buildchain,salt: bump calico to 3.33.0 by riadelhajjaji-scality · Pull Request #5165 · scality/metalk8s

riadelhajjaji-scality · 2026-10-13T15:35:21Z

Component: build, salt, networking

Context:

MetalK8s 136.0 ships Calico 3.32.0. Calico
3.33.0
brings bug and security fixes, and changes how Calico is packaged:
most components now ship in a single calico/calico image, and the
calico-node helper services run in a single calico process.

Summary:

Bump Calico from 3.32.0 to 3.33.0, and rebase
salt/metalk8s/kubernetes/cni/calico/deployed.sls on the upstream
v3.33.0 calico.yaml, keeping all MetalK8s patches
Images: the calico-cni and calico-kube-controllers images are no
longer published, and are replaced by calico (CNI plugin, IPAM,
kube-controllers) and the new calico-third-party-cni-plugins init
image (portmap, host-local, loopback...). versions.py, image.py
(IMGS_PER_REPOSITORY, REMOTE_NAMES, control-plane boot cache) and
BUMPING_CALICO.md are updated accordingly
Listening ports check: the health server on 127.0.0.1:9099 now
runs in the calico process, so the expected process becomes
calico. This prefix still matches the calico-node process of
Calico 3.32, so nodes not yet upgraded keep passing the check during
an upgrade
Add a 10s initialDelaySeconds to the calico-node readiness probe,
to avoid "BIRD is not ready" warnings on startup (documented in
BUMPING_CALICO.md)

Upstream changes reviewed against our configuration:

Felix, not BIRD, now programs the IPIP cluster routes by default
(BIRD programming is deprecated, removal planned for v3.35): no
configuration change needed, we keep IPIP CrossSubnet
The CNI configuration declares cniVersion 1.0.0, which requires
containerd >= 1.6: we ship containerd 2.x
BIRD default logging for BGP peers is more verbose (states, routes,
filters, events), which increases calico-node logs sent to Loki
Felix Prometheus metrics client auth defaults to NoClientCert:
Felix metrics are not enabled in MetalK8s
FIPS image variants removed, netkit device type and BPF attach
changes: not used by MetalK8s

Acceptance criteria:

The CI passes: installation, expansion, upgrade and downgrade tests
All calico-node pods are Ready, and BGP peering between nodes is
established, including after a calico-node pod restart
Pod-to-pod connectivity works across nodes
The listening ports check passes on nodes running Calico 3.32 and
3.33

Closes: #MK8S-351

bert-e · 2026-10-13T15:35:26Z

Hello riadelhajjaji-scality,

My role is to assist you with the merge of this
pull request. Please type @bert-e help to get information
on this process, or consult the user documentation.

Available options

name	description	privileged	authored
`/after_pull_request`	Wait for the given pull request id to be merged before continuing with the current one.
`/bypass_author_approval`	Bypass the pull request author's approval	⭐
`/bypass_build_status`	Bypass the build and test status	⭐
`/bypass_commit_size`	Bypass the check on the size of the changeset `TBA`	⭐
`/bypass_incompatible_branch`	Bypass the check on the source branch prefix	⭐
`/bypass_jira_check`	Bypass the Jira issue check	⭐
`/bypass_peer_approval`	Bypass the pull request peers' approval	⭐
`/bypass_leader_approval`	Bypass the pull request leaders' approval	⭐
`/bypass_source_branch_lineage`	Bypass the cross-branch contamination check	⭐
`/approve`	Instruct Bert-E that the author has approved the pull request.		✍️
`/create_pull_requests`	Allow the creation of integration pull requests.
`/create_integration_branches`	Allow the creation of integration branches.
`/no_octopus`	Prevent Wall-E from doing any octopus merge and use multiple consecutive merge instead
`/unanimity`	Change review acceptance criteria from `one reviewer at least` to `all reviewers`
`/wait`	Instruct Bert-E not to run until further notice.

Available commands

name	description	privileged
`/help`	Print Bert-E's manual in the pull request.
`/status`	Print Bert-E's current status in the pull request.
`/clear`	Remove all comments from Bert-E from the history `TBA`
`/retry`	Re-start a fresh build `TBA`
`/build`	Re-start a fresh build `TBA`
`/force_reset`	Delete integration branches & pull requests, and restart merge process from the beginning.
`/reset`	Try to remove integration branches unless there are commits on them which do not appear on the source branch.

