04 Feb 2025

#### Known issues

- Issue patching policies due to unintended tier prefix [calico 9437](https://github.com/projectcalico/calico/issues/9437)
- Issue garbage collecting policies due to GC permissions [calico 9527](https://github.com/projectcalico/calico/issues/9527)

#### Bug fixes

**BPF Dataplane**

- ebpf: fix icmp error delivery to host networked pods [calico 9749](https://github.com/projectcalico/calico/pull/9749) (@tomastigera)
- ebpf: fixed routing from outside the cluster in EKS with aws-cni [calico 9629](https://github.com/projectcalico/calico/pull/9629) (@tomastigera)

**General**

- Fix: Map OpenStack-derived policy to the "default" tier, not "ossg". [calico 9778](https://github.com/projectcalico/calico/pull/9778) (@nelljerram)
- Fix that libcalico-go would not always fill in the revision when listing certain resources (or single instances of certain resources).  This could result in missed watch events in components such as Typha. [calico 9689](https://github.com/projectcalico/calico/pull/9689) (@fasaxc)
- Fix that nodes with borrowed VXLAN tunnel addresses were not reachable by pods. [calico 9685](https://github.com/projectcalico/calico/pull/9685) (@caseydavenport)
- Fix spammy Tier already exists log from kube-controllers. [calico 9671](https://github.com/projectcalico/calico/pull/9671) (@fasaxc)
- Fixed file handle leak in felix, caused by failing to close netlink handles. [calico 9612](https://github.com/projectcalico/calico/pull/9612) (@fasaxc)
- Fix that non-amd64 builds of node-driver-registrar contained x86 binaries. [calico 9601](https://github.com/projectcalico/calico/pull/9601) (@caseydavenport)
- Fix that in-use VXLAN ARP entries could be repeatedly cleaned up and then re-added if they shared a MAC address with an stale entry that was supposed to be cleaned up. [calico 9582](https://github.com/projectcalico/calico/pull/9582) (@fasaxc)
- Felix: fix that a map used to cache loaded datastore keys would always use RAM proportional to the total number of keys rather than shrinking when no longer needed. [calico 9538](https://github.com/projectcalico/calico/pull/9538) (@fasaxc)

#### Other changes

- To reduce manifest size on OCP installations, the manifests no longer include CustomResourceDefinitions. Instead, the tigera-operator pod will deploy these resources on startup. [calico 9547](https://github.com/projectcalico/calico/pull/9547) (@coutinhop)
