From b3bd74e840b59cbe5872d7f42d6e66caffc9b288 Mon Sep 17 00:00:00 2001 From: caseydavenport <1944093+caseydavenport@users.noreply.github.com> Date: Tue, 14 Jul 2026 04:45:05 +0000 Subject: [PATCH] Automatic API update from projectcalico/calico master --- ...projectcalico.org_felixconfigurations.yaml | 9 +++--- ...ico.org_kubecontrollersconfigurations.yaml | 14 ++++++++++ deps.txt | 8 +++--- go.mod | 14 +++++----- go.sum | 28 +++++++++---------- lib.Makefile | 3 ++ pkg/apis/projectcalico/v3/felixconfig.go | 6 ++-- .../projectcalico/v3/kubecontrollersconfig.go | 7 +++-- .../projectcalico/v3/zz_generated.deepcopy.go | 7 +++++ .../internal/internal.go | 5 ++++ .../v3/felixconfigurationspec.go | 6 ++-- .../projectcalico/v3/template.go | 16 +++++++++++ pkg/openapi/generated.openapi.go | 20 +++++++++++-- 13 files changed, 106 insertions(+), 37 deletions(-) diff --git a/config/crd/projectcalico.org_felixconfigurations.yaml b/config/crd/projectcalico.org_felixconfigurations.yaml index fb577c133..43e3c7209 100644 --- a/config/crd/projectcalico.org_felixconfigurations.yaml +++ b/config/crd/projectcalico.org_felixconfigurations.yaml @@ -1120,9 +1120,10 @@ spec: type: integer nftablesMode: default: Auto - description: - "NFTablesMode configures nftables support in Felix. [Default: - Auto]" + description: |- + NFTablesMode configures nftables support in Felix. In Auto mode, Felix uses the + nftables dataplane if kube-proxy is detected to be running in nftables mode. + [Default: Auto] enum: - Disabled - Enabled @@ -1189,7 +1190,7 @@ spec: prometheusMetricsClientAuth: description: |- PrometheusMetricsClientAuth specifies the client authentication type for the /metrics endpoint. - This determines how the server validates client certificates. Default is "RequireAndVerifyClientCert". + This determines how the server validates client certificates. Default is "NoClientCert". type: string prometheusMetricsEnabled: description: diff --git a/config/crd/projectcalico.org_kubecontrollersconfigurations.yaml b/config/crd/projectcalico.org_kubecontrollersconfigurations.yaml index 3e8fd4a0b..6ec006d96 100644 --- a/config/crd/projectcalico.org_kubecontrollersconfigurations.yaml +++ b/config/crd/projectcalico.org_kubecontrollersconfigurations.yaml @@ -115,6 +115,13 @@ spec: AutoHostEndpoints items: properties: + annotations: + additionalProperties: + type: string + description: + Annotations adds the specified annotations + to the generated AutoHostEndpoint. + type: object generateName: description: GenerateName is appended to the end @@ -344,6 +351,13 @@ spec: AutoHostEndpoints items: properties: + annotations: + additionalProperties: + type: string + description: + Annotations adds the specified + annotations to the generated AutoHostEndpoint. + type: object generateName: description: GenerateName is appended to the diff --git a/deps.txt b/deps.txt index 89a9e1756..a00a547e0 100644 --- a/deps.txt +++ b/deps.txt @@ -25,11 +25,11 @@ github.com/spf13/pflag v1.0.10 github.com/x448/float16 v0.8.4 go.yaml.in/yaml/v2 v2.4.4 go.yaml.in/yaml/v3 v3.0.4 -golang.org/x/net v0.56.0 +golang.org/x/net v0.57.0 golang.org/x/oauth2 v0.36.0 -golang.org/x/sys v0.46.0 -golang.org/x/term v0.44.0 -golang.org/x/text v0.38.0 +golang.org/x/sys v0.47.0 +golang.org/x/term v0.45.0 +golang.org/x/text v0.40.0 golang.org/x/time v0.15.0 google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af gopkg.in/evanphx/json-patch.v4 v4.13.0 diff --git a/go.mod b/go.mod index 0f356c510..d41bfe88d 100644 --- a/go.mod +++ b/go.mod @@ -40,15 +40,15 @@ require ( github.com/x448/float16 v0.8.4 // indirect go.yaml.in/yaml/v2 v2.4.3 // indirect go.yaml.in/yaml/v3 v3.0.4 // indirect - golang.org/x/mod v0.37.0 // indirect - golang.org/x/net v0.56.0 // indirect + golang.org/x/mod v0.38.0 // indirect + golang.org/x/net v0.57.