kubernetes
/
kops
mirror of https://github.com/kubernetes/kops.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #14009 from hakman/calico-3.23.3 

Update Calico and Canal to v3.23.3
This commit is contained in:
Kubernetes Prow Robot 2022-07-25 09:26:35 -07:00 committed by GitHub
parent 79ef84cece b07e5a67e5
commit b13b36a671
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
8 changed files with 213 additions and 47 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
tests/integration/update_cluster/minimal-ipv6-calico/data/aws_s3_object_minimal-ipv6.example.com-addons-bootstrap_content
View File

@ -55,7 +55,7 @@ spec:
version: 9.99.0
- id: k8s-1.22
manifest: networking.projectcalico.org/k8s-1.22.yaml
manifestHash: 5bf23f352fc3520fd6737474625969d90eba2794fd5a748f75a71505eda06db3
manifestHash: 675db76bd70a5e50df0fda95941a8dbf46767487e719a3271894f24efb91aa59
name: networking.projectcalico.org
selector:
role.kubernetes.io/networking: "1"

40
tests/integration/update_cluster/minimal-ipv6-calico/data/aws_s3_object_minimal-ipv6.example.com-addons-networking.projectcalico.org-k8s-1.22_content
View File

@ -4475,7 +4475,7 @@ spec:
- configMapRef:
name: kubernetes-services-endpoint
optional: true
image: docker.io/calico/node:v3.23.2
image: docker.io/calico/node:v3.23.3
lifecycle:
preStop:
exec:
@ -4522,9 +4522,8 @@ spec:
readOnly: false
- mountPath: /var/run/nodeagent
name: policysync
- mountPath: /sys/fs/
mountPropagation: Bidirectional
name: sysfs
- mountPath: /sys/fs/bpf
name: bpffs
- mountPath: /var/log/calico/cni
name: cni-log-dir
readOnly: true
@ -4547,7 +4546,7 @@ spec:
- configMapRef:
name: kubernetes-services-endpoint
optional: true
image: docker.io/calico/cni:v3.23.2
image: docker.io/calico/cni:v3.23.3
name: upgrade-ipam
securityContext:
privileged: true
@ -4581,7 +4580,7 @@ spec:
- configMapRef:
name: kubernetes-services-endpoint
optional: true
image: docker.io/calico/cni:v3.23.2
image: docker.io/calico/cni:v3.23.3
name: install-cni
securityContext:
privileged: true
@ -4590,6 +4589,24 @@ spec:
name: cni-bin-dir
- mountPath: /host/etc/cni/net.d
name: cni-net-dir
- command:
- calico-node
- -init
- -best-effort
image: docker.io/calico/node:v3.23.3
name: mount-bpffs
securityContext:
privileged: true
volumeMounts:
- mountPath: /sys/fs
mountPropagation: Bidirectional
name: sys-fs
- mountPath: /var/run/calico
mountPropagation: Bidirectional
name: var-run-calico
- mountPath: /nodeproc
name: nodeproc
readOnly: true
- command:
- sh
- -c
@ -4625,7 +4642,14 @@ spec:
- hostPath:
path: /sys/fs/
type: DirectoryOrCreate
name: sysfs
name: sys-fs
- hostPath:
path: /sys/fs/bpf
type: Directory
name: bpffs
- hostPath:
path: /proc
name: nodeproc
- hostPath:
path: /opt/cni/bin
name: cni-bin-dir
@ -4695,7 +4719,7 @@ spec:
value: node
- name: DATASTORE_TYPE
value: kubernetes
image: docker.io/calico/kube-controllers:v3.23.2
image: docker.io/calico/kube-controllers:v3.23.3
livenessProbe:
exec:
command:

2
tests/integration/update_cluster/privatecalico/data/aws_s3_object_privatecalico.example.com-addons-bootstrap_content
View File

@ -55,7 +55,7 @@ spec:
version: 9.99.0
- id: k8s-1.22
manifest: networking.projectcalico.org/k8s-1.22.yaml
manifestHash: 9e337fe40420c5145cd25224a03c69838f945237096820cbe9abfaaa09c8b55a
manifestHash: c0608fb886a1ad8b3db3be4c901b048f1e8f4e99b40f30d7cdaaf645b6e396a7
name: networking.projectcalico.org
selector:
role.kubernetes.io/networking: "1"

