Add more support for cilium 1.10

pkg/apis/kops/validation/validation.go

@@ -789,6 +789,10 @@ func validateNetworkingCilium(cluster *kops.Cluster, v *kops.CiliumNetworkingSpe
 			allErrs = append(allErrs, field.Forbidden(versionFld, "Version 1.7 requires kubernetesVersion before 1.17"))
 		}
 
+		if version.Minor == 10 && cluster.IsKubernetesLT("1.16") {
+			allErrs = append(allErrs, field.Forbidden(versionFld, "Version 1.10 requires kubernetesVersion 1.16 or newer"))
+		}
+
 		if v.Hubble != nil && fi.BoolValue(v.Hubble.Enabled) {
 			if !components.IsCertManagerEnabled(cluster) {
 				allErrs = append(allErrs, field.Forbidden(fldPath.Child("hubble", "enabled"), "Hubble requires that cert manager is enabled"))

pkg/model/components/cilium.go

@@ -65,10 +65,6 @@ func (b *CiliumOptionsBuilder) BuildOptions(o interface{}) error {
 		c.SidecarIstioProxyImage = "cilium/istio_proxy"
 	}
 
-	if c.Tunnel == "" {
-		c.Tunnel = "vxlan"
-	}
-
 	if c.ToFqdnsDNSRejectResponseCode == "" {
 		c.ToFqdnsDNSRejectResponseCode = "refused"
 	}
@@ -89,6 +85,14 @@ func (b *CiliumOptionsBuilder) BuildOptions(o interface{}) error {
 		}
 	}
 
+	if c.Tunnel == "" {
+		if c.Ipam == "eni" {
+			c.Tunnel = "disabled"
+		} else {
+			c.Tunnel = "vxlan"
+		}
+	}
+
 	if c.EnableRemoteNodeIdentity == nil {
 		c.EnableRemoteNodeIdentity = fi.Bool(true)
 	}

upup/models/BUILD.bazel

@@ -32,7 +32,6 @@ go_library(
         "cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.12.yaml.template",
         "cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.16.yaml.template",
         "cloudup/resources/addons/networking.cilium.io/k8s-1.12-v1.8.yaml.template",
-        "cloudup/resources/addons/networking.cilium.io/k8s-1.12-v1.9.yaml.template",
         "cloudup/resources/addons/networking.cilium.io/k8s-1.12.yaml.template",
         "cloudup/resources/addons/networking.flannel/k8s-1.12.yaml.template",
         "cloudup/resources/addons/networking.kope.io/k8s-1.12.yaml",
@@ -55,6 +54,8 @@ go_library(
         "cloudup/resources/addons/storage-aws.addons.k8s.io/v1.7.0.yaml.template",
         "cloudup/resources/addons/storage-gce.addons.k8s.io/v1.7.0.yaml.template",
         "cloudup/resources/addons/storage-openstack.addons.k8s.io/k8s-1.16.yaml.template",
+        "cloudup/resources/addons/networking.cilium.io/k8s-1.16-v1.10.yaml.template",
+        "cloudup/resources/addons/networking.cilium.io/k8s-1.12-v1.9.yaml.template",
     ],
     importpath = "k8s.io/kops/upup/models",
     visibility = ["//visibility:public"],

upup/pkg/fi/cloudup/bootstrapchannelbuilder/cilium.go

@@ -64,12 +64,31 @@ func addCiliumAddon(b *BootstrapChannelBuilder, addons *api.Addons) error {
 					NeedsRollingUpdate: "all",
 				})
 			}
-		} else if ver.Minor == 9 || ver.Minor == 10 {
+		} else if ver.Minor == 9 {
 			version := "1.9.4-kops.1"
 			{
 				id := "k8s-1.12"
 				location := key + "/" + id + "-v1.9.yaml"
 
+				addon := &api.AddonSpec{
+					Name:               fi.String(key),
+					Version:            fi.String(version),
+					Selector:           networkingSelector(),
+					Manifest:           fi.String(location),
+					Id:                 id,
+					NeedsRollingUpdate: "all",
+				}
+				if cilium.Hubble != nil && fi.BoolValue(cilium.Hubble.Enabled) {
+					addon.NeedsPKI = true
+				}
+				addons.Spec.Addons = append(addons.Spec.Addons, addon)
+			}
+		} else if ver.Minor == 10 {
+			version := "1.10.0-kops.1"
+			{
+				id := "k8s-1.16"
+				location := key + "/" + id + "-v1.10.yaml"
+
 				addon := &api.AddonSpec{
 					Name:               fi.String(key),
 					Version:            fi.String(version),