component_hash_update: support calico_crds (#12122)

- add support for "no_arch" downloads: arch-indendendant files such as
  YAML manifests, helm charts, etc.
- wire calico_crds with it.

roles/kubespray-defaults/defaults/main/checksums.yml

@@ -536,6 +536,7 @@ ciliumcli_binary_checksums:
     0.15.16: sha256:f30095e1a0b926d2114b7a419141bea76e950b643182e97e666950ca05a205d9
     0.15.15: sha256:492279c1f960c79747290a5d1e1b21084a04a93f9e13ab4ae7df4c76fe808aff
 calico_crds_archive_checksums:
+  no_arch:
     3.29.2: sha256:1866b407213b6191627c0ce7be5a0d7c14a016823b3bbc2a6898c57be6c59917
     3.29.1: sha256:17894ed9f7487f1418e599fdeff5db9047374dee12d560114e25ff9147a455c3
     3.29.0: sha256:403a6b8616c4e97b081d7be27e9024f2f66b2d73a0ea037420a29689205b2064

roles/kubespray-defaults/defaults/main/download.yml

@@ -198,7 +198,6 @@ kubectl_binary_checksum: "{{ kubectl_checksums[image_arch][kube_version] }}"
 kubeadm_binary_checksum: "{{ kubeadm_checksums[image_arch][kube_version] }}"
 yq_binary_checksum: "{{ yq_checksums[image_arch][yq_version] }}"
 calicoctl_binary_checksum: "{{ calicoctl_binary_checksums[image_arch][calico_ctl_version] }}"
-calico_crds_archive_checksum: "{{ calico_crds_archive_checksums[calico_version] }}"
 ciliumcli_binary_checksum: "{{ ciliumcli_binary_checksums[image_arch][cilium_cli_version] }}"
 crictl_binary_checksum: "{{ crictl_checksums[image_arch][crictl_version] }}"
 crio_archive_checksum: "{{ crio_archive_checksums[image_arch][crio_version] }}"
@@ -791,7 +790,7 @@ downloads:
     file: true
     enabled: "{{ kube_network_plugin == 'calico' and calico_datastore == 'kdd' }}"
     dest: "{{ local_release_dir }}/calico-{{ calico_version }}-kdd-crds/{{ calico_version }}.tar.gz"
-    checksum: "{{ calico_crds_archive_checksum }}"
+    checksum: "{{ calico_crds_archive_checksums.no_arch[calico_version] }}"
     url: "{{ calico_crds_download_url }}"
     unarchive: true
     unarchive_extra_opts:

roles/network_plugin/calico/tasks/check.yml

@@ -27,8 +27,8 @@
 - name: Stop if supported Calico versions
   assert:
     that:
-      - "calico_version in calico_crds_archive_checksums.keys()"
-    msg: "Calico version not supported {{ calico_version }} not in {{ calico_crds_archive_checksums.keys() }}"
+      - "calico_version in calico_crds_archive_checksums.no_arch.keys()"
+    msg: "Calico version not supported {{ calico_version }} not in {{ calico_crds_archive_checksums.no_arch.keys() }}"
   run_once: true
   delegate_to: "{{ groups['kube_control_plane'][0] }}"
 

scripts/component_hash_update/src/component_hash_update/components.py

@@ -7,6 +7,11 @@ infos = {
         "url": "https://github.com/projectcalico/calico/releases/download/v{version}/SHA256SUMS",
         "graphql_id": "R_kgDOA87D0g",
     },
+    "calico_crds_archive": {
+        "url": "https://github.com/projectcalico/calico/archive/v{version}.tar.gz",
+        "graphql_id": "R_kgDOA87D0g",
+        "binary": True,
+    },
     "ciliumcli_binary": {
         "url": "https://github.com/cilium/cilium-cli/releases/download/v{version}/cilium-{os}-{arch}.tar.gz.sha256sum",
         "graphql_id": "R_kgDOE0nmLg",

scripts/component_hash_update/src/component_hash_update/download.py

@@ -47,14 +47,13 @@ arch_alt_name = {
     "arm64": "aarch64",
     "ppc64le": None,
     "arm": None,
+    "no_arch": None,
 }
 
 # TODO: downloads not supported
 # helm_archive: PGP signatures
-# calico_crds_archive: different yaml structure (in our download)
 
 # TODO:
-# noarch support -> k8s manifests, helm charts
 # different verification methods (gpg, cosign) ( needs download role changes) (or verify the sig in this script and only use the checksum in the playbook)
 # perf improvements (async)