From 5ed6fe8f462c913f47a056ccc873b9af6b2b404e Mon Sep 17 00:00:00 2001 From: caseydavenport <1944093+caseydavenport@users.noreply.github.com> Date: Thu, 16 Jul 2026 17:59:40 +0000 Subject: [PATCH] Automatic API update from projectcalico/calico master --- ...projectcalico.org_felixconfigurations.yaml | 21 +++++++++++--- ...ico.org_kubecontrollersconfigurations.yaml | 14 ++++++++++ deps.txt | 10 +++---- go.mod | 16 +++++------ go.sum | 28 +++++++++---------- lib.Makefile | 3 ++ metadata.mk | 4 +-- pkg/apis/projectcalico/v3/felixconfig.go | 22 +++++++++++++-- .../projectcalico/v3/kubecontrollersconfig.go | 7 +++-- .../projectcalico/v3/zz_generated.deepcopy.go | 12 ++++++++ .../internal/internal.go | 8 ++++++ .../v3/felixconfigurationspec.go | 21 ++++++++++++-- .../projectcalico/v3/template.go | 16 +++++++++++ pkg/openapi/generated.openapi.go | 27 ++++++++++++++++-- 14 files changed, 168 insertions(+), 41 deletions(-) diff --git a/config/crd/projectcalico.org_felixconfigurations.yaml b/config/crd/projectcalico.org_felixconfigurations.yaml index fb577c133..fdbe777bb 100644 --- a/config/crd/projectcalico.org_felixconfigurations.yaml +++ b/config/crd/projectcalico.org_felixconfigurations.yaml @@ -434,6 +434,18 @@ spec: to hold one entry per workload and a handful of entries per host (enough to cover its own IPs and tunnel IPs). type: integer + bpfOverlayHostSourceIP: + description: |- + BPFOverlayHostSourceIP controls the source IP that Felix uses in BPF mode for host-networked + (node-originated) traffic egressing over an IPIP/VXLAN overlay tunnel. "TunnelAddress" (the default) + assigns an IP address to the overlay tunnel device and uses it as the source, preserving the behaviour + of clusters upgraded from earlier releases. "HostAddress" uses the node's own IP directly and does not + assign a tunnel device IP. This option has no effect on WireGuard tunnels, which always use a tunnel + device IP. [Default: TunnelAddress] + enum: + - TunnelAddress + - HostAddress + type: string bpfPSNATPorts: anyOf: - type: integer @@ -1120,9 +1132,10 @@ spec: type: integer nftablesMode: default: Auto - description: - "NFTablesMode configures nftables support in Felix. [Default: - Auto]" + description: |- + NFTablesMode configures nftables support in Felix. In Auto mode, Felix uses the + nftables dataplane if kube-proxy is detected to be running in nftables mode. + [Default: Auto] enum: - Disabled - Enabled @@ -1189,7 +1202,7 @@ spec: prometheusMetricsClientAuth: description: |- PrometheusMetricsClientAuth specifies the client authentication type for the /metrics endpoint. - This determines how the server validates client certificates. Default is "RequireAndVerifyClientCert". + This determines how the server validates client certificates. Default is "NoClientCert". type: string prometheusMetricsEnabled: description: diff --git a/config/crd/projectcalico.org_kubecontrollersconfigurations.yaml b/config/crd/projectcalico.org_kubecontrollersconfigurations.yaml index 3e8fd4a0b..6ec006d96 100644 --- a/config/crd/projectcalico.org_kubecontrollersconfigurations.yaml +++ b/config/crd/projectcalico.org_kubecontrollersconfigurations.yaml @@ -115,6 +115,13 @@ spec: AutoHostEndpoints items: properties: + annotations: + additionalProperties: + type: string + description: + Annotations adds the specified annotations + to the generated AutoHostEndpoint. + type: object generateName: description: GenerateName is appended to the end @@ -344,6 +351,13 @@ spec: AutoHostEndpoints items: properties: + annotations: + additionalProperties: + type: string + description: + Annotations adds the specified + annotations to the generated AutoHostEndpoint. + type: object generateName: description: GenerateName is appended to the diff --git a/deps.txt b/deps.txt index 89a9e1756..ba4153b7b 100644 --- a/deps.txt +++ b/deps.txt @@ -1,7 +1,7 @@ !!! GENERATED FILE, DO NOT EDIT !!! Run 'make gen-deps-files' to regenerate. -go 1.26.4 +go 1.26.5 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc github.com/emicklei/go-restful v2.15.0+incompatible github.com/emicklei/go-restful/v3 v3.13.0 @@ -25,11 +25,11 @@ github.com/spf13/pflag v1.0.10 github.com/x448/float16 