fix calico rbac issue

[JaneLiuL]

/kind bug
when i install kubernetes with calico cni, and specific calico version in inventory/mycluster/group_vas/k8s-cluster.yml, and specifiy calico version with calico_version: v3.24.5.
the calico pods will fail, logs as below

tunnel-ip-allocator/ipam.go 1847: Error creating IPAM config error=connection is unauthorized:
ipamconfigs.crd.projectcalico.org is forbidden: User "system:serviceaccount:kube-system:calico-node" cannot create resource "ipamconfigs" in API group "crd.projectcalico.org" at the cluster scope

so i just modify the rbac, and grant the permission as this pr, and install again, it works

for latest calico release tag please check here: https://github.com/projectcalico/calico/blob/v3.25.0/charts/calico/templates/calico-node-rbac.yaml#L160

it still need create permission

[JaneLiuL]

/retest

[yankay]

Thanks @JaneLiuL

From the https://github.com/projectcalico/calico/blob/master/charts/calico/templates/calico-node-rbac.yaml#L160
The List, Update, Delete is not needed.

Should it better to be removed ?

[JaneLiuL]

hi, that depends on calico version, when i install kubespray with kubernetes 1.24.10 with calico version 3.24.5. we still need it.
and we should both support lower version.
I still suggest that we should keep it.

And both when i upgrade kubernets from 1.24.0 to 1.25 via kubespray, we still need that.

what do you think so?

and what you provide the link is not release yet, it is in master branch.
for latest calico release tag please check here: https://github.com/projectcalico/calico/blob/v3.25.0/charts/calico/templates/calico-node-rbac.yaml#L160

it still need create permission
@yankay

[floryut]

@JaneLiuL Thank you for the PR 👍
Looks good to me based on explanation

[yankay]

@JaneLiuL Thanks
/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: floryut, JaneLiuL, yankay

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [floryut,yankay]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment