viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

calico: unenroll from Keel — tigera-operator owns DaemonSet spec

Browse source 
Keel kept rewriting calico-node + calico-kube-controllers images to
v3.26.5 (proper patch update); tigera-operator immediately reverted
to v3.26.1 because the Installation CR is the source of truth.
Endless churn but no data loss — Calico stayed healthy throughout.

Removing keel.sh/enrolled label and live label from calico-system ns.
Calico upgrades go through the tigera-operator's Installation CR
manually, not Keel.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Viktor Barzin 2026-05-16 13:18:35 +00:00
parent 2b236a1629
commit 6d71a91fad
1 changed files with 3 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
stacks/calico/main.tf
View file

@ -22,7 +22,9 @@ resource "kubernetes_namespace" "calico_system" {
name = "calico-system"
labels = {
name = "calico-system"
"keel.sh/enrolled" = "true"
# calico-system namespace is managed by tigera-operator — auto-update is
# incompatible (operator reverts DaemonSet image from its Installation CR).
# "keel.sh/enrolled" = "true"
}
}
lifecycle {