DOCS-2840: Publish Calico OSS v3.30.7 (#2598)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Daniel Fox <dan.fox@tigera.io>

Author: 3 people

calico_versioned_docs/version-3.30/reference/installation/_api.mdx

@@ -1585,7 +1585,7 @@ _Appears in:_
 | `nodeUpdateStrategy` _[DaemonSetUpdateStrategy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.33/#daemonsetupdatestrategy-v1-apps)_ | (Optional) NodeUpdateStrategy can be used to customize the desired update strategy, such as the MaxUnavailable field. |
 | `componentResources` _[ComponentResource](#componentresource) array_ | (Optional) Deprecated. Please use CalicoNodeDaemonSet, TyphaDeployment, and KubeControllersDeployment. ComponentResources can be used to customize the resource requirements for each component. Node, Typha, and KubeControllers are supported for installations. |
 | `certificateManagement` _[CertificateManagement](#certificatemanagement)_ | (Optional) CertificateManagement configures pods to submit a CertificateSigningRequest to the certificates.k8s.io/v1beta1 API in order to obtain TLS certificates. This feature requires that you bring your own CSR signing and approval process, otherwise pods will be stuck during initialization. |
-| `nonPrivileged` _[NonPrivilegedType](#nonprivilegedtype)_ | (Optional) NonPrivileged configures Calico to be run in non-privileged containers as non-root users where possible. |
+| `nonPrivileged` _[NonPrivilegedType](#nonprivilegedtype)_ | (Optional) Deprecated. NonPrivileged is deprecated and will be removed from the API in a future release. Enabling this field is not supported and will cause errors. NonPrivileged configures Calico to be run in non-privileged containers as non-root users where possible. |
 | `calicoNodeDaemonSet` _[CalicoNodeDaemonSet](#caliconodedaemonset)_ | CalicoNodeDaemonSet configures the calico-node DaemonSet. If used in conjunction with the deprecated ComponentResources, then these overrides take precedence. |
 | `csiNodeDriverDaemonSet` _[CSINodeDriverDaemonSet](#csinodedriverdaemonset)_ | CSINodeDriverDaemonSet configures the csi-node-driver DaemonSet. |
 | `calicoKubeControllersDeployment` _[CalicoKubeControllersDeployment](#calicokubecontrollersdeployment)_ | CalicoKubeControllersDeployment configures the calico-kube-controllers Deployment. If used in conjunction with the deprecated ComponentResources, then these overrides take precedence. |

calico_versioned_docs/version-3.30/release-notes/index.mdx

@@ -380,8 +380,7 @@ To update a previous version of Calico, see [our upgrade guides](../operations/u
 
 November 26, 2025
 
-### Bug fixes
-
+#### Bug fixes
 
 * eBPF: Fixed loading connecttime load balancer program in 6.12 kernel [calico 11406](https://github.com/projectcalico/calico/pull/11406) (@sridhartigera)
 * Felix now explicitly sets priority 1024 for IPv6 routes instead of relying on kernel default, ensuring routes round-trip correctly when read from the kernel. [calico 11395](https://github.com/projectcalico/calico/pull/11395) (@fasaxc)
@@ -402,11 +401,11 @@ To update a previous version of Calico, see [our upgrade guides](../operations/u
 
 January 23, 2026
 
-### Bug fixes
+#### Bug fixes
 
 * OpenStack: make periodic compaction loop independent of resync [calico 11574](https://github.com/projectcalico/calico/pull/11574) (@nelljerram)
 
-### Other updates
+#### Other updates
 
 * Updated tigera-operator RBAC: create mutatingwebhooks, and update mutatingwebhooks. update restricted to specific resourceNames: envoy-gateway-topology-injector.tigera-gateway [calico 11688](https://github.com/projectcalico/calico/pull/11688) (@nelljerram)
 * Upgrade Envoy Gateway 1.3.2 -> 1.5.7 [calico 11673](https://github.com/projectcalico/calico/pull/11673) (@skoryk-oleksandr)
@@ -415,4 +414,31 @@ January 23, 2026
 
