feat(tigera-operator): Updated image to 1.36.0

Signed-off-by: Steve Hipwell <[email protected]>

charts/tigera-operator/CHANGELOG.md

@@ -14,6 +14,12 @@
 
 ## [UNRELEASED]
 
+## [v2.11.0] - 2024-10-29
+
+### Changed
+
+- Updated the _Tigera Operator_ OCI image to [v1.36.0](https://github.com/tigera/operator/releases/tag/v1.36.0) (_Calico_ [v3.29.0](https://github.com/projectcalico/calico/releases/tag/v3.29.0)). _@stevehipwell_
+
 ## [v2.10.6] - 2024-10-04
 
 ### Changed
@@ -541,6 +547,7 @@
 RELEASE LINKS
 -->
 [UNRELEASED]: https://github.com/stevehipwell/helm-charts/tree/main/charts/tigera-operator
+[v2.11.0]: https://github.com/stevehipwell/helm-charts/releases/tag/tigera-operator-2.11.0
 [v2.10.6]: https://github.com/stevehipwell/helm-charts/releases/tag/tigera-operator-2.10.6
 [v2.10.5]: https://github.com/stevehipwell/helm-charts/releases/tag/tigera-operator-2.10.5
 [v2.10.4]: https://github.com/stevehipwell/helm-charts/releases/tag/tigera-operator-2.10.4

charts/tigera-operator/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: tigera-operator
 description: Helm chart to install the Tigera Operator for managing Calico.
 type: application
-version: 2.10.6
-appVersion: 1.34.5
+version: 2.11.0
+appVersion: 1.36.0
 keywords:
   - kubernetes
   - cni
@@ -26,4 +26,4 @@ annotations:
   artifacthub.io/alternativeName: tigera
   artifacthub.io/changes: |
     - kind: changed
-      description: "Updated the _Tigera Operator_ OCI image to [v1.34.5](https://github.com/tigera/operator/releases/tag/v1.34.5) (_Calico_ [v3.28.2](https://github.com/projectcalico/calico/releases/tag/v3.28.2))."
+      description: "Updated the _Tigera Operator_ OCI image to [v1.36.0](https://github.com/tigera/operator/releases/tag/v1.34.5) (_Calico_ [v3.29.0](https://github.com/projectcalico/calico/releases/tag/v3.29.0))."

charts/tigera-operator/README.md

@@ -1,6 +1,6 @@
 # tigera-operator
 
-![Version: 2.10.6](https://img.shields.io/badge/Version-2.10.6-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.34.5](https://img.shields.io/badge/AppVersion-1.34.5-informational?style=flat-square)
+![Version: 2.11.0](https://img.shields.io/badge/Version-2.11.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.36.0](https://img.shields.io/badge/AppVersion-1.36.0-informational?style=flat-square)
 
 The [Tigera Operator](https://www.tigera.io/) is a Kubernetes operator which manages the lifecycle of a [Calico](https://www.tigera.io/project-calico/) or [Calico Enterprise](https://www.tigera.io/tigera-products/calico-enterprise/) installation on Kubernetes. Its goal is to make installation, upgrades, and ongoing lifecycle management of _Calico_ and _Calico Enterprise_ as simple and reliable as possible.
 
@@ -27,15 +27,15 @@ It is possible to use the _Tigera Operator_ for other use-cases by installing ad
 To install the chart using the recommended OCI method you can use the following command.
 
 ```shell
-helm upgrade --install tigera-operator oci://ghcr.io/stevehipwell/helm-charts/tigera-operator --version 2.10.6
+helm upgrade --install tigera-operator oci://ghcr.io/stevehipwell/helm-charts/tigera-operator --version 2.11.0
 ```
 
 #### Verification
 
 As the OCI chart release is signed by [Cosign](https://github.com/sigstore/cosign) you can verify the chart before installing it by running the following command.
 
 ```shell
-cosign verify --certificate-oidc-issuer https://token.actions.githubusercontent.com --certificate-identity-regexp 'https://github\.com/action-stars/helm-workflows/\.github/workflows/release\.yaml@.+' --certificate-github-workflow-repository stevehipwell/helm-charts --certificate-github-workflow-name Release ghcr.io/stevehipwell/helm-charts/tigera-operator:2.10.6
+cosign verify --certificate-oidc-issuer https://token.actions.githubusercontent.com --certificate-identity-regexp 'https://github\.com/action-stars/helm-workflows/\.github/workflows/release\.yaml@.+' --certificate-github-workflow-repository stevehipwell/helm-charts --certificate-github-workflow-name Release ghcr.io/stevehipwell/helm-charts/tigera-operator:2.11.0
 ```
 
