From 2c33e363920113b98d38500ae3bcb7ad750cf5c1 Mon Sep 17 00:00:00 2001
From: Adrien Reslinger <adrien@reslinger.net>
Date: Sat, 25 Jun 2022 11:34:11 +0200
Subject: [PATCH] Update calico to version v3.23.2

---
 templates/calico-kube-controllers-Deployment.yaml | 2 +-
 templates/calico-node-ClusterRole.yaml            | 8 ++++++++
 templates/calico-node-DaemonSet.yaml              | 6 +++---
 templates/calicoctl-Pod.yaml                      | 2 +-
 templates/calicoctl-ServiceAccount.yaml           | 6 +++---
 5 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/templates/calico-kube-controllers-Deployment.yaml b/templates/calico-kube-controllers-Deployment.yaml
index 3c73ba7..4e00f25 100644
--- a/templates/calico-kube-controllers-Deployment.yaml
+++ b/templates/calico-kube-controllers-Deployment.yaml
@@ -34,7 +34,7 @@ spec:
       priorityClassName: system-cluster-critical
       containers:
         - name: calico-kube-controllers
-          image: docker.io/calico/kube-controllers:v3.23.1
+          image: docker.io/calico/kube-controllers:v3.23.2
           env:
             # Choose which controllers to run.
             - name: ENABLED_CONTROLLERS
diff --git a/templates/calico-node-ClusterRole.yaml b/templates/calico-node-ClusterRole.yaml
index 14cd28b..59407c8 100644
--- a/templates/calico-node-ClusterRole.yaml
+++ b/templates/calico-node-ClusterRole.yaml
@@ -68,6 +68,14 @@ rules:
       - pods/status
     verbs:
       - patch
+  # Used for creating service account tokens to be used by the CNI plugin
+  - apiGroups: [""]
+    resources:
+      - serviceaccounts/token
+    resourceNames:
+      - calico-node
+    verbs:
+      - create
   # Calico monitors various CRDs for config.
   - apiGroups: ["crd.projectcalico.org"]
     resources:
diff --git a/templates/calico-node-DaemonSet.yaml b/templates/calico-node-DaemonSet.yaml
index a690804..3866d2c 100644
--- a/templates/calico-node-DaemonSet.yaml
+++ b/templates/calico-node-DaemonSet.yaml
@@ -44,7 +44,7 @@ spec:
         # It can be deleted if this is a fresh installation, or if you have already
         # upgraded to use calico-ipam.
         - name: upgrade-ipam
-          image: docker.io/calico/cni:v3.23.1
+          image: docker.io/calico/cni:v3.23.2
           command: ["/opt/cni/bin/calico-ipam", "-upgrade"]
           envFrom:
           - configMapRef:
@@ -71,7 +71,7 @@ spec:
         # This container installs the CNI binaries
         # and CNI network config file on each node.
         - name: install-cni
-          image: docker.io/calico/cni:v3.23.1
+          image: docker.io/calico/cni:v3.23.2
           command: ["/opt/cni/bin/install"]
           envFrom:
           - configMapRef:
@@ -114,7 +114,7 @@ spec:
         # container programs network policy and routes on each
         # host.
         - name: calico-node
-          image: docker.io/calico/node:v3.23.1
+          image: docker.io/calico/node:v3.23.2
           envFrom:
           - configMapRef:
               # Allow KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT to be overridden for eBPF mode.
diff --git a/templates/calicoctl-Pod.yaml b/templates/calicoctl-Pod.yaml
index 8110719..81d4a0f 100644
--- a/templates/calicoctl-Pod.yaml
+++ b/templates/calicoctl-Pod.yaml
@@ -11,7 +11,7 @@ spec:
   serviceAccountName: calicoctl
   containers:
   - name: calicoctl
-    image: calico/ctl:v3.23.1
+    image: calico/ctl:v3.23.2
     command:
       - /calicoctl
     args:
diff --git a/templates/calicoctl-ServiceAccount.yaml b/templates/calicoctl-ServiceAccount.yaml
index f23dc36..3644481 100644
--- a/templates/calicoctl-ServiceAccount.yaml
+++ b/templates/calicoctl-ServiceAccount.yaml
@@ -1,7 +1,7 @@
-# Calico Version v3.23.1
-# https://projectcalico.docs.tigera.io/releases#v3.23.1
+# Calico Version v3.23.2
+# https://projectcalico.docs.tigera.io/releases#v3.23.2
 # This manifest includes the following component versions:
-#   calico/ctl:v3.23.1
+#   calico/ctl:v3.23.2
 
 apiVersion: v1
 kind: ServiceAccount