Reenable cni-calico-deep integration test

Fixes #11567

The trick is to run the test under k8s `v1.27.6-k3s1` as the following
versions break Calico in k3s (see k3d-io/k3d#1375).

Also removed the `continue-on-error: true` directive in the integration
workflow because it was hiding this problem.

.github/workflows/integration.yml

@@ -121,7 +121,6 @@ jobs:
         test:
           - cni-calico-deep
           - deep
-    continue-on-error: true
     runs-on: ubuntu-20.04
     timeout-minutes: 15
     steps:

.github/workflows/release.yml

@@ -113,8 +113,7 @@ jobs:
       matrix:
         integration_test:
         - cluster-domain
-        # XXX(ver) Broken.
-        #- cni-calico-deep
+        - cni-calico-deep
         - deep
         - viz
         - default-policy-deny

bin/_k3d-config.yml

@@ -0,0 +1,3 @@
+apiVersion: k3d.io/v1alpha4
+kind: Simple
+image: rancher/k3s:v1.27.6-k3s1

bin/_test-helpers.sh

@@ -4,6 +4,9 @@
 # proper messages
 set +e
 
+k8s_version_min='+v1.21'
+k8s_version_max='+v1.26'
+
 ##### Test setup helpers #####
 
 export default_test_names=(deep viz external helm-upgrade uninstall upgrade-edge upgrade-stable default-policy-deny rsa-ca)
@@ -244,7 +247,7 @@ setup_cluster() {
 
   test_setup
   if [ -z "$skip_cluster_create" ]; then
-    "$bindir"/k3d cluster create "$@" --image +v1.26
+    "$bindir"/k3d cluster create "$@"
     image_load "$name"
   fi
   check_cluster
@@ -317,16 +320,20 @@ start_test() {
 
   case $name in
     cluster-domain)
-      config=("$name" "${config[@]}" --no-lb --k3s-arg --cluster-domain=custom.domain --k3s-arg '--disable=servicelb,traefik@server:0')
+      config=("$name" "${config[@]}" --no-lb --k3s-arg --cluster-domain=custom.domain --k3s-arg '--disable=servicelb,traefik@server:0' --image "$k8s_version_max")
       ;;
     cni-calico-deep)
-      config=("$name" "${config[@]}" --no-lb --k3s-arg --write-kubeconfig-mode=644 --k3s-arg --flannel-backend=none --k3s-arg --cluster-cidr=192.168.0.0/16 --k3s-arg '--disable=servicelb,traefik@server:0')
+      # This requires k8s v1.27.6-k3s1 because after that Calico won't work.
+      # We have to use a config file because that version can't be set via the
+      # --image flag.
+      # See https://github.com/k3d-io/k3d/issues/1375
+      config=("$name" "${config[@]}" --no-lb --k3s-arg --write-kubeconfig-mode=644 --k3s-arg --flannel-backend=none --k3s-arg --cluster-cidr=192.168.0.0/16 --k3s-arg '--disable=servicelb,traefik@server:0' --config "$bindir"/_k3d-config.yml)
       ;;
     multicluster)
-      config=("${config[@]}" --network multicluster-test)
+      config=("${config[@]}" --network multicluster-test --image "$k8s_version_max")
       ;;
     *)
-      config=("$name" "${config[@]}" --no-lb --k3s-arg '--disable=servicelb,traefik@server:0')
+      config=("$name" "${config[@]}" --no-lb --k3s-arg '--disable=servicelb,traefik@server:0' --image "$k8s_version_max")
       ;;
   esac
 
@@ -386,13 +393,13 @@ latest_release_channel() {
 # Run the upgrade-edge test by upgrading the most-recent edge release to the
 # HEAD of this branch.
 run_upgrade-edge_test() {
-  run_test "$test_directory/upgrade-edge/..." 
+  run_test "$test_directory/upgrade-edge/..."
 }
 
 # Run the upgrade-stable test by upgrading the most-recent stable release to the
 # HEAD of this branch.
 run_upgrade-stable_test() {
-  run_test "$test_directory/upgrade-stable/..." 
+  run_test "$test_directory/upgrade-stable/..."
 }
 
 run_viz_test() {
@@ -445,7 +452,7 @@ run_uninstall_test() {
 }
 
 run_multicluster_test() {
-   run_test "$test_directory/multicluster/..." 
+   run_test "$test_directory/multicluster/..."
 }
 
 run_deep_test() {