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect - golang.org/x/sync v0.21.0 // indirect - golang.org/x/sys v0.46.0 // indirect - golang.org/x/term v0.44.0 // indirect - golang.org/x/text v0.38.0 // indirect + golang.org/x/sync v0.22.0 // indirect + golang.org/x/sys v0.47.0 // indirect + golang.org/x/term v0.45.0 // indirect + golang.org/x/text v0.40.0 // indirect golang.org/x/time v0.15.0 // indirect - golang.org/x/tools v0.47.0 // indirect + golang.org/x/tools v0.48.0 // indirect google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect gopkg.in/inf.v0 v0.9.1 // indirect diff --git a/go.sum b/go.sum index 15c44919b..f71160bc9 100644 --- a/go.sum +++ b/go.sum @@ -105,24 +105,24 @@ go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0= go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8= go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= -golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ= -golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0= -golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o= -golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec= +golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk= +golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40= +golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= +golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= -golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM= -golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= -golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw= -golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= -golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc= -golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y= -golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE= -golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4= +golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= +golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= +golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= +golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0= +golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w= +golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs= +golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY= golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= -golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q= -golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA= +golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE= +golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk= google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI= google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= diff --git a/lib.Makefile b/lib.Makefile index 14e68c4cf..b123af0f3 100644 --- a/lib.Makefile +++ b/lib.Makefile @@ -1661,6 +1661,9 @@ endif touch $@ kind-cluster-destroy kind-down: $(KIND) $(KUBECTL) + # Tear down the e2e external node (if any) alongside the cluster. Idempotent + # and a no-op when no external node was created (e.g. non-BPF jobs). + -$(KIND_DIR)/external-node.sh down # We need to drain the cluster gracefully when shutting down to avoid a netdev unregister error from the kernel. # This requires we execute CNI del on pods with pod networking. -$(KIND) delete cluster --name $(KIND_NAME) diff --git a/pkg/apis/projectcalico/v3/felixconfig.go b/pkg/apis/projectcalico/v3/felixconfig.go index 437a5ac8c..f303b465e 100644 --- a/pkg/apis/projectcalico/v3/felixconfig.go +++ b/pkg/apis/projectcalico/v3/felixconfig.go @@ -525,7 +525,7 @@ type FelixConfigurationSpec struct { PrometheusMetricsKeyFile *string `json:"prometheusMetricsKeyFile,omitempty"` // PrometheusMetricsClientAuth specifies the client authentication type for the /metrics endpoint. - // This determines how the server validates client certificates. Default is "RequireAndVerifyClientCert". + // This determines how the server validates client certificates. Default is "NoClientCert". PrometheusMetricsClientAuth *PrometheusMetricsClientAuthType `json:"prometheusMetricsClientAuth,omitempty" validate:"omitempty,oneof=RequireAndVerifyClientCert RequireAnyClientCert VerifyClientCertIfGiven NoClientCert"` // FailsafeInboundHostPorts is a list of ProtoPort struct objects including UDP/TCP/SCTP ports and CIDRs that Felix will @@ -674,7 +674,9 @@ type FelixConfigurationSpec struct { // iptables. [Default: false] GenericXDPEnabled *bool `json:"genericXDPEnabled,omitempty" confignamev1:"GenericXDPEnabled"` - // NFTablesMode configures nftables support in Felix. [Default: Auto] + // NFTablesMode configures nftables support in Felix. In Auto mode, Felix uses the + // nftables dataplane if kube-proxy is detected to be running in nftables mode. + // [Default: Auto] // +kubebuilder:default=Auto NFTablesMode *NFTablesMode `json:"nftablesMode,omitempty"` diff --git a/pkg/apis/projectcalico/v3/kubecontrollersconfig.go b/pkg/apis/projectcalico/v3/kubecontrollersconfig.go index b4da9dfbc..21c65bff3 100644 --- a/pkg/apis/projectcalico/v3/kubecontrollersconfig.go +++ b/pkg/apis/projectcalico/v3/kubecontrollersconfig.go @@ -1,4 +1,4 @@ -// Copyright (c) 2020-2021 Tigera, Inc. All rights reserved. +// Copyright (c) 2020-2026 Tigera, Inc. All rights reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. @@ -155,7 +155,7 @@ type AutoHostEndpointConfig struct { // Templates contains definition for creating AutoHostEndpoints // +listType=atomic - Templates []Template `json:"templates,omitempty" validate:"omitempty"` + Templates []Template `json:"templates,omitempty" validate:"omitempty,dive"` } // DefaultHostEndpointMode controls whether a default host endpoint is created for each node. @@ -185,6 +185,9 @@ type Template struct { // Labels adds the specified labels to the generated AutoHostEndpoint, labels from node with the same name will be overwritten by values from the template label Labels map[string]string `json:"labels,omitempty" validate:"omitempty,labels"` + // Annotations adds the specified annotations to the generated AutoHostEndpoint. + Annotations map[string]string `json:"annotations,omitempty"` + // NodeSelector allows the AutoHostEndpoint to be created only for specific nodes NodeSelector string `json:"nodeSelector,omitempty" validate:"omitempty,selector"` } diff --git a/pkg/apis/projectcalico/v3/zz_generated.deepcopy.go b/pkg/apis/projectcalico/v3/zz_generated.deepcopy.go index bcfe9f256..40dd4e534 100644 --- a/pkg/apis/projectcalico/v3/zz_generated.deepcopy.go +++ b/pkg/apis/projectcalico/v3/zz_generated.deepcopy.go @@ -4066,6 +4066,13 @@ func (in *Template) DeepCopyInto(out *Template) { (*out)[key] = val } } + if in.Annotations != nil { + in, out := &in.Annotations, &out.Annotations + *out = make(map[string]string, len(*in)) + for key, val := range *in { + (*out)[key] = val + } + } return } diff --git a/pkg/client/applyconfiguration_generated/internal/internal.go b/pkg/client/applyconfiguration_generated/internal/internal.go index 90c78b289..8ab34fd82 100644 --- a/pkg/client/applyconfiguration_generated/internal/internal.go +++ b/pkg/client/applyconfiguration_generated/internal/internal.go @@ -2347,6 +2347,11 @@ var schemaYAML = typed.YAMLObject(`types: - name: com.github.projectcalico.api.pkg.apis.projectcalico.v3.Template map: fields: + - name: annotations + type: + map: + elementType: + scalar: string - name: generateName type: scalar: string diff --git a/pkg/client/applyconfiguration_generated/projectcalico/v3/felixconfigurationspec.go b/pkg/client/applyconfiguration_generated/projectcalico/v3/felixconfigurationspec.go index 133b570a8..dd0c2ffad 100644 --- a/pkg/client/applyconfiguration_generated/projectcalico/v3/felixconfigurationspec.go +++ b/pkg/client/applyconfiguration_generated/projectcalico/v3/felixconfigurationspec.go @@ -254,7 +254,7 @@ type FelixConfigurationSpecApplyConfiguration struct { // used for securing the /metrics endpoint. The private key must be valid and accessible by the calico-node process. PrometheusMetricsKeyFile *string `json:"prometheusMetricsKeyFile,omitempty"` // PrometheusMetricsClientAuth specifies the client authentication type for the /metrics endpoint. - // This determines how the server validates client certificates. Default is "RequireAndVerifyClientCert". + // This determines how the server validates client certificates. Default is "NoClientCert". PrometheusMetricsClientAuth *projectcalicov3.PrometheusMetricsClientAuthType `json:"prometheusMetricsClientAuth,omitempty"` // FailsafeInboundHostPorts is a list of ProtoPort struct objects including UDP/TCP/SCTP ports and CIDRs that Felix will // allow incoming traffic to host endpoints on irrespective of the security policy. This is useful to avoid accidentally @@ -358,7 +358,9 @@ type FelixConfigurationSpecApplyConfiguration struct { // modes can use XDP. This is not recommended since it doesn't provide better performance than // iptables. [Default: false] GenericXDPEnabled *bool `json:"genericXDPEnabled,omitempty"` - // NFTablesMode configures nftables support in Felix. [Default: Auto] + // NFTablesMode configures nftables support in Felix. In Auto mode, Felix uses the + // nftables dataplane if kube-proxy is detected to be running in nftables