Repository: tigera/docs
Pull request #2049: DOCS-2574: Publish Calico Open Source 3.29.4
Author: login: ctauchen
Created: 2025-05-14T14:57:05Z | Merged: 2025-05-21T19:13:30Z

<!--- PR title format: [GH#<gh-issue-id>][DOCS#<jira-issue-id>]: <short-description-of-the-pr> --->

Product Version(s):
<!--- Specify which versions of Calico, Calico Enterprise, and Calico Cloud your PR applies to. -->

Issue:
<!--- Add a link to the Jira ticket or GitHub issue, if applicable. --->
https://tigera.atlassian.net/browse/DOCS-2574

Link to docs preview:
<!--- Add direct link(s) to the exact page(s) with updated content from the preview build. --->

SME review:
- [ ] An SME has approved this change. 
<!--- SME approval is required to merge a PR except for changes that do not impact the meaning of the docs. --->

DOCS review:
- [ ] A member of the docs team has approved this change.
<!-- The Docs team must review and approve all changes. -->

Additional information:
<!--- Optional: Include additional context or expand the description here.--->

Merge checklist:
<!--- Mandatory for docs team members before merging code --->
- [ ] Deploy preview inspected wherever changes were made 
- [ ] Build completed successfully
- [ ] Test have passed 


<!--- After you open your PR, ask for review from docs team:
  For community authors: tag @tigera/docs to ask for a review when your PR is ready --->


Diff:
diff --git a/calico_versioned_docs/version-3.29/release-notes/index.mdx b/calico_versioned_docs/version-3.29/release-notes/index.mdx
index 910b0b0dd7..2ed644d77b 100644
--- a/calico_versioned_docs/version-3.29/release-notes/index.mdx
+++ b/calico_versioned_docs/version-3.29/release-notes/index.mdx
@@ -196,4 +196,48 @@ March 25, 2025
 
