `Network`. - [Multus](../networking/configuring/multiple-networks.mdx), for attaching an L2 network to a workload as an additional interface. A workload that takes an L2 network as its primary interface does not use Multus. See [Primary and secondary interfaces](#primary-and-secondary-interfaces). - - If using OpenShift, an up-to-date version, which includes Multus: a Multus bug shipped in OpenShift 4.19 leads to a workload's IP address never being freed when the workload is deleted; the latest patch releases in v4.20+ fix the issue. + - If using OpenShift, an up-to-date version, which includes Multus: a Multus bug shipped in OpenShift 4.19 leads to a workload's IP address never being freed when the workload is deleted; it is fixed in 4.20.40, 4.21.35, 4.22.14 and later patch releases. - On other platforms, Multus v4.3.1 or later. Multus is a third-party component that $[prodname] does not ship. - `multiInterfaceMode: Multus` set in the `calicoNetwork` section of the [Installation](installation/api.mdx) resource, for the same case. Installing Multus is not enough on its own, and nothing reports the omission until a workload fails to get connectivity. From 01356f8ef18738dc001dc9db175836c4abef296f Mon Sep 17 00:00:00 2001 From: Alex O'Regan Date: Tue, 3 Nov 2026 10:03:37 +0000 Subject: [PATCH 16/17] Name the fixed OpenShift patch releases on the other Multus snippets Mirror the reference page wording on the Forklift on OpenShift page and the 3.24-2 copies. Co-Authored-By: Claude Opus 5.5 --- .../networking/kubevirt/install-forklift-openshift.mdx | 2 +- .../networking/kubevirt/install-forklift-openshift.mdx | 2 +- .../version-3.24-2/reference/l2-bridge-support.mdx | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx b/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx index c68daa9d6a..9ec97d8697 100644 --- a/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx +++ b/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx @@ -24,7 +24,7 @@ Install the Tigera fork of Forklift on an OpenShift cluster and connect it to a - Cluster admin access, and `kubectl` or `oc`. - A cluster running $[prodname] as the CNI, and Multus for secondary-NIC attachments, with your Installation's [`spec.calicoNetwork.multiInterfaceMode`](../l2-bridge/connect-vlan.mdx) set to `Multus`. -- An up-to-date version of OpenShift: a Multus bug shipped in OpenShift 4.19 leads to a VM's IP address not being freed when the VM is deleted; the latest patch releases in v4.20+ fix the issue. +- An up-to-date version of OpenShift: a Multus bug shipped in OpenShift 4.19 leads to a VM's IP address not being freed when the VM is deleted; it is fixed in 4.20.40, 4.21.35, 4.22.14 and later patch releases. - The BPF data plane enabled: `bpfEnabled: true` in the default `FelixConfiguration`. See [Enable eBPF on an existing cluster](../../operations/ebpf/enabling-ebpf.mdx). - OpenShift Virtualization (KubeVirt and CDI) installed, with `HyperConverged` Available. - A StorageClass for the migrated VM disks. diff --git a/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx b/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx index c68daa9d6a..9ec97d8697 100644 --- a/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx @@ -24,7 +24,7 @@ Install the Tigera fork of Forklift on an OpenShift cluster and connect it to a - Cluster admin access, and `kubectl` or `oc`. - A cluster running $[prodname] as the CNI, and Multus for secondary-NIC attachments, with your Installation's [`spec.calicoNetwork.multiInterfaceMode`](../l2-bridge/connect-vlan.mdx) set to `Multus`. -- An up-to-date version of OpenShift: a Multus bug shipped in OpenShift 4.19 leads to a VM's IP address not being freed when the VM is deleted; the latest patch releases in v4.20+ fix the issue. +- An up-to-date version of OpenShift: a Multus bug shipped in OpenShift 4.19 leads to a VM's IP address not being freed when the VM is deleted; it is fixed in 4.20.40, 4.21.35, 4.22.14 and later patch releases. - The BPF data plane enabled: `bpfEnabled: true` in the default `FelixConfiguration`. See [Enable eBPF on an existing cluster](../../operations/ebpf/enabling-ebpf.mdx). - OpenShift Virtualization (KubeVirt and CDI) installed, with `HyperConverged` Available. - A StorageClass for the migrated VM disks. diff --git a/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx b/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx index 0d83719ebf..63681895f6 100644 --- a/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx @@ -71,7 +71,7 @@ All of these must be in place before you create a `Network`. - [Multus](../networking/configuring/multiple-networks.mdx), for attaching an L2 network to a workload as an additional interface. A workload that takes an L2 network as its primary interface does not use Multus. See [Primary and secondary interfaces](#primary-and-secondary-interfaces). - - If using OpenShift, an up-to-date version, which includes Multus: a Multus bug shipped in OpenShift 4.19 leads to a workload's IP address never being freed when the workload is deleted; the latest patch releases in v4.20+ fix the issue. + - If using OpenShift, an up-to-date version, which includes Multus: a Multus bug shipped in OpenShift 4.19 leads to a workload's IP address never being freed when the workload is deleted; it is fixed in 4.20.40, 4.21.35, 4.22.14 and later patch releases. - On other platforms, Multus v4.3.1 or later. Multus is a third-party component that $[prodname] does not ship. - `multiInterfaceMode: Multus` set in the `calicoNetwork` section of the [Installation](installation/api.mdx) resource, for the same case. Installing Multus is not enough on its own, and nothing reports the omission until a workload fails to get connectivity. From 1aeb2bd644af25b6b8912cf37d4ea81d0dd62d54 Mon Sep 17 00:00:00 2001 From: Alex O'Regan Date: Tue, 3 Nov 2026 14:20:34 +0000 Subject: [PATCH 17/17] List the OpenShift versions the Forklift install needs Name the first fixed patch release for each supported OpenShift minor as a list, on the current page and the 3.24-2 copy. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Alex O'Regan --- .../networking/kubevirt/install-forklift-openshift.mdx | 5 ++++- .../networking/kubevirt/install-forklift-openshift.mdx | 5 ++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx b/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx index 9ec97d8697..e66f8a6f88 100644 --- a/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx +++ b/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx @@ -24,7 +24,10 @@ Install the Tigera fork of Forklift on an OpenShift cluster and connect it to a - Cluster admin access, and `kubectl` or `oc`. - A cluster running $[prodname] as the CNI, and Multus for secondary-NIC attachments, with your Installation's [`spec.calicoNetwork.multiInterfaceMode`](../l2-bridge/connect-vlan.mdx) set to `Multus`. -- An up-to-date version of OpenShift: a Multus bug shipped in OpenShift 4.19 leads to a VM's IP address not being freed when the VM is deleted; it is fixed in 4.20.40, 4.21.35, 4.22.14 and later patch releases. +- One of the following OpenShift versions. Earlier patch releases ship a Multus bug that leaves a VM's IP address allocated after the VM is deleted. + - 4.20.40 or a later 4.20 patch + - 4.21.35 or a later 4.21 patch + - 4.22.14 or a later 4.22 patch - The BPF data plane enabled: `bpfEnabled: true` in the default `FelixConfiguration`. See [Enable eBPF on an existing cluster](../../operations/ebpf/enabling-ebpf.mdx). - OpenShift Virtualization (KubeVirt and CDI) installed, with `HyperConverged` Available. - A StorageClass for the migrated VM disks. diff --git a/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx b/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx index 9ec97d8697..e66f8a6f88 100644 --- a/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx @@ -24,7 +24,10 @@ Install the Tigera fork of Forklift on an OpenShift cluster and connect it to a - Cluster admin access, and `kubectl` or `oc`. - A cluster running $[prodname] as the CNI, and Multus for secondary-NIC attachments, with your Installation's [`spec.calicoNetwork.multiInterfaceMode`](../l2-bridge/connect-vlan.mdx) set to `Multus`. -- An up-to-date version of OpenShift: a Multus bug shipped in OpenShift 4.19 leads to a VM's IP address not being freed when the VM is deleted; it is fixed in 4.20.40, 4.21.35, 4.22.14 and later patch releases. +- One of the following OpenShift versions. Earlier patch releases ship a Multus bug that leaves a VM's IP address allocated after the VM is deleted. + - 4.20.40 or a later 4.20 patch + - 4.21.35 or a later 4.21 patch + - 4.22.14 or a later 4.22 patch - The BPF data plane enabled: `bpfEnabled: true` in the default `FelixConfiguration`. See [Enable eBPF on an existing cluster](../../operations/ebpf/enabling-ebpf.mdx). - OpenShift Virtualization (KubeVirt and CDI) installed, with `HyperConverged` Available. - A StorageClass for the migrated VM disks.