diff --git a/config/crd/projectcalico.org_felixconfigurations.yaml b/config/crd/projectcalico.org_felixconfigurations.yaml index fb577c133..431b708e5 100644 --- a/config/crd/projectcalico.org_felixconfigurations.yaml +++ b/config/crd/projectcalico.org_felixconfigurations.yaml @@ -434,6 +434,18 @@ spec: to hold one entry per workload and a handful of entries per host (enough to cover its own IPs and tunnel IPs). type: integer + bpfOverlayHostSourceIP: + description: |- + BPFOverlayHostSourceIP controls the source IP that Felix uses in BPF mode for host-networked + (node-originated) traffic egressing over an IPIP/VXLAN overlay tunnel. "TunnelAddress" (the default) + assigns an IP address to the overlay tunnel device and uses it as the source, preserving the behaviour + of clusters upgraded from earlier releases. "HostAddress" uses the node's own IP directly and does not + assign a tunnel device IP. This option has no effect on WireGuard tunnels, which always use a tunnel + device IP. [Default: TunnelAddress] + enum: + - TunnelAddress + - HostAddress + type: string bpfPSNATPorts: anyOf: - type: integer @@ -1102,6 +1114,25 @@ spec: blocks traffic with a "drop" action. If you want to use a "reject" action instead you can configure it here. pattern: ^(?i)(Drop|Reject)?$ type: string + nftablesFlowTableDataIfacePattern: + description: |- + NFTablesFlowTableDataIfacePattern is a regular expression that controls which host + interfaces are added to the nftables flowtable, so that traffic forwarded between those + interfaces and local workloads is offloaded to the flowtable fast path. Leave empty to + offload only workload-to-workload traffic. Only takes effect when NFTablesFlowTableOffload + is not Disabled. [Default: ""] + type: string + nftablesFlowTableOffload: + default: Disabled + description: |- + NFTablesFlowTableOffload controls which traffic nftables flowtable offload is enabled for, + for improved forwarding performance. When set to "All", established connections accepted by + Calico policy are offloaded to the kernel's flowtable fast path. Only applies when + nftables mode is active. [Default: Disabled] + enum: + - All + - Disabled + type: string nftablesMangleAllowAction: description: |- NftablesMangleAllowAction controls the nftables action that Felix uses to represent the "allow" policy verdict @@ -1120,9 +1151,10 @@ spec: type: integer nftablesMode: default: Auto - description: - "NFTablesMode configures nftables support in Felix. [Default: - Auto]" + description: |- + NFTablesMode configures nftables support in Felix. In Auto mode, Felix uses the + nftables dataplane if kube-proxy is detected to be running in nftables mode. + [Default: Auto] enum: - Disabled - Enabled @@ -1189,7 +1221,7 @@ spec: prometheusMetricsClientAuth: description: |- PrometheusMetricsClientAuth specifies the client authentication type for the /metrics endpoint. - This determines how the server validates client certificates. Default is "RequireAndVerifyClientCert". + This determines how the server validates client certificates. Default is "NoClientCert". type: string prometheusMetricsEnabled: description: diff --git a/config/crd/projectcalico.org_kubecontrollersconfigurations.yaml b/config/crd/projectcalico.org_kubecontrollersconfigurations.yaml index 3e8fd4a0b..6ec006d96 100644 --- a/config/crd/projectcalico.org_kubecontrollersconfigurations.yaml +++ b/config/crd/projectcalico.org_kubecontrollersconfigurations.yaml @@ -115,6 +115,13 @@ spec: AutoHostEndpoints items: properties: + annotations: + additionalProperties: + type: string + description: + Annotations adds the specified annotations + to the generated AutoHostEndpoint. + type: object generateName: description: GenerateName is appended to the end @@ -344,6 +351,13 @@ spec: AutoHostEndpoints items: properties: + annotations: + additionalProperties: + type: string + description: + Annotations adds the specified + annotations to the generated AutoHostEndpoint. + type: object generateName: description: GenerateName is appended to the diff --git a/deps.txt b/deps.txt index 89a9e1756..ba4153b7b 100644 --- a/deps.txt +++ b/deps.txt @@ -1,7 +1,7 @@ !!! GENERATED FILE, DO NOT EDIT !!! Run 'make gen-deps-files' to regenerate. -go 1.26.4 +go 1.26.5 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc github.com/emicklei/go-restful v2.15.0+incompatible github.com/emicklei/go-restful/v3 v3.13.0 @@ -25,11 +25,11 @@ github.com/spf13/pflag v1.0.10 github.com/x448/float16 v0.8.4 go.yaml.in/yaml/v2 v2.4.4 go.yaml.in/yaml/v3 v3.0.4 -golang.org/x/net v0.56.0 +golang.org/x/net v0.57.0 golang.org/x/oauth2 v0.36.0 -golang.org/x/sys v0.46.0 -golang.org/x/term v0.44.0 -golang.org/x/text v0.38.0 +golang.org/x/sys v0.47.0 +golang.org/x/term v0.45.0 +golang.org/x/text v0.40.0 golang.org/x/time v0.15.0 google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af gopkg.in/evanphx/json-patch.v4 v4.13.0 diff --git a/go.mod b/go.mod index 0f356c510..21d40bfb6 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/projectcalico/api -go 1.26.4 +go 1.26.5 require ( github.com/jinzhu/copier v0.4.0 @@ -40,15 +40,15 @@ require ( github.com/x448/float16 v0.8.4 // indirect go.yaml.in/yaml/v2 v2.4.3 // indirect go.yaml.in/yaml/v3 v3.0.4 // indirect - golang.org/x/mod v0.37.0 // indirect - golang.org/x/net v0.56.0 // indirect + golang.org/x/mod v0.38.0 // indirect + golang.org/x/net v0.57.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect - golang.org/x/sync v0.21.0 // indirect - golang.org/x/sys v0.46.0 // indirect - golang.org/x/term v0.44.0 // indirect - golang.org/x/text v0.38.0 // indirect + golang.org/x/sync v0.22.0 // indirect + golang.org/x/sys v0.47.0 // indirect + golang.org/x/term v0.45.0 // indirect + golang.org/x/text v0.40.0 // indirect golang.org/x/time v0.15.0 // indirect - golang.org/x/tools v0.47.0 // indirect + golang.org/x/tools v0.48.0 // indirect google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect gopkg.in/inf.v0 v0.9.1 // indirect diff --git a/go.sum b/go.sum index 15c44919b..f71160bc9 100644 --- a/go.sum +++ b/go.sum @@ -105,24 +105,24 @@ go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0= go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8= go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= -golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ= -golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0= -golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o= -golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec= +golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk= +golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40= +golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= +golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= -golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM= -golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= -golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw= -golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= -golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc= -golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y= -golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE= -golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4= +golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= +golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= +golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= +golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0= +golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w= +golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs= +golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY= golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= -golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q= -golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA= +golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE= +golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk= google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI= google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= diff --git a/hack/openapi-violations-known.list b/hack/openapi-violations-known.list index 259361c74..871df99d6 100644 --- a/hack/openapi-violations-known.list +++ b/hack/openapi-violations-known.list @@ -14,6 +14,8 @@ API rule violation: names_match,github.com/projectcalico/api/pkg/apis/projectcal API rule violation: names_match,github.com/projectcalico/api/pkg/apis/projectcalico/v3,FelixConfigurationSpec,IPv6ElevatedRoutePriority API rule violation: names_match,github.com/projectcalico/api/pkg/apis/projectcalico/v3,FelixConfigurationSpec,IPv6NormalRoutePriority API rule violation: names_match,github.com/projectcalico/api/pkg/apis/projectcalico/v3,FelixConfigurationSpec,IPv6Support +API rule violation: names_match,github.com/projectcalico/api/pkg/apis/projectcalico/v3,FelixConfigurationSpec,NFTablesFlowTableDataIfacePattern +API rule violation: names_match,github.com/projectcalico/api/pkg/apis/projectcalico/v3,FelixConfigurationSpec,NFTablesFlowTableOffload API rule violation: names_match,github.com/projectcalico/api/pkg/apis/projectcalico/v3,FelixConfigurationSpec,NFTablesMode API rule violation: names_match,github.com/projectcalico/api/pkg/apis/projectcalico/v3,FelixConfigurationSpec,WireguardPersistentKeepAlive API rule violation: names_match,github.com/projectcalico/api/pkg/apis/projectcalico/v3,IPAMBlockSpec,DeprecatedStrictAffinity diff --git a/lib.Makefile b/lib.Makefile index 14e68c4cf..b123af0f3 100644 --- a/lib.Makefile +++ b/lib.Makefile @@ -1661,6 +1661,9 @@ endif touch $@ kind-cluster-destroy kind-down: $(KIND) $(KUBECTL) + # Tear down the e2e external node (if any) alongside the cluster. Idempotent + # and a no-op when no external node was created (e.g. non-BPF jobs). + -$(KIND_DIR)/external-node.sh down # We need to drain the cluster gracefully when shutting down to avoid a netdev unregister error from the kernel. # This requires we execute CNI del on pods with pod networking. -$(KIND) delete cluster --name $(KIND_NAME) diff --git a/metadata.mk b/metadata.mk index 227e0997b..93608d173 100644 --- a/metadata.mk +++ b/metadata.mk @@ -2,7 +2,7 @@ # This file contains Makefile configuration parameters and metadata for this branch. ################################################################################################# # The project Go version -GO_VERSION=1.26.4 +GO_VERSION=1.26.5 # Version of Kubernetes to use for dependencies, tests, registry.k8s.io/kubectl, and kubectl binary release. K8S_VERSION=v1.36.2 # The version of LLVM to use for go-build and calico/base images. @@ -11,7 +11,7 @@ LLVM_VERSION=21.1.8 GO_BUILD_VER=$(GO_VERSION)-llvm$(LLVM_VERSION)-k8s$(K8S_VERSION:v%=%) RUST_BUILD_VER=1.96.0 -CALICO_BASE_VER=ubi9-1781722225 +CALICO_BASE_VER=ubi9-1783525764 # Version of various tools used in the build and tests. COREDNS_VERSION=1.5.2 diff --git a/pkg/apis/projectcalico/v3/felixconfig.go b/pkg/apis/projectcalico/v3/felixconfig.go index 437a5ac8c..11a5e17a0 100644 --- a/pkg/apis/projectcalico/v3/felixconfig.go +++ b/pkg/apis/projectcalico/v3/felixconfig.go @@ -70,6 +70,18 @@ const ( NFTablesModeAuto NFTablesMode = "Auto" ) +// NFTablesFlowTableOffload controls which traffic nftables flowtable offload is enabled for. When +// set to "All", established connections that have been accepted by Calico policy are offloaded to +// the kernel's flowtable fast path, bypassing most of the networking stack for improved throughput. +// +enum +// +kubebuilder:validation:Enum=All;Disabled +type NFTablesFlowTableOffload string + +const ( + NFTablesFlowTableOffloadAll NFTablesFlowTableOffload = "All" + NFTablesFlowTableOffloadDisabled NFTablesFlowTableOffload = "Disabled" +) + // +kubebuilder:validation:Enum=DoNothing;Enable;Disable type AWSSrcDstCheckOption string @@ -120,6 +132,14 @@ const ( BPFConnectTimeLBDisabled BPFConnectTimeLBType = "Disabled" ) +// +kubebuilder:validation:Enum=TunnelAddress;HostAddress +type BPFOverlayHostSourceIPType string + +const ( + BPFOverlayHostSourceIPTunnelAddress BPFOverlayHostSourceIPType = "TunnelAddress" + BPFOverlayHostSourceIPHostAddress BPFOverlayHostSourceIPType = "HostAddress" +) + // +kubebuilder:validation:Enum=Auto;Userspace;BPFProgram type BPFConntrackMode string @@ -525,7 +545,7 @@ type FelixConfigurationSpec struct { PrometheusMetricsKeyFile *string `json:"prometheusMetricsKeyFile,omitempty"` // PrometheusMetricsClientAuth specifies the client authentication type for the /metrics endpoint. - // This determines how the server validates client certificates. Default is "RequireAndVerifyClientCert". + // This determines how the server validates client certificates. Default is "NoClientCert". PrometheusMetricsClientAuth *PrometheusMetricsClientAuthType `json:"prometheusMetricsClientAuth,omitempty" validate:"omitempty,oneof=RequireAndVerifyClientCert RequireAnyClientCert VerifyClientCertIfGiven NoClientCert"` // FailsafeInboundHostPorts is a list of ProtoPort struct objects including UDP/TCP/SCTP ports and CIDRs that Felix will @@ -674,10 +694,26 @@ type FelixConfigurationSpec struct { // iptables. [Default: false] GenericXDPEnabled *bool `json:"genericXDPEnabled,omitempty" confignamev1:"GenericXDPEnabled"` - // NFTablesMode configures nftables support in Felix. [Default: Auto] + // NFTablesMode configures nftables support in Felix. In Auto mode, Felix uses the + // nftables dataplane if kube-proxy is detected to be running in nftables mode. + // [Default: Auto] // +kubebuilder:default=Auto NFTablesMode *NFTablesMode `json:"nftablesMode,omitempty"` + // NFTablesFlowTableOffload controls which traffic nftables flowtable offload is enabled for, + // for improved forwarding performance. When set to "All", established connections accepted by + // Calico policy are offloaded to the kernel's flowtable fast path. Only applies when + // nftables mode is active. [Default: Disabled] + // +kubebuilder:default=Disabled + NFTablesFlowTableOffload *NFTablesFlowTableOffload `json:"nftablesFlowTableOffload,omitempty"` + + // NFTablesFlowTableDataIfacePattern is a regular expression that controls which host + // interfaces are added to the nftables flowtable, so that traffic forwarded between those + // interfaces and local workloads is offloaded to the flowtable fast path. Leave empty to + // offload only workload-to-workload traffic. Only takes effect when NFTablesFlowTableOffload + // is not Disabled. [Default: ""] + NFTablesFlowTableDataIfacePattern string `json:"nftablesFlowTableDataIfacePattern,omitempty" validate:"omitempty,regexp"` + // NftablesRefreshInterval controls the interval at which Felix periodically refreshes the nftables rules. [Default: 90s] NftablesRefreshInterval *metav1.Duration `json:"nftablesRefreshInterval,omitempty" configv1timescale:"seconds"` @@ -708,6 +744,14 @@ type FelixConfigurationSpec struct { // BPFEnabled, if enabled Felix will use the BPF dataplane. [Default: false] BPFEnabled *bool `json:"bpfEnabled,omitempty" validate:"omitempty"` + // BPFOverlayHostSourceIP controls the source IP that Felix uses in BPF mode for host-networked + // (node-originated) traffic egressing over an IPIP/VXLAN overlay tunnel. "TunnelAddress" (the default) + // assigns an IP address to the overlay tunnel device and uses it as the source, preserving the behaviour + // of clusters upgraded from earlier releases. "HostAddress" uses the node's own IP directly and does not + // assign a tunnel device IP. This option has no effect on WireGuard tunnels, which always use a tunnel + // device IP. [Default: TunnelAddress] + BPFOverlayHostSourceIP *BPFOverlayHostSourceIPType `json:"bpfOverlayHostSourceIP,omitempty" validate:"omitempty,oneof=TunnelAddress HostAddress"` + // BPFDisableUnprivileged, if enabled, Felix sets the kernel.unprivileged_bpf_disabled sysctl to disable // unprivileged use of BPF. This ensures that unprivileged users cannot access Calico's BPF maps and // cannot insert their own BPF programs to interfere with Calico's. [Default: true] diff --git a/pkg/apis/projectcalico/v3/kubecontrollersconfig.go b/pkg/apis/projectcalico/v3/kubecontrollersconfig.go index b4da9dfbc..21c65bff3 100644 --- a/pkg/apis/projectcalico/v3/kubecontrollersconfig.go +++ b/pkg/apis/projectcalico/v3/kubecontrollersconfig.go @@ -1,4 +1,4 @@ -// Copyright (c) 2020-2021 Tigera, Inc. All rights reserved. +// Copyright (c) 2020-2026 Tigera, Inc. All rights reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. @@ -155,7 +155,7 @@ type AutoHostEndpointConfig struct { // Templates contains definition for creating AutoHostEndpoints // +listType=atomic - Templates []Template `json:"templates,omitempty" validate:"omitempty"` + Templates []Template `json:"templates,omitempty" validate:"omitempty,dive"` } // DefaultHostEndpointMode controls whether a default host endpoint is created for each node. @@ -185,6 +185,9 @@ type Template struct { // Labels adds the specified labels to the generated AutoHostEndpoint, labels from node with the same name will be overwritten by values from the template label Labels map[string]string `json:"labels,omitempty" validate:"omitempty,labels"` + // Annotations adds the specified annotations to the generated AutoHostEndpoint. + Annotations map[string]string `json:"annotations,omitempty"` + // NodeSelector allows the AutoHostEndpoint to be created only for specific nodes NodeSelector string `json:"nodeSelector,omitempty" validate:"omitempty,selector"` } diff --git a/pkg/apis/projectcalico/v3/zz_generated.deepcopy.go b/pkg/apis/projectcalico/v3/zz_generated.deepcopy.go index bcfe9f256..eb8fd30a9 100644 --- a/pkg/apis/projectcalico/v3/zz_generated.deepcopy.go +++ b/pkg/apis/projectcalico/v3/zz_generated.deepcopy.go @@ -1728,6 +1728,11 @@ func (in *FelixConfigurationSpec) DeepCopyInto(out *FelixConfigurationSpec) { *out = new(NFTablesMode) **out = **in } + if in.NFTablesFlowTableOffload != nil { + in, out := &in.NFTablesFlowTableOffload, &out.NFTablesFlowTableOffload + *out = new(NFTablesFlowTableOffload) + **out = **in + } if in.NftablesRefreshInterval != nil { in, out := &in.NftablesRefreshInterval, &out.NftablesRefreshInterval *out = new(v1.Duration) @@ -1743,6 +1748,11 @@ func (in *FelixConfigurationSpec) DeepCopyInto(out *FelixConfigurationSpec) { *out = new(bool) **out = **in } + if in.BPFOverlayHostSourceIP != nil { + in, out := &in.BPFOverlayHostSourceIP, &out.BPFOverlayHostSourceIP + *out = new(BPFOverlayHostSourceIPType) + **out = **in + } if in.BPFDisableUnprivileged != nil { in, out := &in.BPFDisableUnprivileged, &out.BPFDisableUnprivileged *out = new(bool) @@ -4066,6 +4076,13 @@ func (in *Template) DeepCopyInto(out *Template) { (*out)[key] = val } } + if in.Annotations != nil { + in, out := &in.Annotations, &out.Annotations + *out = make(map[string]string, len(*in)) + for key, val := range *in { + (*out)[key] = val + } + } return } diff --git a/pkg/client/applyconfiguration_generated/internal/internal.go b/pkg/client/applyconfiguration_generated/internal/internal.go index 90c78b289..0cb6eab2f 100644 --- a/pkg/client/applyconfiguration_generated/internal/internal.go +++ b/pkg/client/applyconfiguration_generated/internal/internal.go @@ -963,6 +963,9 @@ var schemaYAML = typed.YAMLObject(`types: - name: bpfMapSizeRoute type: scalar: numeric + - name: bpfOverlayHostSourceIP + type: + scalar: string - name: bpfPSNATPorts type: namedType: com.github.projectcalico.api.pkg.lib.numorstring.Port @@ -1239,6 +1242,12 @@ var schemaYAML = typed.YAMLObject(`types: - name: nftablesFilterDenyAction type: scalar: string + - name: nftablesFlowTableDataIfacePattern + type: + scalar: string + - name: nftablesFlowTableOffload + type: + scalar: string - name: nftablesMangleAllowAction type: scalar: string @@ -2347,6 +2356,11 @@ var schemaYAML = typed.YAMLObject(`types: - name: com.github.projectcalico.api.pkg.apis.projectcalico.v3.Template map: fields: + - name: annotations + type: + map: + elementType: + scalar: string - name: generateName type: scalar: string diff --git a/pkg/client/applyconfiguration_generated/projectcalico/v3/felixconfigurationspec.go b/pkg/client/applyconfiguration_generated/projectcalico/v3/felixconfigurationspec.go index 133b570a8..aa76dd684 100644 --- a/pkg/client/applyconfiguration_generated/projectcalico/v3/felixconfigurationspec.go +++ b/pkg/client/applyconfiguration_generated/projectcalico/v3/felixconfigurationspec.go @@ -254,7 +254,7 @@ type FelixConfigurationSpecApplyConfiguration struct { // used for securing the /metrics endpoint. The private key must be valid and accessible by the calico-node process. PrometheusMetricsKeyFile *string `json:"prometheusMetricsKeyFile,omitempty"` // PrometheusMetricsClientAuth specifies the client authentication type for the /metrics endpoint. - // This determines how the server validates client certificates. Default is "RequireAndVerifyClientCert". + // This determines how the server validates client certificates. Default is "NoClientCert". PrometheusMetricsClientAuth *projectcalicov3.PrometheusMetricsClientAuthType `json:"prometheusMetricsClientAuth,omitempty"` // FailsafeInboundHostPorts is a list of ProtoPort struct objects including UDP/TCP/SCTP ports and CIDRs that Felix will // allow incoming traffic to host endpoints on irrespective of the security policy. This is useful to avoid accidentally @@ -358,8 +358,21 @@ type FelixConfigurationSpecApplyConfiguration struct { // modes can use XDP. This is not recommended since it doesn't provide better performance than // iptables. [Default: false] GenericXDPEnabled *bool `json:"genericXDPEnabled,omitempty"` - // NFTablesMode configures nftables support in Felix. [Default: Auto] + // NFTablesMode configures nftables support in Felix. In Auto mode, Felix uses the + // nftables dataplane if kube-proxy is detected to be running in nftables mode. + // [Default: Auto] NFTablesMode *projectcalicov3.NFTablesMode `json:"nftablesMode,omitempty"` + // NFTablesFlowTableOffload controls which traffic nftables flowtable offload is enabled for, + // for improved forwarding performance. When set to "All", established connections accepted by + // Calico policy are offloaded to the kernel's flowtable fast path. Only applies when + // nftables mode is active. [Default: Disabled] + NFTablesFlowTableOffload *projectcalicov3.NFTablesFlowTableOffload `json:"nftablesFlowTableOffload,omitempty"` + // NFTablesFlowTableDataIfacePattern is a regular expression that controls which host + // interfaces are added to the nftables flowtable, so that traffic forwarded between those + // interfaces and local workloads is offloaded to the flowtable fast path. Leave empty to + // offload only workload-to-workload traffic. Only takes effect when NFTablesFlowTableOffload + // is not Disabled. [Default: ""] + NFTablesFlowTableDataIfacePattern *string `json:"nftablesFlowTableDataIfacePattern,omitempty"` // NftablesRefreshInterval controls the interval at which Felix periodically refreshes the nftables rules. [Default: 90s] NftablesRefreshInterval *v1.Duration `json:"nftablesRefreshInterval,omitempty"` // NftablesFilterAllowAction controls the nftables action that Felix uses to represent the "allow" policy verdict @@ -379,6 +392,13 @@ type FelixConfigurationSpecApplyConfiguration struct { NftablesMarkMask *int64 `json:"nftablesMarkMask,omitempty"` // BPFEnabled, if enabled Felix will use the BPF dataplane. [Default: false] BPFEnabled *bool `json:"bpfEnabled,omitempty"` + // BPFOverlayHostSourceIP controls the source IP that Felix uses in BPF mode for host-networked + // (node-originated) traffic egressing over an IPIP/VXLAN overlay tunnel. "TunnelAddress" (the default) + // assigns an IP address to the overlay tunnel device and uses it as the source, preserving the behaviour + // of clusters upgraded from earlier releases. "HostAddress" uses the node's own IP directly and does not + // assign a tunnel device IP. This option has no effect on WireGuard tunnels, which always use a tunnel + // device IP. [Default: TunnelAddress] + BPFOverlayHostSourceIP *projectcalicov3.BPFOverlayHostSourceIPType `json:"bpfOverlayHostSourceIP,omitempty"` // BPFDisableUnprivileged, if enabled, Felix sets the kernel.unprivileged_bpf_disabled sysctl to disable // unprivileged use of BPF. This ensures that unprivileged users cannot access Calico's BPF maps and // cannot insert their own BPF programs to interfere with Calico's. [Default: true] @@ -1531,6 +1551,22 @@ func (b *FelixConfigurationSpecApplyConfiguration) WithNFTablesMode(value projec return b } +// WithNFTablesFlowTableOffload sets the NFTablesFlowTableOffload field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the NFTablesFlowTableOffload field is set to the value of the last call. +func (b *FelixConfigurationSpecApplyConfiguration) WithNFTablesFlowTableOffload(value