update: remove extra configs in favor of yq

Signed-off-by: vsoch <vsoch@users.noreply.github.com>

Author: vsoch

Dockerfile

@@ -1,45 +1,61 @@
-ARG BASE_IMAGE=docker.io/kindest/node:v1.35.0@sha256:452d707d4862f52530247495d180205e029056831160e22870e37e3f6c1ac31f
-ARG CNI_PLUGINS_VERSION=v1.9.0
-ARG HELM_VERSION=v4.0.4
-ARG FLANNEL_VERSION=v0.27.4
+ARG BASE_IMAGE=docker.io/kindest/node:v1.33.0@sha256:91e9ed777db80279c22d1d1068c091b899b2078506e4a0f797fbf6e397c0b0b2
+ARG CNI_PLUGINS_VERSION=v1.7.1
+ARG HELM_VERSION=v3.17.3
+ARG FLANNEL_VERSION=v0.26.7
+ARG CALICO_VERSION=v3.30.5
 FROM ${BASE_IMAGE}
 COPY Dockerfile.d/SHA256SUMS.d/ /tmp/SHA256SUMS.d
 ARG CNI_PLUGINS_VERSION
 ARG HELM_VERSION
 ARG FLANNEL_VERSION
-# This are private on our cluster and need to be copied to here
-COPY cspca.llnl.gov.cer.pem /usr/local/share/ca-certificates/
-COPY cspca.cer.pem /usr/local/share/ca-certificates/
+ARG CALICO_VERSION
 RUN update-ca-certificates
 RUN arch="$(uname -m | sed -e s/x86_64/amd64/ -e s/aarch64/arm64/)" && \
+  # CNI Plugins
   fname="cni-plugins-linux-${arch}-${CNI_PLUGINS_VERSION}.tgz" && \
-  curl --insecure -o "${fname}" -fSL "https://github.com/containernetworking/plugins/releases/download/${CNI_PLUGINS_VERSION}/${fname}" && \
+  curl -o "${fname}" -fSL "https://github.com/containernetworking/plugins/releases/download/${CNI_PLUGINS_VERSION}/${fname}" && \
   grep "${fname}" "/tmp/SHA256SUMS.d/cni-plugins-${CNI_PLUGINS_VERSION}" | sha256sum -c && \
   mkdir -p /opt/cni/bin && \
   tar xzf "${fname}" -C /opt/cni/bin && \
   rm -f "${fname}" && \
+  # Helm
   fname="helm-${HELM_VERSION}-linux-${arch}.tar.gz" && \
-  curl --insecure -o "${fname}" -fSL "https://get.helm.sh/${fname}" && \
+  curl -o "${fname}" -fSL "https://get.helm.sh/${fname}" && \
   grep "${fname}" "/tmp/SHA256SUMS.d/helm-${HELM_VERSION}" | sha256sum -c && \
   tar xzf "${fname}" -C /usr/local/bin --strip-components=1 -- "linux-${arch}/helm" && \
   rm -f "${fname}" && \
+  # Flannel
   fname="flannel.tgz" && \
-  curl --insecure -o "${fname}" -fSL "https://github.com/flannel-io/flannel/releases/download/${FLANNEL_VERSION}/${fname}" && \
+  curl -o "${fname}" -fSL "https://github.com/flannel-io/flannel/releases/download/${FLANNEL_VERSION}/${fname}" && \
   grep "${fname}" "/tmp/SHA256SUMS.d/flannel-${FLANNEL_VERSION}" | sha256sum -c && \
   tar xzf "${fname}" -C / && \
-  rm -f "${fname}"
+  rm -f "${fname}" && \
+  # Calico (calicoctl)
+  fname="calicoctl-linux-${arch}" && \
+  curl -o "${fname}" -fSL "https://github.com/projectcalico/calico/releases/download/${CALICO_VERSION}/${fname}" && \
+  grep "${fname}" "/tmp/SHA256SUMS.d/calico-${CALICO_VERSION}" | sha256sum -c && \
+  chmod +x "${fname}" && \
+  mv "${fname}" /usr/local/bin/calicoctl && \
+  # Calico manifest - derive v3.31 from v3.31.5
+  calico_branch="$(echo "${CALICO_VERSION}" | cut -d. -f1,2)" && \
+  fname="calico.yaml" && \
+  curl -o "/${fname}" -fSL "https://raw.githubusercontent.com/projectcalico/calico/refs/heads/release-${calico_branch}/manifests/calico.yaml" && \
+  grep "${fname}" "/tmp/SHA256SUMS.d/calico-manifest-${CALICO_VERSION}" | sha256sum -c
+
 # gettext-base: for `envsubst`
 # moreutils: for `sponge`
 # socat: for `socat` (to silence "[WARNING FileExisting-socat]" from kubeadm)
+# ipset: for using calico and command line utils
+# yq: needed to install custom calico manifests
 RUN apt-get update && apt-get install -y --no-install-recommends \
   gettext-base \
   moreutils \
-  socat ipset wget
-ADD Dockerfile.d/etc_udev_rules.d_90-flannel.rules /etc/udev/rules.d/90-flannel.rules
-ADD Dockerfile.d/etc_udev_rules.d_95-calico.rules /etc/udev/rules.d/95-calico.rules
-ADD Dockerfile.d/u7s-entrypoint.sh /
+  socat \
+  ipset \
+  yq \
+  && rm -rf /var/lib/apt/lists/*
 # Calico
 ENV FELIX_IGNORELOOSERPF=true
-RUN wget https://github.com/projectcalico/calico/releases/download/v3.30.5/calicoctl-linux-amd64 -O /tmp/calicoctl && \
-    chmod +x /tmp/calicoctl && mv /tmp/calicoctl /usr/local/bin
+ADD Dockerfile.d/etc_udev_rules.d_90-flannel-calico.rules /etc/udev/rules.d/90-flannel-calico.rules
+ADD Dockerfile.d/u7s-entrypoint.sh /
 ENTRYPOINT ["/u7s-entrypoint.sh", "/usr/local/bin/entrypoint", "/sbin/init"]