 #### Updating
 
-To update a previous version of Calico, see [our upgrade guides](../operations/upgrading/index.mdx)
\ No newline at end of file
+To update a previous version of Calico, see [our upgrade guides](../operations/upgrading/index.mdx)
+
+### Calico Open Source 3.29.4 bug fix release
+
+:::warning[change in behavior for default-tier policies]
+
+#### Tiered policy naming changes
+
+The addition of tiered policies in version 3.29.0 changed the naming of policies in the default tier, which caused confusion with tooling that didn't expect it.
+In version 3.29.4, we made the following updates to how policies are handled in the default tier:
+
+* **Policies created in the default tier with Calico Open Source 3.29.0 to 3.29.3:**
+  For these default-tier policies, updating to version 3.29.4 will change the name from `default.<policy-name>` to `<policy-name>`.
+* **Policies created with Calico Open Source 3.28 or earlier:**
+  For these default-tier policies, updating to version 3.29.4 will result in no name change.
+  Whatever name they were created with will still be the name they have after the upgrade.
+* Policies in the default tier can be created with or without the `default.` prefix.
+  To manage the policy, you must use the same name that was used to create it.
+  It’s not possible to interchange the prefixed and non-prefixed name.
+* Calico always returns the same policy name that you used to create the policy.
+
+:::
+
+#### Bug fixes
+
+* Change OpenShift manifests order to fix an error when creating HCP clusters. [calico 10255](https://github.com/projectcalico/calico/pull/10255) (@coutinhop)
+* Fix missing RBAC permissions for kube-controller-manager to access tiers in manifest installs, which was preventing proper resource garbage collection. [calico 10230](https://github.com/projectcalico/calico/pull/10230) (@caseydavenport)
+* ebpf - Fix dropping packets from workloads to host interfaces not managed by calico. [calico 10226](https://github.com/projectcalico/calico/pull/10226) (@sridhartigera)
+* ebpf - Fix configuring arp entries for bpf NAT devices for systemd >= 242 [calico 10217](https://github.com/projectcalico/calico/pull/10217) (@sridhartigera)
+* ebpf - Fixed a bug where BPF programs were being re-attached to network interfaces unnecessarily, even when the host IP address had not changed. [calico 10164](https://github.com/projectcalico/calico/pull/10164) (@sridhartigera)
+
+#### Enhancements
+
+#### Changes to policy naming in the default tier
+
+* Policies created prior to v3.28.0 have their name retained across upgrade. Policies created in the default tier with version v3.29.[0-3] will have their names changed from `default.name` to `name`. [calico 10417](https://github.com/projectcalico/calico/pull/10417) (@MichalFupso)
+* Policies part of the default tier can be managed only with the original name they were created with. Policies are no longer able to be managed interchangeably with or without the default. tier prefix [calico 10391](https://github.com/projectcalico/calico/pull/10391) (@MichalFupso)
+
+##### Other enhancements
+
+* Update Operator Helm values to support custom DNS settings [calico 10407](https://github.com/projectcalico/calico/pull/10407) (@caseydavenport)
+
+#### Updating
+
+To update a previous version of Calico, see [our upgrade guides](../operations/upgrading/index.mdx)
diff --git a/calico_versioned_docs/version-3.29/releases.json b/calico_versioned_docs/version-3.29/releases.json
index cc66816086..f5bdded122 100644
--- a/calico_versioned_docs/version-3.29/releases.json
+++ b/calico_versioned_docs/version-3.29/releases.json
@@ -1,4 +1,56 @@
 [
+  {
+    "title": "v3.29.4",
+    "tigera-operator": {
+      "image": "tigera/operator",
+      "registry": "quay.io",
+      "version": "v1.36.9"
+    },
+    "components": {
+      "typha": {
+        "version": "v3.29.4"
+      },
+      "calicoctl": {
+        "version": "v3.29.4"
+      },
+      "calico/node": {
+        "version": "v3.29.4"
+      },
+      "calico/cni": {
+        "version": "v3.29.4"
+      },
+      "calico/apiserver": {
+        "version": "v3.29.4"
+      },
+      "calico/kube-controllers": {
+        "version": "v3.29.4"
+      },
+      "calico/flannel-migration-controller": {
+        "version": "v3.29.4"
+      },
+      "calico/windows": {
+        "version": "v3.29.4"
+      },
+      "networking-calico": {
+        "version": "v3.29.4"
+      },
+      "flannel": {
+        "version": "v0.16.3"
+      },
+      "calico/dikastes": {
+        "version": "v3.29.4"
+      },
+      "flexvol": {
+        "version": "v3.29.4"
+      },
+      "csi-driver": {
+        "version": "v3.29.4"
+      },
+      "csi-node-driver-registrar": {
+        "version": "v3.29.4"
+      }
+    }
+  },
   {
     "title": "v3.29.3",
     "tigera-operator": {
diff --git a/calico_versioned_docs/version-3.29/variables.js b/calico_versioned_docs/version-3.29/variables.js
index 86ce14f98b..3b6fd4979a 100644
--- a/calico_versioned_docs/version-3.29/variables.js
+++ b/calico_versioned_docs/version-3.29/variables.js
@@ -1,7 +1,7 @@
 const releases = require('./releases.json');
 
 const variables = {
-  releaseTitle: 'v3.29.3',
+  releaseTitle: 'v3.29.4',
   prodname: 'Calico',
   prodnamedash: 'calico',
   version: 'v3.29',
@@ -17,7 +17,7 @@ const variables = {
   noderunning: 'calico-node',
   rootDirWindows: 'C:\\CalicoWindows',
   ppa_repo_name: 'calico-3.29',
-  manifestsUrl: 'https://raw.githubusercontent.com/projectcalico/calico/v3.29.3',
+  manifestsUrl: 'https://raw.githubusercontent.com/projectcalico/calico/v3.29.4',
   releases,
   registry: '',
   vppbranch: 'v3.29.0',


Reviews:
user: login: MichalFupso
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-21T15:32:52Z
user: login: MichalFupso
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-21T15:37:40Z
user: login: danudey
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-21T15:38:37Z
user: login: danudey
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-21T15:38:50Z
user: login: MichalFupso
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-21T15:40:50Z
user: login: coutinhop
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-05-21T16:50:15Z