projectcalicov3.NFTablesFlowTableOffload) *FelixConfigurationSpecApplyConfiguration { + b.NFTablesFlowTableOffload = &value + return b +} + +// WithNFTablesFlowTableDataIfacePattern sets the NFTablesFlowTableDataIfacePattern field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the NFTablesFlowTableDataIfacePattern field is set to the value of the last call. +func (b *FelixConfigurationSpecApplyConfiguration) WithNFTablesFlowTableDataIfacePattern(value string) *FelixConfigurationSpecApplyConfiguration { + b.NFTablesFlowTableDataIfacePattern = &value + return b +} + // WithNftablesRefreshInterval sets the NftablesRefreshInterval field in the declarative configuration to the given value // and returns the receiver, so that objects can be built by chaining "With" function invocations. // If called multiple times, the NftablesRefreshInterval field is set to the value of the last call. @@ -1579,6 +1615,14 @@ func (b *FelixConfigurationSpecApplyConfiguration) WithBPFEnabled(value bool) *F return b } +// WithBPFOverlayHostSourceIP sets the BPFOverlayHostSourceIP field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the BPFOverlayHostSourceIP field is set to the value of the last call. +func (b *FelixConfigurationSpecApplyConfiguration) WithBPFOverlayHostSourceIP(value projectcalicov3.BPFOverlayHostSourceIPType) *FelixConfigurationSpecApplyConfiguration { + b.BPFOverlayHostSourceIP = &value + return b +} + // WithBPFDisableUnprivileged sets the BPFDisableUnprivileged field in the declarative configuration to the given value // and returns the receiver, so that objects can be built by chaining "With" function invocations. // If called multiple times, the BPFDisableUnprivileged field is set to the value of the last call. diff --git a/pkg/client/applyconfiguration_generated/projectcalico/v3/template.go b/pkg/client/applyconfiguration_generated/projectcalico/v3/template.go index 6d861a776..b4e6aa981 100644 --- a/pkg/client/applyconfiguration_generated/projectcalico/v3/template.go +++ b/pkg/client/applyconfiguration_generated/projectcalico/v3/template.go @@ -18,6 +18,8 @@ type TemplateApplyConfiguration struct { InterfacePattern *string `json:"interfacePattern,omitempty"` // Labels adds the specified labels to the generated AutoHostEndpoint, labels from node with the same name will be overwritten by values from the template label Labels map[string]string `json:"labels,omitempty"` + // Annotations adds the specified annotations to the generated AutoHostEndpoint. + Annotations map[string]string `json:"annotations,omitempty"` // NodeSelector allows the AutoHostEndpoint to be created only for specific nodes NodeSelector *string `json:"nodeSelector,omitempty"` } @@ -68,6 +70,20 @@ func (b *TemplateApplyConfiguration) WithLabels(entries map[string]string) *Temp return b } +// WithAnnotations puts the entries into the Annotations field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, the entries provided by each call will be put on the Annotations field, +// overwriting an existing map entries in Annotations field with the same key. +func (b *TemplateApplyConfiguration) WithAnnotations(entries map[string]string) *TemplateApplyConfiguration { + if b.Annotations == nil && len(entries) > 0 { + b.Annotations = make(map[string]string, len(entries)) + } + for k, v := range entries { + b.Annotations[k] = v + } + return b +} + // WithNodeSelector sets the NodeSelector field in the declarative configuration to the given value // and returns the receiver, so that objects can be built by chaining "With" function invocations. // If called multiple times, the NodeSelector field is set to the value of the last call. diff --git a/pkg/openapi/generated.openapi.go b/pkg/openapi/generated.openapi.go index 9492954be..21ab45e80 100644 --- a/pkg/openapi/generated.openapi.go +++ b/pkg/openapi/generated.openapi.go @@ -3469,7 +3469,7 @@ func schema_pkg_apis_projectcalico_v3_FelixConfigurationSpec(ref common.Referenc }, "prometheusMetricsClientAuth": { SchemaProps: spec.SchemaProps{ - Description: "PrometheusMetricsClientAuth specifies the client