Let kube-controllers watch IPReservations

[fasaxc]

Description

RBAC change (one verb) to support a Calico change.

The kube-controllers node controller now watches IPReservation on its syncer so it
can publish the new ipam_ippool_reserved metric — how many addresses in each IP pool
an IPReservation covers, and so cannot be assigned. Its ClusterRole grants list on
ipreservations but not watch.

Without watch, the failure is quiet rather than loud: the syncer's List still
succeeds, so the controller reaches in-sync and keeps working, but it re-lists
IPReservations in a tight loop instead of watching them.

Pairs with projectcalico/calico#13331, which carries the
matching change to the Calico chart and static manifests.

Affects: pkg/render/kubecontrollers.

Testing: go test ./pkg/render/kubecontrollers/... passes. No test fixture asserts the
verb list for ipreservations. The behaviour it enables is covered on the Calico side
by a kube-controllers metrics FV that creates an IPReservation after its IP pool and
waits for the metric to change, which only passes if the watch is live.

Release Note

kube-controllers can now watch IPReservations, which it needs to report the ipam_ippool_reserved metric.

For PR author

• Tests for change.
• If changing pkg/apis/, run make gen-files
• If changing versions, run make gen-versions

For PR reviewers

A note for code reviewers - all pull requests must have the following:

• Milestone set according to targeted release.
• Appropriate labels:
  • kind/bug if this is a bugfix.
  • kind/enhancement if this is a a new feature.
  • enterprise if this PR applies to Calico Enterprise only.