Review comments:
diff_hunk: @@ -196,4 +196,48 @@ March 25, 2025
 
 #### Updating
 
-To update a previous version of Calico, see [our upgrade guides](../operations/upgrading/index.mdx)
\ No newline at end of file
+To update a previous version of Calico, see [our upgrade guides](../operations/upgrading/index.mdx)
+
+### Calico Open Source 3.29.4 bug fix release
+
+:::warning[change in behavior for default-tier policies]
+
+#### Tiered policy naming changes
+
+The addition of tiered policies in version 3.29.0 changed the naming of policies in the default tier, which caused confusion with tooling that didn't expect it.
+In version 3.29.4, we made the following updates to how policies are handled in the default tier:
+
+* **Policies created in the default tier with Calico Open Source 3.29.0 to 3.29.3:**
+  For these default-tier policies, updating to version 3.29.4 will change the name from `default.<policy-name>` to `<policy-name>`.
+* **Policies created with Calico Open Source 3.27 or earlier:**
path: calico_versioned_docs/version-3.29/release-notes/index.mdx
user: login: MichalFupso
body: ```suggestion
* **Policies created with Calico Open Source 3.28 or earlier:**
```
created_at: 2025-05-21T15:32:52Z
author_association: CONTRIBUTOR
diff_hunk: @@ -196,4 +196,48 @@ March 25, 2025
 
 #### Updating
 
-To update a previous version of Calico, see [our upgrade guides](../operations/upgrading/index.mdx)
\ No newline at end of file
+To update a previous version of Calico, see [our upgrade guides](../operations/upgrading/index.mdx)
+
+### Calico Open Source 3.29.4 bug fix release
+
+:::warning[change in behavior for default-tier policies]
+
+#### Tiered policy naming changes
+
+The addition of tiered policies in version 3.29.0 changed the naming of policies in the default tier, which caused confusion with tooling that didn't expect it.
+In version 3.29.4, we made the following updates to how policies are handled in the default tier:
+
+* **Policies created in the default tier with Calico Open Source 3.29.0 to 3.29.3:**
+  For these default-tier policies, updating to version 3.29.4 will change the name from `default.<policy-name>` to `<policy-name>`.
+* **Policies created with Calico Open Source 3.27 or earlier:**
+  For these default-tier policies, updating to version 3.29.4 will result in no name change.
+  Whatever name they were created with will still be the name they have after the upgrade.
+* Policies in the default tier can be created with or without the `default.` prefix.
+  To manage the policy, you must use the same name that was used to create it.
+  It’s not possible to interchange the prefixed and non-prefixed name.
+* Calico always returns the same policy name that you used to create the policy.
+
+:::
+
+#### Bug fixes
+
+* Change OpenShift manifests order to fix an error when creating HCP clusters. [calico 10255](https://github.com/projectcalico/calico/pull/10255) (@coutinhop)
+* Fix missing RBAC permissions for kube-controller-manager to access tiers in manifest installs, which was preventing proper resource garbage collection. [calico 10230](https://github.com/projectcalico/calico/pull/10230) (@caseydavenport)
+* ebpf - Fix dropping packets from workloads to host interfaces not managed by calico. [calico 10226](https://github.com/projectcalico/calico/pull/10226) (@sridhartigera)
+* ebpf - Fix configuring arp entries for bpf NAT devices for systemd >= 242 [calico 10217](https://github.com/projectcalico/calico/pull/10217) (@sridhartigera)
+* ebpf - Fixed a bug where BPF programs were being re-attached to network interfaces unnecessarily, even when the host IP address had not changed. [calico 10164](https://github.com/projectcalico/calico/pull/10164) (@sridhartigera)
+
+#### Enhancements
+
+#### Changes to tier naming
path: calico_versioned_docs/version-3.29/release-notes/index.mdx
user: login: MichalFupso
body: I think we should change it to "Changes to policy naming", it does not effect any tier names just policies in the default tier 
created_at: 2025-05-21T15:37:40Z
author_association: CONTRIBUTOR
diff_hunk: @@ -196,4 +196,48 @@ March 25, 2025
 
 #### Updating
 
-To update a previous version of Calico, see [our upgrade guides](../operations/upgrading/index.mdx)
\ No newline at end of file
+To update a previous version of Calico, see [our upgrade guides](../operations/upgrading/index.mdx)
+
+### Calico Open Source 3.29.4 bug fix release
+
+:::warning[change in behavior for default-tier policies]
+
+#### Tiered policy naming changes
+
+The addition of tiered policies in version 3.29.0 changed the naming of policies in the default tier, which caused confusion with tooling that didn't expect it.
+In version 3.29.4, we made the following updates to how policies are handled in the default tier:
+
+* **Policies created in the default tier with Calico Open Source 3.29.0 to 3.29.3:**
+  For these default-tier policies, updating to version 3.29.4 will change the name from `default.<policy-name>` to `<policy-name>`.
+* **Policies created with Calico Open Source 3.28 or earlier:**
+  For these default-tier policies, updating to version 3.29.4 will result in no name change.
+  Whatever name they were created with will still be the name they have after the upgrade.
+* Policies in the default tier can be created with or without the `default.` prefix.
+  To manage the policy, you must use the same name that was used to create it.
+  It’s not possible to interchange the prefixed and non-prefixed name.
+* Calico always returns the same policy name that you used to create the policy.
+
+:::
+
+#### Bug fixes
+
+* Change OpenShift manifests order to fix an error when creating HCP clusters. [calico 10255](https://github.com/projectcalico/calico/pull/10255) (@coutinhop)
+* Fix missing RBAC permissions for kube-controller-manager to access tiers in manifest installs, which was preventing proper resource garbage collection. [calico 10230](https://github.com/projectcalico/calico/pull/10230) (@caseydavenport)
+* ebpf - Fix dropping packets from workloads to host interfaces not managed by calico. [calico 10226](https://github.com/projectcalico/calico/pull/10226) (@sridhartigera)
+* ebpf - Fix configuring arp entries for bpf NAT devices for systemd >= 242 [calico 10217](https://github.com/projectcalico/calico/pull/10217) (@sridhartigera)
+* ebpf - Fixed a bug where BPF programs were being re-attached to network interfaces unnecessarily, even when the host IP address had not changed. [calico 10164](https://github.com/projectcalico/calico/pull/10164) (@sridhartigera)
+
+#### Enhancements
+
+#### Changes to tier naming
path: calico_versioned_docs/version-3.29/release-notes/index.mdx
user: login: danudey
body: ```suggestion
#### Changes to policy naming in the default tier
```
created_at: 2025-05-21T15:38:37Z
author_association: COLLABORATOR
diff_hunk: @@ -196,4 +196,48 @@ March 25, 2025
 
