Patch Calico V3.14.0 roles, missing CR and CRD for calico_kube_controller

roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-cr.yml.j2

@@ -57,6 +57,7 @@ rules:
       - blockaffinities
       - ipamblocks
       - ipamhandles
+      - hostendpoints
     verbs:
       - get
       - list
@@ -72,3 +73,18 @@ rules:
       - create
       - update
 {% endif %}
+{% if calico_version is version('v3.14.0', '>=') %}
+  # KubeControllersConfiguration is where it gets its config
+  - apiGroups: ["crd.projectcalico.org"]
+    resources:
+      - kubecontrollersconfigurations
+    verbs:
+      # read its own config
+      - get
+      # create a default if none exists
+      - create
+      # update status
+      - update
+      # watch for changes
+      - watch
+{% endif %}

roles/network_plugin/calico/templates/kdd-crds.yml.j2

@@ -210,3 +210,18 @@ spec:
     plural: networksets
     singular: networkset
 {% endif %}
+{% if calico_version is version('v3.14.0', '>=') %}
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: kubecontrollersconfigurations.crd.projectcalico.org
+spec:
+  scope: Cluster
+  group: crd.projectcalico.org
+  version: v1
+  names:
+    kind: KubeControllersConfiguration
+    plural: kubecontrollersconfigurations
+    singular: kubecontrollersconfiguration
+{% endif %}