From e1736d2e5cce98f671bb2ea862b9b39629068642 Mon Sep 17 00:00:00 2001
From: Viktor Barzin <vbarzin@gmail.com>
Date: Sat, 20 Jun 2026 08:07:08 +0000
Subject: [PATCH] =?UTF-8?q?calico:=20hop=203.28.5->3.30.7=20(operator=20v1?=
 =?UTF-8?q?.38.13)=20=E2=80=94=20restores=20a=20SUPPORTED=20Calico/k8s-1.3?=
 =?UTF-8?q?4=20pairing.=20Disabled=20new-in-3.30=20Goldmane/Whisker=20(the?=
 =?UTF-8?q?ir=20CRs=20render=20before=20crds/=20install=20on=20helm=20upgr?=
 =?UTF-8?q?ade;=20we=20use=20Prometheus/Loki).=20calico-node=207/7=20on=20?=
 =?UTF-8?q?quay/v3.30.7,=20tigerastatus=20green.=20Applied=20manually=20+?=
 =?UTF-8?q?=20verified=20overnight.?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 stacks/calico/main.tf | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/stacks/calico/main.tf b/stacks/calico/main.tf
index 5105033d..878a594c 100644
--- a/stacks/calico/main.tf
+++ b/stacks/calico/main.tf
@@ -151,11 +151,17 @@ resource "helm_release" "tigera_operator" {
   create_namespace = false
   repository       = "https://docs.tigera.io/calico/charts"
   chart            = "tigera-operator"
-  version          = "v3.28.5"
+  version          = "v3.30.7"
 
   values = [yamlencode({
     installation = { enabled = false }
     apiServer    = { enabled = false }
-    resources    = { limits = { memory = "256Mi" } }
+    # Goldmane (flow aggregator) + Whisker (observability UI) are new in Calico
+    # 3.30 and default-on; disabled — we use Prometheus/Loki, and on a helm
+    # UPGRADE their CRs render before their crds/ (which helm skips on upgrade)
+    # are installed -> "ensure CRDs are installed first". Not needed here.
+    goldmane  = { enabled = false }
+    whisker   = { enabled = false }
+    resources = { limits = { memory = "256Mi" } }
   })]
 }