Use copies of upstream calico kdd CRDs

[hafe]

What type of PR is this?

Uncomment only one /kind <> line, hit enter to put that in a new line, and remove leading whitespaces from that line:

/kind api-change
/kind bug
/kind cleanup

/kind design

/kind documentation
/kind failing-test
/kind feature
/kind flake

What this PR does / why we need it:

This is an attempt to manage the problem of making sure calico CRDs are in sync with upstream (projectcalico). By keeping an exact identical copy of the CRDs, a simple recursive diff can be used to check for differences. This check (and eventual update) should be included in the process when bumping the calico version.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

NONE

[k8s-ci-robot]

Hi @hafe. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: hafe
To complete the pull request process, please assign mattymo after the PR has been reviewed.
You can assign the PR to them by writing /assign @mattymo in a comment when ready.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hafe]

How do we solve this? We want to keep exact copies and not modify them

[LuckySB]

/ok-to-test

[hafe]

/test packet_centos7_calico-ha-once-localhost

[k8s-ci-robot]

@hafe: The specified target(s) for /test were not found.
The following commands are available to trigger jobs:

• /test pull-kubespray-yamllint

Use /test all to run all jobs.

In response to this:

/test packet_centos7_calico-ha-once-localhost

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[hafe]

/retest

[mirwan]

@hafe
The diff between files in https://github.com/projectcalico/calico/tree/.../_includes/charts/calico/crds/kdd and those in roles/network_plugin/calico/files/crds/kdd seems only to be the annotations and creationTimestamp in metadata.
Have you considered simply maintaining a kustomize file in kubespray (that removes these annotations), using unarchive module with https://github.com/projectcalico/calico/releases/download/{{ calico_version }}/release-{{ calico_version }}.tgz and applying the manifests with kustomize ?

[hafe]

No because I may not familiar with kustomize. A good way forward would be if projectcalico provided templates (e.g a helm chart) but from the discussions that doesn't seem to happen soon. There are other projects maintaining helm charts for calico

[hafe]

Thanks for the first feedback!

[champtar]

Downloading the source from their repo would make next upgrades way easier. @mirwan do we really need kustomize ? isn't kubectl apply enough ?

[mirwan]

@champtar
There are some metadata in the manifests from projectcalico/calico that we may want to get rid of (as they are neither in roles/network_plugin/calico/templates/kdd-crds.yml.j2 nor in the CRDs in the current PR), like annotations and creationTimestamp.
If it is actually required, using kustomize for that purpose seems the simplest way

[champtar]

@mirwan I was confused by your message because I couldn't find them, but they have been very recently removed: projectcalico/calico@2e28c85 (3.16.5/3.17)
Also kustomize is part of kubectl for some release now, so this is 100% acceptable to use it

[mirwan]

@champtar Indeed, from 3.17/3.16.5, these have been removed, but if we want to have all the calico versions handled in kubespray (3.15.2, 3.16 prior to 3.16.5) covered by this feature, we should get rid of these...

[champtar]

sed could also do the trick if it's only those 3 lines ;)

[hafe]

@champtar Indeed, from 3.17/3.16.5, these have been removed, but if we want to have all the calico versions handled in kubespray (3.15.2, 3.16 prior to 3.16.5) covered by this feature, we should get rid of these...

I hope that the next kubespray release will only care about exactly one version of components. That would a lot of things a lot more easier!

[hafe]

@mirwan I was confused by your message because I couldn't find them, but they have been very recently removed: projectcalico/calico@2e28c85 (3.16.5/3.17)
Also kustomize is part of kubectl for some release now, so this is 100% acceptable to use it

Still kubespray would have to maintain templates?

[champtar]

@mirwan I was confused by your message because I couldn't find them, but they have been very recently removed: projectcalico/calico@2e28c85 (3.16.5/3.17)
Also kustomize is part of kubectl for some release now, so this is 100% acceptable to use it

Still kubespray would have to maintain templates?

I don't think we need to maintain them in tree, download calico source from GH and apply the CRDs

[hafe]

It would be better if kubespray used some existing templates. Just found this:
https://hub.kubeapps.com/charts/aws/aws-calico

[champtar]

It would be better if kubespray used some existing templates. Just found this:
https://hub.kubeapps.com/charts/aws/aws-calico

There are still at 3.15.1 ... and the job is only to download the sources, extract them and kubectl apply, with worst case scenario a sed to remove 3 lines. We also want everything to work offline / with separate download step, and we haven't implemented that for helm yet.

[champtar]

/close superseded by #7372

[k8s-ci-robot]

@hafe: PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.