[radixo]

Description

Companion to the calico-side "Resolve pod netns in Felix" change (implements design tigera/designs#62). Felix's new pod-netns resolution reaches host-mount-namespace paths (pod netns files, the CRI socket) through host PID-1's root at /host/proc/1/root, which works regardless of calico-node's PID namespace and does not require hostPID=true.

This PR bind-mounts the host's /proc into calico-node at /host/proc (read-only), reusing the existing nodeproc HostPath(/proc) volume. The existing hostPID=true usage for process-path collection is left as-is; converging it is a separate Enterprise follow-up.

• Affected: pkg/render/node.go (+ node render test). No API change.
• The ValidatingAdmissionPolicy delivery and the Installation.spec.cniAnnotationsPolicy toggle land in a follow-up PR stacked on this one.

Release Note

The operator bind-mounts the host /proc into calico-node at /host/proc (read-only) to support Felix pod network-namespace resolution.

🤖 Generated with Claude Code

[radixo]

Companion Calico PR: projectcalico/calico#13501 (Felix pod-netns resolution). Follow-up (stacked on this one): the CNI-annotations ValidatingAdmissionPolicy delivery + Installation.spec.cniAnnotationsPolicy toggle.

[caseydavenport]

Heads up - operator development on master has moved into the Calico monorepo at projectcalico/calico, under operator/. This repo only carries the release-v1.41 through release-v1.44 branches now, so I'm closing this out here. Please re-open it against projectcalico/calico and we'll review it there.

The move shifted every file down a directory and changed the import prefix, so a plain cherry-pick won't apply. This gets most of the way:

# in your tigera/operator checkout
git format-patch master..HEAD --stdout > /tmp/pr.patch

# in a projectcalico/calico checkout
git apply --directory=operator /tmp/pr.patch
grep -rl 'github.com/tigera/operator' operator | xargs sed -i 's|github.com/tigera/operator|github.com/projectcalico/calico/operator|g'

Anything the PR touched outside the operator tree (.semaphore/, .github/) doesn't map into operator/, so that part needs redoing by hand. Sorry for the churn.