Skip to content

Commit 53a86dd

Browse files
caseydavenportgithub-actions[bot]
caseydavenport
authored and
github-actions[bot]
committed
Automatic API update from tigera/calico-private release-calient-v3.23
1 parent d5444a5 commit 53a86dd

14 files changed

Lines changed: 1314 additions & 1017 deletions

‎config/crd/projectcalico.org_caliconodestatuses.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -224,4 +224,5 @@ spec:
224224
type: object
225225
served: true
226226
storage: true
227-
subresources: {}
227+
subresources:
228+
status: {}

‎config/crd/projectcalico.org_policyrecommendationscopes.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,22 @@ spec:
2626
type: object
2727
spec:
2828
properties:
29+
hostEndpointSpec:
30+
properties:
31+
recommendationStatus:
32+
enum:
33+
- Enabled
34+
- Disabled
35+
type: string
36+
selector:
37+
maxLength: 4096
38+
type: string
39+
tierName:
40+
maxLength: 253
41+
type: string
42+
required:
43+
- selector
44+
type: object
2945
initialLookback:
3046
type: string
3147
interval:
@@ -37,10 +53,15 @@ spec:
3753
intraNamespacePassThroughTraffic:
3854
type: boolean
3955
recStatus:
56+
enum:
57+
- Enabled
58+
- Disabled
4059
type: string
4160
selector:
61+
maxLength: 4096
4262
type: string
4363
tierName:
64+
maxLength: 253
4465
type: string
4566
required:
4667
- selector

‎lib.Makefile‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1606,8 +1606,10 @@ $(REPO_ROOT)/.$(KIND_NAME).created: $(KUBECTL) $(KIND)
16061606
while ! KUBECONFIG=$(KIND_KUBECONFIG) $(KUBECTL) apply -f $(REPO_ROOT)/libcalico-go/config/crd/policy.networking.k8s.io_adminnetworkpolicies.yaml; do echo "Waiting for ANP CRDs to be created"; sleep 2; done
16071607
while ! KUBECONFIG=$(KIND_KUBECONFIG) $(KUBECTL) apply -f $(REPO_ROOT)/libcalico-go/config/crd/policy.networking.k8s.io_baselineadminnetworkpolicies.yaml; do echo "Waiting for CRDs to be created"; sleep 2; done
16081608

1609-
# Install mutating admission policies.
1609+
# Install mutating admission policies (only for v3 CRDs, since they reference projectcalico.org/v3 resources).
1610+
ifeq ($(CALICO_API_GROUP),projectcalico.org/v3)
16101611
while ! KUBECONFIG=$(KIND_KUBECONFIG) $(KUBECTL) apply -f $(REPO_ROOT)/api/admission/; do echo "Waiting for mutating admission policies to be created"; sleep 2; done
1612+
endif
16111613

16121614
touch $@
16131615

‎pkg/apis/projectcalico/v3/doc.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
// +k8s:deepcopy-gen=package,register
44
// +k8s:openapi-gen=true
5+
// +k8s:openapi-model-package=com.github.tigera.api.pkg.apis.projectcalico.v3
56

67
// Package v3 is the v3 version of the API.
78
// +groupName=projectcalico.org

‎pkg/apis/projectcalico/v3/nodestatus.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ type CalicoNodeStatusList struct {
3939
// +genclient:nonNamespaced
4040
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
4141
// +kubebuilder:resource:scope=Cluster
42+
// +kubebuilder:subresource:status
4243
// +kubebuilder:printcolumn:name="Node",type=string,JSONPath=".spec.node",description="The name of the node"
4344
// +kubebuilder:printcolumn:name="Classes",type=string,JSONPath=".spec.classes",description="The types of information to monitor for this calico/node"
4445

‎pkg/apis/projectcalico/v3/policyrecommendationscope.go‎

Lines changed: 32 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright (c) 2022 Tigera, Inc. All rights reserved.
1+
// Copyright (c) 2022-2026 Tigera, Inc. All rights reserved.
22
package v3
33

44
import (
@@ -57,7 +57,12 @@ type PolicyRecommendationScopeSpec struct {
5757
PoliciesLearningCutOff *int `json:"policiesLearningCutOff,omitempty"`
5858

5959
// The namespace spec contains the namespace relative recommendation vars.
60-
NamespaceSpec PolicyRecommendationScopeNamespaceSpec `json:"namespaceSpec,omitempty"`
60+
// +optional
61+
NamespaceSpec *PolicyRecommendationScopeNamespaceSpec `json:"namespaceSpec,omitempty"`
62+
63+
// The host endpoint spec contains host endpoint relative recommendation vars.
64+
// +optional
65+
HostEndpointSpec *PolicyRecommendationScopeHostEndpointSpec `json:"hostEndpointSpec,omitempty"`
6166
}
6267

6368
type PolicyRecommendationScopeStatus struct {
@@ -85,24 +90,45 @@ type PolicyRecommendationScopeNamespaceSpec struct {
8590
// +optional
8691
IntraNamespacePassThroughTraffic bool `json:"intraNamespacePassThroughTraffic,omitempty"`
8792
// Recommendation status. One of Enabled, Disabled.
88-
RecStatus PolicyRecommendationNamespaceStatus `json:"recStatus,omitempty" validate:"omitempty,policyrecstatus"`
93+
RecStatus PolicyRecommendationStatus `json:"recStatus,omitempty" validate:"omitempty,policyrecstatus"`
8994
// The namespace selector is an expression used to pick out the namespaces that the policy
9095
// recommendation engine should create policies for. The syntax is the same as the
9196
// NetworkPolicy.projectcalico.org resource selectors.
97+
// +kubebuilder:validation:MaxLength=4096
9298
Selector string `json:"selector" validate:"selector"`
9399
// The name of the policy recommendation tier for namespace-isolated policies.
94100
// [Default: "namespace-isolation"]
95101
// +optional
102+
// +kubebuilder:validation:MaxLength=253
96103
TierName string `json:"tierName,omitempty" validate:"omitempty,name"`
97104
}
98105

99-
type PolicyRecommendationNamespaceStatus string
106+
// +kubebuilder:validation:Enum=Enabled;Disabled
107+
type PolicyRecommendationStatus string
100108

101109
const (
102-
PolicyRecommendationScopeEnabled PolicyRecommendationNamespaceStatus = "Enabled"
103-
PolicyRecommendationScopeDisabled PolicyRecommendationNamespaceStatus = "Disabled"
110+
PolicyRecommendationEnabled PolicyRecommendationStatus = "Enabled"
111+
PolicyRecommendationDisabled PolicyRecommendationStatus = "Disabled"
104112
)
105113

114+
// PolicyRecommendationScopeHostEndpointSpec contains host endpoint information that defines the
115+
// host endpoint based recommended policy.
116+
type PolicyRecommendationScopeHostEndpointSpec struct {
117+
// Recommendation status. One of Enabled, Disabled.
118+
// +optional
119+
RecommendationStatus PolicyRecommendationStatus `json:"recommendationStatus,omitempty" validate:"omitempty,policyrecstatus"`
120+
// The selector is an expression used to pick out the host endpoints that the policy
121+
// recommendation engine should create policies for. The syntax is the same as the
122+
// NetworkPolicy.projectcalico.org resource selectors.
123+
// +kubebuilder:validation:MaxLength=4096
124+
Selector string `json:"selector" validate:"selector"`
125+
// The name of the policy recommendation tier for host endpoint isolated policies.
126+
// [Default: "hostendpoint-isolation"]
127+
// +optional
128+
// +kubebuilder:validation:MaxLength=253
129+
TierName string `json:"tierName,omitempty" validate:"omitempty,name"`
130+
}
131+
106132
// +genclient:nonNamespaced
107133
// +kubebuilder:resource:scope=Cluster
108134
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object