40
tests/integration/update_cluster/privatecalico/data/aws_s3_object_privatecalico.example.com-addons-networking.projectcalico.org-k8s-1.22_content
View File

@ -4470,7 +4470,7 @@ spec:
- configMapRef:
name: kubernetes-services-endpoint
optional: true
image: docker.io/calico/node:v3.23.2
image: docker.io/calico/node:v3.23.3
lifecycle:
preStop:
exec:
@ -4519,9 +4519,8 @@ spec:
readOnly: false
- mountPath: /var/run/nodeagent
name: policysync
- mountPath: /sys/fs/
mountPropagation: Bidirectional
name: sysfs
- mountPath: /sys/fs/bpf
name: bpffs
- mountPath: /var/log/calico/cni
name: cni-log-dir
readOnly: true
@ -4544,7 +4543,7 @@ spec:
- configMapRef:
name: kubernetes-services-endpoint
optional: true
image: docker.io/calico/cni:v3.23.2
image: docker.io/calico/cni:v3.23.3
name: upgrade-ipam
securityContext:
privileged: true
@ -4578,7 +4577,7 @@ spec:
- configMapRef:
name: kubernetes-services-endpoint
optional: true
image: docker.io/calico/cni:v3.23.2
image: docker.io/calico/cni:v3.23.3
name: install-cni
securityContext:
privileged: true
@ -4587,6 +4586,24 @@ spec:
name: cni-bin-dir
- mountPath: /host/etc/cni/net.d
name: cni-net-dir
- command:
- calico-node
- -init
- -best-effort
image: docker.io/calico/node:v3.23.3
name: mount-bpffs
securityContext:
privileged: true
volumeMounts:
- mountPath: /sys/fs
mountPropagation: Bidirectional
name: sys-fs
- mountPath: /var/run/calico
mountPropagation: Bidirectional
name: var-run-calico
- mountPath: /nodeproc
name: nodeproc
readOnly: true
- command:
- sh
- -c
@ -4622,7 +4639,14 @@ spec:
- hostPath:
path: /sys/fs/
type: DirectoryOrCreate
name: sysfs
name: sys-fs
- hostPath:
path: /sys/fs/bpf
type: Directory
name: bpffs
- hostPath:
path: /proc
name: nodeproc
- hostPath:
path: /opt/cni/bin
name: cni-bin-dir
@ -4692,7 +4716,7 @@ spec:
value: node
- name: DATASTORE_TYPE
value: kubernetes
image: docker.io/calico/kube-controllers:v3.23.2
image: docker.io/calico/kube-controllers:v3.23.3
livenessProbe:
exec:
command:

2
tests/integration/update_cluster/privatecanal/data/aws_s3_object_privatecanal.example.com-addons-bootstrap_content
View File

@ -48,7 +48,7 @@ spec:
version: 9.99.0
- id: k8s-1.22
manifest: networking.projectcalico.org.canal/k8s-1.22.yaml
manifestHash: 29ccdd676c3e714cff126169a51cdc21bf058b59346650d9e32cfd643462529d
manifestHash: bf117f1f4bf614fb8dbebdfa23efea7da57a05c380902a809d44de3c26f53cd7
name: networking.projectcalico.org.canal
selector:
role.kubernetes.io/networking: "1"

54
tests/integration/update_cluster/privatecanal/data/aws_s3_object_privatecanal.example.com-addons-networking.projectcalico.org.canal-k8s-1.22_content
View File