 ### Non-OCI Repository
@@ -44,7 +44,7 @@ Alternatively you can use the legacy non-OCI method via the following commands.
 
 ```shell
 helm repo add stevehipwell https://stevehipwell.github.io/helm-charts/
-helm upgrade --install tigera-operator stevehipwell/tigera-operator --version 2.10.6
+helm upgrade --install tigera-operator stevehipwell/tigera-operator --version 2.11.0
 ```
 
 ## Values

charts/tigera-operator/crds/calico/bgpfilters.crd.projectcalico.org.yaml

@@ -51,6 +51,19 @@ spec:
                         type: string
                       matchOperator:
                         type: string
+                      prefixLength:
+                        properties:
+                          max:
+                            format: int32
+                            maximum: 32
+                            minimum: 0
+                            type: integer
+                          min:
+                            format: int32
+                            maximum: 32
+                            minimum: 0
+                            type: integer
+                        type: object
                       source:
                         type: string
                     required:
@@ -74,6 +87,19 @@ spec:
                         type: string
                       matchOperator:
                         type: string
+                      prefixLength:
+                        properties:
+                          max:
+                            format: int32
+                            maximum: 128
+                            minimum: 0
+                            type: integer
+                          min:
+                            format: int32
+                            maximum: 128
+                            minimum: 0
+                            type: integer
+                        type: object
                       source:
                         type: string
                     required:
@@ -97,6 +123,19 @@ spec:
                         type: string
                       matchOperator:
                         type: string
+                      prefixLength:
+                        properties:
+                          max:
+                            format: int32
+                            maximum: 32
+                            minimum: 0
+                            type: integer
+                          min:
+                            format: int32
+                            maximum: 32
+                            minimum: 0
+                            type: integer
+                        type: object
                       source:
                         type: string
                     required:
@@ -120,6 +159,19 @@ spec:
                         type: string
                       matchOperator:
                         type: string
+                      prefixLength:
+                        properties:
+                          max:
+                            format: int32
+                            maximum: 128
+                            minimum: 0
+                            type: integer
+                          min:
+                            format: int32
+                            maximum: 128
+                            minimum: 0
+                            type: integer
+                        type: object
                       source:
                         type: string
                     required:

charts/tigera-operator/crds/calico/felixconfigurations.crd.projectcalico.org.yaml

