After update from 1.27 to 1.28 Calico is ignoring juju network binding for cni

[Gustavo Sanchez]

Juju status looks all green and healthy
https://paste.ubuntu.com/p/Q2g8P9Nmp4/

NOTE: calico is at the moment using channel 1.28/candidate
I though the issue might be related to this one https://bugs.launchpad.net/charm-calico/+bug/2034737
So I refreshed only calico from 1.28/stable to 1.28/candidate to get the patch for that bug
But, that doesn't seem to be related

It looks like the charm is ignoring the bind on cni to oam-space (192.168.20.0/24) and instead taking any host IP into the calico mesh

It should be using the oam IPs instead of taking any when running calicoctl node status
https://pastebin.ubuntu.com/p/y9t6qznxym/

Workaround (see in pastebin for commands)
Manually updating network IP used for the calico bind communication between pods works again

[Chris Johnston (cjohnston)]

I was able to reproduce this as well on an upgrade from 1.27 to 1.28.

[George Kraft (cynerva)]

In CK 1.27 and earlier, there was a calico-node systemd service that each unit configured with a specific IP value provided by Juju.

In CK 1.28, the systemd service was replaced with a calico-node DaemonSet that uses IP autodetection. With this architecture, it's no longer possible for units to provide their own unit-specific configuration to calico-node.

To fix this, I think we need to either configure calico-node with IP_AUTODETECTION_METHOD=cidr=<bind-cidr>, or we need to split up the DaemonSet so that each unit can configure its own service independently.

[Chris Johnston (cjohnston)]

https://github.com/charmed-kubernetes/charm-calico/pull/104

[Kevin W Monroe (kwmonroe)]

@mateo, please backport to release-1.28.

[Adam Dyess (addyess)]

Backport completed