Run hack/update-expected.sh

tests/integration/update_cluster/minimal-ipv6-calico/data/aws_s3_object_minimal-ipv6.example.com-addons-bootstrap_content

@@ -55,7 +55,7 @@ spec:
     version: 9.99.0
   - id: k8s-1.22
     manifest: networking.projectcalico.org/k8s-1.22.yaml
-    manifestHash: 5bf23f352fc3520fd6737474625969d90eba2794fd5a748f75a71505eda06db3
+    manifestHash: 675db76bd70a5e50df0fda95941a8dbf46767487e719a3271894f24efb91aa59
     name: networking.projectcalico.org
     selector:
       role.kubernetes.io/networking: "1"

tests/integration/update_cluster/minimal-ipv6-calico/data/aws_s3_object_minimal-ipv6.example.com-addons-networking.projectcalico.org-k8s-1.22_content

@@ -4475,7 +4475,7 @@ spec:
         - configMapRef:
             name: kubernetes-services-endpoint
             optional: true
-        image: docker.io/calico/node:v3.23.2
+        image: docker.io/calico/node:v3.23.3
         lifecycle:
           preStop:
             exec:
@@ -4522,9 +4522,8 @@ spec:
           readOnly: false
         - mountPath: /var/run/nodeagent
           name: policysync
-        - mountPath: /sys/fs/
-          mountPropagation: Bidirectional
-          name: sysfs
+        - mountPath: /sys/fs/bpf
+          name: bpffs
         - mountPath: /var/log/calico/cni
           name: cni-log-dir
           readOnly: true
@@ -4547,7 +4546,7 @@ spec:
         - configMapRef:
             name: kubernetes-services-endpoint
             optional: true
-        image: docker.io/calico/cni:v3.23.2
+        image: docker.io/calico/cni:v3.23.3
         name: upgrade-ipam
         securityContext:
           privileged: true
@@ -4581,7 +4580,7 @@ spec:
         - configMapRef:
             name: kubernetes-services-endpoint
             optional: true
-        image: docker.io/calico/cni:v3.23.2
+        image: docker.io/calico/cni:v3.23.3
         name: install-cni
         securityContext:
           privileged: true
@@ -4590,6 +4589,24 @@ spec:
           name: cni-bin-dir
         - mountPath: /host/etc/cni/net.d
           name: cni-net-dir
+      - command:
+        - calico-node
+        - -init
+        - -best-effort
+        image: docker.io/calico/node:v3.23.3
+        name: mount-bpffs
+        securityContext:
+          privileged: true
+        volumeMounts:
+        - mountPath: /sys/fs
+          mountPropagation: Bidirectional
+          name: sys-fs
+        - mountPath: /var/run/calico
+          mountPropagation: Bidirectional
+          name: var-run-calico
+        - mountPath: /nodeproc
+          name: nodeproc
+          readOnly: true
       - command:
         - sh
         - -c
@@ -4625,7 +4642,14 @@ spec:
       - hostPath:
           path: /sys/fs/
           type: DirectoryOrCreate
-        name: sysfs
+        name: sys-fs
+      - hostPath:
+          path: /sys/fs/bpf
+          type: Directory
+        name: bpffs
+      - hostPath:
+          path: /proc
+        name: nodeproc
       - hostPath:
           path: /opt/cni/bin
         name: cni-bin-dir
@@ -4695,7 +4719,7 @@ spec:
           value: node
         - name: DATASTORE_TYPE
           value: kubernetes
-        image: docker.io/calico/kube-controllers:v3.23.2
+        image: docker.io/calico/kube-controllers:v3.23.3
         livenessProbe:
           exec:
             command:

tests/integration/update_cluster/privatecalico/data/aws_s3_object_privatecalico.example.com-addons-bootstrap_content

@@ -55,7 +55,7 @@ spec:
     version: 9.99.0
   - id: k8s-1.22
     manifest: networking.projectcalico.org/k8s-1.22.yaml
-    manifestHash: 9e337fe40420c5145cd25224a03c69838f945237096820cbe9abfaaa09c8b55a
+    manifestHash: c0608fb886a1ad8b3db3be4c901b048f1e8f4e99b40f30d7cdaaf645b6e396a7
     name: networking.projectcalico.org
     selector:
       role.kubernetes.io/networking: "1"

tests/integration/update_cluster/privatecalico/data/aws_s3_object_privatecalico.example.com-addons-networking.projectcalico.org-k8s-1.22_content