authentication type for the /metrics endpoint. This determines how the server validates client certificates. Default is \"RequireAndVerifyClientCert\".", + Description: "PrometheusMetricsClientAuth specifies the client authentication type for the /metrics endpoint. This determines how the server validates client certificates. Default is \"NoClientCert\".", Type: []string{"string"}, Format: "", }, @@ -3694,12 +3694,27 @@ func schema_pkg_apis_projectcalico_v3_FelixConfigurationSpec(ref common.Referenc }, "nftablesMode": { SchemaProps: spec.SchemaProps{ - Description: "NFTablesMode configures nftables support in Felix. [Default: Auto]\n\nPossible enum values:\n - `\"Auto\"`\n - `\"Disabled\"`\n - `\"Enabled\"`", + Description: "NFTablesMode configures nftables support in Felix. In Auto mode, Felix uses the nftables dataplane if kube-proxy is detected to be running in nftables mode. [Default: Auto]\n\nPossible enum values:\n - `\"Auto\"`\n - `\"Disabled\"`\n - `\"Enabled\"`", Type: []string{"string"}, Format: "", Enum: []interface{}{"Auto", "Disabled", "Enabled"}, }, }, + "nftablesFlowTableOffload": { + SchemaProps: spec.SchemaProps{ + Description: "NFTablesFlowTableOffload controls which traffic nftables flowtable offload is enabled for, for improved forwarding performance. When set to \"All\", established connections accepted by Calico policy are offloaded to the kernel's flowtable fast path. Only applies when nftables mode is active. [Default: Disabled]\n\nPossible enum values:\n - `\"All\"`\n - `\"Disabled\"`", + Type: []string{"string"}, + Format: "", + Enum: []interface{}{"All", "Disabled"}, + }, + }, + "nftablesFlowTableDataIfacePattern": { + SchemaProps: spec.SchemaProps{ + Description: "NFTablesFlowTableDataIfacePattern is a regular expression that controls which host interfaces are added to the nftables flowtable, so that traffic forwarded between those interfaces and local workloads is offloaded to the flowtable fast path. Leave empty to offload only workload-to-workload traffic. Only takes effect when NFTablesFlowTableOffload is not Disabled. [Default: \"\"]", + Type: []string{"string"}, + Format: "", + }, + }, "nftablesRefreshInterval": { SchemaProps: spec.SchemaProps{ Description: "NftablesRefreshInterval controls the interval at which Felix periodically refreshes the nftables rules. [Default: 90s]", @@ -3741,6 +3756,13 @@ func schema_pkg_apis_projectcalico_v3_FelixConfigurationSpec(ref common.Referenc Format: "", }, }, + "bpfOverlayHostSourceIP": { + SchemaProps: spec.SchemaProps{ + Description: "BPFOverlayHostSourceIP controls the source IP that Felix uses in BPF mode for host-networked (node-originated) traffic egressing over an IPIP/VXLAN overlay tunnel. \"TunnelAddress\" (the default) assigns an IP address to the overlay tunnel device and uses it as the source, preserving the behaviour of clusters upgraded from earlier releases. \"HostAddress\" uses the node's own IP directly and does not assign a tunnel device IP. This option has no effect on WireGuard tunnels, which always use a tunnel device IP. [Default: TunnelAddress]", + Type: []string{"string"}, + Format: "", + }, + }, "bpfDisableUnprivileged": { SchemaProps: spec.SchemaProps{ Description: "BPFDisableUnprivileged, if enabled, Felix sets the kernel.unprivileged_bpf_disabled sysctl to disable unprivileged use of BPF. This ensures that unprivileged users cannot access Calico's BPF maps and cannot insert their own BPF programs to interfere with Calico's. [Default: true]", @@ -7833,6 +7855,22 @@ func schema_pkg_apis_projectcalico_v3_Template(ref common.ReferenceCallback) com }, }, }, + "annotations": { + SchemaProps: spec.SchemaProps{ + Description: "Annotations adds the specified annotations to the generated AutoHostEndpoint.", + Type: []string{"object"}, + AdditionalProperties: &spec.SchemaOrBool{ + Allows: true, + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: "", + Type: []string{"string"}, + Format: "", + }, + }, + }, + }, + }, "nodeSelector": { SchemaProps: spec.SchemaProps{ Description: "NodeSelector allows the AutoHostEndpoint to be created only for specific nodes",