In preparation of the next k8s upgrade(s) we need to update calico to 3.30 which is the last version supporting our currently running kubernetes version (1.31)

• build and publish new calico package
• build and publish calico Docker images
• update calico helm chart
• update calico-crds helm chart
• deploy new calico Packages
• deploy new calico charts

Changelog for version v3.30.0: https://github.com/projectcalico/calico/blob/release-v3.30/release-notes/v3.30.0-release-notes.md

New features and enhancements

Introducing Calico Whisker (tech preview)

This release includes Calico Whisker, a new observability tool that helps you see and understand your network activity.
Whisker is a web console that provides a user-friendly interface for viewing flow logs.

Backed by the new flow logs API, this console displays a stream of aggregated connection data that you can use to monitor and troubleshoot your network.

Flow logs API (tech preview)

The flow logs API, which backs the Calico Whisker web console, is a gRPC API that provides aggregated network traffic data, including policy enforcement details and statistics like packet and byte counts.
You can use the API directly through your own applications or scripts.

Staged network policies

You can now use staged network policies to test network policies before applying them to your production environment.
To do this, create a StagedNetworkPolicy (or StagedGlobalNetworkPolicy or StagedKubernetesNetworkPolicy) resource with the policy specifications you want to test.
Next, open a flow log in Whisker to see how the policy would have affected your network traffic, had it been enforced.
When you're happy with the results, you can apply the policy with the appropriate non-staged resource name.

Calico Ingress Gateway (tech-preview)

Calico now includes the ability to deploy Calico Ingress Gateway which is an Enterprise hardened, 100% upstream distribution of Envoy Gateway.
Envoy Gateway is an implementation of the Kubernetes Gateway API with several extensions that provide advanced security and traffic management features.

IPAM for load balancers

Calico now extends its IPAM capabilities to support service LoadBalancer IP allocation, providing a centralized, automated approach to managing LoadBalancer IPs within Kubernetes clusters.

Improvements to host endpoint protection

You are now able to create and manage custom host endpoints for nodes, based on user-specified templates.
Previously, host endpoints applied to all node interfaces, regardless of need.
Now, you can choose exactly which interfaces are protected by Calico policy.
These templates can be used with automatic host endpoint creation.

Quality of Service controls

You can now configure Quality of Service (QoS) controls for Calico workloads by using Kubernetes pod annotations.
These controls allow you to limit ingress and egress bandwidth, packet rate, and the maximum number of established connections for individual pods.
This helps prevent resource overuse by specific workloads and ensures fair network resource allocation across your cluster.
This feature is currently supported only in iptables and nftables modes.

BGP Peering for nested KubeVirt clusters

Configure direct BGP peering between your Calico parent cluster and nested Kubernetes clusters running within KubeVirt VMs.
This extends layer 3 network reachability from nested pods to your physical infrastructure, avoiding network overlays and associated overhead.
Setup involves standard Calico BGP resources (BGPPeer, BGPFilter) for eBGP peering and requires KubeVirt's bridged networking mode.

Default tier policy naming changes

In previous versions, there were inconsistencies in how default tier policies were named and managed, particularly affecting users using CI/CD tools.

Starting with version 3.30.0, we have addressed these inconsistencies.
Users can now create policies in the default tier with or without the default. prefix.
However, policies must be managed using the exact name they were created with.
The API server will now consistently return the policy name as it was originally created (with or without the prefix).
If you upgraded from a previous version of Calico, all policies in the default tier will be treated as if they were created with the default. prefix.
This change ensures compatibility with CI/CD tools like ArgoCD.

OpenStack Caracal support

This release adds support for OpenStack Caracal.

Install and Upgrade changes

To reduce manifest size, tigera-operator.yaml no longer includes CustomResourceDefinitions. Instead, the tigera-operator pod will deploy these resources on startup. calico 9518 (@caseydavenport)

For many installers, such as helm, this change should be seamless. However, note that some CI/CD systems may see this change and trigger a deletion of Calico CustomResourceDefinitions. To avoid this, you can ensure your CI/CD system is configured to explicitly manage the CustomResourceDefinitions for this release.

