diff --git a/pkg/minikube/bootstrapper/images/images.go b/pkg/minikube/bootstrapper/images/images.go
index 1d5a4b5e1019..e6658c644497 100644
--- a/pkg/minikube/bootstrapper/images/images.go
+++ b/pkg/minikube/bootstrapper/images/images.go
@@ -183,7 +183,7 @@ func KindNet(repo string) string {
 }
 
 // all calico images are from /~https://github.com/projectcalico/calico/blob/master/manifests/calico.yaml
-const calicoVersion = "v3.27.0"
+const calicoVersion = "v3.27.2"
 const calicoRepo = "docker.io/calico"
 
 // CalicoDaemonSet returns the image used for calicoDaemonSet
diff --git a/pkg/minikube/cni/calico.yaml b/pkg/minikube/cni/calico.yaml
index 5f460192c804..1a456243fe70 100644
--- a/pkg/minikube/cni/calico.yaml
+++ b/pkg/minikube/cni/calico.yaml
@@ -1057,6 +1057,13 @@ spec:
                   Loose]'
                 pattern: ^(?i)(Disabled|Strict|Loose)?$
                 type: string
+              bpfExcludeCIDRsFromNAT:
+                description: BPFExcludeCIDRsFromNAT is a list of CIDRs that are to
+                  be excluded from NAT resolution so that host can handle them. A
+                  typical usecase is node local DNS cache.
+                items:
+                  type: string
+                type: array
               bpfExtToServiceConnmark:
                 description: 'BPFExtToServiceConnmark in BPF mode, control a 32bit
                   mark that is set on connections from an external client to a local