 #### Updating
 
-To update a previous version of Calico, see [our upgrade guides](../operations/upgrading/index.mdx)
\ No newline at end of file
+To update a previous version of Calico, see [our upgrade guides](../operations/upgrading/index.mdx)
+
+### Calico Open Source 3.29.4 bug fix release
+
+:::warning[change in behavior for default-tier policies]
+
+#### Tiered policy naming changes
+
+The addition of tiered policies in version 3.29.0 changed the naming of policies in the default tier, which caused confusion with tooling that didn't expect it.
+In version 3.29.4, we made the following updates to how policies are handled in the default tier:
+
+* **Policies created in the default tier with Calico Open Source 3.29.0 to 3.29.3:**
+  For these default-tier policies, updating to version 3.29.4 will change the name from `default.<policy-name>` to `<policy-name>`.
+* **Policies created with Calico Open Source 3.28 or earlier:**
+  For these default-tier policies, updating to version 3.29.4 will result in no name change.
+  Whatever name they were created with will still be the name they have after the upgrade.
+* Policies in the default tier can be created with or without the `default.` prefix.
+  To manage the policy, you must use the same name that was used to create it.
+  It’s not possible to interchange the prefixed and non-prefixed name.
+* Calico always returns the same policy name that you used to create the policy.
+
+:::
+
+#### Bug fixes
+
+* Change OpenShift manifests order to fix an error when creating HCP clusters. [calico 10255](https://github.com/projectcalico/calico/pull/10255) (@coutinhop)
+* Fix missing RBAC permissions for kube-controller-manager to access tiers in manifest installs, which was preventing proper resource garbage collection. [calico 10230](https://github.com/projectcalico/calico/pull/10230) (@caseydavenport)
+* ebpf - Fix dropping packets from workloads to host interfaces not managed by calico. [calico 10226](https://github.com/projectcalico/calico/pull/10226) (@sridhartigera)
+* ebpf - Fix configuring arp entries for bpf NAT devices for systemd >= 242 [calico 10217](https://github.com/projectcalico/calico/pull/10217) (@sridhartigera)
+* ebpf - Fixed a bug where BPF programs were being re-attached to network interfaces unnecessarily, even when the host IP address had not changed. [calico 10164](https://github.com/projectcalico/calico/pull/10164) (@sridhartigera)
+
+#### Enhancements
+
+#### Changes to tier naming
path: calico_versioned_docs/version-3.29/release-notes/index.mdx
user: login: danudey
body: @MichalFupso Thoughts?
created_at: 2025-05-21T15:38:50Z
author_association: COLLABORATOR
diff_hunk: @@ -196,4 +196,48 @@ March 25, 2025
 