Bug fixes

• Fix spammy logs when handling endpoint status creation events. calico 10327 (@song-jiang)
• Change OpenShift manifests order to fix an error when creating HCP clusters. calico 10254 (@coutinhop)
• Fix potential nil pointer access in confd calico 10177 (@fasaxc)
• Fix up various spammy warning logs. calico 10176 (@fasaxc)
• Fix that BPF-based conntrack cleaner would expire DSR entries too soon due to missing type check. calico 9957 (@fasaxc)
• Fix missing RBAC permissions for kube-controller-manager to access tiers in manifest installs, which was preventing proper resource garbage collection. calico 9879 (@caseydavenport)
• Fixed tiers RBAC for calicoctl when it runs as a k8s pod. calico 9822 (@lucastigera)
• Rev bpftool to v7.5.0. Should fix issues with listing programs when there are non-Calico programs present that bpftool doesn't understand. calico 9806 (@fasaxc)
• Fix: Map OpenStack-derived policy to the "default" tier, not "ossg". calico 9777 (@nelljerram)
• Fix that netlink list operations could fail with "device or resource busy" errors when under load resulting in Felix restarting. calico 9769 (@fasaxc)
• Fix incorrect comment for TCPResetSeen. calico 9759 (@ioworker0)
• The default value of endpointStatusPathPrefix in FelixConfiguration is /var/run/calico. Felix writes endpoint status files by default unless explicitly disabled by setting endpointStatusPathPrefix to an empty value. calico 9721 (@song-jiang)
• Fix route programming for VXLAN tunnel IPs assigned from a /32 or /128 IPAM block. calico 9698 (@caseydavenport)
• Fix spammy Tier already exists message from kube-controllers. calico 9670 (@fasaxc)
• Fix that nodes with borrowed VXLAN tunnel addresses were not reachable by pods. calico 9662 (@caseydavenport)
• Fix nftables mode for arm64 including wrong libnftnl version calico 9657 (@caseydavenport)
• Policies part of the default tier can be managed only with the original name they were created with. Policies are no longer able to be managed interchangeably with or without the default. tier prefix calico 9615 (@MichalFupso)
• Fixed file handle leak in felix, caused by failing to close netlink handles. calico 9609 (@sridhartigera)
• Fix that libcalico-go would not always fill in the revision when listing certain resources (or single instances of certain resources). This could result in missed watch events in components such as Typha. calico 9599 (@fasaxc)
• Fix that non-amd64 builds of node-driver-registrar contained x86 binaries. calico 9594 (@caseydavenport)
• Fix that in-use VXLAN ARP entries could be repeatedly cleaned up and then re-added if they shared a MAC address with an stale entry that was supposed to be cleaned up. calico 9576 (@fasaxc)
• Felix: fix that a map used to cache loaded datastore keys would always use RAM proportional to the total number of keys rather than shrinking when no longer needed. calico 9526 (@fasaxc)
• Fix that the new tiers resource was omitted from etcd->Kubernetes migration. calico 9493 (@fasaxc)
• Fix a panic in Felix when accessing a nil address in flushing host addresses, i.e. flushHostIPUpdates function. calico 9466 (@cyclinder)
• Helm: Fix that uninstall Job had duplicate k8s-app labels calico 9438 (@caseydavenport)
• Fix that single-IP entries on BGPConfiguration serviceExternalIPs were not advertised according to external traffic policy. calico 9422 (@tanujd11)
• Fix missing routes when vxlan mode is cross-subnet and the environment is purely V6 (no V4 host addresses) calico 9416 (@tomastigera)
• Fix spurious warning about unexpected inserted rules. calico 9393 (@fasaxc)
• Fixed memory leak in BPF endpoint manager. calico 9307 (@sridhartigera)
• Helm: Fix OpenShift provider case sensitivity calico 9305 (@unai-ttxu)
• Fix a bug where pods with flexvol/nodeagent volumes would get stuck in the Terminating phase, if, during termination, their node rebooted. calico 9279 (@aaaaaaaalex)
• fix image in flannel migration manifest calico 9263 (@radTuti)