v0.8.4 go.yaml.in/yaml/v2 v2.4.4 go.yaml.in/yaml/v3 v3.0.4 -golang.org/x/net v0.56.0 +golang.org/x/net v0.57.0 golang.org/x/oauth2 v0.36.0 -golang.org/x/sys v0.46.0 -golang.org/x/term v0.44.0 -golang.org/x/text v0.38.0 +golang.org/x/sys v0.47.0 +golang.org/x/term v0.45.0 +golang.org/x/text v0.40.0 golang.org/x/time v0.15.0 google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af gopkg.in/evanphx/json-patch.v4 v4.13.0 diff --git a/go.mod b/go.mod index 0f356c510..21d40bfb6 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/projectcalico/api -go 1.26.4 +go 1.26.5 require ( github.com/jinzhu/copier v0.4.0 @@ -40,15 +40,15 @@ require ( github.com/x448/float16 v0.8.4 // indirect go.yaml.in/yaml/v2 v2.4.3 // indirect go.yaml.in/yaml/v3 v3.0.4 // indirect - golang.org/x/mod v0.37.0 // indirect - golang.org/x/net v0.56.0 // indirect + golang.org/x/mod v0.38.0 // indirect + golang.org/x/net v0.57.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect - golang.org/x/sync v0.21.0 // indirect - golang.org/x/sys v0.46.0 // indirect - golang.org/x/term v0.44.0 // indirect - golang.org/x/text v0.38.0 // indirect + golang.org/x/sync v0.22.0 // indirect + golang.org/x/sys v0.47.0 // indirect + golang.org/x/term v0.45.0 // indirect + golang.org/x/text v0.40.0 // indirect golang.org/x/time v0.15.0 // indirect - golang.org/x/tools v0.47.0 // indirect + golang.org/x/tools v0.48.0 // indirect google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect gopkg.in/inf.v0 v0.9.1 // indirect diff --git a/go.sum b/go.sum index 15c44919b..f71160bc9 100644 --- a/go.sum +++ b/go.sum @@ -105,24 +105,24 @@ go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0= go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8= go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= -golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ= -golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0= -golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o= -golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec= +golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk= +golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40= +golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= +golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= -golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM= -golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= -golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw= -golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= -golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc= -golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y= -golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE= -golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4= +golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= +golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= +golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= +golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0= +golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w= +golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs= +golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY= golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= -golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q= -golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA= +golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE= +golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk= google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI= google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= diff --git a/lib.Makefile b/lib.Makefile index 14e68c4cf..b123af0f3 100644 --- a/lib.Makefile +++ b/lib.Makefile @@ -1661,6 +1661,9 @@ endif touch $@ kind-cluster-destroy kind-down: $(KIND) $(KUBECTL) + # Tear down the e2e external node (if any) alongside the cluster. Idempotent + # and a no-op when no external node was created (e.g. non-BPF jobs). + -$(KIND_DIR)/external-node.sh down # We need to drain the cluster gracefully when shutting down to avoid a netdev unregister error from the kernel. # This requires we execute CNI del on pods with pod networking. -$(KIND) delete