kops 1.12 configuration for calico: use CRDs

[justinsb]

In kops 1.12 (I am proposing) we move to etcd3 with TLS and no external access.

Calico must move to use CRDs therefore; this is a disruptive upgrade cf #6408

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: justinsb

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [justinsb]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[chrisz100]

/test pull-kops-e2e-kubernetes-aws

[sstarcher]

@justinsb is this ready for test I'm hoping it will resolve my issue with migration from calico 2 -> 3
#6261

[KashifSaadat]

FYI I've just approved a PR (#6397) that will conflict with this one (updates apiversions of all addon manifests for v1.12) so will need to reapply the manifest file updates, sorry!

[chrisz100]

@justinsb is this ready to get merged? Lgtm! Plus really appreciate the efforts to get etcd3 tls only as a default in Kops.

[sstarcher]

I really need to setup the kops build process so I can test these things out. Looking forward to getting this in so I can test it out.

[justinsb]

@chrisz100 yes I believe this is ready for merge - it's one of the last blockers for 1.12.0-alpha.1 :-)

And then that'll also mean you don't need to do the build process @sstarcher - though it is much easier (well at least faster) now, if we ignore the time to download bazel 😛

[chrisz100]

/lgtm

:)