Status report is not available.

bert-e · 2026-10-13T15:35:34Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
2 peers

Peer approvals must include at least 1 approval from the following list:

riadelhajjaji-scality · 2026-10-13T15:35:49Z

/changie Enhanced
Bump calico to 3.33.0
calico-cni/calico-kube-controllers images were replaced by calico and calico-third-party-cni-plugins

claude · 2026-10-13T15:37:00Z

No changelog entry for the Calico 3.33.0 bump; the unreleased entry Enhanced-20260727-091019-556322167.yaml still says 3.32.0
- Update that entry to 3.33.0 (it hasn't been released yet), or add a new one with a /changie comment
- Mention that the calico-cni/calico-kube-controllers images were replaced by calico and calico-third-party-cni-plugins

Review by Claude Code

bert-e · 2026-10-14T07:07:16Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
2 peers

Peer approvals must include at least 1 approval from the following list:

claude · 2026-10-14T07:08:58Z

LGTM

Review by Claude Code

claude · 2026-10-14T16:00:17Z

Unrelated CI change: the debug step sleep goes from 3600 to 7200 in single-node-test.yaml and multi-node-test.yaml
- Revert both to sleep 3600, or move the change to its own PR

Review by Claude Code

bert-e · 2026-10-15T09:27:55Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
2 peers

Peer approvals must include at least 1 approval from the following list:

claude · 2026-10-15T09:29:44Z

LGTM

Review by Claude Code

claude · 2026-10-15T09:36:29Z

LGTM

Review by Claude Code

ezekiel-alexrod

Adding release links to the changelog message could be handy too

#5163 (comment)

ezekiel-alexrod · 2026-10-15T10:38:22Z

 K8S_VERSION: str = f"{K8S_SHORT_VERSION}.{K8S_VERSION_PATCH}"

-CALICO_VERSION: str = "3.32.0"
+CALICO_VERSION: str = "3.33.0"


Calico 3.33 is tested on Kubernetes 1.35, 1.36 and 1.37 (_system-requirements.mdx in tigera/docs, "Supported versions"). development/136.0 still runs 1.34.7, and goes to 1.36.5 only with #5146. So I'd merge this one after #5146, and say it in the PR body.

Thanks for your comment !
I have already tested it to see compatibility with our Calico configuration, and I didn't notice any issues. I put what I have checked in #MK8S-351

Bump Calico from v3.32.0 to v3.33.0. The deployed.sls manifest is rebased on the upstream v3.33.0 calico.yaml, and all MetalK8s patches are kept (see BUMPING_CALICO.md). Breaking changes upstream, handled in this commit: - Single calico image: the calico/cni and calico/kube-controllers images are no longer published. They are replaced by calico/calico (CNI plugin, IPAM, kube-controllers), plus the new calico/third-party-cni-plugins init image (portmap, host-local, loopback...). Images, REMOTE_NAMES and the control-plane boot cache are updated accordingly. - Node process consolidation: calico-node now runs its helper services in a single `calico` process, which listens on the 127.0.0.1:9099 health port. The expected process in the listening ports check becomes `calico`, a prefix that still matches the `calico-node` process of older Calico, so nodes not upgraded yet keep passing the check during an upgrade. Changes that could impact MetalK8s: - Felix, not BIRD, now programs the IPIP cluster routes by default (BIRD programming is deprecated, removal planned for v3.35): no configuration change needed, we keep IPIP CrossSubnet. - The CNI configuration declares cniVersion 1.0.0, which requires containerd >= 1.6: we ship containerd 2.2.5. - BIRD default logging for BGP peers is more verbose (states, routes, filters, events), which increases calico-node logs sent to Loki. - Felix Prometheus metrics client auth defaults to NoClientCert: Felix metrics are not enabled in MetalK8s. - FIPS image variants removed, netkit device type and BPF attach changes: not used by MetalK8s (no FIPS images, veth, iptables dataplane). Also add a 10s initialDelaySeconds to the calico-node readiness probe, so the first check does not run before BIRD is started, avoiding "BIRD is not ready" warnings on startup. This patch is documented in BUMPING_CALICO.md so it is reapplied on next bumps. The digests have been updated by pulling the images from the registry using: gcrane digest docker.io/calico/calico:v3.33.0 gcrane digest docker.io/calico/node:v3.33.0 gcrane digest docker.io/calico/third-party-cni-plugins:v3.33.0 Ref: MK8S-351

bert-e · 2026-10-16T07:25:57Z

Branches have diverged

This pull request's source branch feature/MK8S-351-bump-calico has diverged from
development/136.0 by more than 50 commits.

