Upgrade Calico and fully disable vxlan

tigera-operator/custom-resources.yaml

@@ -58,6 +58,21 @@ spec:
   vxlanMode: Never
   natOutgoing: false
 ---
+apiVersion: projectcalico.org/v3
+kind: FelixConfiguration
+metadata:
+  name: default
+spec:
+  # No IP pool uses VXLAN (see vxlanMode: Never above), but calico-node startup
+  # only ever enables this flag and never clears it. Left enabled, Felix retries
+  # the nonexistent vxlan.calico device on every resync, spamming route_mgr
+  # errors and forking `nft` on all nodes.
+  vxlanEnabled: false
+  # Stored as "ACCEPT" by an older Calico, which today's validator rejects
+  # (Drop/Accept/Return, case-sensitive) — that made every write to this object
+  # fail, so the casing has to be corrected here. Same semantics.
+  defaultEndpointToHostAction: Accept
+---
 # This section configures the Calico API server.
 # For more information, see: https://projectcalico.docs.tigera.io/master/reference/installation/api#operator.tigera.io/v1.APIServer
 apiVersion: operator.tigera.io/v1