About this Helm chart

This is a Tigera Operator Docker Hardened Helm chart built from the upstream Calico tigera-operator Helm chart and using a hardened configuration with Docker Hardened Images.

Differences between Calico 3.32 and 3.33

Two chart lines are published. Both are built from the upstream tigera-operator Helm chart, but Calico 3.33 ships a different set of images, so the two lines are defined and published separately.

The sections below describe the 3.32.x chart unless stated otherwise. See Images referenced in the Helm chart (3.33.x)⁠ for the 3.33.x chart.

Images referenced in the Helm chart (3.32.x, digest-pinned at build)

These images are wired directly into chart templates and tracked in the chart build:

• dhi/tigera-operator — the Tigera operator that installs and reconciles Calico components
• dhi/calico-ctl — calicoctl init container on OpenShift installs (upstream chart template)

There are other images controlled by chart values (whisker.enabled, and so on)

Images deployed by the operator (3.32.x, installation.registry / installation.imagePrefix)

The operator resolves Calico component images at runtime (default layout: dhi.io/calico-<component>:v<version>). Set installation.imagePath when mirroring into a registry namespace (for example dhi on docker.io).

Lean networking installs enable only the core rows. Policy, observability, and CSI features enable additional rows via chart values or the Installation CR.

Images referenced in the Helm chart (3.33.x)

The 3.33.x chart references these images, all digest-pinned at build:

• dhi/tigera-operator — the Tigera operator that installs and reconciles Calico components
• dhi/calico-calico — combined Calico image, also used by the calicoctl init container of the operator pod (OpenShift installs)
• dhi/calico-node — node agent (Felix, BIRD/eBPF, routing)
• dhi/calico-whisker — observability UI
• dhi/calico-third-party-cni-plugins — init container that stages the upstream CNI plugins (host-local, portmap, loopback, tuning, flannel) on each node

Only dhi/tigera-operator and dhi/calico-calico (as calicoctl.image) are set directly in the chart values. The operator deploys the Calico component images itself from installation.registry, installation.imagePath and installation.imagePrefix, resolving each reference as <registry>/<imagePath>/<imagePrefix><component>, where the component is calico, node, whisker or third-party-cni-plugins.

To learn more about how to use this Helm chart you can visit the upstream documentation: https://github.com/projectcalico/calico/tree/master/charts/tigera-operator⁠

About Tigera Operator

The Tigera Operator is a Kubernetes operator that installs, configures, and manages Calico networking and policy components. It reconciles custom resources such as Installation to deploy Calico as the cluster CNI and optional policy engine.

For more details, visit https://docs.tigera.io/calico/latest/operations/installing-with-helm⁠.

About Docker Hardened Images

Docker Hardened Images are built to meet the highest security and compliance standards. They provide a trusted foundation for containerized workloads by incorporating security best practices from the start.

Why use Docker Hardened Images?

These images are published with near-zero known CVEs, include signed provenance, and come with a complete Software Bill of Materials (SBOM) and VEX metadata. They're designed to secure your software supply chain while fitting seamlessly into existing Docker workflows.

Trademarks

Calico® is a trademark of Tigera, Inc. All rights in the mark are reserved to Tigera, Inc. Any use by Docker is for referential purposes only and does not indicate sponsorship, endorsement, or affiliation.