To avoid any integration risks, please re-synchronize them using one of the
following solutions:

Merge origin/development/136.0 into feature/MK8S-351-bump-calico
Rebase feature/MK8S-351-bump-calico onto origin/development/136.0

Note: If you choose to rebase, you may have to ask me to rebuild
integration branches using the reset command.

claude · 2026-10-16T07:27:34Z

LGTM

Review by Claude Code

g-carre · 2026-10-19T16:12:54Z

@riadelhajjaji-scality please resolve conflicts

…K8S-351-bump-calico # Conflicts: # buildchain/buildchain/image.py

bert-e · 2026-10-19T16:34:37Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
2 peers

Peer approvals must include at least 1 approval from the following list:

claude · 2026-10-19T16:36:10Z

LGTM

Review by Claude Code

github-actions · 2026-10-19T17:07:06Z

✅ Changelog check passed.

claude · 2026-10-19T17:09:03Z

@@ -364,7 +363,6 @@ def _local_image(name: str, **kwargs: Any) -> targets.LocalImage:
        "kube-controller-manager",
        "kube-scheduler",
        "coredns",


Moving calico-kube-controllers out of the control-plane boot cache makes the unreleased changelog entry .changes/unreleased/Enhanced-20260820-140410-488064253.yaml wrong: it still lists calico-kube-controllers in metalk8s-boot-cache-control-plane. Please update that entry (control-plane: kube-apiserver, kube-controller-manager, kube-scheduler, CoreDNS; Calico images all in the worker cache).

— Claude Code

claude · 2026-10-19T17:09:09Z

The boot cache changelog entry .changes/unreleased/Enhanced-20260820-140410-488064253.yaml still lists calico-kube-controllers in the control-plane boot cache, which this PR removes
- Drop calico-kube-controllers from the control-plane list in that entry; all Calico images are now in the worker cache
- You could also merge the 3.33.0 entry into the existing 3.32.0 one (Enhanced-20260727-091019-556322167.yaml), so the release notes for this version show only the final Calico version

Review by Claude Code

riadelhajjaji-scality requested a review from a team as a code owner October 13, 2026 15:35

claude Bot reviewed Oct 13, 2026

View reviewed changes

Comment thread buildchain/buildchain/versions.py

riadelhajjaji-scality self-assigned this Oct 14, 2026

claude Bot reviewed Oct 14, 2026

View reviewed changes

Comment thread .github/workflows/single-node-test.yaml Outdated

claude Bot reviewed Oct 14, 2026

View reviewed changes

Comment thread .github/workflows/multi-node-test.yaml Outdated

riadelhajjaji-scality force-pushed the feature/MK8S-351-bump-calico branch from 906a64a to 4dc5a6c Compare October 15, 2026 09:35

ezekiel-alexrod reviewed Oct 15, 2026

View reviewed changes

riadelhajjaji-scality force-pushed the feature/MK8S-351-bump-calico branch from 0d823e2 to f0d7f05 Compare October 16, 2026 07:25

riadelhajjaji-scality requested review from a team as code owners October 16, 2026 07:25

riadelhajjaji-scality requested review from ezekiel-alexrod and g-carre and removed request for a team October 16, 2026 07:25

Merge remote-tracking branch 'origin/development/136.0' into feature/M…

3acf13e

…K8S-351-bump-calico # Conflicts: # buildchain/buildchain/image.py

buildchain: fix spelling lint in boot cache comment

40f6bea

claude Bot reviewed Oct 19, 2026

View reviewed changes

Conversation

riadelhajjaji-scality commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bert-e commented Oct 13, 2026

Hello riadelhajjaji-scality,

Uh oh!

bert-e commented Oct 13, 2026

Waiting for approval

Uh oh!

riadelhajjaji-scality commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

claude Bot commented Oct 13, 2026

Uh oh!

bert-e commented Oct 14, 2026

Waiting for approval

Uh oh!

claude Bot commented Oct 14, 2026

Uh oh!

Uh oh!

Uh oh!

claude Bot commented Oct 14, 2026

Uh oh!

bert-e commented Oct 15, 2026

Waiting for approval

Uh oh!

claude Bot commented Oct 15, 2026

Uh oh!

claude Bot commented Oct 15, 2026

Uh oh!

ezekiel-alexrod left a comment

Choose a reason for hiding this comment

Uh oh!

ezekiel-alexrod Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

riadelhajjaji-scality Oct 16, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

bert-e commented Oct 16, 2026

Branches have diverged

Uh oh!

claude Bot commented Oct 16, 2026

Uh oh!

g-carre commented Oct 19, 2026

Uh oh!

bert-e commented Oct 19, 2026

Waiting for approval

Uh oh!

claude Bot commented Oct 19, 2026

Uh oh!

github-actions Bot commented Oct 19, 2026

Uh oh!

claude Bot Oct 19, 2026

Choose a reason for hiding this comment

Uh oh!

claude Bot commented Oct 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

riadelhajjaji-scality commented Oct 13, 2026 •

edited

Loading

riadelhajjaji-scality commented Oct 13, 2026 •

edited

Loading

ezekiel-alexrod Oct 15, 2026 •

edited

Loading