[DOCS#CORE-13910]: State Multus v4.3.1 floor for L2 bridge and Forklift on OpenShift

calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx

@@ -24,6 +24,10 @@ Install the Tigera fork of Forklift on an OpenShift cluster and connect it to a
 
 - Cluster admin access, and `kubectl` or `oc`.
 - A cluster running $[prodname] as the CNI, and Multus for secondary-NIC attachments, with your Installation's [`spec.calicoNetwork.multiInterfaceMode`](../l2-bridge/connect-vlan.mdx) set to `Multus`.
+- One of the following OpenShift versions. Earlier patch releases ship a Multus bug that leaves a VM's IP address allocated after the VM is deleted.
+  - 4.20.40 or a later 4.20 patch
+  - 4.21.35 or a later 4.21 patch
+  - 4.22.14 or a later 4.22 patch
 - The BPF data plane enabled: `bpfEnabled: true` in the default `FelixConfiguration`. See [Enable eBPF on an existing cluster](../../operations/ebpf/enabling-ebpf.mdx).
 - OpenShift Virtualization (KubeVirt and CDI) installed, with `HyperConverged` Available.
 - A StorageClass for the migrated VM disks.

calico-enterprise/networking/l2-bridge/byo-bridge.mdx

@@ -51,7 +51,7 @@ They are quick to check, and any one of them not being true means the bridge you
   That arrived upstream in 5.18, but some distributions backport it: RHEL 9 and RHCOS report 5.14 and meet the requirement.
   See [Platform requirements](../../reference/l2-bridge-support.mdx#platform-requirements).
 - An active $[prodname] license.
-- [Multus](../configuring/multiple-networks.mdx) installed, unless your workloads will take the L2 network as their primary interface.
+- [Multus](../configuring/multiple-networks.mdx) v4.3.1 or later installed if you plan to attach secondary interfaces, or for OpenShift, see [Prerequisites](../../reference/l2-bridge-support.mdx#prerequisites) for the recommended versions.
   See [Primary and secondary interfaces](../../reference/l2-bridge-support.mdx#primary-and-secondary-interfaces).
 - KubeVirt installed, if you are attaching VMs.
 

calico-enterprise/networking/l2-bridge/connect-vlan.mdx

@@ -39,11 +39,12 @@ The failures they cause are cheaper to avoid than to diagnose.
   That arrived upstream in 5.18, but some distributions backport it: RHEL 9 and RHCOS report 5.14 and meet the requirement.
   See [Platform requirements](../../reference/l2-bridge-support.mdx#platform-requirements).
 - An active $[prodname] license.
-- [Multus](../configuring/multiple-networks.mdx) installed.
+- [Multus](../configuring/multiple-networks.mdx) v4.3.1 or later installed.
   Every procedure on this page attaches the L2 network as an additional interface, which is what Multus does, so it is required here.
   A workload taking an L2 network as its primary interface is configured with annotations instead and does not need Multus; see [Primary and secondary interfaces](../../reference/l2-bridge-support.mdx#primary-and-secondary-interfaces).
   OpenShift includes Multus by default.
   On other platforms it is a third-party component that $[prodname] does not ship.
+  See [Prerequisites](../../reference/l2-bridge-support.mdx#prerequisites) for the recommended versions.
 - KubeVirt installed, if you are attaching VMs.
 - On each node, an interface cabled to a switch port configured as a trunk carrying your workload VLANs.
   $[prodname] attaches to the trunk you already have: it does not configure the switch, and it cannot turn an access port into a trunk.

calico-enterprise/reference/l2-bridge-support.mdx

@@ -69,9 +69,10 @@ All of these must be in place before you create a `Network`.
 - An active $[prodname] license.
 - The eBPF data plane, enabled cluster-wide.
 - [Multus](../networking/configuring/multiple-networks.mdx), for attaching an L2 network to a workload as an additional interface.
-  OpenShift includes Multus by default; on other platforms it is a third-party component that $[prodname] does not ship.
   A workload that takes an L2 network as its primary interface does not use Multus.
   See [Primary and secondary interfaces](#primary-and-secondary-interfaces).
+  - If using OpenShift, an up-to-date version, which includes Multus: a Multus bug shipped in OpenShift 4.19 leads to a workload's IP address never being freed when the workload is deleted; it is fixed in 4.20.40, 4.21.35, 4.22.14 and later patch releases.
+  - On other platforms, Multus v4.3.1 or later. Multus is a third-party component that $[prodname] does not ship.
 - `multiInterfaceMode: Multus` set in the `calicoNetwork` section of the [Installation](installation/api.mdx) resource, for the same case.
   Installing Multus is not enough on its own, and nothing reports the omission until a workload fails to get connectivity.
 - A `NetworkAttachmentDefinition` that delegates to $[prodname] must declare `cniVersion` 1.0.0 or lower.

calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx

@@ -24,6 +24,10 @@ Install the Tigera fork of Forklift on an OpenShift cluster and connect it to a
 
 - Cluster admin access, and `kubectl` or `oc`.
 - A cluster running $[prodname] as the CNI, and Multus for secondary-NIC attachments, with your Installation's [`spec.calicoNetwork.multiInterfaceMode`](../l2-bridge/connect-vlan.mdx) set to `Multus`.
+- One of the following OpenShift versions. Earlier patch releases ship a Multus bug that leaves a VM's IP address allocated after the VM is deleted.
+  - 4.20.40 or a later 4.20 patch
+  - 4.21.35 or a later 4.21 patch
+  - 4.22.14 or a later 4.22 patch
 - The BPF data plane enabled: `bpfEnabled: true` in the default `FelixConfiguration`. See [Enable eBPF on an existing cluster](../../operations/ebpf/enabling-ebpf.mdx).
 - OpenShift Virtualization (KubeVirt and CDI) installed, with `HyperConverged` Available.
 - A StorageClass for the migrated VM disks.

calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/byo-bridge.mdx

@@ -51,7 +51,7 @@ They are quick to check, and any one of them not being true means the bridge you
   That arrived upstream in 5.18, but some distributions backport it: RHEL 9 and RHCOS report 5.14 and meet the requirement.
   See [Platform requirements](../../reference/l2-bridge-support.mdx#platform-requirements).
 - An active $[prodname] license.
-- [Multus](../configuring/multiple-networks.mdx) installed, unless your workloads will take the L2 network as their primary interface.
+- [Multus](../configuring/multiple-networks.mdx) v4.3.1 or later installed if you plan to attach secondary interfaces, or for OpenShift, see [Prerequisites](../../reference/l2-bridge-support.mdx#prerequisites) for the recommended versions.
   See [Primary and secondary interfaces](../../reference/l2-bridge-support.mdx#primary-and-secondary-interfaces).
 - KubeVirt installed, if you are attaching VMs.
 

calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/connect-vlan.mdx

@@ -39,11 +39,12 @@ The failures they cause are cheaper to avoid than to diagnose.
   That arrived upstream in 5.18, but some distributions backport it: RHEL 9 and RHCOS report 5.14 and meet the requirement.
   See [Platform requirements](../../reference/l2-bridge-support.mdx#platform-requirements).
 - An active $[prodname] license.
-- [Multus](../configuring/multiple-networks.mdx) installed.
+- [Multus](../configuring/multiple-networks.mdx) v4.3.1 or later installed.
   Every procedure on this page attaches the L2 network as an additional interface, which is what Multus does, so it is required here.
   A workload taking an L2 network as its primary interface is configured with annotations instead and does not need Multus; see [Primary and secondary interfaces](../../reference/l2-bridge-support.mdx#primary-and-secondary-interfaces).
   OpenShift includes Multus by default.
   On other platforms it is a third-party component that $[prodname] does not ship.
+  See [Prerequisites](../../reference/l2-bridge-support.mdx#prerequisites) for the recommended versions.
 - KubeVirt installed, if you are attaching VMs.
 - On each node, an interface cabled to a switch port configured as a trunk carrying your workload VLANs.
   $[prodname] attaches to the trunk you already have: it does not configure the switch, and it cannot turn an access port into a trunk.

calico-enterprise_versioned_docs/version-3.24-2/reference/l2-bridge-support.mdx

@@ -69,9 +69,10 @@ All of these must be in place before you create a `Network`.
 - An active $[prodname] license.
 - The eBPF data plane, enabled cluster-wide.
 - [Multus](../networking/configuring/multiple-networks.mdx), for attaching an L2 network to a workload as an additional interface.
-  OpenShift includes Multus by default; on other platforms it is a third-party component that $[prodname] does not ship.
   A workload that takes an L2 network as its primary interface does not use Multus.
   See [Primary and secondary interfaces](#primary-and-secondary-interfaces).
+  - If using OpenShift, an up-to-date version, which includes Multus: a Multus bug shipped in OpenShift 4.19 leads to a workload's IP address never being freed when the workload is deleted; it is fixed in 4.20.40, 4.21.35, 4.22.14 and later patch releases.
+  - On other platforms, Multus v4.3.1 or later. Multus is a third-party component that $[prodname] does not ship.
 - `multiInterfaceMode: Multus` set in the `calicoNetwork` section of the [Installation](installation/api.mdx) resource, for the same case.
   Installing Multus is not enough on its own, and nothing reports the omission until a workload fails to get connectivity.
 - A `NetworkAttachmentDefinition` that delegates to $[prodname] must declare `cniVersion` 1.0.0 or lower.