 #### Updating
 
-To update a previous version of Calico, see [our upgrade guides](../operations/upgrading/index.mdx)
\ No newline at end of file
+To update a previous version of Calico, see [our upgrade guides](../operations/upgrading/index.mdx)
+
+### Calico Open Source 3.29.4 bug fix release
+
+:::warning[change in behavior for default-tier policies]
+
+#### Tiered policy naming changes
+
+The addition of tiered policies in version 3.29.0 changed the naming of policies in the default tier, which caused confusion with tooling that didn't expect it.
+In version 3.29.4, we made the following updates to how policies are handled in the default tier:
+
+* **Policies created in the default tier with Calico Open Source 3.29.0 to 3.29.3:**
+  For these default-tier policies, updating to version 3.29.4 will change the name from `default.<policy-name>` to `<policy-name>`.
+* **Policies created with Calico Open Source 3.28 or earlier:**
+  For these default-tier policies, updating to version 3.29.4 will result in no name change.
+  Whatever name they were created with will still be the name they have after the upgrade.
+* Policies in the default tier can be created with or without the `default.` prefix.
+  To manage the policy, you must use the same name that was used to create it.
+  It’s not possible to interchange the prefixed and non-prefixed name.
+* Calico always returns the same policy name that you used to create the policy.
+
+:::
+
+#### Bug fixes
+
+* Change OpenShift manifests order to fix an error when creating HCP clusters. [calico 10255](https://github.com/projectcalico/calico/pull/10255) (@coutinhop)
+* Fix missing RBAC permissions for kube-controller-manager to access tiers in manifest installs, which was preventing proper resource garbage collection. [calico 10230](https://github.com/projectcalico/calico/pull/10230) (@caseydavenport)
+* ebpf - Fix dropping packets from workloads to host interfaces not managed by calico. [calico 10226](https://github.com/projectcalico/calico/pull/10226) (@sridhartigera)
+* ebpf - Fix configuring arp entries for bpf NAT devices for systemd >= 242 [calico 10217](https://github.com/projectcalico/calico/pull/10217) (@sridhartigera)
+* ebpf - Fixed a bug where BPF programs were being re-attached to network interfaces unnecessarily, even when the host IP address had not changed. [calico 10164](https://github.com/projectcalico/calico/pull/10164) (@sridhartigera)
+
+#### Enhancements
+
+#### Changes to tier naming
path: calico_versioned_docs/version-3.29/release-notes/index.mdx
user: login: MichalFupso
body: That works, thanks
created_at: 2025-05-21T15:40:50Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,4 +1,56 @@
 [
+  {
+    "title": "v3.29.4",
+    "tigera-operator": {
+      "image": "tigera/operator",
+      "registry": "quay.io",
+      "version": "v1.36.7"
path: calico_versioned_docs/version-3.29/releases.json
user: login: coutinhop
body: ```suggestion
      "version": "v1.36.9"
```
created_at: 2025-05-21T16:50:15Z
author_association: MEMBER

PR comments:
user: login: netlify[bot]
created_at: 2025-05-14T14:57:11Z
body: ### <span aria-hidden="true">✅</span> Deploy Preview succeeded!


|  Name | Link |
|:-:|------------------------|
|<span aria-hidden="true">🔨</span> Latest commit | 396c8413516166838ad04f3f464ae43abed07a8f |
