From 8b1863de830c862e994cf9e558568d4ad1bf357c Mon Sep 17 00:00:00 2001 From: Casey Davenport Date: Sun, 1 Nov 2026 13:14:57 -0500 Subject: [PATCH 1/5] Derive CNI address families from workload-capable IP pools An IPv6 pool reserved for tunnels or load balancers no longer turns on IPv6 assignment in the CNI config of a single-stack IPv4 cluster. Only pools whose allowedUses includes Workload, or is unset, decide assign_ipv4 and assign_ipv6 and the host-local ranges. Ported from projectcalico/calico#13983. --- pkg/render/node.go | 32 ++++++++++-- pkg/render/node_test.go | 113 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 142 insertions(+), 3 deletions(-) diff --git a/pkg/render/node.go b/pkg/render/node.go index 96039bf54c..195ff92678 100644 --- a/pkg/render/node.go +++ b/pkg/render/node.go @@ -689,7 +689,7 @@ func (c *nodeComponent) createCalicoPluginConfig() map[string]any { ipam := c.getCalicoIPAM() if c.cfg.Installation.CNI.IPAM.Type == operatorv1.IPAMPluginHostLocal { - ipam = buildHostLocalIPAM(c.cfg.IPPools) + ipam = buildHostLocalIPAM(WorkloadIPPools(c.cfg.IPPools)) } apiRoot := c.cfg.K8sServiceEp.CNIAPIRoot() @@ -840,14 +840,15 @@ func (c *nodeComponent) nodeCNIConfigMap() *corev1.ConfigMap { func (c *nodeComponent) getCalicoIPAM() map[string]any { // Determine what address families to enable. + pools := WorkloadIPPools(c.cfg.IPPools) var assign_ipv4 string var assign_ipv6 string - if v4pool := GetIPv4Pool(c.cfg.IPPools); v4pool != nil { + if v4pool := GetIPv4Pool(pools); v4pool != nil { assign_ipv4 = "true" } else { assign_ipv4 = "false" } - if v6pool := GetIPv6Pool(c.cfg.IPPools); v6pool != nil { + if v6pool := GetIPv6Pool(pools); v6pool != nil { assign_ipv6 = "true" } else { assign_ipv6 = "false" @@ -1898,6 +1899,31 @@ func GetIPv6Pool(pools []operatorv1.IPPool) *operatorv1.IPPool { return nil } +// WorkloadIPPools returns the pools that can hand out addresses to ordinary workloads. +func WorkloadIPPools(pools []operatorv1.IPPool) []operatorv1.IPPool { + filtered := []operatorv1.IPPool{} + for _, pool := range pools { + if allowsWorkloads(pool) { + filtered = append(filtered, pool) + } + } + return filtered +} + +func allowsWorkloads(pool operatorv1.IPPool) bool { + if len(pool.AllowedUses) == 0 { + // An unset allowedUses means Workload and Tunnel, for back-compatibility. + return true + } + + for _, use := range pool.AllowedUses { + if use == operatorv1.IPPoolAllowedUseWorkload { + return true + } + } + return false +} + // bgpEnabled returns true if the given Installation enables BGP, false otherwise. func bgpEnabled(instance *operatorv1.InstallationSpec) bool { return instance.CalicoNetwork != nil && diff --git a/pkg/render/node_test.go b/pkg/render/node_test.go index 34b50d49bb..47dcc55ee6 100644 --- a/pkg/render/node_test.go +++ b/pkg/render/node_test.go @@ -15,6 +15,7 @@ package render_test import ( + "encoding/json" "fmt" "strings" @@ -3511,3 +3512,115 @@ func verifyInitContainers(ds *appsv1.DaemonSet, instance *operatorv1.Installatio Expect(flexvolContainer).To(BeNil()) } } + +var _ = Describe("Node CNI address family selection", func() { + const l2Workload = operatorv1.IPPoolAllowedUse("L2Workload") + + var cfg render.NodeConfiguration + var instance *operatorv1.InstallationSpec + + // ipamConfig renders the CNI config map and returns the ipam block of the calico plugin. + ipamConfig := func() map[string]any { + component := render.Node(&cfg) + Expect(component.ResolveImages(nil)).To(BeNil()) + resources, _ := component.Objects() + + cm, ok := rtest.GetResource(resources, "cni-config", "calico-system", "", "v1", "ConfigMap").