--- title: "What’s New in Calico v3.20" source: "https://www.tigera.io/blog/whats-new-in-calico-v3-20/" --- [Technical Blog](https://www.tigera.io/category/technical-blog/) # What’s New in Calico v3.20 By [Casey Davenport](https://www.tigera.io/blog/author/caseydavenport/) on Aug 04, 2021 • 2 min read We’re excited to announce Calico v3.20! Thank you to everyone who contributed to this release! For detailed release notes, please go [here](https://docs.projectcalico.org/release-notes/). Below are some highlights from the release. ## Service-based egress rules Calico NetworkPolicy and GlobalNetworkPolicy now support egress rules that match on Kubernetes service names. Service matches in egress rules can be used to allow or deny access to in-cluster services, as well as services typically not backed by pods (for example, the Kubernetes API). Address and port information is learned from the individual endpoints within the service, making it easier to keep your network policy in sync with your workloads. Check out [the docs](https://docs.projectcalico.org/security/service-policy) for more! ## Golang API In Calico v3.19, we introduced a tech-preview API server that allows management of Calico resources directly with kubectl. In v3.20, we’re building upon that with a new Golang API for Calico! Install the API server and import the Golang API to manage Calico network policies and more, in your own applications! See the [projectcalico/api](https://github.com/projectcalico/api) repository, which includes an example, and the Go documentation page. ## Configurable BGP graceful restart timer If you’re using BGP in your cluster, the graceful restart timer is used during rolling updates to ensure a graceful upgrade of Calico without disrupting network traffic. For large or heavily burdened clusters, sometimes an update of a particular node can take longer than the 2 minutes BGP typically allows due to load on the Kubernetes control plane. Calico v3.20 now allows configuration of the BGP graceful restart timer to better work in these scenarios. See the [maxRestartTime](https://docs.projectcalico.org/reference/resources/bgppeer) configuration option in the BGPPeer API. ## BPF mode support for DoNotTrack policy for DoS prevention Calico’s eBPF data plane has not previously supported any DoNotTrack policy. Calico v3.20 adds tech preview support for a specific subset of DoNotTrack policy, using XDP to implement that. The specific subset is any DoNotTrack ingress deny policy (i.e. policy whose effect is only to drop certain traffic on ingress) and is useful for preventing denial of service attacks from known malicious IPs. More general DoNotTrack policy support, for the eBPF data plane, is in progress and should arrive in a subsequent release in the near future. Did you know you can become a certified Calico operator? Learn Kubernetes networking and security fundamentals using Calico in this[free, self-paced certification course](https://academy.tigera.io/course/certified-calico-operator-level-1/). [Open Source](https://www.tigera.io/tags/open-source/)[Release](https://www.tigera.io/tags/release/)[Project Calico](https://www.tigera.io/tags/project-calico/) ## Related posts [![What’s new in Calico: Spring 2026 Release](https://www.tigera.io/app/uploads/2026/06/Whats-New-in-Calico-NEW-TEMPLATE-2026.png)](https://www.tigera.io/blog/whats-new-in-calico-spring-2026-release/) [Company Blog](https://www.tigera.io/category/company-blog/) #### [What’s new in Calico: Spring 2026 Release](https://www.tigera.io/blog/whats-new-in-calico-spring-2026-release/) By [Veronika Smolik](https://www.tigera.io/blog/author/veronika-smolik/) on Jun 2, 2026 Kubernetes has come a long way since its debut in 2014. It’s gone from running a couple of containerized microservices to orchestrating fleets of production workloads spanning everything from AI agents to full scale VMs... [Read more](https://www.tigera.io/blog/whats-new-in-calico-spring-2026-release/) [![Kubernetes Operational Maturity: Secure and Resilient Cluster Federation with Cluster Mesh](https://www.tigera.io/app/uploads/2026/05/Kubernetes-Operational-Maturity-Secure-and-Resilient-Cluster-Federation-with-Cluster-Mesh.png)](https://www.tigera.io/blog/kubernetes-operational-maturity-secure-and-resilient-cluster-federation-with-cluster-mesh/) #### [Kubernetes Operational Maturity: Secure and Resilient Cluster Federation with Cluster Mesh](https://www.tigera.io/blog/kubernetes-operational-maturity-secure-and-resilient-cluster-federation-with-cluster-mesh/) By [Veronika Smolik](https://www.tigera.io/blog/author/veronika-smolik/) on May 25, 2026 Practically no one runs a single Kubernetes cluster in production these days. Maybe that’s how it started but data sovereignty requirements, acquisitions, AI initiatives and the need for edge servers, among other considerations, have pulled... [Read more](https://www.tigera.io/blog/kubernetes-operational-maturity-secure-and-resilient-cluster-federation-with-cluster-mesh/) [![What’s New in Calico v3.32](https://www.tigera.io/app/uploads/2026/05/Green-Please-use-a-different-background-color-alternately-1.png)](https://www.tigera.io/blog/whats-new-in-calico-v3-32/) #### [What’s New in Calico v3.32](https://www.tigera.io/blog/whats-new-in-calico-v3-32/) By [Reza Ramezanpour](https://www.tigera.io/blog/author/rezar/) on May 13, 2026 We’re excited to announce the release of Calico Open Source v3.32! 🎉 This release corresponds with Kubernetes v1.36 (Codename Haru) and it goes beyond just sharing a cat as the mascot of the release, it... [Read more](https://www.tigera.io/blog/whats-new-in-calico-v3-32/)