Update Calico operator to 1.21, updates CRDs, and roles #1578

haouc · 2021-08-18T17:55:37Z

What type of PR is this?
This PR is for updating the calico operator to v1.21.

update operator image tag to 1.21
update CRDs accordingly
update cluster roles

Which issue does this PR fix:
In order to avoid the known issue in earlier versions of Calico, we need update Calico to latest version to unblock users.

What does this PR do / Why do we need it:
The known issue blocks users.

If an issue # is not available please add repro steps and logs from IPAMD/CNI showing the issue:

Testing done on this change:

The manifests were templated by helm from charts/aws-calico. The manifests were applied to EKS 1.20 cluster and

NAMESPACE         NAME                                       READY   STATUS    RESTARTS   AGE
calico-system     calico-kube-controllers-7b785959dd-9bnqt   1/1     Running   0          9m19s
calico-system     calico-node-29pw9                          1/1     Running   0          9m19s
calico-system     calico-node-tv8nl                          1/1     Running   0          9m19s
calico-system     calico-typha-77d6d5d8d5-2vlbx              1/1     Running   0          9m19s
calico-system     calico-typha-77d6d5d8d5-llbt7              1/1     Running   0          9m18s
kube-system       aws-node-jkvgr                             1/1     Running   0          72d
kube-system       aws-node-xjgxl                             1/1     Running   0          72d
kube-system       coredns-574cb6ccd7-b58d4                   1/1     Running   0          68d
kube-system       coredns-574cb6ccd7-j7k5r                   1/1     Running   0          68d
kube-system       kube-proxy-f9kwb                           1/1     Running   0          14d
kube-system       kube-proxy-npvc7                           1/1     Running   0          14d
tigera-operator   tigera-operator-7765c5d66f-tqp7d           1/1     Running   3          11m

Updated operator's version to 1.20.1

% kap
NAMESPACE         NAME                                       READY   STATUS    RESTARTS   AGE
calico-system     calico-kube-controllers-5689468587-xhzrp   1/1     Running   0          12m
calico-system     calico-node-92bs9                          1/1     Running   0          12m
calico-system     calico-typha-85d4999f9c-ntvls              1/1     Running   0          12m
kube-system       aws-node-x8jrm                             1/1     Running   0          31m
kube-system       coredns-559b5db75d-j7jk2                   1/1     Running   0          52m
kube-system       coredns-559b5db75d-nrshb                   1/1     Running   0          52m
kube-system       kube-proxy-l5dst                           1/1     Running   0          31m
tigera-operator   tigera-operator-856b4c65b4-csdcd           1/1     Running   0          13m
zhuhz@3c22fb4b2616 amazon-vpc-cni-k8s % k get deploy tigera-operator -n tigera-operator -oyaml | grep image:
                f:image: {}
        image: quay.io/tigera/operator:v1.20.1

Automation added to e2e:

Will this break upgrades or downgrades. Has updating a running cluster been tested?:
on EKS 1.21, Calico operator 1.13.8

amazon-vpc-cni-k8s % kap                                                         
NAMESPACE         NAME                                       READY   STATUS    RESTARTS   AGE
calico-system     calico-kube-controllers-775d9c5554-bt2dg   1/1     Running   0          85s
calico-system     calico-node-6r4zf                          1/1     Running   0          86s
calico-system     calico-node-6wrjn                          1/1     Running   0          85s
calico-system     calico-typha-bbbb8fdc6-k5mr9               1/1     Running   0          86s
kube-system       aws-node-jkvgr                             1/1     Running   0          72d
kube-system       aws-node-xjgxl                             1/1     Running   0          72d
kube-system       coredns-574cb6ccd7-b58d4                   1/1     Running   0          68d
kube-system       coredns-574cb6ccd7-j7k5r                   1/1     Running   0          68d
kube-system       kube-proxy-f9kwb                           1/1     Running   0          14d
kube-system       kube-proxy-npvc7                           1/1     Running   0          14d
tigera-operator   tigera-operator-7fdc45bbbf-n7b58           1/1     Running   0          95s
amazon-vpc-cni-k8s % k get deploy -n tigera-operator   tigera-operator -oyaml | grep image:
                f:image: {}
        image: quay.io/tigera/operator:v1.13.8

updated to Calico operator 1.21

amazon-vpc-cni-k8s % kap
NAMESPACE         NAME                                       READY   STATUS    RESTARTS   AGE
calico-system     calico-kube-controllers-7b785959dd-wkhgw   1/1     Running   0          3m35s
calico-system     calico-node-829vx                          1/1     Running   0          3m35s
calico-system     calico-node-jv656                          1/1     Running   0          3m45s
calico-system     calico-typha-77787d7798-drtv6              1/1     Running   0          3m45s
calico-system     calico-typha-77787d7798-w45kg              1/1     Running   0          3m45s
kube-system       aws-node-jkvgr                             1/1     Running   0          72d
kube-system       aws-node-xjgxl                             1/1     Running   0          72d
kube-system       coredns-574cb6ccd7-b58d4                   1/1     Running   0          68d
kube-system       coredns-574cb6ccd7-j7k5r                   1/1     Running   0          68d
kube-system       kube-proxy-f9kwb                           1/1     Running   0          14d
kube-system       kube-proxy-npvc7                           1/1     Running   0          14d
tigera-operator   tigera-operator-7765c5d66f-dbwpq           1/1     Running   0          4m5s
zhuhz@3c22fb4b2616 amazon-vpc-cni-k8s % k get -n tigera-operator   tigera-operator-7fdc45bbbf-n7b58 -oyaml | grep image:
error: the server doesn't have a resource type "tigera-operator-7fdc45bbbf-n7b58"
zhuhz@3c22fb4b2616 amazon-vpc-cni-k8s % k get deploy -n tigera-operator   tigera-operator -oyaml | grep image:          
                f:image: {}
        image: quay.io/tigera/operator:v1.21.0

Does this change require updates to the CNI daemonset config files to work?:

no
Does this PR introduce any user-facing change?:

no

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

jayanthvn · 2021-08-18T18:05:24Z

/cc @tmjd

tmjd · 2021-08-18T22:30:26Z

@haouc could you include what you used as the source for these changes? did you base them off github.com/projectcalico/calico release-v3.20 branch, master branch, the v3.20.0 tag, or something else?

haouc · 2021-08-19T20:01:53Z

Hey @tmjd
Sure. I am using https://github.com/projectcalico/calico and based off tag: v3.20.0. Thanks.

calico % git log
commit e9a2c0d394da952e401aab707b8a200a2abe7da8 (HEAD -> release-v3.20.0, tag: v3.20.0)
Author: Casey Davenport <davenport.cas@gmail.com>
Date:   Fri Jul 30 13:33:32 2021 -0700

    Updates for v3.20.0

commit daa0dec3513d022b8e4e73b4b68aaa1af866eef6
Merge: cb0bfd4d be9ce37f
Author: marvin-tigera <marvin-tigera@users.noreply.github.com>
Date:   Thu Jul 29 13:56:45 2021 -0700

    Merge pull request #4793 from coutinhop/pedro-calicoctl-clusterinfo-rbac-3.20
    
    Add clusterinformations 'get' permissions to operator for openshift

haouc · 2021-08-25T16:15:33Z

@tmjd Can you take a look at the PR? please let me know if you need any other information. Thanks.

tmjd

The changes are looking like what I would expect, though I haven't compared them exactly, all the changes look like what I would reasonably expect.
Sorry for the delay on reviewing this PR. I was waiting on reviewing because I wanted to suggest that you use the v1.20 operator release instead of v1.21 because that is what was tested with the Calico v3.20 release. But because I believe there is a bug in v1.20.0 with AWS CNI I was trying to wait until the v1.20.1 patch release was available which addresses the bug and I believe will be available soon.