eBPF-related changes

• ebpf: Fix configuring arp entries for bpf NAT devices for systemd >= 242 calico 10209 (@sridhartigera)
• ebpf: Fixed a bug where BPF programs were being re-attached to network interfaces unnecessarily, even when the host IP address had not changed. calico 10163 (@sridhartigera)
• ebpf: fix cleanup of UDP service entries when a service gets (re)created calico 10098 (@tomastigera)
• ebpf: Fix dropping packets from workloads to host interfaces not managed by calico. calico 10085 (@sridhartigera)
• ebpf: treat conns with both FINs as finished in flowlogs, do not wait until conntrack is to be removed. calico 9838 (@tomastigera)
• ebpf: fix icmp error delivery to host networked pods calico 9747 (@tomastigera)
• ebpf: conntrack table doubles in size if it is running out of space calico 9732 (@tomastigera)
• ebpf: adjust the default value to the value from the actual map when dumping the conntrack map in calico-bpf calico 9704 (@ioworker0)
• ebpf: conntrack more resistant to spurious RSTs calico 9692 (@tomastigera)
• ebpf: conntrack timers are configurable, closed TCP connections are closed now by default after /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_time_wait seconds (120 by default) up from 30s. calico 9607 (@tomastigera)
• ebpf: additional conntrack counters calico 9590 (@tomastigera)
• ebpf: fixed routing from outside the cluster in EKS with aws-cni calico 9569 (@tomastigera)
• ebpf: end-2-end latency measurement within tc programs calico 9545 (@tomastigera)
• ebpf: improved autodetection of device hierarchy like bonds and vlans. tc is attached to the root and xdp to the leaves. calico 9498 (@sridhartigera)
• ebpf: fall back to non-CO-RE if CO-RE object does not load calico 9456 (@tomastigera)
• ebpf: support for log action in policy rules calico 9452 (@tomastigera)
• ebpf: calico special interfaces excluded from dataIfaceRegex calico 9451 (@tomastigera)
• ebpf: Fix that we'd fail to clear mark bits after applying do-not-track policy. Use dedicated mark for XDP bypass traffic. calico 9392 (@fasaxc)
• ebpf: real IPs in bpf debug output with co-re enabled kernels calico 9378 (@tomastigera)
• ebpf: disable conntrack bypass by default (not needed for kernels 5.9+), exclude link-local from the bypass calico 9159 (@tomastigera)

