Calico fails on OpenShift 4.22 due to CNI version mismatch

[mgencur]

OpenShift uses Multus CNI which has been bumped to use CNI 1.1.0 in cluster-network-operator PR. Multus has a strict version compatibility check in generator.go which requires the primary CNI delegate (Calico) to use at least CNI 0.4.0. The current version is hardcoded as 0.3.1 in node.go.

This results in the following error in kube-multus Pod:

[error] failed to create the configuration manager for the primary CNI plugin: 
failed to load the primary CNI configuration as a multus delegate with error 
'delegate cni version is 0.3.1 while top level cni version is 1.1.0'

[mgencur]

The current workaround is patching the cni-config map after the Tigera operator deploys it. However, the annotation is unsupported:

# Annotate the configmap to prevent the operator from reverting the patch.
oc annotate configmap cni-config -n calico-system unsupported.operator.tigera.io/ignore=true

oc -n calico-system get cm cni-config -o yaml | \
  sed 's/\\"cniVersion\\": \\"0.3.1\\"/\\"cniVersion\\": \\"0.4.0\\"/' | \
  oc apply -f -
oc -n calico-system rollout restart ds/calico-node
oc -n calico-system rollout status ds/calico-node --timeout=5m

Another option is to scale down the tigera operator deployment before patching the ConfigMap. But it will stop reconciling resources, including TigeraStatus.