Dockerfile.d/SHA256SUMS.d/calico-manifest-v3.30.5

@@ -0,0 +1 @@
+ed105288f27c7ba4cae143bcaa3f6425f02d84fa94a4786cc8e3d371412c1a36  calico.yaml

Dockerfile.d/SHA256SUMS.d/calico-v3.30.5

@@ -0,0 +1,2 @@
+6cdfb17b0276f648f4fdb051a5d75617a50b3c328d4cccfc40d087b96c361d80  calicoctl-linux-amd64
+7611343e7a56e770b95e2bb882dda787efbbd4331b1dd6316ff8ea189238dfaa  calicoctl-linux-arm64

…file.d/etc_udev_rules.d_90-flannel.rules …etc_udev_rules.d_90-flannel-calico.rulesDockerfile.d/etc_udev_rules.d_90-flannel.rules renamed to Dockerfile.d/etc_udev_rules.d_90-flannel-calico.rules Dockerfile.d/etc_udev_rules.d_90-flannel.rules renamed to Dockerfile.d/etc_udev_rules.d_90-flannel-calico.rules

@@ -3,3 +3,4 @@
 # https://github.com/kubernetes/kops/pull/9074
 # https://github.com/karmab/kcli/commit/b1a8eff658d17cf4e28162f0fa2c8b2b10e5ad00
 SUBSYSTEM=="net", ACTION=="add|change|move", ENV{INTERFACE}=="flannel.1", RUN+="/usr/sbin/ethtool -K flannel.1 tx-checksum-ip-generic off"
+SUBSYSTEM=="net", ACTION=="add|change|move", ENV{INTERFACE}=="vxlan.calico", RUN+="/usr/sbin/ethtool -K vxlan.calico tx-checksum-ip-generic off"

Dockerfile.d/etc_udev_rules.d_95-calico.rules

@@ -136,7 +136,7 @@ join-command:
 .PHONY: kubeadm-init
 kubeadm-init:
 	$(NODE_SHELL) sh -euc "envsubst </usernetes/kubeadm-config.yaml >/tmp/kubeadm-config.yaml"
-	$(NODE_SHELL) kubeadm init --ignore-preflight-errors all --config /tmp/kubeadm-config.yaml --skip-token-print
+	$(NODE_SHELL) kubeadm init --config /tmp/kubeadm-config.yaml --skip-token-print
 	$(MAKE) sync-external-ip
 	@echo "# Run 'make join-command' to print the join command"
 
@@ -146,8 +146,6 @@ sync-external-ip:
 
 .PHONY: kubeadm-join
 kubeadm-join:
-	# Our kernel is too old for usernetes, so we need this
-	sed -i "s/--token/--ignore-preflight-errors=all --token/g" join-command
 	$(NODE_SHELL) /bin/bash /usernetes/join-command
 	@echo "# Run 'make sync-external-ip' on the control plane"
 
@@ -157,11 +155,7 @@ kubeadm-reset:
 
 .PHONY: install-flannel
 install-flannel:
-	# Kubernetes 1.30.x removed the check for br_netfilter from kubeadm.
-	# Flannel over version 0.25 checks for br_netfilter, which won't be in the podman node.
-	# We don't actually need it there, just on the physical node, so we use newer K8s and older flannel
-	$(NODE_SHELL) kubectl apply -f https://github.com/flannel-io/flannel/releases/download/v0.25.1/kube-flannel.yml
-	#$(NODE_SHELL) /usernetes/Makefile.d/install-flannel.sh
+	$(NODE_SHELL) /usernetes/Makefile.d/install-flannel.sh
 
 .PHONY: install-calico
 install-calico: