[caseydavenport]

Description

This PR ports three bug fixes from projectcalico/calico to release-v1.42 (Calico v3.32, Calico Enterprise v3.23).

CNI address families from workload IP pools

Port of PR 13983 (CNI families from workload pools).

• Bug. The CNI config enabled an address family whenever any pool of that family existed, whatever its allowedUses. On a single-stack IPv4 cluster, an IPv6 pool reserved for tunnels turned on assign_ipv6 and every new pod sandbox failed with cannot find a qualified ippool, no pools match the required use (Workload).
• Fix. Only pools whose allowedUses includes Workload, or is unset, now decide assign_ipv4, assign_ipv6 and the host-local ranges.
• Testing. Six new render tests cover non-workload pools in either family and host-local ranges. Four failed before the fix.

Istio resources override

Port of PR 14334 (Istio resources override fix).

• Bug. The Istio CR accepted pod-level resources for istiod, Istio CNI and ztunnel but ignored them, since overrides only set resources per container.
• Fix. Those resources now land on the main istiod, CNI and ztunnel containers. Unset keeps the chart defaults.
• Testing. Tests now check the exact istiod, CNI and ztunnel container resources, plus the unset case. Three of four failed before the fix.

4-byte AS numbers in the BGP CRDs

CRD re-import from PR 13979 (full 4-byte AS range).

• Bug. The AS number fields in BGPConfiguration, BGPPeer and BGPFilter were format: int32, so the API server rejected AS numbers above 2147483647 and accepted negative ones.
• Fix. They now declare format: int64 with a 0 to 4294967295 range, in the v1 and v3 Calico CRDs, not the Enterprise copies.
• Hand-applied. The v3.32 backport hasn't merged, so these edits copy master's generated schema rather than coming from make update-calico-crds. A later import with the backport should leave them unchanged.

The full pkg/render unit suite passes. Not tried on a real cluster.

AI assistance: Claude Code ported the three changes and wrote the tests; I reviewed them.

By opening this PR you take responsibility for every line in it, and you agree to explain the change yourself during review rather than routing review comments back through an agent. See AI_POLICY.md.

Release Note

Fixes pods failing to start on single-stack clusters with a non-workload IP pool of the other family, the Istio CR's resources being ignored for istiod, Istio CNI and ztunnel, and BGPConfiguration, BGPPeer and BGPFilter rejecting AS numbers above 2147483647.

For PR author

• Tests for change.
• If changing pkg/apis/, run make gen-files
• If changing versions, run make gen-versions

For PR reviewers

A note for code reviewers - all pull requests must have the following:

• Milestone set according to targeted release.
• Appropriate labels:
  • kind/bug if this is a bugfix.
  • kind/enhancement if this is a a new feature.
  • enterprise if this PR applies to Calico Enterprise only.

Agent context

Decisions

• release-v1.42 has GetIPv4Pool/GetIPv6Pool where master has HasIPv4Pool/HasIPv6Pool, so WorkloadIPPools filters the pools before those calls. Behavior matches master. An earlier attempt against operator master was PR 5322 (closed master attempt).
• Unset allowedUses counts as workload-capable, the documented back-compat default.
• The old istiod resources assertion passed on chart defaults alone, so it now checks the exact discovery container resources.
• The Istio resources are applied at the end of the v1.42 IstioComponent.Objects(), after the existing overrides, since ObjectsBeforeOverrides() from PR 14150 (overrides after variant modifiers) isn't on this branch.
• setContainerResources matches containers by name instead of using master's MustContainer helper, which this branch lacks, so a missing container is skipped rather than panicking.
• The BGP CRD edits cover BGPConfiguration asNumber, BGPPeer asNumber and localASNumber, and BGPFilter asPathPrefix and prependASPath.prefix items, each now format: int64, minimum: 0, maximum: 4294967295. The changed-field count per file matches the master-generated CRDs, and nothing else in the imported CRDs changes.

Constraints and gotchas

• The CNI bug stays latent until calico-node restarts and rewrites the CNI config, so it shows up at the next reboot or upgrade.

Verification

• go build ./... and go vet are clean.
• make ut UT_DIR=./pkg/render passes: top-level render suite 560 of 560, and every sub-suite, including istio and common/components.
• Before the CNI fix, 4 of 6 new specs failed, e.g. Expected "assign_ipv6": "true" to have {key: value} "assign_ipv6": "false". Before the Istio fix, 3 of 4 failed.

Code map

• pkg/render/node.go: WorkloadIPPools and allowsWorkloads; getCalicoIPAM and createCalicoPluginConfig use the filtered pools.
• pkg/render/node_test.go: "Node CNI address family selection".
• pkg/render/common/components/components.go: GetResources reads the pod-level resources override, as on master.
• pkg/render/istio/istio.go: container name constants, setContainerResources, and its three calls in Objects().
• pkg/render/istio/istio_test.go: istiod, CNI, ztunnel and unset resources entries.
• pkg/imports/crds/calico/{v1.crd.projectcalico.org,v3.projectcalico.org}: bgpconfigurations, bgppeers and bgpfilters.