Making /var/log/calico/cni vol mount writable

Signed-off-by: Mark Rossett <[email protected]>

Author: marosset

templates/addons/calico.yaml

@@ -6212,6 +6212,9 @@ spec:
         securityContext:
           privileged: true
         volumeMounts:
+        - mountPath: /var/log/calico/cni
+          name: cni-log-dir
+          readOnly: false
         - mountPath: /host/etc/cni/net.d
           name: cni-net-dir
           readOnly: false
@@ -6231,9 +6234,6 @@ spec:
           name: policysync
         - mountPath: /sys/fs/bpf
           name: bpffs
-        - mountPath: /var/log/calico/cni
-          name: cni-log-dir
-          readOnly: true
       hostNetwork: true
       initContainers:
       - command:
@@ -6333,6 +6333,10 @@ spec:
       - effect: NoExecute
         operator: Exists
       volumes:
+      - hostPath:
+          path: /var/log/calico/cni
+          type: DirectoryOrCreate
+        name: cni-log-dir
       - hostPath:
           path: /lib/modules
         name: lib-modules
@@ -6366,9 +6370,6 @@ spec:
       - hostPath:
           path: /etc/cni/net.d
         name: cni-net-dir
-      - hostPath:
-          path: /var/log/calico/cni
-        name: cni-log-dir
       - hostPath:
           path: /var/lib/cni/networks
         name: host-local-net-dir

templates/addons/calico/patches/calico-node.yaml

@@ -14,4 +14,15 @@ spec:
           value: "ChecksumOffloadBroken=true"
         - name: CALICO_IPV4POOL_VXLAN	
           value: "Always"
+        volumeMounts:
+        # Fix CNI logging - make cni-log-dir writable
+        - mountPath: /var/log/calico/cni
+          name: cni-log-dir
+          readOnly: false
+      volumes:
+      # Ensure CNI log directory gets created
+      - hostPath:
+          path: /var/log/calico/cni
+          type: DirectoryOrCreate
+        name: cni-log-dir