Update calico to v3.23.3 (#3385)

Author: ktsakalozos-canonical

docs/build.md

@@ -90,11 +90,12 @@ snap install microk8s_*_amd64.snap --classic --dangerous
 
 The calico CNI manifest can be found under `upgrade-scripts/000-switch-to-calico/resources/calico.yaml`.
 Building the manifest is subject to the upstream calico project k8s installation process.
-At the time of the v3.23.4 release. The `calico.yaml` manifest is a slightly modified version of:
-`https://projectcalico.docs.tigera.io/archive/v3.21/manifests/calico.yaml`:
+The `calico.yaml` manifest is a slightly modified version of:
+`https://projectcalico.docs.tigera.io/archive/v3.23/manifests/calico.yaml`:
 
+- Set the calico backend from "bird" to "vxlan": `calico_backend: "vxlan"`
 - `CALICO_IPV4POOL_CIDR` was set to "10.1.0.0/16"
-- `CNI_NET_DIR` was set to "/var/snap/microk8s/current/args/cni-network"
+- `CNI_NET_DIR` had to be added and set to "/var/snap/microk8s/current/args/cni-network"
 - We set the following mount paths:
   1. `var-run-calico` to `/var/snap/microk8s/current/var/run/calico`
   1. `var-lib-calico` to `/var/snap/microk8s/current/var/lib/calico`
@@ -104,7 +105,6 @@ At the time of the v3.23.4 release. The `calico.yaml` manifest is a slightly mod
   1. `host-local-net-dir` to `/var/snap/microk8s/current/var/lib/cni/networks`
   1. `policysync` to `/var/snap/microk8s/current/var/run/nodeagent`
 - We enabled vxlan following the instructions in [the official docs.](https://docs.projectcalico.org/getting-started/kubernetes/installation/config-options#switching-from-ip-in-ip-to-vxlan)
-- `FELIX_LOGSEVERITYSCREEN` was set to "error"
 - The `liveness` and `readiness` probes of `bird-live` was commented out 
 - We set the IP autodetection method to
 
@@ -116,7 +116,7 @@ At the time of the v3.23.4 release. The `calico.yaml` manifest is a slightly mod
   ```dtd
           "nodename_file_optional": true,
   ```
-- The sys `mountpath` is commented out. This disables eBPF support but allows the CNI to deploy inside an LXC container. 
+- The `mount-bpffs` pod is commented out. This disables eBPF support but allows the CNI to deploy inside an LXC container. 
 
 ## Running the tests locally
 

scripts/calico/upgrade.py

@@ -142,17 +142,17 @@ def try_upgrade(cni_file, new_cni_file):
     """
 
     # If cni files are not in place do nothing
-    if not (os.path.exists(cni_file) and os.path.exists(cni_file)):
+    if not (os.path.exists(cni_file) and os.path.exists(new_cni_file)):
         return False
 
     # If the current cni.yaml is not calico do nothing
     if not is_calico_cni_manifest(cni_file):
         return False
 
-    # If the current cni.yaml is not from 3.19 do nothing
+    # If the current cni.yaml is not from 3.21 do nothing
     # s390x will be filtered out because it is in 3.15
     current_version = get_installed_version_of_calico(cni_file)
-    if "3.19" not in current_version:
+    if "3.21" not in current_version:
         return False
 
     backup_old_cni(cni_file)

tests/unit/test_upgrade_calico_cni.py

@@ -35,7 +35,7 @@ def test_get_version(self):
         Test extracting the Calico version
         """
         res = get_installed_version_of_calico(self._calico_new_yaml)
-        assert res == "v3.21.4"
+        assert res == "v3.23.4"
 