 #### Updating
 
+To update a previous version of Calico, see [our upgrade guides](../operations/upgrading/index.mdx)
+
+### Calico Open Source 3.30.7 bug fix release
+
+March 18, 2026
+
+#### Deprecations
+
+- We continue testing Calico against OpenStack Caracal, but have stopped testing Calico against OpenStack Yoga. This is because Yoga has now been "unmaintained" for over a year, and is not compatible with current CI platforms based on Ubuntu 22.04. [calico 11746](https://github.com/projectcalico/calico/pull/11746) (@nelljerram)
+
+#### Bug fixes
+
+- ebpf: Fixed issue where VXLAN traffic was dropped on nodes still running Calico 3.30 during a rolling upgrade to 3.31. This caused connectivity failures for host-networked pods communicating via Kubernetes services across nodes at different versions. Upgrading to this 3.30 patch release before upgrading to 3.31 resolves the issue. [calico 12054](https://github.com/projectcalico/calico/pull/12054) (@tomastigera)
+- Fix failure to enable ingress bandwidth QoS controls when a non-default qdisc previously existed on the workload interface (handle != 0). [calico 11984](https://github.com/projectcalico/calico/pull/11984) (@coutinhop)
+- Fix CNI delete timeout to start after IPAM lock acquisition, preventing "context deadline exceeded" failures during high pod churn. [calico 11943](https://github.com/projectcalico/calico/pull/11943) (@sridhartigera)
+- Fix advertisement of /32 LB IP addresses when not present in the Service Spec [calico 11928](https://github.com/projectcalico/calico/pull/11928) (@caseydavenport)
+- Prevent nil pointer dereference in LoadBalancer controller `handleBlockUpdate` [calico 11923](https://github.com/projectcalico/calico/pull/11923) (@MichalFupso)
+- Bugfix: fix rendering of NatPortRange option when using nftables. [calico 11740](https://github.com/projectcalico/calico/pull/11740) (@nelljerram)
+- Don't uninstall CNI and kube-proxy service when using non-Calico CNI on Windows with operator install. [calico 11723](https://github.com/projectcalico/calico/pull/11723) (@coutinhop)
+- Fix that the CNI plugin installer generated a malformed URL for IPv4 addresses. This bug was exposed by a fix to the golang URL parser. [calico 11720](https://github.com/projectcalico/calico/pull/11720) (@fasaxc)
+
+#### Other changes
+
+- Update LoadBalancer controller to not run when not explicitly configured as part of `ENABLED_CONTROLLERS` [calico 12055](https://github.com/projectcalico/calico/pull/12055) (@MichalFupso)%
+
+#### Updating
+
 To update a previous version of Calico, see [our upgrade guides](../operations/upgrading/index.mdx)

calico_versioned_docs/version-3.30/releases.json

@@ -1,4 +1,102 @@
 [
+  {
+    "title": "v3.30.7",
+    "tigera-operator": {
+      "image": "tigera/operator",
+      "registry": "quay.io",
+      "version": "v1.38.13"
+    },
+    "components": {
+      "calico/typha": {
+        "version": "v3.30.7",
+        "registry": "quay.io"
+      },
+      "calico/ctl": {
+        "version": "v3.30.7",
+        "registry": "quay.io"
+      },
+      "calico/node": {
+        "version": "v3.30.7",
+        "registry": "quay.io"
+      },
+      "calico/node-windows": {
+        "version": "v3.30.7",
+        "registry": "quay.io"
+      },
+      "calico/cni": {
+        "version": "v3.30.7",
+        "registry": "quay.io"
+      },
+      "calico/cni-windows": {
+        "version": "v3.30.7",
+        "registry": "quay.io"
+      },
+      "calico/apiserver": {
+        "version": "v3.30.7",
+        "registry": "quay.io"
+      },
+      "calico/kube-controllers": {
+        "version": "v3.30.7",
+        "registry": "quay.io"
+      },
+      "calico/envoy-gateway": {
+        "version": "v3.30.7",
+        "registry": "quay.io"
+      },
+      "calico/envoy-proxy": {
+        "version": "v3.30.7",
+        "registry": "quay.io"
+      },
+      "calico/envoy-ratelimit": {
+        "version": "v3.30.7",
+        "registry": "quay.io"
+      },
+      "calico/flannel-migration-controller": {
+        "version": "v3.30.7",
+        "registry": "quay.io"
+      },
+      "flannel": {
+        "version": "v0.24.4",
+        "registry": "docker.io"
+      },
+      "calico/dikastes": {
+        "version": "v3.30.7",
+        "registry": "quay.io"
+      },
+      "flexvol": {
+        "version": "v3.30.7",
+        "registry": "quay.io"
+      },
+      "calico/csi": {
+        "version": "v3.30.7",
+        "registry": "quay.io"
+      },
+      "calico/node-driver-registrar": {
+        "version": "v3.30.7",
+        "registry": "quay.io"
+      },
+      "calico/pod2daemon-flexvol": {
+        "version": "v3.30.7",
+        "registry": "quay.io"
+      },
+      "calico/key-cert-provisioner": {
+        "version": "v3.30.7",
+        "registry": "quay.io"
+      },
+      "calico/goldmane": {
+        "version": "v3.30.7",
+        "registry": "quay.io"
+      },
+      "calico/whisker": {
+        "version": "v3.30.7",
+        "registry": "quay.io"
+      },
+      "calico/whisker-backend": {
+        "version": "v3.30.7",
+        "registry": "quay.io"
+      }
+    }
+  },
   {
     "title": "v3.30.6",
     "tigera-operator": {

calico_versioned_docs/version-3.30/variables.js

@@ -1,7 +1,7 @@
 const releases = require('./releases.json');
 
 const variables = {
-  releaseTitle: 'v3.30.6',
+  releaseTitle: 'v3.30.7',
   prodname: 'Calico',
   prodnamedash: 'calico',
   version: 'v3.30',
@@ -17,7 +17,7 @@ const variables = {
   noderunning: 'calico-node',
   rootDirWindows: 'C:\\CalicoWindows',
   ppa_repo_name: 'calico-3.30',
-  manifestsUrl: 'https://raw.githubusercontent.com/projectcalico/calico/v3.30.6',
+  manifestsUrl: 'https://raw.githubusercontent.com/projectcalico/calico/v3.30.7',
   releases,
   registry: '',
   vppbranch: 'v3.30.0',