@ -4197,6 +4197,14 @@ metadata:
role.kubernetes.io/networking: "1"
name: calico
rules:
- apiGroups:
- ""
resourceNames:
- canal
resources:
- serviceaccounts/token
verbs:
- create
- apiGroups:
- ""
resources:
@ -4419,6 +4427,10 @@ spec:
valueFrom:
fieldRef:
fieldPath: spec.nodeName
- name: CALICO_CNI_SERVICE_ACCOUNT
valueFrom:
fieldRef:
fieldPath: spec.serviceAccountName
- name: CALICO_NETWORKING_BACKEND
value: none
- name: CLUSTER_TYPE
@ -4458,7 +4470,7 @@ spec:
- configMapRef:
name: kubernetes-services-endpoint
optional: true
image: docker.io/calico/node:v3.23.1
image: docker.io/calico/node:v3.23.3
lifecycle:
preStop:
exec:
@ -4505,9 +4517,8 @@ spec:
readOnly: false
- mountPath: /var/run/nodeagent
name: policysync
- mountPath: /sys/fs/
mountPropagation: Bidirectional
name: sysfs
- mountPath: /sys/fs/bpf
name: bpffs
- mountPath: /var/log/calico/cni
name: cni-log-dir
readOnly: true
@ -4549,6 +4560,10 @@ spec:
- command:
- /opt/cni/bin/install
env:
- name: CALICO_CNI_SERVICE_ACCOUNT
valueFrom:
fieldRef:
fieldPath: spec.serviceAccountName
- name: CNI_CONF_NAME
value: 10-canal.conflist
- name: CNI_NETWORK_CONFIG
@ -4571,7 +4586,7 @@ spec:
- configMapRef:
name: kubernetes-services-endpoint
optional: true
image: docker.io/calico/cni:v3.23.1
image: docker.io/calico/cni:v3.23.3
name: install-cni
securityContext:
privileged: true
@ -4580,6 +4595,24 @@ spec:
name: cni-bin-dir
- mountPath: /host/etc/cni/net.d
name: cni-net-dir
- command:
- calico-node
- -init
- -best-effort
image: docker.io/calico/node:v3.23.3
name: mount-bpffs
securityContext:
privileged: true
volumeMounts:
- mountPath: /sys/fs
mountPropagation: Bidirectional
name: sys-fs
- mountPath: /var/run/calico
mountPropagation: Bidirectional
name: var-run-calico
- mountPath: /nodeproc
name: nodeproc
readOnly: true
nodeSelector:
kubernetes.io/os: linux
priorityClassName: system-node-critical
@ -4609,7 +4642,14 @@ spec:
- hostPath:
path: /sys/fs/
type: DirectoryOrCreate
name: sysfs
name: sys-fs
- hostPath:
path: /sys/fs/bpf
type: Directory
name: bpffs
- hostPath:
path: /proc
name: nodeproc
- configMap:
name: canal-config
name: flannel-cfg
@ -4697,7 +4737,7 @@ spec:
value: node
- name: DATASTORE_TYPE
value: kubernetes
image: docker.io/calico/kube-controllers:v3.23.1
image: docker.io/calico/kube-controllers:v3.23.3
livenessProbe:
exec:
command:

69
upup/models/cloudup/resources/addons/networking.projectcalico.org.canal/k8s-1.22.yaml.template
View File