@@ -298,6 +298,18 @@ spec:
                     information about the BPF policy programs, which can be examined
                     with the calico-bpf command-line tool.
                   type: boolean
+                bpfRedirectToPeer:
+                  description:
+                    "BPFRedirectToPeer controls which whether it is allowed
+                    to forward straight to the peer side of the workload devices. It
+                    is allowed for any host L2 devices by default (L2Only), but it breaks
+                    TCP dump on the host side of workload device as it bypasses it on
+                    ingress. Value of Enabled also allows redirection from L3 host devices
+                    like IPIP tunnel or Wireguard directly to the peer side of the workload's
+                    device. This makes redirection faster, however, it breaks tools
+                    like tcpdump on the peer side. Use Enabled with caution. [Default:
+                    L2Only]"
+                  type: string
                 chainInsertMode:
                   description:
                     "ChainInsertMode controls whether Felix hooks the kernel's
@@ -404,15 +416,17 @@ spec:
                   type: array
                 failsafeInboundHostPorts:
                   description:
-                    'FailsafeInboundHostPorts is a list of UDP/TCP ports
-                    and CIDRs that Felix will allow incoming traffic to host endpoints
-                    on irrespective of the security policy. This is useful to avoid
-                    accidentally cutting off a host with incorrect configuration. For
-                    back-compatibility, if the protocol is not specified, it defaults
-                    to "tcp". If a CIDR is not specified, it will allow traffic from
-                    all addresses. To disable all inbound host ports, use the value
-                    none. The default value allows ssh access and DHCP. [Default: tcp:22,
-                    udp:68, tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, tcp:6667]'
+                    'FailsafeInboundHostPorts is a list of PortProto struct
+                    objects including UDP/TCP/SCTP ports and CIDRs that Felix will allow
+                    incoming traffic to host endpoints on irrespective of the security
+                    policy. This is useful to avoid accidentally cutting off a host
+                    with incorrect configuration. For backwards compatibility, if the
+                    protocol is not specified, it defaults to "tcp". If a CIDR is not
+                    specified, it will allow traffic from all addresses. To disable
+                    all inbound host ports, use the value "[]". The default value allows
+                    ssh access, DHCP, BGP, etcd and the Kubernetes API. [Default: tcp:22,
+                    udp:68, tcp:179, tcp:2379, tcp:2380, tcp:5473, tcp:6443, tcp:6666,
+                    tcp:6667 ]'
                   items:
                     description:
                       ProtoPort is combination of protocol, port, and CIDR.
@@ -431,17 +445,18 @@ spec:
                   type: array
                 failsafeOutboundHostPorts:
                   description:
-                    'FailsafeOutboundHostPorts is a list of UDP/TCP ports
-                    and CIDRs that Felix will allow outgoing traffic from host endpoints
-                    to irrespective of the security policy. This is useful to avoid
-                    accidentally cutting off a host with incorrect configuration. For
-                    back-compatibility, if the protocol is not specified, it defaults
-                    to "tcp". If a CIDR is not specified, it will allow traffic from
-                    all addresses. To disable all outbound host ports, use the value
-                    none. The default value opens etcd''s standard ports to ensure that
-                    Felix does not get cut off from etcd as well as allowing DHCP and
-                    DNS. [Default: tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666,
-                    tcp:6667, udp:53, udp:67]'
+                    'FailsafeOutboundHostPorts is a list of List of PortProto
+                    struct objects including UDP/TCP/SCTP ports and CIDRs that Felix
+                    will allow outgoing traffic from host endpoints to irrespective
+                    of the security policy. This is useful to avoid accidentally cutting
+                    off a host with incorrect configuration. For backwards compatibility,
+                    if the protocol is not specified, it defaults to "tcp". If a CIDR
+                    is not specified, it will allow traffic from all addresses. To disable
+                    all outbound host ports, use the value "[]". The default value opens
+                    etcd''s standard ports to ensure that Felix does not get cut off
+                    from etcd as well as allowing DHCP, DNS, BGP and the Kubernetes
+                    API. [Default: udp:53, udp:67, tcp:179, tcp:2379, tcp:2380, tcp:5473,
+                    tcp:6443, tcp:6666, tcp:6667 ]'
                   items:
                     description:
                       ProtoPort is combination of protocol, port, and CIDR.
@@ -490,6 +505,38 @@ spec:
                     is not recommended since it doesn't provide better performance
                     than iptables. [Default: false]"
                   type: boolean
+                goGCThreshold:
+                  description:
+                    "GoGCThreshold Sets the Go runtime's garbage collection
+                    threshold.  I.e. the percentage that the heap is allowed to grow
+                    before garbage collection is triggered.  In general, doubling the
+                    value halves the CPU time spent doing GC, but it also doubles peak
+                    GC memory overhead.  A special value of -1 can be used to disable
+                    GC entirely; this should only be used in conjunction with the GoMemoryLimitMB
+                    setting. \n This setting is overridden by the GOGC environment variable.
+                    \n [Default: 40]"
+                  type: integer
+                goMaxProcs:
+                  description:
+                    "GoMaxProcs sets the maximum number of CPUs that the
+                    Go runtime will use concurrently.  A value of -1 means \"use the
+                    system default\"; typically the number of real CPUs on the system.
+                    \n this setting is overridden by the GOMAXPROCS environment variable.
+                    \n [Default: -1]"
+                  type: integer
+                goMemoryLimitMB:
+                  description:
+                    "GoMemoryLimitMB sets a (soft) memory limit for the Go
+                    runtime in MB.  The Go runtime will try to keep its memory usage
+                    under the limit by triggering GC as needed.  To avoid thrashing,
+                    it will exceed the limit if GC starts to take more than 50% of the
+                    process's CPU time.  A value of -1 disables the memory limit. \n
+                    Note that the memory limit, if used, must be considerably less than
+                    any hard resource limit set at the container or pod level.  This
+                    is because felix is not the only process that must run in the container
+                    or pod. \n This setting is overridden by the GOMEMLIMIT environment
+                    variable. \n [Default: -1]"
+                  type: integer
                 healthEnabled:
                   type: boolean
                 healthHost:
@@ -542,6 +589,16 @@ spec:
                     disabled by setting the interval to 0.
                   pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))*$
                   type: string
+                ipForwarding:
+                  description:
+                    "IPForwarding controls whether Felix sets the host sysctls
+                    to enable IP forwarding.  IP forwarding is required when using Calico
+                    for workload networking.  This should only be disabled on hosts
+                    where Calico is used for host protection.  [Default: Enabled]"
+                  enum:
+                    - Enabled
+                    - Disabled
+                  type: string
                 ipipEnabled:
                   description:
                     "IPIPEnabled overrides whether Felix should configure
@@ -692,6 +749,10 @@ spec:
                   pattern: ^(?i)(Debug|Info|Warning|Error|Fatal)?$
                   type: string
                 maxIpsetSize:
+                  description:
+                    MaxIpsetSize is the maximum number of IP addresses that
+                    can be stored in an IP set. Not applicable if using the nftables
+                    backend.
                   type: integer
                 metadataAddr:
                   description:
@@ -735,6 +796,38 @@ spec:
                 netlinkTimeout:
                   pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))*$
                   type: string
+                nftablesFilterAllowAction:
+                  pattern: ^(?i)(Accept|Return)?$
+                  type: string
+                nftablesFilterDenyAction:
+                  description:
+                    FilterDenyAction controls what happens to traffic that
+                    is denied by network policy. By default Calico blocks traffic with
+                    a "drop" action. If you want to use a "reject" action instead you
+                    can configure it here.
+                  pattern: ^(?i)(Drop|Reject)?$
+                  type: string
+                nftablesMangleAllowAction:
+                  pattern: ^(?i)(Accept|Return)?$
+                  type: string
+                nftablesMarkMask:
+                  description:
+                    "MarkMask is the mask that Felix selects its nftables
+                    Mark bits from. Should be a 32 bit hexadecimal number with at least
+                    8 bits set, none of which clash with any other mark bits in use
+                    on the system. [Default: 0xffff0000]"
+                  format: int32
+                  type: integer
+                nftablesMode:
+                  description:
+                    "NFTablesMode configures nftables support in Felix. [Default:
+                    Disabled]"
+                  type: string
+                nftablesRefreshInterval:
+                  description:
+                    "NftablesRefreshInterval controls the interval at which
+                    Felix periodically refreshes the nftables rules. [Default: 90s]"
+                  type: string
                 openstackRegion:
                   description:
                     "OpenstackRegion is the name of the region that a particular