(*corev1.ConfigMap) + Expect(ok).To(BeTrue()) + + var parsed cniNetworkConfig + Expect(json.Unmarshal([]byte(cm.Data["config"]), &parsed)).NotTo(HaveOccurred()) + Expect(parsed.Plugins).NotTo(BeEmpty()) + return parsed.Plugins[0].IPAM + } + + BeforeEach(func() { + ff := true + instance = &operatorv1.InstallationSpec{ + CNI: &operatorv1.CNISpec{ + Type: operatorv1.PluginCalico, + IPAM: &operatorv1.IPAMSpec{Type: operatorv1.IPAMPluginCalico}, + }, + CalicoNetwork: &operatorv1.CalicoNetworkSpec{ + BGP: &bgpEnabled, + IPPools: []operatorv1.IPPool{{CIDR: "192.168.0.0/16"}}, + NodeAddressAutodetectionV4: &operatorv1.NodeAddressAutodetection{FirstFound: &ff}, + }, + } + defaultCNIConfDir, defaultCNIBinDir := render.DefaultCNIDirectories(instance.KubernetesProvider) + instance.CNI.ConfDir, instance.CNI.BinDir = &defaultCNIConfDir, &defaultCNIBinDir + + scheme := runtime.NewScheme() + Expect(apis.AddToScheme(scheme, false)).NotTo(HaveOccurred()) + cli := ctrlrfake.DefaultFakeClientBuilder(scheme).Build() + certificateManager, err := certificatemanager.Create(cli, nil, clusterDomain, common.OperatorNamespace(), certificatemanager.AllowCACreation()) + Expect(err).NotTo(HaveOccurred()) + + cfg = render.NodeConfiguration{ + K8sServiceEp: k8sapi.ServiceEndpoint{}, + Installation: instance, + TLS: getTyphaNodeTLS(cli, certificateManager), + ClusterDomain: clusterDomain, + FelixHealthPort: 9099, + IPPools: instance.CalicoNetwork.IPPools, + } + }) + + It("should not enable IPv6 assignment for a pool that doesn't allow workloads", func() { + cfg.IPPools = append(cfg.IPPools, operatorv1.IPPool{ + CIDR: "2001:db8:1::/122", + AllowedUses: []operatorv1.IPPoolAllowedUse{l2Workload}, + }) + ipam := ipamConfig() + Expect(ipam).To(HaveKeyWithValue("assign_ipv4", "true")) + Expect(ipam).To(HaveKeyWithValue("assign_ipv6", "false")) + }) + + It("should not enable IPv6 assignment for a tunnel-only IPv6 pool", func() { + cfg.IPPools = append(cfg.IPPools, operatorv1.IPPool{ + CIDR: "2001:db8:1::/122", + AllowedUses: []operatorv1.IPPoolAllowedUse{operatorv1.IPPoolAllowedUseTunnel}, + }) + Expect(ipamConfig()).To(HaveKeyWithValue("assign_ipv6", "false")) + }) + + It("should enable IPv6 assignment for a pool that allows workloads", func() { + cfg.IPPools = append(cfg.IPPools, operatorv1.IPPool{ + CIDR: "2001:db8:1::/122", + AllowedUses: []operatorv1.IPPoolAllowedUse{l2Workload, operatorv1.IPPoolAllowedUseWorkload}, + }) + Expect(ipamConfig()).To(HaveKeyWithValue("assign_ipv6", "true")) + }) + + It("should enable IPv6 assignment for a pool with no allowed uses set", func() { + cfg.IPPools = append(cfg.IPPools, operatorv1.IPPool{CIDR: "2001:db8:1::/122"}) + Expect(ipamConfig()).To(HaveKeyWithValue("assign_ipv6", "true")) + }) + + It("should disable IPv4 assignment when the only IPv4 pool is tunnel-only", func() { + cfg.IPPools = []operatorv1.IPPool{{ + CIDR: "192.168.0.0/16", + AllowedUses: []operatorv1.IPPoolAllowedUse{operatorv1.IPPoolAllowedUseTunnel}, + }} + Expect(ipamConfig()).To(HaveKeyWithValue("assign_ipv4", "false")) + }) + + It("should render host-local as single-stack when the IPv6 pool doesn't allow workloads", func() { + instance.CNI.IPAM.Type = operatorv1.IPAMPluginHostLocal + cfg.IPPools = append(cfg.IPPools, operatorv1.IPPool{ + CIDR: "2001:db8:1::/122", + AllowedUses: []operatorv1.IPPoolAllowedUse{l2Workload}, + }) + Expect(ipamConfig()).To(Equal(map[string]any{"type": "host-local", "subnet": "usePodCidr"})) + }) +}) + +// cniNetworkConfig mirrors the parts of the rendered CNI network config the tests assert on. +type cniNetworkConfig struct { + Plugins []cniPluginConfig `json:"plugins"` +} + +// cniPluginConfig mirrors the ipam block of one plugin in the rendered CNI network config. +type cniPluginConfig struct { + IPAM map[string]any `json:"ipam"` +} From c6ee5fe1303a08ca897da541b45a5970457a5864 Mon Sep 17 00:00:00 2001 From: Casey Davenport Date: Sun, 1 Nov 2026 13:14:58 -0500 Subject: [PATCH 2/5] Apply the Istio resources override to istiod, CNI and ztunnel The pod-level resources field on the Istio CR was accepted but never applied, because overrides only reach individual containers. It now lands on the discovery, install-cni and istio-proxy containers. Ported from projectcalico/calico#14334. --- pkg/render/common/components/components.go | 15 +++++ pkg/render/istio/istio.go | 34 ++++++++-- pkg/render/istio/istio_test.go | 75 ++++++++++++++++++---- 3 files changed, 108 insertions(+), 16 deletions(-) diff --git a/pkg/render/common/components/components.go b/pkg/render/common/components/components.go index cd2ab67ec0..b5d8e5683c 100644 --- a/pkg/render/common/components/components.go +++ b/pkg/render/common/components/components.go @@ -220,6 +220,21 @@ func GetNodeSelector(overrides any) map[string]string { return value.Interface().(map[string]string) } +// GetResources returns the pod-level Spec.Template.Spec.Resources override, or nil +// if unset. The shared override path doesn't apply it, because only the +// component knows which container should receive it. +func GetResources(overrides any) *corev1.ResourceRequirements { + value := getField(overrides, "Spec", "Template", "Spec", "Resources") + if !value.IsValid() || value.IsNil() { + return nil + } + r, ok := value.Interface().(*corev1.ResourceRequirements) + if !ok { + return nil + } + return r +} + func GetTopologySpreadConstraints(overrides any) []corev1.TopologySpreadConstraint { value := getField(overrides, "Spec", "Template", "Spec", "TopologySpreadConstraints") if !value.IsValid() || value.IsNil() { diff --git a/pkg/render/istio/istio.go b/pkg/render/istio/istio.go index f26748e7b1..a81a2a9e73 100644 --- a/pkg/render/istio/istio.go +++ b/pkg/render/istio/istio.go @@ -76,6 +76,10 @@ const ( IstioIstiodServiceName = "istiod" istioFakeImageProxyv2 = "fake.io/fakeimg/proxyv2:faketag" + + istiodContainerName = "discovery" + istioCNIContainerName = "install-cni" + ztunnelContainerName = "istio-proxy" ) func Istio(cfg *Configuration) (*IstioComponentCRDs, *IstioComponent, error) { @@ -155,19 +159,19 @@ func (c *IstioComponent) patchImages() (err error) { for i := range c.resources.IstiodDeployment.Spec.Template.Spec.Containers { container := &c.resources.IstiodDeployment.Spec.Template.Spec.Containers[i] - if container.Name == "discovery" { + if container.Name == istiodContainerName { container.Image = c.IstioPilotImage } } for i := range c.resources.CNIDaemonSet.Spec.Template.Spec.Containers { container := &c.resources.CNIDaemonSet.Spec.Template.Spec.Containers[i] - if container.Name == "install-cni" { + if container.Name == istioCNIContainerName { container.Image = c.IstioInstallCNIImage } } for i := range c.resources.ZTunnelDaemonSet.Spec.Template.Spec.Containers { container := &c.resources.ZTunnelDaemonSet.Spec.Template.Spec.Containers[i] - if container.Name == "istio-proxy" { + if container.Name == ztunnelContainerName { container.Image = c.IstioZTunnelImage } } @@ -260,7 +264,7 @@ func (c *IstioComponent) Objects() ([]client.Object, []client.Object) { // Set required configs for i := range res.ZTunnelDaemonSet.Spec.Template.Spec.Containers { cont := &res.ZTunnelDaemonSet.Spec.Template.Spec.Containers[i] - if cont.Name == "istio-proxy" { + if cont.Name == ztunnelContainerName { cont.Env = append(cont.Env, corev1.EnvVar{ Name: "TRANSPARENT_NETWORK_POLICIES", Value: "true", @@ -270,7 +274,7 @@ func (c *IstioComponent) Objects() ([]client.Object, []client.Object) { } for i := range res.CNIDaemonSet.Spec.Template.Spec.Containers { cont := &res.CNIDaemonSet.Spec.Template.Spec.Containers[i] - if cont.Name == "install-cni" { + if cont.Name == istioCNIContainerName { cont.Env = append(cont.Env, corev1.EnvVar{ Name: "MAGIC_DSCP_MARK", Value: strconv.FormatInt(int64(c.cfg.Istio.Spec.DSCPMark.ToUint8()), 10), @@ -278,6 +282,12 @@ func (c *IstioComponent) Objects() ([]client.Object, []client.Object) { } } + // The Istio CR's resources field sits at pod level, so the shared override + // path can't place it. Each workload has one main container to receive it. + setContainerResources(&res.IstiodDeployment.Spec.Template.Spec, istiodContainerName, rcomp.GetResources(c.cfg.Istio.Spec.IstiodDeployment)) + setContainerResources(&res.CNIDaemonSet.Spec.Template.Spec, istioCNIContainerName, rcomp.GetResources(c.cfg.Istio.Spec.IstioCNIDaemonset)) + setContainerResources(&res.ZTunnelDaemonSet.Spec.Template.Spec, ztunnelContainerName, rcomp.GetResources(c.cfg.Istio.Spec.ZTunnelDaemonset)) + // Set additional pull secrets res.IstiodDeployment.Spec.Template.Spec.ImagePullSecrets = append( res.IstiodDeployment.Spec.Template.Spec.ImagePullSecrets, @@ -402,6 +412,20 @@ func (c *IstioComponent) ztunnelCalicoSystemPolicy() *v3.NetworkPolicy { } } +// setContainerResources replaces the resources of the named container with r. +// A nil r leaves the Helm chart's defaults in place. +func setContainerResources(spec *corev1.PodSpec, name string, r *corev1.ResourceRequirements) { + if r == nil { + return + } + for i := range spec.Containers { + if spec.Containers[i].Name == name { + spec.Containers[i].Resources = *r + return + } + } +} + func (c *IstioComponentCRDs) Objects() ([]client.Object, []client.Object) { return c.resources.CRDs, nil } diff --git a/pkg/render/istio/istio_test.go b/pkg/render/istio/istio_test.go index 512f52009f..6e303b0c5a 100644 --- a/pkg/render/istio/istio_test.go +++ b/pkg/render/istio/istio_test.go @@ -443,20 +443,27 @@ var _ = Describe("Istio Component Rendering", func() { }, }, func(deployment *appsv1.Deployment) { - // Resources are applied to the deployment - // The override system applies resources to the pod spec, not individual containers - // So we just verify that the deployment has at least one container with resources set - hasResourcesSet := false - for _, container := range deployment.Spec.Template.Spec.Containers { - if container.Resources.Limits != nil || container.Resources.Requests != nil { - hasResourcesSet = true - break - } - } - Expect(hasResourcesSet).To(BeTrue(), "Expected at least one container to have resources set") + Expect(deployment.Spec.Template.Spec.Containers).To(ContainElement(SatisfyAll( + HaveField("Name", "discovery"), + HaveField("Resources", corev1.ResourceRequirements{ + Limits: corev1.ResourceList{"memory": resource.MustParse("2Gi")}, + Requests: corev1.ResourceList{"memory": resource.MustParse("1Gi")}, + }), + ))) }, ), ) + + It("should keep the chart's default resources when no override is set", func() { + _, component, err := istio.Istio(cfg) + Expect(err).ShouldNot(HaveOccurred()) + + objsToCreate, _ := component.Objects() + deployment, err := rtest.GetResourceOfType[*appsv1.Deployment](objsToCreate, istio.IstioIstiodDeploymentName, istio.IstioNamespace) + Expect(err).ShouldNot(HaveOccurred()) + + Expect(deployment.Spec.Template.Spec.Containers).To(ContainElement(SatisfyAll(HaveField("Name", "discovery"), HaveField("Resources.Requests", Not(BeEmpty()))))) + }) }) Describe("DaemonSet Overrides", func() { @@ -511,6 +518,29 @@ var _ = Describe("Istio Component Rendering", func() { })) }, ), + Entry("should apply resources override to the install-cni container", + &operatorv1.IstioCNIDaemonset{ + Spec: &operatorv1.IstioCNIDaemonsetSpec{ + Template: &operatorv1.IstioCNIDaemonsetSpecTemplate{ + Spec: &operatorv1.IstioCNIDaemonsetPodSpec{ + Resources: &corev1.ResourceRequirements{ + Limits: corev1.ResourceList{"cpu": resource.MustParse("300m")}, + Requests: corev1.ResourceList{"cpu": resource.MustParse("150m")}, + }, + }, + }, + }, + }, + func(daemonset *appsv1.DaemonSet) { + Expect(daemonset.Spec.Template.Spec.Containers).To(ContainElement(SatisfyAll( + HaveField("Name", "install-cni"), + HaveField("Resources", corev1.ResourceRequirements{ + Limits: corev1.ResourceList{"cpu": resource.MustParse("300m")}, + Requests: corev1.ResourceList{"cpu": resource.MustParse("150m")}, + }), + ))) + }, + ), ) DescribeTable("ZTunnel DaemonSet Overrides", func(overrides *operatorv1.ZTunnelDaemonset, verify func(*appsv1.DaemonSet)) { @@ -571,6 +601,29 @@ var _ = Describe("Istio Component Rendering", func() { Expect(daemonset.Spec.Template.Spec.Affinity.NodeAffinity.RequiredDuringSchedulingIgnoredDuringExecution.NodeSelectorTerms[0].MatchExpressions[0].Key).To(Equal("ztunnel-affinity-key")) }, ), + Entry("should apply resources override to the istio-proxy container", + &operatorv1.ZTunnelDaemonset{ + Spec: &operatorv1.ZTunnelDaemonsetSpec{ + Template: &operatorv1.ZTunnelDaemonsetSpecTemplate{ + Spec: &operatorv1.ZTunnelDaemonsetPodSpec{ + Resources: &corev1.ResourceRequirements{ + Limits: corev1.ResourceList{"memory": resource.MustParse("1Gi")}, + Requests: corev1.ResourceList{"memory": resource.MustParse("512Mi")}, + }, + }, + }, + }, + }, + func(daemonset *appsv1.DaemonSet) { + Expect(daemonset.Spec.Template.Spec.Containers).To(ContainElement(SatisfyAll( + HaveField("Name", "istio-proxy"), + HaveField("Resources", corev1.ResourceRequirements{ + Limits: corev1.ResourceList{"memory": resource.MustParse("1Gi")}, + Requests: corev1.ResourceList{"memory": resource.MustParse("512Mi")}, + }), + ))) + }, + ), ) }) From 9c5c755ee8c6cc28e5db7d52ca40a6fa6231b931 Mon Sep 17 00:00:00 2001 From: Casey Davenport Date: Sun, 1 Nov 2026 13:14:59 -0500 Subject: [PATCH 3/5] Accept 4-byte AS numbers in the imported BGP CRDs The BGPConfiguration, BGPPeer and BGPFilter AS number fields declared format int32, which rejects AS numbers above 2147483647 and accepts negative ones. They now declare int64 with a 0 to 4294967295 range, matching the regenerated CRDs on calico master. Only those schema lines change; the rest of the imported CRDs stay at v3.32.3. Ported from projectcalico/calico#13979. --- ...d.projectcalico.org_bgpconfigurations.yaml | 4 ++- .../crd.projectcalico.org_bgpfilters.yaml | 32 ++++++++++++++----- .../crd.projectcalico.org_bgppeers.yaml | 8 +++-- .../projectcalico.org_bgpconfigurations.yaml | 4 ++- .../projectcalico.org_bgpfilters.yaml | 32 ++++++++++++++----- .../projectcalico.org_bgppeers.yaml | 8 +++-- 6 files changed, 66 insertions(+), 22 deletions(-) diff --git a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgpconfigurations.yaml b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgpconfigurations.yaml index fe81a66d4c..01a41e9893 100644 --- a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgpconfigurations.yaml +++ b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgpconfigurations.yaml @@ -27,7 +27,9 @@ spec: spec: properties: asNumber: - format: int32 + format: int64 + maximum: 4294967295 + minimum: 0 type: integer bindMode: enum: diff --git a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgpfilters.yaml b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgpfilters.yaml index c791b84c6a..86523a1ab5 100644 --- a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgpfilters.yaml +++ b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgpfilters.yaml @@ -36,7 +36,9 @@ spec: type: string asPathPrefix: items: - format: int32 + format: int64 + maximum: 4294967295 + minimum: 0 type: integer type: array cidr: @@ -85,7 +87,9 @@ spec: properties: prefix: items: - format: int32 + format: int64 + maximum: 4294967295 + minimum: 0 type: integer maxItems: 10 minItems: 1 @@ -166,7 +170,9 @@ spec: type: string asPathPrefix: items: - format: int32 + format: int64 + maximum: 4294967295 + minimum: 0 type: integer type: array cidr: @@ -215,7 +221,9 @@ spec: properties: prefix: items: - format: int32 + format: int64 + maximum: 4294967295 + minimum: 0 type: integer maxItems: 10 minItems: 1 @@ -296,7 +304,9 @@ spec: type: string asPathPrefix: items: - format: int32 + format: int64 + maximum: 4294967295 + minimum: 0 type: integer type: array cidr: @@ -345,7 +355,9 @@ spec: properties: prefix: items: - format: int32 + format: int64 + maximum: 4294967295 + minimum: 0 type: integer maxItems: 10 minItems: 1 @@ -426,7 +438,9 @@ spec: type: string asPathPrefix: items: - format: int32 + format: int64 + maximum: 4294967295 + minimum: 0 type: integer type: array cidr: @@ -475,7 +489,9 @@ spec: properties: prefix: items: - format: int32 + format: int64 + maximum: 4294967295 + minimum: 0 type: integer maxItems: 10 minItems: 1 diff --git a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgppeers.yaml b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgppeers.yaml index f3d372f20e..652c34d209 100644 --- a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgppeers.yaml +++ b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgppeers.yaml @@ -27,7 +27,9 @@ spec: spec: properties: asNumber: - format: int32 + format: int64 + maximum: 4294967295 + minimum: 0 type: integer filters: items: @@ -38,7 +40,9 @@ spec: keepaliveTime: type: string localASNumber: - format: int32 + format: int64 + maximum: 4294967295 + minimum: 0 type: integer localWorkloadSelector: maxLength: 4096 diff --git a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_bgpconfigurations.yaml b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_bgpconfigurations.yaml index f2d4d43053..989f3ba9d7 100644 --- a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_bgpconfigurations.yaml +++ b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_bgpconfigurations.yaml @@ -30,7 +30,9 @@ spec: spec: properties: asNumber: - format: int32 + format: int64 + maximum: 4294967295 + minimum: 0 type: integer bindMode: enum: diff --git a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_bgpfilters.yaml b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_bgpfilters.yaml index c5cb6a5705..410f9c3926 100644 --- a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_bgpfilters.yaml +++ b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_bgpfilters.yaml @@ -36,7 +36,9 @@ spec: type: string asPathPrefix: items: - format: int32 + format: int64 + maximum: 4294967295 + minimum: 0 type: integer type: array cidr: @@ -85,7 +87,9 @@ spec: properties: prefix: items: - format: int32 + format: int64 + maximum: 4294967295 + minimum: 0 type: integer maxItems: 10 minItems: 1 @@ -166,7 +170,9 @@ spec: type: string asPathPrefix: items: - format: int32 + format: int64 + maximum: 4294967295 + minimum: 0 type: integer type: array cidr: @@ -215,7 +221,9 @@ spec: properties: prefix: items: - format: int32 + format: int64 + maximum: 4294967295 + minimum: 0 type: integer maxItems: 10 minItems: 1 @@ -296,7 +304,9 @@ spec: type: string asPathPrefix: items: - format: int32 + format: int64 + maximum: 4294967295 + minimum: 0 type: integer type: array cidr: @@ -345,7 +355,9 @@ spec: properties: prefix: items: - format: int32 + format: int64 + maximum: 4294967295 + minimum: 