‎pkg/apis/projectcalico/v3/policyrecommendationscope_test.go‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
// Copyright (c) 2026 Tigera, Inc. All rights reserved.
2+
3+
package v3_test
4+
5+
import (
6+
"encoding/json"
7+
"testing"
8+
"time"
9+
10+
. "github.com/onsi/gomega"
11+
v3 "github.com/tigera/api/pkg/apis/projectcalico/v3"
12+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
13+
)
14+
15+
func TestPolicyRecommendationScopeHostEndpointSpecSerialization(t *testing.T) {
16+
g := NewGomegaWithT(t)
17+
18+
scope := v3.PolicyRecommendationScope{
19+
TypeMeta: metav1.TypeMeta{
20+
Kind: v3.KindPolicyRecommendationScope,
21+
APIVersion: v3.GroupVersionCurrent,
22+
},
23+
ObjectMeta: metav1.ObjectMeta{
24+
Name: "default",
25+
},
26+
Spec: v3.PolicyRecommendationScopeSpec{
27+
Interval: &metav1.Duration{Duration: 150 * time.Second},
28+
NamespaceSpec: &v3.PolicyRecommendationScopeNamespaceSpec{
29+
RecStatus: v3.PolicyRecommendationEnabled,
30+
Selector: "all()",
31+
},
32+
HostEndpointSpec: &v3.PolicyRecommendationScopeHostEndpointSpec{
33+
RecommendationStatus: v3.PolicyRecommendationEnabled,
34+
Selector: "hostendpoint.projectcalico.org/type == 'nonclusterhost'",
35+
TierName: "hostendpoint-isolation",
36+
},
37+
},
38+
}
39+
40+
// Marshal to JSON.
41+
data, err := json.Marshal(scope)
42+
g.Expect(err).NotTo(HaveOccurred())
43+
44+
// Verify JSON contains the hostEndpointSpec fields.
45+
var raw map[string]interface{}
46+
err = json.Unmarshal(data, &raw)
47+
g.Expect(err).NotTo(HaveOccurred())
48+
spec := raw["spec"].(map[string]interface{})
49+
g.Expect(spec).To(HaveKey("hostEndpointSpec"))
50+
hostEndpointSpec := spec["hostEndpointSpec"].(map[string]interface{})
51+
g.Expect(hostEndpointSpec["recommendationStatus"]).To(Equal("Enabled"))
52+
g.Expect(hostEndpointSpec["selector"]).To(Equal("hostendpoint.projectcalico.org/type == 'nonclusterhost'"))
53+
g.Expect(hostEndpointSpec["tierName"]).To(Equal("hostendpoint-isolation"))
54+
55+
// Unmarshal back and verify round-trip.
56+
var decoded v3.PolicyRecommendationScope
57+
err = json.Unmarshal(data, &decoded)
58+
g.Expect(err).NotTo(HaveOccurred())
59+
g.Expect(decoded.Spec.HostEndpointSpec).NotTo(BeNil())
60+
g.Expect(decoded.Spec.HostEndpointSpec.RecommendationStatus).To(Equal(v3.PolicyRecommendationEnabled))
61+
g.Expect(decoded.Spec.HostEndpointSpec.Selector).To(Equal("hostendpoint.projectcalico.org/type == 'nonclusterhost'"))
62+
g.Expect(decoded.Spec.HostEndpointSpec.TierName).To(Equal("hostendpoint-isolation"))
63+
}
64+
65+
func TestPolicyRecommendationScopeHostEndpointSpecOmittedWhenNil(t *testing.T) {
66+
g := NewGomegaWithT(t)
67+
68+
scope := v3.PolicyRecommendationScope{
69+
Spec: v3.PolicyRecommendationScopeSpec{
70+
NamespaceSpec: &v3.PolicyRecommendationScopeNamespaceSpec{
71+
Selector: "all()",
72+
},
73+
},
74+
}
75+
76+
data, err := json.Marshal(scope)
77+
g.Expect(err).NotTo(HaveOccurred())
78+
79+
var raw map[string]interface{}
80+
err = json.Unmarshal(data, &raw)
81+
g.Expect(err).NotTo(HaveOccurred())
82+
83+
spec := raw["spec"].(map[string]interface{})
84+
// hostEndpointSpec is a pointer with omitempty, so a nil value is omitted from JSON.
85+
g.Expect(spec).NotTo(HaveKey("hostEndpointSpec"))
86+
}
87+
88+
func TestPolicyRecommendationScopeHostEndpointSpecDisabledStatus(t *testing.T) {
89+
g := NewGomegaWithT(t)
90+
91+
scope := v3.PolicyRecommendationScope{
92+
Spec: v3.PolicyRecommendationScopeSpec{
93+
HostEndpointSpec: &v3.PolicyRecommendationScopeHostEndpointSpec{
94+
RecommendationStatus: v3.PolicyRecommendationDisabled,
95+
Selector: "all()",
96+
},
97+
},
98+
}
99+
100+
data, err := json.Marshal(scope)
101+
g.Expect(err).NotTo(HaveOccurred())
102+
103+
var decoded v3.PolicyRecommendationScope
104+
err = json.Unmarshal(data, &decoded)
105+
g.Expect(err).NotTo(HaveOccurred())
106+
g.Expect(decoded.Spec.HostEndpointSpec).NotTo(BeNil())
107+
g.Expect(decoded.Spec.HostEndpointSpec.RecommendationStatus).To(Equal(v3.PolicyRecommendationDisabled))
108+
}

‎pkg/apis/projectcalico/v3/zz_generated.deepcopy.go‎

Lines changed: 26 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/client/applyconfiguration_generated/projectcalico/v3/policyrecommendationscopehostendpointspec.go‎

Lines changed: 56 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/client/applyconfiguration_generated/projectcalico/v3/policyrecommendationscopenamespacespec.go‎

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)