Automated cherry pick of #7917 and #8076

[hakman]

Cherry pick of #7917 #8076 on release-1.17.

#7917: Canal v3.10 manifest for k8s v1.15+
#8076: Set FELIX_IPTABLESBACKEND for Calico and Canal

For details on the cherry pick process, see the cherry pick requests page.

[k8s-ci-robot]

Hi @hakman. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[hakman]

/assign @KashifSaadat

[hakman]

@KashifSaadat I had to pull also your change that adds Canal 3.10 in the cherry-pick. I thing will be good to have in 1.17.

[KashifSaadat]

Thanks @hakman, makes sense to have it in v1.17 release 👍

/ok-to-test
/lgtm
/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: hakman, KashifSaadat

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [KashifSaadat]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hakman]

Thanks @KashifSaadat! Do you think we should bump both Calico and Canal to v3.10.2?

[KashifSaadat]

No worries!

Yep absolutely, would be good to get them both updated. For Canal we're at v3.10.1 so just a minor patch-fix release, bumping the version numbers. Calico in kops is on v3.9 currently so will need some checks against the v3.10 manifest to see if there are any additional changes which we would need to apply.

[hakman]

Great, will prepare a PR tomorrow. There are some extra things in the manifests that should be pulled in and verified.
Btw, I noticed that Canal is missing the role.kubernetes.io/networking: "1" labels. Should I add those too?

[KashifSaadat]

Thank you!

I'm not sure where the label has come from, if it was a legacy addition which has persisted through the updates. I tend to keep as much in-line with the upstream manifest where possible (with our additions for Typha support, configurable vars etc), and it doesn't appear to be included there:

• https://docs.projectcalico.org/v3.10/manifests/calico.yaml
• https://docs.projectcalico.org/v3.10/manifests/canal.yaml

[hakman]

The label is one of Kops's features, from what I see: 8afba37.

[KashifSaadat]

Good spot, yep that needs adding on all the Canal resources :)