mode. + // [Default: Auto] NFTablesMode *projectcalicov3.NFTablesMode `json:"nftablesMode,omitempty"` // NftablesRefreshInterval controls the interval at which Felix periodically refreshes the nftables rules. [Default: 90s] NftablesRefreshInterval *v1.Duration `json:"nftablesRefreshInterval,omitempty"` diff --git a/pkg/client/applyconfiguration_generated/projectcalico/v3/template.go b/pkg/client/applyconfiguration_generated/projectcalico/v3/template.go index 6d861a776..b4e6aa981 100644 --- a/pkg/client/applyconfiguration_generated/projectcalico/v3/template.go +++ b/pkg/client/applyconfiguration_generated/projectcalico/v3/template.go @@ -18,6 +18,8 @@ type TemplateApplyConfiguration struct { InterfacePattern *string `json:"interfacePattern,omitempty"` // Labels adds the specified labels to the generated AutoHostEndpoint, labels from node with the same name will be overwritten by values from the template label Labels map[string]string `json:"labels,omitempty"` + // Annotations adds the specified annotations to the generated AutoHostEndpoint. + Annotations map[string]string `json:"annotations,omitempty"` // NodeSelector allows the AutoHostEndpoint to be created only for specific nodes NodeSelector *string `json:"nodeSelector,omitempty"` } @@ -68,6 +70,20 @@ func (b *TemplateApplyConfiguration) WithLabels(entries map[string]string) *Temp return b } +// WithAnnotations puts the entries into the Annotations field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, the entries provided by each call will be put on the Annotations field, +// overwriting an existing map entries in Annotations field with the same key. +func (b *TemplateApplyConfiguration) WithAnnotations(entries map[string]string) *TemplateApplyConfiguration { + if b.Annotations == nil && len(entries) > 0 { + b.Annotations = make(map[string]string, len(entries)) + } + for k, v := range entries { + b.Annotations[k] = v + } + return b +} + // WithNodeSelector sets the NodeSelector field in the declarative configuration to the given value // and returns the receiver, so that objects can be built by chaining "With" function invocations. // If called multiple times, the NodeSelector field is set to the value of the last call. diff --git a/pkg/openapi/generated.openapi.go b/pkg/openapi/generated.openapi.go index 9492954be..e14e994fc 100644 --- a/pkg/openapi/generated.openapi.go +++ b/pkg/openapi/generated.openapi.go @@ -3469,7 +3469,7 @@ func schema_pkg_apis_projectcalico_v3_FelixConfigurationSpec(ref common.Referenc }, "prometheusMetricsClientAuth": { SchemaProps: spec.SchemaProps{ - Description: "PrometheusMetricsClientAuth specifies the client authentication type for the /metrics endpoint. This determines how the server validates client certificates. Default is \"RequireAndVerifyClientCert\".", + Description: "PrometheusMetricsClientAuth specifies the client authentication type for the /metrics endpoint. This determines how the server validates client certificates. Default is \"NoClientCert\".", Type: []string{"string"}, Format: "", }, @@ -3694,7 +3694,7 @@ func schema_pkg_apis_projectcalico_v3_FelixConfigurationSpec(ref common.Referenc }, "nftablesMode": { SchemaProps: spec.SchemaProps{ - Description: "NFTablesMode configures nftables support in Felix. [Default: Auto]\n\nPossible enum values:\n - `\"Auto\"`\n - `\"Disabled\"`\n - `\"Enabled\"`", + Description: "NFTablesMode configures nftables support in Felix. In Auto mode, Felix uses the nftables dataplane if kube-proxy is detected to be running in nftables mode. [Default: Auto]\n\nPossible enum values:\n - `\"Auto\"`\n - `\"Disabled\"`\n - `\"Enabled\"`", Type: []string{"string"}, Format: "", Enum: []interface{}{"Auto", "Disabled", "Enabled"}, @@ -7833,6 +7833,22 @@ func schema_pkg_apis_projectcalico_v3_Template(ref common.ReferenceCallback) com }, }, }, + "annotations": { + SchemaProps: spec.SchemaProps{ + Description: "Annotations adds the specified annotations to the generated AutoHostEndpoint.", + Type: []string{"object"}, + AdditionalProperties: &spec.SchemaOrBool{ + Allows: true, + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: "", + Type: []string{"string"}, + Format: "", + }, + }, + }, + }, + }, "nodeSelector": { SchemaProps: spec.SchemaProps{ Description: "NodeSelector allows the AutoHostEndpoint to be created only for specific nodes",