Other changes

• Resolved an issue preventing the program from launching on the s390x architecture. calico 10206 (@hjiawei)
• New manifests to install Calico with the eBPF dataplane in an OpenShift cluster. calico 10108 (@lucastigera)
• Reduce logging-related allocations in hot path. Reduces garbage collection overheads. calico 9990 (@fasaxc)
• Add packet number of connections limiting QoS control to workloads. calico 9989 (@coutinhop)
• Add packet rate limiting QoS control to workloads. calico 9947 (@coutinhop)
• Add helm values.yaml config option for operator management of CRDs (default: true) calico 9937 (@caseydavenport)
• Updates the AutoHEP Kube-Controller to allow creation of multiple custom HostEndpoints per Node calico 9901 (@MichalFupso)
• Whisker observability UI is enabled by default in the helm chart and Tigera operator custom-resources.yaml. calico 9894 (@caseydavenport)
• Optimization: avoid listing all IPPools for simple IPAM assignments. calico 9891 (@gojoy)
• Calico is now built with Go 1.24 against Kubernetes v1.32. calico 9890 (@hjiawei)
• Add bandwidth limiting QoS control to workloads. calico 9881 (@coutinhop)
• Support nested BGP peering with calico-nodes running in local KubeVirt VMs. calico 9875 (@song-jiang)
• Added support for configuring MaxBlocksPerHost via calicoctl ipam configure --maxblockhost. This allows operators to limit the number of IP blocks assigned to a host. calico 9842 (@phantooom)
• Wireguard: Defer setting NAPI threading until after adding first peer. Kernel disallows the setting until then. calico 9815 (@fasaxc)
• Calico for OpenStack now supports some Neutron QoS policy fields: the "max_kbps" and "max_burst_kbps" fields of bandwidth limit rules, and the "max_kpps" field of packet rate limit rules. There are also new driver settings (cluster-wide) for imposing a maximum number of egress connections per Neutron port, and similarly for ingress connections. calico 9811 (@nelljerram)
• Adding support for staged policies, by introducing stagedglobalnetworkpolicy, stagednetworkpolicy, and stagedkubernetesnetworkpolicy CRDs. calico 9746 (@mazdakn)
• Adding flow log to Felix for collecting observability data from each Calico node and sending to calico/goldmane calico 9737 (@mazdakn)
• Introduces calico/goldmane, a new component for aggregating observability data across nodes. calico 9708 (@caseydavenport)
• Ensure existing CNI config file has correct permissions on upgrade calico 9656 (@kashifest)
• Improve CPU efficiency of IP address garbage collection controller calico 9654 (@caseydavenport)
• Calico is now built with Go 1.23.4 against Kubernetes v1.31.4. calico 9608 (@hjiawei)
• Unify all logging to logrus for consistency in logging across all components which also enables controlling what is logged via only one parameter LOG_LEVEL calico 9600 (@ti-afra)
• Calico now takes advantage of "watch bookmarks" when watching Kubernetes resources. This prevents "resource version too old" errors, which result in unnecessary resyncs (which delay updates and increase API server CPU load). calico 9593 (@fasaxc)
• Enhance conntrack map flexibility with CPU-based scaling. calico 9581 (@ioworker0)
• Improve performance of selector parsing and validation. calico 9564 (@fasaxc)
• Support for a new cni.projectcalico.org/ipFamilies annotation to configure which IP families to use on a per-pod or per-Namespace basis. calico 9544 (@renyunkang)
• Configurable CNI token refresh duration calico 9539 (@huutomerkki)
• In nftables dataplane, use human readable policy chain names where possible. calico 9528 (@caseydavenport)
• Felix now compresses network policies and namespaces in memory, reducing RAM usage in clusters with many policies/namespaces that are not active on a given node. calico 9514 (@fasaxc)
• Reduce get/update node API calls in allocate-tunnel-addrs. calico 9506 (@liuxu623)
• Add permission to Calico API server to create tier resources. calico 9482 (@sebhoss)
• Add support for Kubernetes BaselineAdminNetworkPolicy. https://network-policy-api.sigs.k8s.io/api-overview/ calico 9464 (@fasaxc)
• Do not fail data store initialisation when unauthorised error happen while creating default and adminnetworkpolicy tiers. Those tiers eventually get created by another component. calico 9446 (@mazdakn)
• Tweak bounds checking in Felix parameter conversion to avoid false positives in static analysis. calico 9382 (@fasaxc)
• The felix_iptables_rules Prometheus metric now only counts rules within referenced Iptables chains, no longer counts candidate rules. calico 9374 (@aaaaaaaalex)
• Calico is now built with Go 1.23.2 against Kubernetes v1.30.5. calico 9335 (@hjiawei)
• Add tooling to auto-generate Felix configuration documentation. Improve CRD documentation and validation. calico 9325 (@fasaxc)
• New Felix config param IPForwarding allows for preventing Felix from enabling IP forwarding on systems that are only using Calico for host protection (and hence don't need to forward traffic to workloads). calico 9313 (@fasaxc)
• Automate embedding of CRDs in calicoctl datastore migrate import; removes a manual step that could be forgotten. calico 9297 (@fasaxc)
• Added support for calicoctl version --client calico 9291 (@cyclinder)
• Update Calico's OpenStack integration code to work with the OpenStack Caracal release, and also with Ubuntu Jammy. calico 9278 (@nelljerram)
• Add support for AdminNetworkPolicy egress network CIDRs. calico 9276 (@mazdakn)
• Calico is now built with Go 1.23.2 against Kubernetes v1.29.9. calico 9270 (@hjiawei)
• Add setting to enable wireguard NAPI threading calico 9260 (@jrcichra)
• Allow users to specify the default action in a tier. calico 9232 (@mazdakn)
• Add LoadBalancer kube-controller to allow for Service LoadBalancer IPAM calico 9221 (@MichalFupso)
• Use restricted pod security standard on calico-apiserver namespace in manifests for OCP calico 9217 (@mihivagyok)
• Add a label to Workload endpoints for the name of the network of the related port. Useful for cases where there are many different OpenStack deployments with the same network name. No impact requiring code changes. calico 9129 (@trev97)
• Adjust CNI config file permissions to satisfy CIS benchmark expectations. calico 8991 (@missa-wndrvr)
• Calico now reconciles its VXLAN tunnel interface MAC address if it changes. calico 8924 (@MageekChiu)
• Support for using named ports in NetworkPolicy when exposed via an initContainer. calico 8885 (@george-angel)

Changelog for version v3.30.1: https://github.com/projectcalico/calico/blob/release-v3.30/release-notes/v3.30.1-release-notes.md

[!WARNING]

Tiered Policy naming changes

If you are upgrading your Calico cluster to v3.30.1, please see the release notes from Calico v3.29.4 as naming of policies in the default tier may have changed.

