[caseydavenport]

Description

This ports two fixes from calico master to release-v1.44. PR 13983 (CNI address families from workload IP pools) fixes new pods failing to get an address on single-stack clusters, a bug in v1.44.0. PR 14334 (Istio resources override applied) makes the Istio resource's resources override take effect.

CNI address families

• Pool filtering. Only IP pools whose allowedUses includes Workload, or is unset, now decide which address families the CNI config assigns. Before, a tunnel or load balancer IPv6 pool on a single-stack IPv4 cluster turned on IPv6 assignment, and new pods failed with "cannot find a qualified ippool, no pools match the required use (Workload)".
• Host-local IPAM. Its single or dual stack choice uses the same filtered list.
• Port difference. This branch's pool lookups differ from master's, so the port filters the list first.
• Testing. New CNI config tests from master, plus tunnel-only and LoadBalancer-then-workload IPv6 pool cases. Four of the seven fail without the fix.

Istio resources

• Resources override. The resources field in the istiod, Istio CNI, and ztunnel overrides is pod-level, and the shared override code only applies per-container resources. The operator now copies it onto each workload's main container. Unset keeps the Helm chart's defaults.
• Port difference. On master this lives in the render split from PR 14150 (render ObjectsBeforeOverrides split), which this branch lacks. The port applies the resources just before the shared overrides, the same order as master, and makes the container names constants.
• Testing. The istiod resources test now checks exact values (the old check passed without the fix), and new tests cover Istio CNI, ztunnel, and the chart defaults. The three resources entries fail without the fix.

Related: Bug CORE-13664 (CNI assign_ipv6 from non-workload pools)
Related: Bug CORE-13783 (Istio resources override ignored)

Release Note

Fixes new pods failing to get an address on single-stack clusters with an IP pool of the other address family that doesn't allow workloads. Fixes the Istio resource's resources overrides for istiod, Istio CNI, and ztunnel being ignored.

AI assistance: Claude Code (Claude Opus 5.5) ported the changes and drafted this description; I reviewed every change.

By opening this PR you take responsibility for every line in it, and you agree to explain the change yourself during review rather than routing review comments back through an agent.

For PR author

• Tests for change.
• If changing pkg/apis/, run make gen-files
• If changing versions, run make gen-versions

For PR reviewers

A note for code reviewers - all pull requests must have the following:

• Milestone set according to targeted release.
• Appropriate labels:
  • kind/bug if this is a bugfix.
  • kind/enhancement if this is a a new feature.
  • enterprise if this PR applies to Calico Enterprise only.

Agent context

Decisions

• Commit 737c6a3 ports calico master squash commit 0946f5983c, and 1834494 ports a8274ae9ad.
• release-v1.44 has GetIPv4Pool/GetIPv6Pool where master has HasIPv4Pool/HasIPv6Pool, so the CNI port filters the pool list with the same WorkloadIPPools helper before calling them. The closed PR 5322 (same fix against operator master) carried the same code.
• An IP pool with no allowedUses counts as workload-capable, matching the back-compat default of Workload and Tunnel.
• The Istio port sets resources in IstioComponent.Objects() just before ApplyDeploymentOverrides and ApplyDaemonSetOverrides, since ObjectsBeforeOverrides() from PR 14150 (render ObjectsBeforeOverrides split) doesn't exist here. Master gets the same order.

Constraints and gotchas

• The CNI bug stays latent until calico-node next restarts and rewrites the CNI config, so it surfaces at the next reboot or upgrade. Recovery needs the IP pool's finalizer patched off by hand, since kube-controllers can't get an address either.
• Other callers of GetIPv4Pool/GetIPv6Pool (migration conversion, Installation validation) are untouched, as on master.
• Master's overrides_test.go change has no counterpart here, because that override coverage test doesn't exist on this branch.
• The old istiod resources assertion passed without the fix, because the chart already sets resources on discovery.

Verification

• Before the CNI fix, 4 of the 7 "Node CNI address family selection" specs failed, for example Expected {assign_ipv4: true, assign_ipv6: true, type: calico-ipam} to have {assign_ipv6: false}. After it, 7 of 7 pass.
• Before the Istio fix, the three resources entries failed (5 passed and 3 failed of 8 focused specs). After it, 8 of 8 pass.
• go build ./... is clean, and go vet on pkg/render, pkg/render/istio, and pkg/render/common/components is clean.
• make ut UT_DIR=./pkg/render passes all 25 suites under pkg/render (950 specs, 0 failures), and make static-checks reports 0 issues.

Code map

• pkg/render/node.go: WorkloadIPPools and allowsWorkloads filter the pools; getCalicoIPAM and the host-local path in createCalicoPluginConfig use the filtered list.
• pkg/render/node_test.go: the "Node CNI address family selection" Describe, with the tunnel-only and LoadBalancer-then-workload IPv6 cases added beyond master.
• pkg/render/common/components/components.go: GetResources reads the pod-level Spec.Template.Spec.Resources override.
• pkg/render/istio/istio.go: setContainerResources, called from Objects() before the shared overrides, and the istiodContainerName, istioCNIContainerName, and ztunnelContainerName constants.
• pkg/render/istio/istio_test.go: exact-value istiod check, new Istio CNI and ztunnel resources entries, and the chart-default test.