Apply the libcalico-go write defaults in the CRD schemas

api/admission/ippool.mutatingadmissionpolicy.yaml

@@ -0,0 +1,38 @@
+# This MutatingAdmissionPolicy defaults spec.blockSize to 26 for IPv4 pools and 122
+# for IPv6. A static CRD default cannot express it, because the value depends on the
+# CIDR family.
+apiVersion: admissionregistration.k8s.io/v1beta1
+kind: MutatingAdmissionPolicy
+metadata:
+  name: "ippool.policy.projectcalico.org"
+spec:
+  matchConstraints:
+    resourceRules:
+      - apiGroups: ["projectcalico.org"]
+        apiVersions: ["v3"]
+        operations: ["CREATE", "UPDATE"]
+        resources:
+          - ippools
+  failurePolicy: Fail
+  reinvocationPolicy: IfNeeded
+  variables:
+    # Mutation runs before schema validation, so a missing or malformed CIDR has to
+    # be tolerated here and left for the validator to reject.
+    - name: cidrUsable
+      expression: |
+        has(object.spec.cidr) && isCIDR(object.spec.cidr)
+    - name: blockSizeUnset
+      expression: |
+        !has(object.spec.blockSize) || object.spec.blockSize == 0
+    - name: blockSize
+      expression: |
+        variables.cidrUsable && cidr(object.spec.cidr).ip().family() == 6 ? 122 : 26
+  mutations:
+    # Also on update: blockSize is immutable, but its transition rule cannot fire
+    # when the field is absent, so a write that omits it would otherwise clear it.
+    - patchType: "JSONPatch"
+      jsonPatch:
+        expression: |
+          variables.cidrUsable && variables.blockSizeUnset ?
+            [JSONPatch{op: "add", path: "/spec/blockSize", value: variables.blockSize}] :
+            []

api/admission/ippool.mutatingadmissionpolicybinding.yaml

@@ -0,0 +1,14 @@
+# This MutatingAdmissionPolicyBinding binds the IP pool blockSize defaulting to IP pools.
+apiVersion: admissionregistration.k8s.io/v1beta1
+kind: MutatingAdmissionPolicyBinding
+metadata:
+  name: set-ippool-blocksize-binding
+spec:
+  policyName: ippool.policy.projectcalico.org
+  matchResources:
+    resourceRules:
+      - apiGroups: ["projectcalico.org"]
+        apiVersions: ["v3"]
+        operations: ["CREATE", "UPDATE"]
+        resources:
+          - ippools

api/pkg/apis/projectcalico/v3/felixconfig.go

@@ -903,10 +903,12 @@ type FelixConfigurationSpec struct {
 	// balancer. The connect-time load balancer is required for the host to be able to reach Kubernetes services
 	// and it improves the performance of pod-to-service connections.When set to TCP, connect time load balancing
 	// is available only for services with TCP ports. [Default: TCP]
+	// +kubebuilder:default=TCP
 	BPFConnectTimeLoadBalancing *BPFConnectTimeLBType `json:"bpfConnectTimeLoadBalancing,omitempty" validate:"omitempty,oneof=TCP Enabled Disabled"`
 
 	// BPFHostNetworkedNATWithoutCTLB when in BPF mode, controls whether Felix does a NAT without CTLB. This along with BPFConnectTimeLoadBalancing
 	// determines the CTLB behavior. [Default: Enabled]
+	// +kubebuilder:default=Enabled
 	BPFHostNetworkedNATWithoutCTLB *BPFHostNetworkedNATType `json:"bpfHostNetworkedNATWithoutCTLB,omitempty" validate:"omitempty,oneof=Enabled Disabled"`
 
 	// BPFExternalServiceMode in BPF mode, controls how connections from outside the cluster to services (node ports
@@ -1215,6 +1217,7 @@ type FelixConfigurationSpec struct {
 	// floating IPs are always programmed, regardless of this setting.)
 	//
 	// +optional
+	// +kubebuilder:default=Disabled
 	FloatingIPs *FloatingIPType `json:"floatingIPs,omitempty" validate:"omitempty"`
 
 	// LocalSubnetL2Reachability controls whether Felix automatically responds to

api/pkg/apis/projectcalico/v3/ippool.go

@@ -106,10 +106,12 @@ type IPPoolSpec struct {
 	CIDR string `json:"cidr" validate:"net"`
 
 	// Contains configuration for VXLAN tunneling for this pool.
+	// +kubebuilder:default=Never
 	VXLANMode VXLANMode `json:"vxlanMode,omitempty"`
 
 	// Contains configuration for IPIP tunneling for this pool.
 	// For IPv6 pools, IPIP tunneling must be disabled.
+	// +kubebuilder:default=Never
 	IPIPMode IPIPMode `json:"ipipMode,omitempty"`
 
 	// When natOutgoing is true, packets sent from Calico networked containers in
@@ -142,6 +144,7 @@ type IPPoolSpec struct {
 
 	// AllowedUses controls what the IP pool will be used for. If not specified or empty, defaults to
 	// ["Tunnel", "Workload"] for back-compatibility. Valid values: "Tunnel", "Workload", "LoadBalancer".
+	// +kubebuilder:default={"Workload","Tunnel"}
 	// +kubebuilder:validation:MaxItems=10
 	// +listType=set
 	AllowedUses []IPPoolAllowedUse `json:"allowedUses,omitempty" validate:"omitempty"`

api/pkg/apis/projectcalico/v3/kubecontrollersconfig.go

@@ -78,6 +78,7 @@ type KubeControllersConfigurationSpec struct {
 
 	// PrometheusMetricsPort is the TCP port that the Prometheus metrics server should bind to. Set to 0 to disable. [Default: 9094]
 	// Valid values are: 0-65535.
+	// +kubebuilder:default=9094
 	// +kubebuilder:validation:Minimum=0
 	// +kubebuilder:validation:Maximum=65535
 	PrometheusMetricsPort *int `json:"prometheusMetricsPort,omitempty"`

libcalico-go/lib/clientv3/felixconfig.go

@@ -112,8 +112,7 @@ func (r felixConfigurations) Watch(ctx context.Context, opts options.ListOptions
 }
 
 func setDefaults(fc *apiv3.FelixConfiguration) {
-	// Defaulting of the FloatingIPs field is handled via CRD validation in CRD mode, but
-	// requires an explicit defaulting step for etcd.
+	// The CRD defaults FloatingIPs in CRD mode; etcd needs this explicit step.
 	if fc.Spec.FloatingIPs == nil {
 		disabled := apiv3.FloatingIPsDisabled
 		fc.Spec.FloatingIPs = &disabled