0 type: integer maxItems: 10 minItems: 1 @@ -426,7 +438,9 @@ spec: type: string asPathPrefix: items: - format: int32 + format: int64 + maximum: 4294967295 + minimum: 0 type: integer type: array cidr: @@ -475,7 +489,9 @@ spec: properties: prefix: items: - format: int32 + format: int64 + maximum: 4294967295 + minimum: 0 type: integer maxItems: 10 minItems: 1 diff --git a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_bgppeers.yaml b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_bgppeers.yaml index 636da64156..b2d84a89de 100644 --- a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_bgppeers.yaml +++ b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_bgppeers.yaml @@ -58,7 +58,9 @@ spec: spec: properties: asNumber: - format: int32 + format: int64 + maximum: 4294967295 + minimum: 0 type: integer filters: items: @@ -69,7 +71,9 @@ spec: keepaliveTime: type: string localASNumber: - format: int32 + format: int64 + maximum: 4294967295 + minimum: 0 type: integer localWorkloadSelector: maxLength: 4096 From a8d791b5c76c4cccaf1b2bfe9db78ca350807a51 Mon Sep 17 00:00:00 2001 From: Casey Davenport Date: Mon, 2 Nov 2026 22:33:19 -0500 Subject: [PATCH 4/5] Revert "Accept 4-byte AS numbers in the imported BGP CRDs" This reverts commit 9c5c755ee8c6cc28e5db7d52ca40a6fa6231b931. --- ...d.projectcalico.org_bgpconfigurations.yaml | 4 +-- .../crd.projectcalico.org_bgpfilters.yaml | 32 +++++-------------- .../crd.projectcalico.org_bgppeers.yaml | 8 ++--- .../projectcalico.org_bgpconfigurations.yaml | 4 +-- .../projectcalico.org_bgpfilters.yaml | 32 +++++-------------- .../projectcalico.org_bgppeers.yaml | 8 ++--- 6 files changed, 22 insertions(+), 66 deletions(-) diff --git a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgpconfigurations.yaml b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgpconfigurations.yaml index 01a41e9893..fe81a66d4c 100644 --- a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgpconfigurations.yaml +++ b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgpconfigurations.yaml @@ -27,9 +27,7 @@ spec: spec: properties: asNumber: - format: int64 - maximum: 4294967295 - minimum: 0 + format: int32 type: integer bindMode: enum: diff --git a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgpfilters.yaml b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgpfilters.yaml index 86523a1ab5..c791b84c6a 100644 --- a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgpfilters.yaml +++ b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgpfilters.yaml @@ -36,9 +36,7 @@ spec: type: string asPathPrefix: items: - format: int64 - maximum: 4294967295 - minimum: 0 + format: int32 type: integer type: array cidr: @@ -87,9 +85,7 @@ spec: properties: prefix: items: - format: int64 - maximum: 4294967295 - minimum: 0 + format: int32 type: integer maxItems: 10 minItems: 1 @@ -170,9 +166,7 @@ spec: type: string asPathPrefix: items: - format: int64 - maximum: 4294967295 - minimum: 0 + format: int32 type: integer type: array cidr: @@ -221,9 +215,7 @@ spec: properties: prefix: items: - format: int64 - maximum: 4294967295 - minimum: 0 + format: int32 type: integer maxItems: 10 minItems: 1 @@ -304,9 +296,7 @@ spec: type: string asPathPrefix: items: - format: int64 - maximum: 4294967295 - minimum: 0 + format: int32 type: integer type: array cidr: @@ -355,9 +345,7 @@ spec: properties: prefix: items: - format: int64 - maximum: 4294967295 - minimum: 0 + format: int32 type: integer maxItems: 10 minItems: 1 @@ -438,9 +426,7 @@ spec: type: string asPathPrefix: items: - format: int64 - maximum: 4294967295 - minimum: 0 + format: int32 type: integer type: array cidr: @@ -489,9 +475,7 @@ spec: properties: prefix: items: - format: int64 - maximum: 4294967295 - minimum: 0 + format: int32 type: integer maxItems: 10 minItems: 1 diff --git a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgppeers.yaml b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgppeers.yaml index 652c34d209..f3d372f20e 100644 --- a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgppeers.yaml +++ b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgppeers.yaml @@ -27,9 +27,7 @@ spec: spec: properties: asNumber: - format: int64 - maximum: 4294967295 - minimum: 0 + format: int32 type: integer filters: items: @@ -40,9 +38,7 @@ spec: keepaliveTime: type: string localASNumber: - format: int64 - maximum: 4294967295 - minimum: 0 + format: int32 type: integer localWorkloadSelector: maxLength: 4096 diff --git a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_bgpconfigurations.yaml b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_bgpconfigurations.yaml index 989f3ba9d7..f2d4d43053 100644 --- a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_bgpconfigurations.yaml +++ b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_bgpconfigurations.yaml @@ -30,9 +30,7 @@ spec: spec: properties: asNumber: - format: int64 - maximum: 4294967295 - minimum: 0 + format: int32 type: integer bindMode: enum: diff --git a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_bgpfilters.yaml b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_bgpfilters.yaml index 410f9c3926..c5cb6a5705 100644 --- a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_bgpfilters.yaml +++ b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_bgpfilters.yaml @@ -36,9 +36,7 @@ spec: type: string asPathPrefix: items: - format: int64 - maximum: 4294967295 - minimum: 0 + format: int32 type: integer type: array cidr: @@ -87,9 +85,7 @@ spec: properties: prefix: items: - format: int64 - maximum: 4294967295 - minimum: 0 + format: int32 type: integer maxItems: 10 minItems: 1 @@ -170,9 +166,7 @@ spec: type: string asPathPrefix: items: - format: int64 - maximum: 4294967295 - minimum: 0 + format: int32 type: integer type: array cidr: @@ -221,9 +215,7 @@ spec: properties: prefix: items: - format: int64 - maximum: 4294967295 - minimum: 0 + format: int32 type: integer maxItems: 10 minItems: 1 @@ -304,9 +296,7 @@ spec: type: string asPathPrefix: items: - format: int64 - maximum: 4294967295 - minimum: 0 + format: int32 type: integer type: array cidr: @@ -355,9 +345,7 @@ spec: properties: prefix: items: - format: int64 - maximum: 4294967295 - minimum: 0 + format: int32 type: integer maxItems: 10 minItems: 1 @@ -438,9 +426,7 @@ spec: type: string asPathPrefix: items: - format: int64 - maximum: 4294967295 - minimum: 0 + format: int32 type: integer type: array cidr: @@ -489,9 +475,7 @@ spec: properties: prefix: items: - format: int64 - maximum: 4294967295 - minimum: 0 + format: int32 type: integer maxItems: 10 minItems: 1 diff --git a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_bgppeers.yaml b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_bgppeers.yaml index b2d84a89de..636da64156 100644 --- a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_bgppeers.yaml +++ b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_bgppeers.yaml @@ -58,9 +58,7 @@ spec: spec: properties: asNumber: - format: int64 - maximum: 4294967295 - minimum: 0 + format: int32 type: integer filters: items: @@ -71,9 +69,7 @@ spec: keepaliveTime: type: string localASNumber: - format: int64 - maximum: 4294967295 - minimum: 0 + format: int32 type: integer localWorkloadSelector: maxLength: 4096 From dd6d64fd075066dae40119759d8a30f812f54636 Mon Sep 17 00:00:00 2001 From: Casey Davenport Date: Tue, 3 Nov 2026 16:18:14 -0500 Subject: [PATCH 5/5] Retrigger CI