Calico v3.28.[0-1] checksums and change calico default version (#11234)

* make calico api server manifest backward compatible with version older than 3.27.3

Add 3.28.1 checksums
Add 3.28.0 checksums
Change default version to 3.27.3

* change default calico version to 3.28.1

* Set mount type to DirectoryOrCreate for hostPath needed by Calico

roles/network_plugin/calico/templates/calico-apiserver.yml.j2

@@ -72,6 +72,15 @@ spec:
           initialDelaySeconds: 90
           periodSeconds: 10
         name: calico-apiserver
+{% if calico_version is version('v3.28.0', '>=') %}
+        readinessProbe:
+          httpGet:
+            path: /readyz
+            port: 5443
+            scheme: HTTPS
+          timeoutSeconds: 5
+          periodSeconds: 60
+{% else %}
         readinessProbe:
           exec:
             command:
@@ -79,6 +88,7 @@ spec:
           failureThreshold: 5
           initialDelaySeconds: 5
           periodSeconds: 10
+{% endif %}
         securityContext:
           privileged: false
           runAsUser: 0
@@ -173,7 +183,16 @@ rules:
   - create
   - update
   - delete
-
+{% if calico_version is version('v3.28.0', '>=') %}
+- apiGroups:
+  - policy
+  resourceNames:
+  - calico-apiserver
+  resources:
+  - podsecuritypolicies
+  verbs:
+  - use
+{% endif %}
 ---
 
 apiVersion: rbac.authorization.k8s.io/v1

roles/network_plugin/calico/templates/calico-node.yml.j2

@@ -411,9 +411,11 @@ spec:
         - name: var-run-calico
           hostPath:
             path: /var/run/calico
+            type: DirectoryOrCreate
         - name: var-lib-calico
           hostPath:
             path: /var/lib/calico
+            type: DirectoryOrCreate
         # Used to install CNI.
         - name: cni-net-dir
           hostPath:
@@ -421,6 +423,7 @@ spec:
         - name: cni-bin-dir
           hostPath:
             path: /opt/cni/bin
+            type: DirectoryOrCreate
 {% if calico_datastore == "etcd" %}
         # Mount in the etcd TLS secrets.
         - name: etcd-certs