v1-to-v3 CRD migration controller to enable API server removal

.gitignore

@@ -26,6 +26,7 @@ builder.coverprofile
 
 /* Image build stamp files for kind testing */
 .stamp.*
+hack/test/kind/infra/operator
 
 /* Created by local kind cluster */
 hack/test/kind/kind
@@ -40,4 +41,4 @@ pod2daemon/node-driver-registrar/
 /networking-calico/upper-constraints*.txt
 
 /* Created by libcalico-go UTs */
-ut-tmp-dir
+ut-tmp-dir

Makefile

@@ -193,6 +193,13 @@ kind-up: kind-build-images
 	$(MAKE) kind-cluster-create CALICO_API_GROUP=$(KIND_CALICO_API_GROUP)
 	$(MAKE) kind-deploy
 
+## Build images, create a kind cluster with v1 CRDs, deploy Calico, and run the
+## v1-to-v3 migration test.
+.PHONY: kind-migration-test
+kind-migration-test:
+	KIND_CALICO_API_GROUP=crd.projectcalico.org/v1 $(MAKE) kind-up
+	$(REPO_ROOT)/hack/test/kind/migration/run_test.sh
+
 ## Create a kind cluster and run all e2e tests.
 e2e-test:
 	$(MAKE) -C e2e build

charts/tigera-operator/templates/tigera-operator/02-role-tigera-operator.yaml

@@ -696,3 +696,13 @@ rules:
       - update
     resourceNames:
       - istiod
+  # The operator checks DatastoreMigration CRs at startup and during reconciliation
+  # to determine whether a v1-to-v3 CRD migration is in progress or complete.
+  - apiGroups:
+      - migration.projectcalico.org
+    resources:
+      - datastoremigrations
+    verbs:
+      - get
+      - list
+      - watch

hack/test/kind/migration/connectivity.yaml

@@ -0,0 +1,96 @@
+# Connectivity test workloads for migration testing. A client pod continuously
+# probes the server pod via a Service. After migration, we check the client's
+# logs for any probe failures — there should be zero packet loss since the
+# dataplane state is cached while the datastore is locked.
+
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: migration-test
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: server
+  namespace: migration-test
+  labels:
+    app: migration-server
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: migration-server
+  template:
+    metadata:
+      labels:
+        app: migration-server
+    spec:
+      containers:
+      - name: server
+        image: busybox:1.36
+        command:
+        - /bin/sh
+        - -c
+        - |
+          mkdir -p /www
+          echo "ok" > /www/index.html
+          httpd -f -p 8080 -h /www
+        ports:
+        - containerPort: 8080
+        readinessProbe:
+          httpGet:
+            path: /
+            port: 8080
+          initialDelaySeconds: 1
+          periodSeconds: 2
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: server
+  namespace: migration-test
+spec:
+  selector:
+    app: migration-server
+  ports:
+  - port: 80
+    targetPort: 8080
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: client
+  namespace: migration-test
+  labels:
+    app: migration-client
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: migration-client
+  template:
+    metadata:
+      labels:
+        app: migration-client
+    spec:
+      containers:
+      - name: client
+        image: busybox:1.36
+        command:
+        - /bin/sh
+        - -c
+        - |
+          echo "PROBE_START $(date +%s)"
+          while true; do
+            ts=$(date +%s)
+            if wget -q -T 2 -O /dev/null http://server.migration-test.svc.cluster.local 2>/dev/null; then
+              echo "PROBE_OK $ts"
+            else
+              echo "PROBE_FAIL $ts"
+            fi
+            sleep 1
+          done