cluster --name $(KIND_NAME) diff --git a/metadata.mk b/metadata.mk index 227e0997b..93608d173 100644 --- a/metadata.mk +++ b/metadata.mk @@ -2,7 +2,7 @@ # This file contains Makefile configuration parameters and metadata for this branch. ################################################################################################# # The project Go version -GO_VERSION=1.26.4 +GO_VERSION=1.26.5 # Version of Kubernetes to use for dependencies, tests, registry.k8s.io/kubectl, and kubectl binary release. K8S_VERSION=v1.36.2 # The version of LLVM to use for go-build and calico/base images. @@ -11,7 +11,7 @@ LLVM_VERSION=21.1.8 GO_BUILD_VER=$(GO_VERSION)-llvm$(LLVM_VERSION)-k8s$(K8S_VERSION:v%=%) RUST_BUILD_VER=1.96.0 -CALICO_BASE_VER=ubi9-1781722225 +CALICO_BASE_VER=ubi9-1783525764 # Version of various tools used in the build and tests. COREDNS_VERSION=1.5.2 diff --git a/pkg/apis/projectcalico/v3/felixconfig.go b/pkg/apis/projectcalico/v3/felixconfig.go index 437a5ac8c..d1305b0f7 100644 --- a/pkg/apis/projectcalico/v3/felixconfig.go +++ b/pkg/apis/projectcalico/v3/felixconfig.go @@ -120,6 +120,14 @@ const ( BPFConnectTimeLBDisabled BPFConnectTimeLBType = "Disabled" ) +// +kubebuilder:validation:Enum=TunnelAddress;HostAddress +type BPFOverlayHostSourceIPType string + +const ( + BPFOverlayHostSourceIPTunnelAddress BPFOverlayHostSourceIPType = "TunnelAddress" + BPFOverlayHostSourceIPHostAddress BPFOverlayHostSourceIPType = "HostAddress" +) + // +kubebuilder:validation:Enum=Auto;Userspace;BPFProgram type BPFConntrackMode string @@ -525,7 +533,7 @@ type FelixConfigurationSpec struct { PrometheusMetricsKeyFile *string `json:"prometheusMetricsKeyFile,omitempty"` // PrometheusMetricsClientAuth specifies the client authentication type for the /metrics endpoint. - // This determines how the server validates client certificates. Default is "RequireAndVerifyClientCert". + // This determines how the server validates client certificates. Default is "NoClientCert". PrometheusMetricsClientAuth *PrometheusMetricsClientAuthType `json:"prometheusMetricsClientAuth,omitempty" validate:"omitempty,oneof=RequireAndVerifyClientCert RequireAnyClientCert VerifyClientCertIfGiven NoClientCert"` // FailsafeInboundHostPorts is a list of ProtoPort struct objects including UDP/TCP/SCTP ports and CIDRs that Felix will @@ -674,7 +682,9 @@ type FelixConfigurationSpec struct { // iptables. [Default: false] GenericXDPEnabled *bool `json:"genericXDPEnabled,omitempty" confignamev1:"GenericXDPEnabled"` - // NFTablesMode configures nftables support in Felix. [Default: Auto] + // NFTablesMode configures nftables support in Felix. In Auto mode, Felix uses the + // nftables dataplane if kube-proxy is detected to be running in nftables mode. + // [Default: Auto] // +kubebuilder:default=Auto NFTablesMode *NFTablesMode `json:"nftablesMode,omitempty"` @@ -708,6 +718,14 @@ type FelixConfigurationSpec struct { // BPFEnabled, if enabled Felix will use the BPF dataplane. [Default: false] BPFEnabled *bool `json:"bpfEnabled,omitempty" validate:"omitempty"` + // BPFOverlayHostSourceIP controls the source IP that Felix uses in BPF mode for host-networked + // (node-originated) traffic egressing over an IPIP/VXLAN overlay tunnel. "TunnelAddress" (the default) + // assigns an IP address to the overlay tunnel device and uses it as the source, preserving the behaviour + // of clusters upgraded from earlier releases. "HostAddress" uses the node's own IP directly and does not + // assign a tunnel device IP. This option has no effect on WireGuard tunnels, which always use a tunnel + // device IP. [Default: TunnelAddress] + BPFOverlayHostSourceIP *BPFOverlayHostSourceIPType `json:"bpfOverlayHostSourceIP,omitempty" validate:"omitempty,oneof=TunnelAddress HostAddress"` + // BPFDisableUnprivileged, if enabled, Felix sets the kernel.unprivileged_bpf_disabled sysctl to disable // unprivileged use of BPF. This ensures that unprivileged users cannot access Calico's BPF maps and // cannot insert their own BPF programs to interfere with Calico's. [Default: true] diff --git a/pkg/apis/projectcalico/v3/kubecontrollersconfig.go b/pkg/apis/projectcalico/v3/kubecontrollersconfig.go