@ -4113,6 +4113,14 @@ apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: calico
rules:
# Used for creating service account tokens to be used by the CNI plugin
- apiGroups: [""]
resources:
- serviceaccounts/token
resourceNames:
- canal
verbs:
- create
# The CNI plugin needs to get pods, nodes, and namespaces.
- apiGroups: [""]
resources:
@ -4358,7 +4366,7 @@ spec:
securityContext:
fsGroup: 65534
containers:
- image: calico/typha:v3.23.1
- image: calico/typha:v3.23.3
name: calico-typha
ports:
- containerPort: 5473
@ -4468,7 +4476,7 @@ spec:
# This container installs the CNI binaries
# and CNI network config file on each node.
- name: install-cni
image: docker.io/calico/cni:v3.23.1
image: docker.io/calico/cni:v3.23.3
command: ["/opt/cni/bin/install"]
envFrom:
- configMapRef:
@ -4476,6 +4484,12 @@ spec:
name: kubernetes-services-endpoint
optional: true
env:
# Set the serviceaccount name to use for the Calico CNI plugin.
# We use canal-node instead of calico-node when using flannel networking.
- name: CALICO_CNI_SERVICE_ACCOUNT
valueFrom:
fieldRef:
fieldPath: spec.serviceAccountName
# Name of the CNI config file to create.
- name: CNI_CONF_NAME
value: "10-canal.conflist"
@ -4506,12 +4520,36 @@ spec:
name: cni-net-dir
securityContext:
privileged: true
# This init container mounts the necessary filesystems needed by the BPF data plane
# i.e. bpf at /sys/fs/bpf and cgroup2 at /run/calico/cgroup. Calico-node initialisation is executed
# in best effort fashion, i.e. no failure for errors, to not disrupt pod creation in iptable mode.
- name: "mount-bpffs"
image: docker.io/calico/node:v3.23.3
command: ["calico-node", "-init", "-best-effort"]
volumeMounts:
- mountPath: /sys/fs
name: sys-fs
# Bidirectional is required to ensure that the new mount we make at /sys/fs/bpf propagates to the host
# so that it outlives the init container.
mountPropagation: Bidirectional
- mountPath: /var/run/calico
name: var-run-calico
# Bidirectional is required to ensure that the new mount we make at /run/calico/cgroup propagates to the host
# so that it outlives the init container.
mountPropagation: Bidirectional
# Mount /proc/ from host which usually is an init program at /nodeproc. It's needed by mountns binary,
# executed by calico-node, to mount root cgroup2 fs at /run/calico/cgroup to attach CTLB programs correctly.
- mountPath: /nodeproc
name: nodeproc
readOnly: true
securityContext:
privileged: true
containers:
# Runs canal container on each Kubernetes node. This
# container programs network policy and routes on each
# host.
- name: calico-node
image: docker.io/calico/node:v3.23.1
image: docker.io/calico/node:v3.23.3
envFrom:
- configMapRef:
# Allow KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT to be overridden for eBPF mode.
@ -4540,6 +4578,12 @@ spec:
valueFrom:
fieldRef:
fieldPath: spec.nodeName
# Set the serviceaccount name to use for the Calico CNI plugin.
# We use canal-node instead of calico-node when using flannel networking.
- name: CALICO_CNI_SERVICE_ACCOUNT
valueFrom:
fieldRef:
fieldPath: spec.serviceAccountName
# Don't enable BGP.
- name: CALICO_NETWORKING_BACKEND
value: "none"
@ -4645,11 +4689,8 @@ spec:
mountPath: /var/run/nodeagent
# For eBPF mode, we need to be able to mount the BPF filesystem at /sys/fs/bpf so we mount in the
# parent directory.
- name: sysfs
mountPath: /sys/fs/
# Bidirectional means that, if we mount the BPF filesystem at /sys/fs/bpf it will propagate to the host.
# If the host is known to mount that filesystem already then Bidirectional can be omitted.
mountPropagation: Bidirectional
- name: bpffs
mountPath: /sys/fs/bpf
- name: cni-log-dir
mountPath: /var/log/calico/cni
readOnly: true
@ -4704,10 +4745,18 @@ spec:
hostPath:
path: /run/xtables.lock
type: FileOrCreate
- name: sysfs
- name: sys-fs
hostPath:
path: /sys/fs/
type: DirectoryOrCreate
- name: bpffs
hostPath:
path: /sys/fs/bpf
type: Directory
# mount /proc at /nodeproc to be used by mount-bpffs initContainer to mount root cgroup2 fs.
- name: nodeproc
hostPath:
path: /proc
# Used by flannel.
- name: flannel-cfg
configMap:
@ -4791,7 +4840,7 @@ spec:
priorityClassName: system-cluster-critical
containers:
- name: calico-kube-controllers
image: docker.io/calico/kube-controllers:v3.23.1
image: docker.io/calico/kube-controllers:v3.23.3
env:
# Choose which controllers to run.
- name: ENABLED_CONTROLLERS

51
upup/models/cloudup/resources/addons/networking.projectcalico.org/k8s-1.22.yaml.template
View File

