AddBindingForKubeSystemNode updates the ClusterRoleBinding passed in to also bind the service account in the kube-system namespace to the Role.

We create a cluster role and cluster role binding to give the kube-system calico-node permissions to create serviceaccount tokens.

LimitDaemonSetToMigratedNodes updates the ds DaemonSet passed in with a nodeSelector that will only allow pods to be schedueled on nodes with the key:value projectcalico.org/operator-node-migration:migrated.

NewCoreNamespaceMigration initializes a CoreNamespaceMigration and returns a handle to it.

SetTyphaAntiAffinity updates the Deployment passed in with a PodAntiAffinity to ensure the new typha pods will not be scheduled to the same nodes as the 'old' typha pods.

Converter converts an unmanaged Calico install into an Installation resource which represents said install.