index b4da9dfbc..21c65bff3 100644 --- a/pkg/apis/projectcalico/v3/kubecontrollersconfig.go +++ b/pkg/apis/projectcalico/v3/kubecontrollersconfig.go @@ -1,4 +1,4 @@ -// Copyright (c) 2020-2021 Tigera, Inc. All rights reserved. +// Copyright (c) 2020-2026 Tigera, Inc. All rights reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. @@ -155,7 +155,7 @@ type AutoHostEndpointConfig struct { // Templates contains definition for creating AutoHostEndpoints // +listType=atomic - Templates []Template `json:"templates,omitempty" validate:"omitempty"` + Templates []Template `json:"templates,omitempty" validate:"omitempty,dive"` } // DefaultHostEndpointMode controls whether a default host endpoint is created for each node. @@ -185,6 +185,9 @@ type Template struct { // Labels adds the specified labels to the generated AutoHostEndpoint, labels from node with the same name will be overwritten by values from the template label Labels map[string]string `json:"labels,omitempty" validate:"omitempty,labels"` + // Annotations adds the specified annotations to the generated AutoHostEndpoint. + Annotations map[string]string `json:"annotations,omitempty"` + // NodeSelector allows the AutoHostEndpoint to be created only for specific nodes NodeSelector string `json:"nodeSelector,omitempty" validate:"omitempty,selector"` } diff --git a/pkg/apis/projectcalico/v3/zz_generated.deepcopy.go b/pkg/apis/projectcalico/v3/zz_generated.deepcopy.go index bcfe9f256..13c7668e4 100644 --- a/pkg/apis/projectcalico/v3/zz_generated.deepcopy.go +++ b/pkg/apis/projectcalico/v3/zz_generated.deepcopy.go @@ -1743,6 +1743,11 @@ func (in *FelixConfigurationSpec) DeepCopyInto(out *FelixConfigurationSpec) { *out = new(bool) **out = **in } + if in.BPFOverlayHostSourceIP != nil { + in, out := &in.BPFOverlayHostSourceIP, &out.BPFOverlayHostSourceIP + *out = new(BPFOverlayHostSourceIPType) + **out = **in + } if in.BPFDisableUnprivileged != nil { in, out := &in.BPFDisableUnprivileged, &out.BPFDisableUnprivileged *out = new(bool) @@ -4066,6 +4071,13 @@ func (in *Template) DeepCopyInto(out *Template) { (*out)[key] = val } } + if in.Annotations != nil { + in, out := &in.Annotations, &out.Annotations + *out = make(map[string]string, len(*in)) + for key, val := range *in { + (*out)[key] = val + } + } return } diff --git a/pkg/client/applyconfiguration_generated/internal/internal.go b/pkg/client/applyconfiguration_generated/internal/internal.go index 90c78b289..e0d6f2bbf 100644 --- a/pkg/client/applyconfiguration_generated/internal/internal.go +++ b/pkg/client/applyconfiguration_generated/internal/internal.go @@ -963,6 +963,9 @@ var schemaYAML = typed.YAMLObject(`types: - name: bpfMapSizeRoute type: scalar: numeric + - name: bpfOverlayHostSourceIP + type: + scalar: string - name: bpfPSNATPorts type: namedType: com.github.projectcalico.api.pkg.lib.numorstring.Port @@ -2347,6 +2350,11 @@ var schemaYAML = typed.YAMLObject(`types: - name: com.github.projectcalico.api.pkg.apis.projectcalico.v3.Template map: fields: + - name: annotations + type: + map: + elementType: + scalar: string - name: generateName type: scalar: string diff --git a/pkg/client/applyconfiguration_generated/projectcalico/v3/felixconfigurationspec.go b/pkg/client/applyconfiguration_generated/projectcalico/v3/felixconfigurationspec.go index 133b570a8..ca3668e4a 100644 --- a/pkg/client/applyconfiguration_generated/projectcalico/v3/felixconfigurationspec.go +++ b/pkg/client/applyconfiguration_generated/projectcalico/v3/felixconfigurationspec.go @@ -254,7 +254,7 @@ type FelixConfigurationSpecApplyConfiguration struct { // used for securing the /metrics endpoint. The private key must be valid and accessible by the calico-node process. PrometheusMetricsKeyFile *string `json:"prometheusMetricsKeyFile,omitempty"` // PrometheusMetricsClientAuth specifies the client authentication type for the /metrics endpoint. - // This determines how the server validates client certificates. Default is "RequireAndVerifyClientCert". + // This determines how the server validates client certificates. Default is "NoClientCert". PrometheusMetricsClientAuth *projectcalicov3.PrometheusMetricsClientAuthType `json:"prometheusMetricsClientAuth,omitempty"` // FailsafeInboundHostPorts is a list of ProtoPort struct objects including UDP/TCP/SCTP ports and CIDRs that Felix will // allow incoming traffic to host endpoints on irrespective of the security policy. This is useful to avoid accidentally @@ -358,7 +358,9 @@ type FelixConfigurationSpecApplyConfiguration struct { // modes can use XDP. This is not recommended since it doesn't provide better performance than // iptables. [Default: false] GenericXDPEnabled *bool `json:"genericXDPEnabled,omitempty"` - // NFTablesMode configures nftables support in Felix. [Default: Auto] + // NFTablesMode configures nftables support in Felix. In Auto mode, Felix uses the + // nftables dataplane if kube-proxy is detected to be running in nftables mode. + // [Default: Auto] NFTablesMode *projectcalicov3.NFTablesMode `json:"nftablesMode,omitempty"` // NftablesRefreshInterval controls the interval at which Felix periodically refreshes the nftables rules. [Default: 90s] NftablesRefreshInterval *v1.Duration `json:"nftablesRefreshInterval,omitempty"` @@ -379,6 +381,13 @@ type FelixConfigurationSpecApplyConfiguration struct { NftablesMarkMask *int64 `json:"nftablesMarkMask,omitempty"` // BPFEnabled, if enabled Felix will use the BPF dataplane. [Default: false] BPFEnabled *bool `json:"bpfEnabled,omitempty"` + // BPFOverlayHostSourceIP controls the source IP that Felix uses in BPF mode for host-networked + // (node-originated) traffic egressing over an IPIP/VXLAN overlay tunnel. "TunnelAddress" (the default) + // assigns an IP address to the overlay tunnel device and uses it as the source, preserving the behaviour + // of clusters upgraded from earlier releases. "HostAddress" uses the node's own IP directly and does not + // assign a tunnel device IP. This option has no effect on WireGuard tunnels, which always use a tunnel + // device IP. [Default: TunnelAddress] + BPFOverlayHostSourceIP *projectcalicov3.BPFOverlayHostSourceIPType `json:"bpfOverlayHostSourceIP,omitempty"` // BPFDisableUnprivileged, if enabled, Felix sets the kernel.unprivileged_bpf_disabled sysctl to disable // unprivileged use of BPF. This ensures that unprivileged users cannot access Calico's BPF maps and // cannot insert their own BPF programs to interfere with Calico's. [Default: true] @@ -1579,6 +1588,14 @@ func (b *FelixConfigurationSpecApplyConfiguration) WithBPFEnabled(value bool) *F return b } +// WithBPFOverlayHostSourceIP sets the BPFOverlayHostSourceIP field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the BPFOverlayHostSourceIP field is set to the value of the last call. +func (b *FelixConfigurationSpecApplyConfiguration) WithBPFOverlayHostSourceIP(value projectcalicov3.BPFOverlayHostSourceIPType) *FelixConfigurationSpecApplyConfiguration { + b.BPFOverlayHostSourceIP = &value + return b +} + // WithBPFDisableUnprivileged sets the BPFDisableUnprivileged field in the declarative configuration to the given value // and returns the receiver, so that objects can be built by chaining "With" function invocations. // If called multiple times, the BPFDisableUnprivileged field is set to the value of the last call. diff --git a/pkg/client/applyconfiguration_generated/projectcalico/v3/template.go b/pkg/client/applyconfiguration_generated/projectcalico/v3/template.go index 6d861a776..b4e6aa981 100644 --- a/pkg/client/applyconfiguration_generated/projectcalico/v3/template.go +++ b/pkg/client/applyconfiguration_generated/projectcalico/v3/template.go @@ -18,6 +18,8 @@ type TemplateApplyConfiguration struct { InterfacePattern *string `json:"interfacePattern,omitempty"` // Labels adds the specified labels to the generated AutoHostEndpoint, labels from node with the same name will be overwritten by values from the template label Labels map[string]string `json:"labels,omitempty"` + // Annotations adds the specified annotations to the generated AutoHostEndpoint. + Annotations map[string]string `json:"annotations,omitempty"` // NodeSelector allows the AutoHostEndpoint to be created only for specific nodes NodeSelector *string `json:"nodeSelector,omitempty"` } @@ -68,6 +70,20 @@ func (b *TemplateApplyConfiguration) WithLabels(entries