charts/tigera-operator/crds/calico/globalnetworkpolicies.crd.projectcalico.org.yaml

@@ -888,10 +888,10 @@ spec:
                   description:
                     Order is an optional field that specifies the order in
                     which the policy is applied. Policies with higher "order" are applied
-                    after those with lower order.  If the order is omitted, it may be
-                    considered to be "infinite" - i.e. the policy will be applied last.  Policies
-                    with identical order will be applied in alphanumerical order based
-                    on the Policy "Name".
+                    after those with lower order within the same tier.  If the order
+                    is omitted, it may be considered to be "infinite" - i.e. the policy
+                    will be applied last.  Policies with identical order will be applied
+                    in alphanumerical order based on the Policy "Name" within the tier.
                   type: number
                 performanceHints:
                   description:
@@ -937,6 +937,15 @@ spec:
                     ServiceAccountSelector is an optional field for an expression
                     used to select a pod based on service accounts.
                   type: string
+                tier:
+                  description:
+                    The name of the tier that this policy belongs to.  If
+                    this is omitted, the default tier (name is "default") is assumed.  The
+                    specified tier must exist in order to create security policies within
+                    the tier, the "default" tier is created automatically if it does
+                    not exist, this means for deployments requiring only a single Tier,
+                    the tier name may be omitted on all policy management requests.
+                  type: string
                 types:
                   description:
                     "Types indicates whether this policy applies to ingress,