Apply the libcalico-go write defaults in the CRD schemas

api/admission/ippool.mutatingadmissionpolicy.yaml

@@ -0,0 +1,56 @@
+# This MutatingAdmissionPolicy carries the two IP pool defaults a static CRD default
+# cannot express: blockSize depends on the CIDR family, and allowedUses depends on
+# whether a namespaceSelector is set.
+apiVersion: admissionregistration.k8s.io/v1beta1
+kind: MutatingAdmissionPolicy
+metadata:
+  name: "ippool.policy.projectcalico.org"
+spec:
+  matchConstraints:
+    resourceRules:
+      - apiGroups: ["projectcalico.org"]
+        apiVersions: ["v3"]
+        operations: ["CREATE", "UPDATE"]
+        resources:
+          - ippools
+  failurePolicy: Fail
+  reinvocationPolicy: IfNeeded
+  variables:
+    # Mutation runs before schema validation, so a missing or malformed CIDR has to
+    # be tolerated here and left for the validator to reject.
+    - name: cidrUsable
+      expression: |
+        has(object.spec.cidr) && isCIDR(object.spec.cidr)
+    - name: blockSizeUnset
+      expression: |
+        !has(object.spec.blockSize) || object.spec.blockSize == 0
+    - name: blockSize
+      expression: |
+        variables.cidrUsable && cidr(object.spec.cidr).ip().family() == 6 ? 122 : 26
+    - name: allowedUsesUnset
+      expression: |
+        !has(object.spec.allowedUses) || size(object.spec.allowedUses) == 0
+    # A pool that names a namespace is a workload pool, and Tunnel is rejected
+    # alongside a namespaceSelector, so the back-compatible pair is wrong there.
+    - name: namespaceScoped
+      expression: |
+        has(object.spec.namespaceSelector) && size(object.spec.namespaceSelector) != 0
+  mutations:
+    # Also on update: blockSize is immutable, but its transition rule cannot fire
+    # when the field is absent, so a write that omits it would otherwise clear it.
+    - patchType: "JSONPatch"
+      jsonPatch:
+        expression: |
+          variables.cidrUsable && variables.blockSizeUnset ?
+            [JSONPatch{op: "add", path: "/spec/blockSize", value: variables.blockSize}] :
+            []
+    - patchType: "JSONPatch"
+      jsonPatch:
+        expression: |
+          variables.allowedUsesUnset ?
+            [JSONPatch{
+              op: "add",
+              path: "/spec/allowedUses",
+              value: variables.namespaceScoped ? ["Workload"] : ["Workload", "Tunnel"],
+            }] :
+            []

api/admission/ippool.mutatingadmissionpolicybinding.yaml

@@ -0,0 +1,14 @@
+# This MutatingAdmissionPolicyBinding binds the IP pool defaulting policy to IP pools.
+apiVersion: admissionregistration.k8s.io/v1beta1
+kind: MutatingAdmissionPolicyBinding
+metadata:
+  name: set-ippool-defaults-binding
+spec:
+  policyName: ippool.policy.projectcalico.org
+  matchResources:
+    resourceRules:
+      - apiGroups: ["projectcalico.org"]
+        apiVersions: ["v3"]
+        operations: ["CREATE", "UPDATE"]
+        resources:
+          - ippools

api/pkg/apis/projectcalico/v3/felixconfig.go

@@ -903,10 +903,12 @@ type FelixConfigurationSpec struct {
 	// balancer. The connect-time load balancer is required for the host to be able to reach Kubernetes services
 	// and it improves the performance of pod-to-service connections.When set to TCP, connect time load balancing
 	// is available only for services with TCP ports. [Default: TCP]
+	// +kubebuilder:default=TCP
 	BPFConnectTimeLoadBalancing *BPFConnectTimeLBType `json:"bpfConnectTimeLoadBalancing,omitempty" validate:"omitempty,oneof=TCP Enabled Disabled"`
 