@ -4367,7 +4367,7 @@ spec:
securityContext:
fsGroup: 65534
containers:
- image: {{ or .Networking.Calico.Registry "docker.io" }}/calico/typha:{{ or .Networking.Calico.Version "v3.23.2" }}
- image: {{ or .Networking.Calico.Registry "docker.io" }}/calico/typha:{{ or .Networking.Calico.Version "v3.23.3" }}
name: calico-typha
ports:
- containerPort: 5473
@ -4488,7 +4488,7 @@ spec:
# It can be deleted if this is a fresh installation, or if you have already
# upgraded to use calico-ipam.
- name: upgrade-ipam
image: {{ or .Networking.Calico.Registry "docker.io" }}/calico/cni:{{ or .Networking.Calico.Version "v3.23.2" }}
image: {{ or .Networking.Calico.Registry "docker.io" }}/calico/cni:{{ or .Networking.Calico.Version "v3.23.3" }}
command: ["/opt/cni/bin/calico-ipam", "-upgrade"]
envFrom:
- configMapRef:
@ -4515,7 +4515,7 @@ spec:
# This container installs the CNI binaries
# and CNI network config file on each node.
- name: install-cni
image: {{ or .Networking.Calico.Registry "docker.io" }}/calico/cni:{{ or .Networking.Calico.Version "v3.23.2" }}
image: {{ or .Networking.Calico.Registry "docker.io" }}/calico/cni:{{ or .Networking.Calico.Version "v3.23.3" }}
command: ["/opt/cni/bin/install"]
envFrom:
- configMapRef:
@ -4553,6 +4553,30 @@ spec:
name: cni-net-dir
securityContext:
privileged: true
# This init container mounts the necessary filesystems needed by the BPF data plane
# i.e. bpf at /sys/fs/bpf and cgroup2 at /run/calico/cgroup. Calico-node initialisation is executed
# in best effort fashion, i.e. no failure for errors, to not disrupt pod creation in iptable mode.
- name: "mount-bpffs"
image: {{ or .Networking.Calico.Registry "docker.io" }}/calico/node:{{ or .Networking.Calico.Version "v3.23.3" }}
command: ["calico-node", "-init", "-best-effort"]
volumeMounts:
- mountPath: /sys/fs
name: sys-fs
# Bidirectional is required to ensure that the new mount we make at /sys/fs/bpf propagates to the host
# so that it outlives the init container.
mountPropagation: Bidirectional
- mountPath: /var/run/calico
name: var-run-calico
# Bidirectional is required to ensure that the new mount we make at /run/calico/cgroup propagates to the host
# so that it outlives the init container.
mountPropagation: Bidirectional
# Mount /proc/ from host which usually is an init program at /nodeproc. It's needed by mountns binary,
# executed by calico-node, to mount root cgroup2 fs at /run/calico/cgroup to attach CTLB programs correctly.
- mountPath: /nodeproc
name: nodeproc
readOnly: true
securityContext:
privileged: true
- name: flexvol-driver
image: busybox
command: ['sh', '-c', 'echo Temporary fix to avoid server side apply issues']
@ -4561,7 +4585,7 @@ spec:
# container programs network policy and routes on each
# host.
- name: calico-node
image: {{ or .Networking.Calico.Registry "docker.io" }}/calico/node:{{ or .Networking.Calico.Version "v3.23.2" }}
image: {{ or .Networking.Calico.Registry "docker.io" }}/calico/node:{{ or .Networking.Calico.Version "v3.23.3" }}
envFrom:
- configMapRef:
# Allow KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT to be overridden for eBPF mode.
@ -4778,11 +4802,8 @@ spec:
mountPath: /var/run/nodeagent
# For eBPF mode, we need to be able to mount the BPF filesystem at /sys/fs/bpf so we mount in the
# parent directory.
- name: sysfs
mountPath: /sys/fs/
# Bidirectional means that, if we mount the BPF filesystem at /sys/fs/bpf it will propagate to the host.
# If the host is known to mount that filesystem already then Bidirectional can be omitted.
mountPropagation: Bidirectional
- name: bpffs
mountPath: /sys/fs/bpf
- name: cni-log-dir
mountPath: /var/log/calico/cni
readOnly: true
@ -4801,10 +4822,18 @@ spec:
hostPath:
path: /run/xtables.lock
type: FileOrCreate
- name: sysfs
- name: sys-fs
hostPath:
path: /sys/fs/
type: DirectoryOrCreate
- name: bpffs
hostPath:
path: /sys/fs/bpf
type: Directory
# mount /proc at /nodeproc to be used by mount-bpffs initContainer to mount root cgroup2 fs.
- name: nodeproc
hostPath:
path: /proc
# Used to install CNI.
- name: cni-bin-dir
hostPath:
@ -4874,7 +4903,7 @@ spec:
priorityClassName: system-cluster-critical
containers:
- name: calico-kube-controllers
image: {{ or .Networking.Calico.Registry "docker.io" }}/calico/kube-controllers:{{ or .Networking.Calico.Version "v3.23.2" }}
image: {{ or .Networking.Calico.Registry "docker.io" }}/calico/kube-controllers:{{ or .Networking.Calico.Version "v3.23.3" }}
env:
# Choose which controllers to run.
- name: ENABLED_CONTROLLERS