map[string]string) *Temp return b } +// WithAnnotations puts the entries into the Annotations field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, the entries provided by each call will be put on the Annotations field, +// overwriting an existing map entries in Annotations field with the same key. +func (b *TemplateApplyConfiguration) WithAnnotations(entries map[string]string) *TemplateApplyConfiguration { + if b.Annotations == nil && len(entries) > 0 { + b.Annotations = make(map[string]string, len(entries)) + } + for k, v := range entries { + b.Annotations[k] = v + } + return b +} + // WithNodeSelector sets the NodeSelector field in the declarative configuration to the given value // and returns the receiver, so that objects can be built by chaining "With" function invocations. // If called multiple times, the NodeSelector field is set to the value of the last call. diff --git a/pkg/openapi/generated.openapi.go b/pkg/openapi/generated.openapi.go index 9492954be..7efbac30b 100644 --- a/pkg/openapi/generated.openapi.go +++ b/pkg/openapi/generated.openapi.go @@ -3469,7 +3469,7 @@ func schema_pkg_apis_projectcalico_v3_FelixConfigurationSpec(ref common.Referenc }, "prometheusMetricsClientAuth": { SchemaProps: spec.SchemaProps{ - Description: "PrometheusMetricsClientAuth specifies the client authentication type for the /metrics endpoint. This determines how the server validates client certificates. Default is \"RequireAndVerifyClientCert\".", + Description: "PrometheusMetricsClientAuth specifies the client authentication type for the /metrics endpoint. This determines how the server validates client certificates. Default is \"NoClientCert\".", Type: []string{"string"}, Format: "", }, @@ -3694,7 +3694,7 @@ func schema_pkg_apis_projectcalico_v3_FelixConfigurationSpec(ref common.Referenc }, "nftablesMode": { SchemaProps: spec.SchemaProps{ - Description: "NFTablesMode configures nftables support in Felix. [Default: Auto]\n\nPossible enum values:\n - `\"Auto\"`\n - `\"Disabled\"`\n - `\"Enabled\"`", + Description: "NFTablesMode configures nftables support in Felix. In Auto mode, Felix uses the nftables dataplane if kube-proxy is detected to be running in nftables mode. [Default: Auto]\n\nPossible enum values:\n - `\"Auto\"`\n - `\"Disabled\"`\n - `\"Enabled\"`", Type: []string{"string"}, Format: "", Enum: []interface{}{"Auto", "Disabled", "Enabled"}, @@ -3741,6 +3741,13 @@ func schema_pkg_apis_projectcalico_v3_FelixConfigurationSpec(ref common.Referenc Format: "", }, }, + "bpfOverlayHostSourceIP": { + SchemaProps: spec.SchemaProps{ + Description: "BPFOverlayHostSourceIP controls the source IP that Felix uses in BPF mode for host-networked (node-originated) traffic egressing over an IPIP/VXLAN overlay tunnel. \"TunnelAddress\" (the default) assigns an IP address to the overlay tunnel device and uses it as the source, preserving the behaviour of clusters upgraded from earlier releases. \"HostAddress\" uses the node's own IP directly and does not assign a tunnel device IP. This option has no effect on WireGuard tunnels, which always use a tunnel device IP. [Default: TunnelAddress]", + Type: []string{"string"}, + Format: "", + }, + }, "bpfDisableUnprivileged": { SchemaProps: spec.SchemaProps{ Description: "BPFDisableUnprivileged, if enabled, Felix sets the kernel.unprivileged_bpf_disabled sysctl to disable unprivileged use of BPF. This ensures that unprivileged users cannot access Calico's BPF maps and cannot insert their own BPF programs to interfere with Calico's. [Default: true]", @@ -7833,6 +7840,22 @@ func schema_pkg_apis_projectcalico_v3_Template(ref common.ReferenceCallback) com }, }, }, + "annotations": { + SchemaProps: spec.SchemaProps{ + Description: "Annotations adds the specified annotations to the generated AutoHostEndpoint.", + Type: []string{"object"}, + AdditionalProperties: &spec.SchemaOrBool{ + Allows: true, + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: "", + Type: []string{"string"}, + Format: "", + }, + }, + }, + }, + }, "nodeSelector": { SchemaProps: spec.SchemaProps{ Description: "NodeSelector allows the AutoHostEndpoint to be created only for specific nodes",