|<span aria-hidden="true">🔍</span> Latest deploy log | https://app.netlify.com/projects/tigera/deploys/682e1204ce974b0008239efc |
|<span aria-hidden="true">😎</span> Deploy Preview | [https://deploy-preview-2049--tigera.netlify.app](https://deploy-preview-2049--tigera.netlify.app) |
|<span aria-hidden="true">📱</span> Preview on mobile | <details><summary> Toggle QR Code... </summary><br /><br />![QR Code](https://app.netlify.com/qr-code/eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1cmwiOiJodHRwczovL2RlcGxveS1wcmV2aWV3LTIwNDktLXRpZ2VyYS5uZXRsaWZ5LmFwcCJ9.fuzzlZkaKtptOI_Mv47JcycZb1W_W6bPEpzxe8vdPro)<br /><br />_Use your smartphone camera to open QR code link._</details> |
|<span aria-hidden="true">![Lighthouse](https://app.netlify.com/public/external-usage/git-comments/lighthouse-sm.png)</span><br />Lighthouse | 1 paths audited<br />**Performance**: 21 (🔴 down 5 from production)<br />**Accessibility**: 90 (no change from production)<br />**Best Practices**: 83 (no change from production)<br />**SEO**: 85 (no change from production)<br />**PWA**: -<br />[View the detailed breakdown and full score reports](https://app.netlify.com/projects/tigera/deploys/682e1204ce974b0008239efc) |
---
<!-- [tigera Preview](https://deploy-preview-2049--tigera.netlify.app) -->
_To edit notification comments on pull requests, go to your [Netlify project configuration](https://app.netlify.com/projects/tigera/configuration/notifications#deploy-notifications)._
author_association: NONE
user: login: netlify[bot]
created_at: 2025-05-14T14:57:11Z
body: ### <span aria-hidden="true">✅</span> Deploy Preview for *calico-docs-preview-next* ready!


|  Name | Link |
|:-:|------------------------|
|<span aria-hidden="true">🔨</span> Latest commit | 396c8413516166838ad04f3f464ae43abed07a8f |
|<span aria-hidden="true">🔍</span> Latest deploy log | https://app.netlify.com/projects/calico-docs-preview-next/deploys/682e12045542550008a5d1f7 |
|<span aria-hidden="true">😎</span> Deploy Preview | [https://deploy-preview-2049--calico-docs-preview-next.netlify.app](https://deploy-preview-2049--calico-docs-preview-next.netlify.app) |
|<span aria-hidden="true">📱</span> Preview on mobile | <details><summary> Toggle QR Code... </summary><br /><br />![QR Code](https://app.netlify.com/qr-code/eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1cmwiOiJodHRwczovL2RlcGxveS1wcmV2aWV3LTIwNDktLWNhbGljby1kb2NzLXByZXZpZXctbmV4dC5uZXRsaWZ5LmFwcCJ9.xTXgi58UMd7mrSSE87zheHz8PK-iqBUY4Hxx1bHdzyM)<br /><br />_Use your smartphone camera to open QR code link._</details> |
---
<!-- [calico-docs-preview-next Preview](https://deploy-preview-2049--calico-docs-preview-next.netlify.app) -->
_To edit notification comments on pull requests, go to your [Netlify project configuration](https://app.netlify.com/projects/calico-docs-preview-next/configuration/notifications#deploy-notifications)._
author_association: NONE
user: login: ctauchen
created_at: 2025-05-14T14:59:33Z
body: @tigera/release-team Scaffolding here. Still needs:
* generated release notes added to `calico_versioned_docs/version-3.29/release-notes/index.mdx`
* updates to `calico_versioned_docs/version-3.29/releases.json` (DEFINITELY operator version, maybe others)
author_association: COLLABORATOR
user: login: ctauchen
created_at: 2025-05-21T14:09:37Z
body: @MichalFupso PTAL
CC @danudey 
author_association: COLLABORATOR