ClusterRole mismatching between calico v3.25.2 and v3.26.x or above

[hadi2f244]

Comparing Calico v3.26.0 manifest with v3.25.2 shows this different

# Source: calico/templates/calico-node-rbac.yaml
# Include a clusterrole for the calico-node DaemonSet,
# and bind it to the calico-node serviceaccount.
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: calico-node
rules:
  # Used for creating service account tokens to be used by the CNI plugin
  - apiGroups: [""]
    resources:
      - serviceaccounts/token
    resourceNames:
      - calico-cni-plugin  <--> calico-node
    verbs:
      - create

Possible Solution

Merging this part of manifests:

# Source: calico/templates/calico-node-rbac.yaml
# Include a clusterrole for the calico-node DaemonSet,
# and bind it to the calico-node serviceaccount.
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: calico-node
rules:
  # Used for creating service account tokens to be used by the CNI plugin
  - apiGroups: [""]
    resources:
      - serviceaccounts/token
    resourceNames:
      - calico-cni-plugin
      - calico-node
    verbs:
      - create

Your Environment

• Calico v3.25.2 and v3.26.0

[caseydavenport]

This is intentional - Calico v3.26 and above does not allow calico/node to create tokens for itself. We removed that permission as part of a security improvement.

When installing Calico, you need to make sure that you are using the manifests / RBAC that are associated with the version you are trying to install.

[hadi2f244]

Thanks a lot. This issue is related to Kubespray and should be fix. I will follow there.