tmjd · 2021-08-25T19:48:43Z

charts/aws-calico/templates/tigera-operator/02-role-tigera-operator.yaml

  - apiGroups:
    - crd.projectcalico.org
    resources:
    - felixconfigurations
    verbs:
    - patch
+    - list


I think you should update this list to match what is in the release-v3.20 branch https://github.com/projectcalico/calico/blob/75797b545f786f6955387d1ce51fd8de69f7500e/_includes/charts/tigera-operator/templates/tigera-operator/02-role-tigera-operator.yaml#L102
You should make do this in the order: create, patch, list, get, watch
That way future updates will hopefully not show any changes.

Bump helm version to stable 3.6.3 and enable helm hook

…ting charts

haouc · 2021-08-31T20:31:57Z

@tmjd I have updated the PR. The operator is using 1.20.1 now. Could you take a look? Thanks.

tmjd

LGTM

jayanthvn

lgtm, but please make sure charts version is upgraded.

jayanthvn · 2021-09-01T20:34:56Z

Looks good...Thanks.

jayanthvn mentioned this pull request Aug 24, 2021

How to integrate calico network policy engine with aws vpc cni plugin? #1573

Closed

tmjd reviewed Aug 25, 2021

View reviewed changes

amitkatyal mentioned this pull request Aug 29, 2021

Typha autoscaler should exclude tainted nodes in node count tigera/operator#1441

Closed

haouc added 5 commits August 31, 2021 13:28

Update Calico operator to 1.21, CRDs, and roles

9a037e8

Adding a hook to CR Installation

a8e29c6

Bump helm version to stable 3.6.3 and enable helm hook

Update the verbs for felixconfigurations cluster role

a7be1f9

Change the Calico Operator version to 1.20.1

35bdea1

Ran generate-cni-yaml to update calico manifests in config after upda…

e8f6c13

…ting charts

haouc force-pushed the update-calico branch from e2433ba to e8f6c13 Compare August 31, 2021 20:28

tmjd approved these changes Sep 1, 2021

View reviewed changes

jayanthvn mentioned this pull request Sep 1, 2021

Calico networkpolicy enforcement does not allow Terminating pods to gracefully shut down when using non calico cni #1531

Closed

jayanthvn approved these changes Sep 1, 2021

View reviewed changes

Update aws-calico chart version

4985c13

haouc merged commit f8e1e06 into aws:master Sep 1, 2021

haouc deleted the update-calico branch September 1, 2021 21:00

jayanthvn added this to the v1.10 milestone Sep 15, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update Calico operator to 1.21, updates CRDs, and roles #1578

Update Calico operator to 1.21, updates CRDs, and roles #1578

haouc commented Aug 18, 2021 •

edited

Loading

jayanthvn commented Aug 18, 2021

tmjd commented Aug 18, 2021

haouc commented Aug 19, 2021

haouc commented Aug 25, 2021

tmjd left a comment

tmjd Aug 25, 2021

haouc commented Aug 31, 2021

tmjd left a comment

jayanthvn left a comment

jayanthvn commented Sep 1, 2021

Update Calico operator to 1.21, updates CRDs, and roles #1578

Update Calico operator to 1.21, updates CRDs, and roles #1578

Conversation

haouc commented Aug 18, 2021 • edited Loading

jayanthvn commented Aug 18, 2021

tmjd commented Aug 18, 2021

haouc commented Aug 19, 2021

haouc commented Aug 25, 2021

tmjd left a comment

Choose a reason for hiding this comment

tmjd Aug 25, 2021

Choose a reason for hiding this comment

haouc commented Aug 31, 2021

tmjd left a comment

Choose a reason for hiding this comment

jayanthvn left a comment

Choose a reason for hiding this comment

jayanthvn commented Sep 1, 2021

haouc commented Aug 18, 2021 •

edited

Loading