Clusters meeting the following criteria may be affected:

1. You previously had Calico v3.29.1, v3.29.2, or v3.29.3 installed
2. You created policies in the default tier while those versions were installed
3. Your cluster has never been upgraded to v3.29.4 (even if you have upgraded to v3.30.0 already)

Bug fixes

• ebpf: Fixed attaching bpf programs by atomically replacing the old program rather than attaching new and detaching old. calico 10454 (@sridhartigera)
• Disable WatchList in Calico API server, fixing issue with stuck Namespace termination. calico 10440 (@tmjd)
• Policies created prior to v3.28.0 have their name retained across upgrade. Policies created in the default tier with version v3.29.[0-3] will have their names changed from default.name to name. calico 10418 (@MichalFupso)
• eBPF - Fix forwarding of packets to kubevirt pods when in bridge mode. calico 10415 (@sridhartigera)
• Add missing tiers permissions for flannel migration controller calico 10385 (@caseydavenport)
• Fix flannel migration use of deprecated flag "delete-local-data" calico 10379 (@caseydavenport)

Other changes

• Introduces a shorthand for StagedNetworkPolicy -> snp, StagedGlobalNetworkPolicy -> sgnp and StagedKubernetesNetworkPolicy -> sknp calico 10424 (@MichalFupso)
• Update Operator Helm values to support custom DNS settings calico 10406 (@caseydavenport)

Changelog for version v3.30.2: https://github.com/projectcalico/calico/blob/release-v3.30/release-notes/v3.30.2-release-notes.md

QoS Enhancements

Several enhancements have been made to Calico's QoS controls calico 10518

• Added support for peakrate (and optionally minburst) configuration to bandwidth QoS controls.
• Added support for packet burst configuration to packet rate QoS controls.
• Fixed upper and lower boundaries of packet rate and number of connections QoS controls to be in-line with kernel limits.

Several enhancements have been made to Calico's QoS support in OpenStack calico 10532 (@nelljerram)

• Calico for OpenStack's QoS support has been enhanced to cover packet rate burst size configuration. There are new driver settings (cluster-wide, set in neutron.conf) for configuring max and min packet burst sizes in each direction.
• Calico for OpenStack's QoS support has been enhanced to cover peak rate configuration. The max_burst_kbps field of bandwidth limit rules is honoured as the peak rate, and there are new driver settings (cluster-wide, set in neutron.conf) for configuring max and min burst sizes in each direction.

Bug fixes

• ebpf: fix forwarding for asymetric routing https://github.com/projectcalico/calico/issues/10469 calico 10535 (@tomastigera)
• Fix race condition in Goldmane startup calico 10514 (@caseydavenport)
• Fix Goldmane race condition when terminating streams calico 10513 (@caseydavenport)

Other changes

• Add NextHopMode field to BGPPeer API calico 10562 (@song-jiang)
• Allow Operator to delete ANP/BANP CRDs to set owner refs when assuming control of pre-existing CRDs, for example on OCP. calico 10552 (@mazdakn)

Changelog for version v3.30.3: https://github.com/projectcalico/calico/blob/release-v3.30/release-notes/v3.30.3-release-notes.md

Bug fixes

• Fix that whisker wouldn't bind to IPv6 addresses. calico 10840 (@caseydavenport)
• ebpf: Fix race between loading kubernetes services and conntrack cleanup. If conntrack cleanup ran before services were loaded, all service entries would look stale and get cleaned up. calico 10724 (@fasaxc)
• Fix confd on Windows by skipping watching endpoint status files. calico 10703 (@song-jiang)
• ebpf: fixes ICMP response source IP when nodes have multiple IPs assigned calico 10661 (@tomastigera)
• Fix that CalicoNodeStatus updates could get blocked by datastore errors calico 10595 (@theboringstuff)

Other changes

• Updates k8s to 1.32.8 calico 10836 (@MichalFupso)
• Update RBAC for kube-controllers to access services/servicestatus for etcd manifest installation. calico 10792 (@MichalFupso)
• Update k8s to 1.32.8 and go to 1.24.6 calico 10773 (@MichalFupso)
• ebpf: Squash benign "Not a valid CIDR." log when processing headless services in kube proxy. calico 10701 (@fasaxc)
• Add validation to guard against catch-all CIDRs (e.g. 0.0.0.0/0) on negated (notnets) policy rules, as those would effectively disallow all addresses. calico 10688 (@dzacball)
• ebpf: use pre-dnat IP for icmp response on ingress to node. Either it is an external IP or routable from the previous hop. The node can pose as having the VIP. calico 10677 (@tomastigera)
• Add ReversePeering field to BGPPeer API calico 10675 (@song-jiang)
• Calico LoadBalancerController will consider service.spec.LoadBalancerClass in determining if IP should be assigned. When in RequestedServicesOnly mode service will be assigned IP if LoadBalancerClass is set to calico. When running is AllServices and RequestedServicesOnly mode and the LoadBalancerClass is set to other value than calico, service will not be assigned an IP calico 10631 (@MichalFupso)
• Calico packages for Ubuntu Noble are built with separate debug symbols for Calico v3.30 and later. To install, add the main/debug component in your project-calico-ubuntu-master-noble.sources file alongside the main component and then run apt update and install the calico-felix-dbgsym package. calico 10622 (@danudey)

Changelog for version v3.30.4: https://github.com/projectcalico/calico/blob/release-v3.30/release-notes/v3.30.4-release-notes.md

Bug fixes

• ebpf: do not blindly redirect back to the same host iface - fixed regression from 3.29 to 3.30 calico 11155 (@tomastigera)
• Reinstate support for VMs that are configured not to respond to ARP requests. calico 11099 (@nelljerram)
• Fix that IPAM allocation could leak handles when many workloads are scheduled to the same node at the same time, causing timeouts by "thundering herd". calico 11096 (@fasaxc)
• Fix slow IPAM release performance when releasing IPs from disabled or deleted pools (especially for bulk deletions like those done by IPAM GC). Consider disabled pools as potential IP owners and cache any loaded blocks for fast access. calico 11095 (@fasaxc)
• nftables: fix reprogramming of base chain rules after out-of-band flush. calico 10939 (@caseydavenport)
• Helm: fix role binding to use correct serviceaccount name when deployed in an alternative namespace. calico 10908 (@caseydavenport)

Other changes

• ebpf: calico-node -bpf policy dump prints the End of (Rule | Policy | Tier) in the default concise output calico 11157 (@tomastigera)
• ebpf: Added a new Felix configuration option CgroupV2Path to set a custom cgroupV2 mount path, improving compatibility with immutable OSes like Talos Linux. calico 11131 (@lucastigera)
• ebpf: BPFKubeProxyHealtzPort allows to change the kube-proxy healthz server port calico 11054 (@tomastigera)
• Make Calico's backing CRDs optional. Calico will no longer fail to start if a CRD is missing. calico 11036 (@caseydavenport)
• Add missing staged policy permissions to apiserver.yaml calico 11032 (@caseydavenport)
• OpenStack QoS handling has been improved to respond immediately to all kinds of QoS changes on the Neutron API. In particular when rules are added, updated or deleted for a QoS policy that is already in use, and when a QoS policy is added, updated or deleted for a Neutron network that is already in use. Calico's handling of these changes previously relied on a periodic resync, which could in practice take a long time; now those changes are handled immediately (within a few seconds). calico 11006 (@nelljerram)
• When the AssumeNeededOnEveryNode performance hint is set on a policy, the iptables dataplane now renders the policy rules to the filter table, even if the chain is not yet referenced; this reduces the work needed when a new workload arrives needing the policy. calico 10999 (@fasaxc)
• Improve Whisker UI display of enforced and pending policy traces. calico 10938 (@caseydavenport)
• Remove manual Windows Kubernetes service installation calico 10916 (@song-jiang)

Changelog for version v3.30.5: https://github.com/projectcalico/calico/blob/release-v3.30/release-notes/v3.30.5-release-notes.md