@@ -4470,7 +4470,7 @@ spec:
         - configMapRef:
             name: kubernetes-services-endpoint
             optional: true
-        image: docker.io/calico/node:v3.23.2
+        image: docker.io/calico/node:v3.23.3
         lifecycle:
           preStop:
             exec:
@@ -4519,9 +4519,8 @@ spec:
           readOnly: false
         - mountPath: /var/run/nodeagent
           name: policysync
-        - mountPath: /sys/fs/
-          mountPropagation: Bidirectional
-          name: sysfs
+        - mountPath: /sys/fs/bpf
+          name: bpffs
         - mountPath: /var/log/calico/cni
           name: cni-log-dir
           readOnly: true
@@ -4544,7 +4543,7 @@ spec:
         - configMapRef:
             name: kubernetes-services-endpoint
             optional: true
-        image: docker.io/calico/cni:v3.23.2
+        image: docker.io/calico/cni:v3.23.3
         name: upgrade-ipam
         securityContext:
           privileged: true
@@ -4578,7 +4577,7 @@ spec:
         - configMapRef:
             name: kubernetes-services-endpoint
             optional: true
-        image: docker.io/calico/cni:v3.23.2
+        image: docker.io/calico/cni:v3.23.3
         name: install-cni
         securityContext:
           privileged: true
@@ -4587,6 +4586,24 @@ spec:
           name: cni-bin-dir
         - mountPath: /host/etc/cni/net.d
           name: cni-net-dir
+      - command:
+        - calico-node
+        - -init
+        - -best-effort
+        image: docker.io/calico/node:v3.23.3
+        name: mount-bpffs
+        securityContext:
+          privileged: true
+        volumeMounts:
+        - mountPath: /sys/fs
+          mountPropagation: Bidirectional
+          name: sys-fs
+        - mountPath: /var/run/calico
+          mountPropagation: Bidirectional
+          name: var-run-calico
+        - mountPath: /nodeproc
+          name: nodeproc
+          readOnly: true
       - command:
         - sh
         - -c
@@ -4622,7 +4639,14 @@ spec:
       - hostPath:
           path: /sys/fs/
           type: DirectoryOrCreate
-        name: sysfs
+        name: sys-fs
+      - hostPath:
+          path: /sys/fs/bpf
+          type: Directory
+        name: bpffs
+      - hostPath:
+          path: /proc
+        name: nodeproc
       - hostPath:
           path: /opt/cni/bin
         name: cni-bin-dir
@@ -4692,7 +4716,7 @@ spec:
           value: node
         - name: DATASTORE_TYPE
           value: kubernetes
-        image: docker.io/calico/kube-controllers:v3.23.2
+        image: docker.io/calico/kube-controllers:v3.23.3
         livenessProbe:
           exec:
             command:

tests/integration/update_cluster/privatecanal/data/aws_s3_object_privatecanal.example.com-addons-bootstrap_content

@@ -48,7 +48,7 @@ spec:
     version: 9.99.0
   - id: k8s-1.22
     manifest: networking.projectcalico.org.canal/k8s-1.22.yaml
-    manifestHash: 29ccdd676c3e714cff126169a51cdc21bf058b59346650d9e32cfd643462529d
+    manifestHash: bf117f1f4bf614fb8dbebdfa23efea7da57a05c380902a809d44de3c26f53cd7
     name: networking.projectcalico.org.canal
     selector:
       role.kubernetes.io/networking: "1"

tests/integration/update_cluster/privatecanal/data/aws_s3_object_privatecanal.example.com-addons-networking.projectcalico.org.canal-k8s-1.22_content

@@ -4197,6 +4197,14 @@ metadata:
     role.kubernetes.io/networking: "1"
   name: calico
 rules:
+- apiGroups:
+  - ""
+  resourceNames:
+  - canal
+  resources:
+  - serviceaccounts/token
+  verbs:
+  - create
 - apiGroups:
   - ""
   resources:
@@ -4419,6 +4427,10 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: CALICO_CNI_SERVICE_ACCOUNT
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.serviceAccountName
         - name: CALICO_NETWORKING_BACKEND
           value: none
         - name: CLUSTER_TYPE
@@ -4458,7 +4470,7 @@ spec:
         - configMapRef:
             name: kubernetes-services-endpoint
             optional: true
-        image: docker.io/calico/node:v3.23.1
+        image: docker.io/calico/node:v3.23.3
         lifecycle:
           preStop:
             exec:
@@ -4505,9 +4517,8 @@ spec:
           readOnly: false
         - mountPath: /var/run/nodeagent
           name: policysync
-        - mountPath: /sys/fs/
-          mountPropagation: Bidirectional
-          name: sysfs
+        - mountPath: /sys/fs/bpf
+          name: bpffs
         - mountPath: /var/log/calico/cni
           name: cni-log-dir
           readOnly: true
@@ -4549,6 +4560,10 @@ spec:
       - command:
         - /opt/cni/bin/install
         env:
+        - name: CALICO_CNI_SERVICE_ACCOUNT
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.serviceAccountName
         - name: CNI_CONF_NAME
           value: 10-canal.conflist
         - name: CNI_NETWORK_CONFIG
@@ -4571,7 +4586,7 @@ spec:
         - configMapRef:
             name: kubernetes-services-endpoint
             optional: true
-        image: docker.io/calico/cni:v3.23.1
+        image: docker.io/calico/cni:v3.23.3
         name: install-cni
         securityContext:
           privileged: true
@@ -4580,6 +4595,24 @@ spec:
           name: cni-bin-dir
         - mountPath: /host/etc/cni/net.d
           name: cni-net-dir
+      - command:
+        - calico-node
+        - -init
+        - -best-effort
+        image: docker.io/calico/node:v3.23.3
+        name: mount-bpffs
+        securityContext:
+          privileged: true
+        volumeMounts:
+        - mountPath: /sys/fs
+          mountPropagation: Bidirectional
+          name: sys-fs
+        - mountPath: /var/run/calico
+          mountPropagation: Bidirectional
+          name: var-run-calico
+        - mountPath: /nodeproc
+          name: nodeproc
+          readOnly: true
       nodeSelector:
         kubernetes.io/os: linux
       priorityClassName: system-node-critical
@@ -4609,7 +4642,14 @@ spec:
       - hostPath:
           path: /sys/fs/
           type: DirectoryOrCreate
-        name: sysfs
+        name: sys-fs
+      - hostPath:
+          path: /sys/fs/bpf
+          type: Directory
+        name: bpffs
+      - hostPath:
+          path: /proc
+        name: nodeproc
       - configMap:
           name: canal-config
         name: flannel-cfg
@@ -4697,7 +4737,7 @@ spec:
           value: node
         - name: DATASTORE_TYPE
           value: kubernetes
-        image: docker.io/calico/kube-controllers:v3.23.1
+        image: docker.io/calico/kube-controllers:v3.23.3
         livenessProbe:
           exec:
             command: