kubernetes-sigs · k8s-ci-robot · Jun 18, 2025 · Jun 16, 2025
diff --git a/templates/addons/calico-dual-stack/values.yaml b/templates/addons/calico-dual-stack/values.yaml
@@ -17,3 +17,15 @@ installation:
       encapsulation: None
       natOutgoing: Enabled
       nodeSelector: all()
+# By default, tigera tolerates all NoSchedule taints. This breaks upgrades
+# when it continuously gets scheduled onto an out-of-date Node that is being
+# deleted. Tolerate only the NoSchedule taints that are expected.
+tolerations:
+  - effect: NoExecute
+    operator: Exists
+  - effect: NoSchedule
+    key: node-role.kubernetes.io/control-plane
+    operator: Exists
+  - effect: NoSchedule
+    key: node.kubernetes.io/not-ready
+    operator: Exists
diff --git a/templates/addons/calico-ipv6/values.yaml b/templates/addons/calico-ipv6/values.yaml
@@ -12,3 +12,15 @@ installation:
       encapsulation: None
       natOutgoing: Enabled
       nodeSelector: all()
+# By default, tigera tolerates all NoSchedule taints. This breaks upgrades
+# when it continuously gets scheduled onto an out-of-date Node that is being
+# deleted. Tolerate only the NoSchedule taints that are expected.
+tolerations:
+  - effect: NoExecute
+    operator: Exists
+  - effect: NoSchedule
+    key: node-role.kubernetes.io/control-plane
+    operator: Exists
+  - effect: NoSchedule
+    key: node.kubernetes.io/not-ready
+    operator: Exists
diff --git a/templates/addons/calico/values.yaml b/templates/addons/calico/values.yaml
@@ -14,3 +14,15 @@ tigeraOperator:
   registry: mcr.microsoft.com/oss
 calicoctl:
   image: mcr.microsoft.com/oss/calico/ctl
+# By default, tigera tolerates all NoSchedule taints. This breaks upgrades
+# when it continuously gets scheduled onto an out-of-date Node that is being
+# deleted. Tolerate only the NoSchedule taints that are expected.
+tolerations:
+  - effect: NoExecute
+    operator: Exists
+  - effect: NoSchedule
+    key: node-role.kubernetes.io/control-plane
+    operator: Exists
+  - effect: NoSchedule
+    key: node.kubernetes.io/not-ready
+    operator: Exists
diff --git a/templates/addons/cluster-api-helm/calico-dual-stack.yaml b/templates/addons/cluster-api-helm/calico-dual-stack.yaml
@@ -38,3 +38,15 @@ spec:
       registry: mcr.microsoft.com/oss
     calicoctl:
       image: mcr.microsoft.com/oss/calico/ctl
+    # By default, tigera tolerates all NoSchedule taints. This breaks upgrades
+    # when it continuously gets scheduled onto an out-of-date Node that is being
+    # deleted. Tolerate only the NoSchedule taints that are expected.
+    tolerations:
+      - effect: NoExecute
+        operator: Exists
+      - effect: NoSchedule
+        key: node-role.kubernetes.io/control-plane
+        operator: Exists
+      - effect: NoSchedule
+        key: node.kubernetes.io/not-ready
+        operator: Exists
diff --git a/templates/addons/cluster-api-helm/calico-ipv6.yaml b/templates/addons/cluster-api-helm/calico-ipv6.yaml
@@ -32,4 +32,16 @@ spec:
       image: tigera/operator
       registry: mcr.microsoft.com/oss
     calicoctl:
-      image: mcr.microsoft.com/oss/calico/ctl
+      image: mcr.microsoft.com/oss/calico/ctl
+    # By default, tigera tolerates all NoSchedule taints. This breaks upgrades
+    # when it continuously gets scheduled onto an out-of-date Node that is being
+    # deleted. Tolerate only the NoSchedule taints that are expected.
+    tolerations:
+      - effect: NoExecute
+        operator: Exists
+      - effect: NoSchedule
+        key: node-role.kubernetes.io/control-plane
+        operator: Exists
+      - effect: NoSchedule
+        key: node.kubernetes.io/not-ready
+        operator: Exists
diff --git a/templates/addons/cluster-api-helm/calico.yaml b/templates/addons/cluster-api-helm/calico.yaml
@@ -30,4 +30,16 @@ spec:
       image: tigera/operator
       registry: mcr.microsoft.com/oss
     calicoctl:
-      image: mcr.microsoft.com/oss/calico/ctl
+      image: mcr.microsoft.com/oss/calico/ctl
+    # By default, tigera tolerates all NoSchedule taints. This breaks upgrades
+    # when it continuously gets scheduled onto an out-of-date Node that is being
+    # deleted. Tolerate only the NoSchedule taints that are expected.
+    tolerations:
+      - effect: NoExecute
+        operator: Exists
+      - effect: NoSchedule
+        key: node-role.kubernetes.io/control-plane
+        operator: Exists
+      - effect: NoSchedule
+        key: node.kubernetes.io/not-ready
+        operator: Exists
diff --git a/templates/test/ci/cluster-template-prow-apiserver-ilb.yaml b/templates/test/ci/cluster-template-prow-apiserver-ilb.yaml
diff --git a/templates/test/ci/cluster-template-prow-ci-version-dra.yaml b/templates/test/ci/cluster-template-prow-ci-version-dra.yaml
diff --git a/templates/test/ci/cluster-template-prow-ci-version-dual-stack.yaml b/templates/test/ci/cluster-template-prow-ci-version-dual-stack.yaml
diff --git a/templates/test/ci/cluster-template-prow-ci-version-ipv6.yaml b/templates/test/ci/cluster-template-prow-ci-version-ipv6.yaml
diff --git a/templates/test/ci/cluster-template-prow-ci-version-md-and-mp.yaml b/templates/test/ci/cluster-template-prow-ci-version-md-and-mp.yaml
diff --git a/templates/test/ci/cluster-template-prow-ci-version.yaml b/templates/test/ci/cluster-template-prow-ci-version.yaml
diff --git a/templates/test/ci/cluster-template-prow-clusterclass-ci-rke2.yaml b/templates/test/ci/cluster-template-prow-clusterclass-ci-rke2.yaml
diff --git a/templates/test/ci/cluster-template-prow-custom-vnet.yaml b/templates/test/ci/cluster-template-prow-custom-vnet.yaml
diff --git a/templates/test/ci/cluster-template-prow-dual-stack.yaml b/templates/test/ci/cluster-template-prow-dual-stack.yaml
diff --git a/templates/test/ci/cluster-template-prow-edgezone.yaml b/templates/test/ci/cluster-template-prow-edgezone.yaml
diff --git a/templates/test/ci/cluster-template-prow-flatcar-sysext.yaml b/templates/test/ci/cluster-template-prow-flatcar-sysext.yaml