Bug fixes

• ebpf: Fixed loading connecttime load balancer program in 6.12 kernel calico 11406 (@sridhartigera)
• Felix now explicitly sets priority 1024 for IPv6 routes instead of relying on kernel default, ensuring routes round-trip correctly when read from the kernel. calico 11395 (@fasaxc)
• Fix AllowSpoofedSourcePrefixes for dual stack clusters. calico 11373 (@lucastigera)
• fix (release-tool): include image tarballs in release archive file calico 11296 (@radTuti)
• Default KubeControllersConfiguration.LoadBalancer when not set to AllServices calico 11267 (@MichalFupso)
• ebpf: Do not adjust gso_size after nodeport tunnel vxlan decap. There is no guarantee that there would be enough data after removing tunnel headers. The packet is shrunk by 50 bytes while the gso_size would grow. Kernel would drop the packet if the original gso packet is too small. calico 11259 (@tomastigera)
• Fix BGP advertisement of externalIP addresses on Services with type=ClusterIP. calico 11235 (@caseydavenport)
• ebpf: start only a single kube-proxy health-server in dual stack mode calico 11222 (@tomastigera)
• Fix typo in FelixConfiguration BPFKubeProxyHealthzPort field. calico 11209 (@tomastigera)
• Fix IPAM block leak of older blocks when deleting IP pools. calico 11196 (@gojoy)

Changelog for version v3.30.6: https://github.com/projectcalico/calico/blob/release-v3.30/release-notes/v3.30.6-release-notes.md

Bug fixes

• OpenStack: make periodic compaction loop independent of resync calico 11574 (@nelljerram)

Other changes

• Updated tigera-operator RBAC: create mutatingwebhooks, and update mutatingwebhooks. update restricted to specific resourceNames: envoy-gateway-topology-injector.tigera-gateway calico 11688 (@nelljerram)
• Upgrade Envoy Gateway 1.3.2 -> 1.5.7 calico 11673 (@skoryk-oleksandr)
• Add configurable field resync_max_interval_secs that defines the max time allowed between successful periodic resyncs. Log an error message if the interval exceeds the threshold. calico 11647 (@nelljerram)
• Re-create and swap out Calico ipsets that are not possible to list due to different failures like user-space/kernel incompatibility. Performance: After failures to program IP sets, the dataplane now does a partial resync of only the affected IP sets. This should reduce the overhead of dealing with a transient failure. calico 11472 (@mazdakn)

Changelog for version v3.30.7: https://github.com/projectcalico/calico/blob/release-v3.30/release-notes/v3.30.7-release-notes.md

Deprecations

• Support for non-privileged mode is no longer available for Operator installations. The Installation.spec.nonPrivileged field is deprecated and ignored; setting it to Enabled will mark Calico as Degraded. calico 12091 (@MichalFupso)
• We continue testing Calico against OpenStack Caracal, but have stopped testing Calico against OpenStack Yoga. This is because Yoga has now been "unmaintained" for over a year, and is not compatible with current CI platforms based on Ubuntu 22.04. calico 11746 (@nelljerram)

Bug fixes

• ebpf: Fixed issue where VXLAN traffic was dropped on nodes still running Calico 3.30 during a rolling upgrade to 3.31. This caused connectivity failures for host-networked pods communicating via Kubernetes services across nodes at different versions. Upgrading to this 3.30 patch release before upgrading to 3.31 resolves the issue. calico 12054 (@tomastigera)
• Fix failure to enable ingress bandwidth QoS controls when a non-default qdisc previously existed on the workload interface (handle != 0). calico 11984 (@coutinhop)
• Fix CNI delete timeout to start after IPAM lock acquisition, preventing "context deadline exceeded" failures during high pod churn. calico 11943 (@sridhartigera)
• Fix advertisement of /32 LB IP addresses when not present in the Service Spec calico 11928 (@caseydavenport)
• Prevent nil pointer dereference in LoadBalancer controller handleBlockUpdate calico 11923 (@MichalFupso)
• Bugfix: fix rendering of NatPortRange option when using nftables. calico 11740 (@nelljerram)
• Don't uninstall CNI and kube-proxy service when using non-Calico CNI on Windows with operator install. calico 11723 (@coutinhop)
• Fix that the CNI plugin installer generated a malformed URL for IPv4 addresses. This bug was exposed by a fix to the golang URL parser. calico 11720 (@fasaxc)

Other changes

• Update LoadBalancer controller to not run when not explicitly configured as part of ENABLED_CONTROLLERS calico 12055 (@MichalFupso)