[ctauchen]

Adds the release note and the upgrade note for boot-time network protection on non-cluster hosts, and a procedure for removing the host packages.

Jira: https://tigera.atlassian.net/browse/DOCS-3159

Preview

• https://deploy-preview-3187--calico-docs-preview-next.netlify.app/calico-enterprise/next/release-notes/
• https://deploy-preview-3187--calico-docs-preview-next.netlify.app/calico-enterprise/next/getting-started/bare-metal/about

To do

• SME to confirm that the RPM upgrade restart engages protection during the upgrade, and that Debian and Ubuntu need daemon-reload before the restart.

Flags

• Nothing was tested on a host.
• Two other open PRs add entries to the release notes. Whichever merges later rebases.

[netlify]

👷 Deploy request for calico-docs-preview-next pending review.

Visit the deploys page to approve it

Name	Link
🔨 Latest commit	5228566

[netlify]

✅ Deploy Preview succeeded!

Built without sensitive environment variables

Name	Link
🔨 Latest commit	5228566
🔍 Latest deploy log	https://app.netlify.com/projects/tigera/deploys/6af73993ea9c1060a57d8b03
😎 Deploy Preview	https://deploy-preview-3187--tigera.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	1 paths audited Performance: 85 (🔴 down 9 from production) Accessibility: 98 (no change from production) Best Practices: 92 (no change from production) SEO: 100 (no change from production) PWA: - View the detailed breakdown and full score reports
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[Copilot]

🔵 Needs a closer look

Approval is deferred because distro-specific package and systemd upgrade behavior affecting firewall state remains unverified, with no host testing and SME validation still required.

No open issues 🎉

What changed in this PR

Adds Calico Enterprise release and upgrade documentation for boot-time network protection on non-cluster hosts and VMs, including package-removal guidance.

Changes:

• Documents boot-time protection behavior and related RHEL 8 package changes.
• Adds upgrade guidance for service restarts, systemd reloads, custom integrations, and protection checks.
• Adds procedures for removing Calico Node and Fluent Bit packages, including the resulting loss of host protection.

File	Description
calico-enterprise/​release-notes/​index.mdx	Adds release, upgrade, breaking-change, and RHEL support notes for non-cluster host boot protection.
calico-enterprise/​getting-started/​bare-metal/​about.mdx	Adds instructions for removing Calico packages from non-cluster hosts and VMs.

_{Review effort: Lite}

[hjiawei]

SME check on the two claims in the upgrade note. Updated now that the Debian and Ubuntu fix is merged.

RHEL: correct. The RPM restarts a running calico-node.service at the end of the upgrade, and that restart turns on boot protection. An e2e test covers this on a RHEL 9 host. A stopped service stays stopped, and protection starts on its next start or reboot.

Debian and Ubuntu: now the same as RHEL.

• The fix is merged for 3.24 EP3. The deb upgrade reloads systemd and restarts a running calico-node.service. A stopped service stays stopped.
• The restart turns on boot protection, as it does on RHEL.
• This holds for any release the host upgrades from, because the new package's scripts do the work.
• Tested on an Ubuntu 24.04 host: the agent was running again after the upgrade, with no manual step. A Debian host was not tried. The package scripts are the same there.

What to change in the note. The RHEL sentence now holds for Debian and Ubuntu too, so these two parts can go:

• "On Debian and Ubuntu, the package upgrade does not restart the service ..." in the intro.
• The daemon-reload and restart commands in step 4.