 	// BPFHostNetworkedNATWithoutCTLB when in BPF mode, controls whether Felix does a NAT without CTLB. This along with BPFConnectTimeLoadBalancing
 	// determines the CTLB behavior. [Default: Enabled]
+	// +kubebuilder:default=Enabled
 	BPFHostNetworkedNATWithoutCTLB *BPFHostNetworkedNATType `json:"bpfHostNetworkedNATWithoutCTLB,omitempty" validate:"omitempty,oneof=Enabled Disabled"`
 
 	// BPFExternalServiceMode in BPF mode, controls how connections from outside the cluster to services (node ports
@@ -1215,6 +1217,7 @@ type FelixConfigurationSpec struct {
 	// floating IPs are always programmed, regardless of this setting.)
 	//
 	// +optional
+	// +kubebuilder:default=Disabled
 	FloatingIPs *FloatingIPType `json:"floatingIPs,omitempty" validate:"omitempty"`
 
 	// LocalSubnetL2Reachability controls whether Felix automatically responds to

api/pkg/apis/projectcalico/v3/ippool.go

@@ -106,10 +106,12 @@ type IPPoolSpec struct {
 	CIDR string `json:"cidr" validate:"net"`
 
 	// Contains configuration for VXLAN tunneling for this pool.
+	// +kubebuilder:default=Never
 	VXLANMode VXLANMode `json:"vxlanMode,omitempty"`
 
 	// Contains configuration for IPIP tunneling for this pool.
 	// For IPv6 pools, IPIP tunneling must be disabled.
+	// +kubebuilder:default=Never
 	IPIPMode IPIPMode `json:"ipipMode,omitempty"`
 
 	// When natOutgoing is true, packets sent from Calico networked containers in

api/pkg/apis/projectcalico/v3/kubecontrollersconfig.go

@@ -78,6 +78,7 @@ type KubeControllersConfigurationSpec struct {
 
 	// PrometheusMetricsPort is the TCP port that the Prometheus metrics server should bind to. Set to 0 to disable. [Default: 9094]
 	// Valid values are: 0-65535.
+	// +kubebuilder:default=9094
 	// +kubebuilder:validation:Minimum=0
 	// +kubebuilder:validation:Maximum=65535
 	PrometheusMetricsPort *int `json:"prometheusMetricsPort,omitempty"`

libcalico-go/lib/backend/k8s/client_test.go

@@ -2696,11 +2696,15 @@ var _ = testutils.E2eDatastoreDescribe("Test Syncer API for Kubernetes backend",
 				ObjectMeta: metav1.ObjectMeta{
 					Name: "myfelixconfig",
 				},
+				// The fields the CRD schema defaults are spelled out, so the
+				// round trip compares equal.
 				Spec: apiv3.FelixConfigurationSpec{
-					InterfacePrefix:          "xali-",
-					FloatingIPs:              ptr.To(apiv3.FloatingIPsEnabled),
-					NFTablesMode:             ptr.To(apiv3.NFTablesModeAuto),
-					NFTablesFlowTableOffload: ptr.To(apiv3.NFTablesFlowTableOffloadAll),
+					InterfacePrefix:                "xali-",
+					FloatingIPs:                    ptr.To(apiv3.FloatingIPsEnabled),
+					NFTablesMode:                   ptr.To(apiv3.NFTablesModeAuto),
+					NFTablesFlowTableOffload:       ptr.To(apiv3.NFTablesFlowTableOffloadAll),
+					BPFConnectTimeLoadBalancing:    ptr.To(apiv3.BPFConnectTimeLBTCP),
+					BPFHostNetworkedNATWithoutCTLB: ptr.To(apiv3.BPFHostNetworkedNATEnabled),
 				},
 			},
 		}

libcalico-go/lib/clientv3/felixconfig.go

@@ -112,8 +112,7 @@ func (r felixConfigurations) Watch(ctx context.Context, opts options.ListOptions
 }
 
 func setDefaults(fc *apiv3.FelixConfiguration) {
-	// Defaulting of the FloatingIPs field is handled via CRD validation in CRD mode, but
-	// requires an explicit defaulting step for etcd.
+	// The CRD defaults FloatingIPs in CRD mode; etcd needs this explicit step.
 	if fc.Spec.FloatingIPs == nil {
 		disabled := apiv3.FloatingIPsDisabled
 		fc.Spec.FloatingIPs = &disabled