     def test_get_autodetect_method(self):
         """
@@ -54,11 +54,11 @@ def test_patch(self):
         res = get_calicos_autodetection_method(self._calico_new_yaml)
         assert res == "first-found"
         res = get_installed_version_of_calico(self._calico_old_copy_yaml)
-        assert res == "v3.19.1"
+        assert res == "v3.21.1"
         res = try_upgrade(self._calico_old_copy_yaml, self._calico_new_yaml)
         assert os.path.exists(self._calico_old_copy_backup_yaml)
         res = get_installed_version_of_calico(self._calico_old_copy_yaml)
-        assert res == "v3.21.4"
+        assert res == "v3.23.4"
         os.remove(self._calico_old_copy_yaml)
         os.remove(self._calico_old_copy_backup_yaml)
 

tests/unit/yamls/calico-new.yaml

@@ -4084,7 +4084,7 @@ spec:
         # It can be deleted if this is a fresh installation, or if you have already
         # upgraded to use calico-ipam.
         - name: upgrade-ipam
-          image: docker.io/calico/cni:v3.21.4
+          image: docker.io/calico/cni:v3.23.4
           command: ["/opt/cni/bin/calico-ipam", "-upgrade"]
           envFrom:
           - configMapRef:
@@ -4111,7 +4111,7 @@ spec:
         # This container installs the CNI binaries
         # and CNI network config file on each node.
         - name: install-cni
-          image: docker.io/calico/cni:v3.21.4
+          image: docker.io/calico/cni:v3.23.4
           command: ["/opt/cni/bin/install"]
           envFrom:
           - configMapRef:
@@ -4154,7 +4154,7 @@ spec:
         # Adds a Flex Volume Driver that creates a per-pod Unix Domain Socket to allow Dikastes
         # to communicate with Felix over the Policy Sync API.
         - name: flexvol-driver
-          image: docker.io/calico/pod2daemon-flexvol:v3.21.4
+          image: docker.io/calico/pod2daemon-flexvol:v3.23.4
           volumeMounts:
           - name: flexvol-driver-host
             mountPath: /host/driver
@@ -4165,7 +4165,7 @@ spec:
         # container programs network policy and routes on each
         # host.
         - name: calico-node
-          image: docker.io/calico/node:v3.21.4
+          image: docker.io/calico/node:v3.23.4
           envFrom:
           - configMapRef:
               # Allow KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT to be overridden for eBPF mode.
@@ -4389,7 +4389,7 @@ spec:
       priorityClassName: system-cluster-critical
       containers:
         - name: calico-kube-controllers
-          image: docker.io/calico/kube-controllers:v3.21.4
+          image: docker.io/calico/kube-controllers:v3.23.4
           env:
             # Choose which controllers to run.
             - name: ENABLED_CONTROLLERS

tests/unit/yamls/cni.yaml

@@ -3827,7 +3827,7 @@ spec:
         # It can be deleted if this is a fresh installation, or if you have already
         # upgraded to use calico-ipam.
         - name: upgrade-ipam
-          image: docker.io/calico/cni:v3.19.1
+          image: docker.io/calico/cni:v3.21.1
           command: ["/opt/cni/bin/calico-ipam", "-upgrade"]
           envFrom:
             - configMapRef:
@@ -3854,7 +3854,7 @@ spec:
         # This container installs the CNI binaries
         # and CNI network config file on each node.
         - name: install-cni
-          image: docker.io/calico/cni:v3.19.1
+          image: docker.io/calico/cni:v3.21.1
           command: ["/opt/cni/bin/install"]
           envFrom:
             - configMapRef:
@@ -3897,7 +3897,7 @@ spec:
         # Adds a Flex Volume Driver that creates a per-pod Unix Domain Socket to allow Dikastes
         # to communicate with Felix over the Policy Sync API.
         - name: flexvol-driver
-          image: docker.io/calico/pod2daemon-flexvol:v3.19.1
+          image: docker.io/calico/pod2daemon-flexvol:v3.21.1
           volumeMounts:
             - name: flexvol-driver-host
               mountPath: /host/driver
@@ -3908,7 +3908,7 @@ spec:
         # container programs network policy and routes on each
         # host.
         - name: calico-node
-          image: docker.io/calico/node:v3.19.1
+          image: docker.io/calico/node:v3.21.1
           envFrom:
             - configMapRef:
                 # Allow KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT to be overridden for eBPF mode.