fix(calico-3.29.yaml): Disable the calico-apiserver 3.29.2 when Valid…

…ating Admission Policy checks until upstream tigrea operator adds the required rules

Because we are using tigera-operator during image test we are reliant on tigera-operator setting
up all the required rbac rules that are needed for calico-apiserver to run. This is a temporary solution
until tigera/operator#3780 is resovled upstream with a new release of tigera-operator.
This issue was highlighed in calico-apiserver 3.29.2 when Validating Admission Policy became enabled by default.
This patch disables the Validating Admission Policy in calico-apiserver until the issue is resolved.

Signed-off-by: philroche <phil.roche@chainguard.dev>

calico-3.29.yaml

@@ -1,7 +1,7 @@
 package:
   name: calico-3.29
   version: "3.29.2"
-  epoch: 0
+  epoch: 1
   description: "Cloud native networking and network security"
   copyright:
     - license: Apache-2.0
@@ -65,6 +65,16 @@ pipeline:
       repository: https://github.com/projectcalico/calico
       tag: v${{package.version}}
       expected-commit: c29210835f7a2795d0791974602c8e1c625c8ca1
+
+  # Because we are using tigera-operator during image test we are reliant on tigera-operator setting
+  # up all the required rbac rules that are needed for calico-apiserver to run. This is a temporary solution
+  # until https://github.com/tigera/operator/issues/3780 is resovled upstream with a new release of tigera-operator.
+  # This issue was highlighed in calico-apiserver 3.29.2 when Validating Admission Policy became enabled by default.
+  # This patch disables the Validating Admission Policy in calico-apiserver until the issue is resolved.
+  - uses: patch
+    with:
+      patches: calico-apiserver-disable-validating-admission-policy.patch
+
   - working-directory: felix
     pipeline:
       # Equivalent to target: "build-bpf"

calico-3.29/calico-apiserver-disable-validating-admission-policy.patch

@@ -0,0 +1,13 @@
+diff --git a/apiserver/cmd/apiserver/server/options.go b/apiserver/cmd/apiserver/server/options.go
+index 3701a9659..f8637cff6 100644
+--- a/apiserver/cmd/apiserver/server/options.go
++++ b/apiserver/cmd/apiserver/server/options.go
+@@ -68,7 +68,7 @@ func (o *CalicoServerOptions) addFlags(flags *pflag.FlagSet) {
+ 		"If true, prints swagger to stdout and exits.")
+ 	flags.StringVar(&o.SwaggerFilePath, "swagger-file-path", "./",
+ 		"If print-swagger is set true, then write swagger.json to location specified. Default is current directory.")
+-	flags.BoolVar(&o.EnableValidatingAdmissionPolicy, "enable-validating-admission-policy", true,
++	flags.BoolVar(&o.EnableValidatingAdmissionPolicy, "enable-validating-admission-policy", false,
+ 		"If true, establishes watches for ValidatingAdmissionPolicy at startup.")
+ }
+