From 7216e858891961182ad56950a26f562de91bd688 Mon Sep 17 00:00:00 2001
From: Erki Aas <erki@veebkolm.ee>
Date: Sun, 23 Aug 2026 13:30:51 +0300
Subject: [PATCH] Improve stability of Calico upgrades

---
 kube-system/descheduler.yaml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/kube-system/descheduler.yaml b/kube-system/descheduler.yaml
index 1412d59..df20cb0 100644
--- a/kube-system/descheduler.yaml
+++ b/kube-system/descheduler.yaml
@@ -48,6 +48,13 @@ data:
           - requiredDuringSchedulingIgnoredDuringExecution
       RemovePodsViolatingNodeTaints:
         enabled: true
+        params:
+          # calico-node flips NetworkUnavailable while it restarts, which the
+          # node lifecycle controller turns into a NoSchedule taint. Without
+          # this exclusion a rolling CNI upgrade evicts every pod in the
+          # cluster (81 pods on 2026-08-23) for a taint that lasts seconds.
+          excludedTaints:
+          - node.kubernetes.io/network-unavailable
       RemovePodsViolatingTopologySpreadConstraint:
         enabled: true
         params: