Auto: sync API from tigera/calico-private [master]

config/crd/projectcalico.org_bgpconfigurations.yaml

@@ -82,7 +82,7 @@ spec:
                     x-kubernetes-map-type: atomic
                   maxItems: 500
                   type: array
-                  x-kubernetes-list-type: set
+                  x-kubernetes-list-type: atomic
                 extensions:
                   additionalProperties:
                     type: string
@@ -211,7 +211,7 @@ spec:
                     x-kubernetes-map-type: atomic
                   maxItems: 500
                   type: array
-                  x-kubernetes-list-type: set
+                  x-kubernetes-list-type: atomic
                 programClusterRoutes:
                   description: |-
                     ProgramClusterRoutes controls how a cluster node gets a route to a workload on another node,
@@ -237,7 +237,7 @@ spec:
                     type: object
                     x-kubernetes-map-type: atomic
                   type: array
-                  x-kubernetes-list-type: set
+                  x-kubernetes-list-type: atomic
                 serviceExternalIPs:
                   description: |-
                     ServiceExternalIPs are the CIDR blocks for Kubernetes Service External IPs.
@@ -253,7 +253,7 @@ spec:
                     type: object
                     x-kubernetes-map-type: atomic
                   type: array
-                  x-kubernetes-list-type: set
+                  x-kubernetes-list-type: atomic
                 serviceLoadBalancerAggregation:
                   default: Enabled
                   description: |-
@@ -280,7 +280,7 @@ spec:
                     type: object
                     x-kubernetes-map-type: atomic
                   type: array
-                  x-kubernetes-list-type: set
+                  x-kubernetes-list-type: atomic
               type: object
               x-kubernetes-validations:
                 - message:

config/crd/projectcalico.org_felixconfigurations.yaml

@@ -322,6 +322,14 @@ spec:
                     [Default: unset - read from net.ipv4.ipfrag_time]
                   pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))*$
                   type: string
+                bpfIPFragmentReassemblyEnabled:
+                  description: |-
+                    BPFIPFragmentReassemblyEnabled controls whether Felix loads the BPF program that
+                    reassembles out-of-order IP fragments from external networks. This program requires
+                    a kernel newer than 5.10. When enabled (the default) and the program fails to load,
+                    Felix reports not-ready until the user sets this to false. When false, fragmented
+                    packets from external sources are dropped. [Default: true]
+                  type: boolean
                 bpfJITHardening:
                   allOf:
                     - enum:
@@ -1709,6 +1717,22 @@ spec:
                     "NftablesRefreshInterval controls the interval at which
                     Felix periodically refreshes the nftables rules. [Default: 90s]"
                   type: string
+                nodeSelector:
+                  description: |-
+                    NodeSelector is an optional label selector that restricts this FelixConfiguration
+                    to apply only to nodes that match the given selector. This field is only valid
+                    on FelixConfiguration resources whose name is not "default" and does not start
+                    with "node.". For resources named "default", the configuration applies globally
+                    to all nodes. For resources named "node.<nodename>", the configuration applies to
+                    the named node only.
+
+                    At most one selector-scoped FelixConfiguration should match any given node.
+                    If multiple selector-scoped resources match, the oldest (by creation
+                    timestamp) is used and a warning is logged. This prevents an accidentally
+                    created conflicting resource from disrupting an existing, working
+                    configuration.
+                  maxLength: 1024
+                  type: string
                 openstackRegion:
                   description: |-
                     OpenstackRegion is the name of the region that a particular Felix belongs to. In a multi-region
@@ -2195,5 +2219,13 @@ spec:
             - metadata
             - spec
           type: object
+          x-kubernetes-validations:
+            - message:
+                nodeSelector must not be set on the 'default' or per-node ('node.*')
+                FelixConfiguration
+              reason: FieldValueForbidden
+              rule:
+                "self.metadata.name == 'default' || self.metadata.name.startsWith('node.')
+                ? !has(self.spec.nodeSelector) : true"
       served: true
       storage: true

config/crd/projectcalico.org_ippools.yaml

@@ -70,14 +70,16 @@ spec:
                   items:
                     description: |-
                       IPPoolAllowedUse defines the allowed uses for an IP pool.
-                      It can be one of "Workload", "Tunnel", or "LoadBalancer".
+                      It can be one of "Workload", "Tunnel", "LoadBalancer" or "HostSecondaryInterface".
                       - "Workload" means the pool is used for workload IP addresses.
                       - "Tunnel" means the pool is used for tunnel IP addresses.
                       - "LoadBalancer" means the pool is used for load balancer IP addresses.
+                      - "HostSecondaryInterface" means the pool is used for host secondary interface IP addresses.
                     enum:
                       - Workload
                       - Tunnel
                       - LoadBalancer
+                      - HostSecondaryInterface
                     type: string
                   maxItems: 10
                   type: array

config/crd/projectcalico.org_licensekeys.yaml

@@ -24,6 +24,9 @@ spec:
         - jsonPath: .status.maxnodes
           name: Max-Nodes
           type: integer
+        - jsonPath: .status.maxcores
+          name: Max-Cores
+          type: integer
         - jsonPath: .status.conditions[?(@.type=='Valid')].status
           name: Valid
           type: string
@@ -149,8 +152,11 @@ spec:
                     GracePeriod is how long after expiry the license remains
                     functional (e.g. "90d")
                   type: string
+                maxcores:
+                  description: Maximum Number of Allowed CPU Cores.
+                  type: integer
                 maxnodes:
-                  description: Maximum Number of Allowed Nodes
+                  description: Maximum Number of Allowed Nodes.
                   type: integer
                 package:
                   description:

deps.txt

@@ -1,14 +1,14 @@
 !!! GENERATED FILE, DO NOT EDIT !!!
 Run 'make gen-deps-files' to regenerate.
 
-go 1.26.1
+go 1.26.2
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
 github.com/emicklei/go-restful v2.15.0+incompatible
 github.com/emicklei/go-restful/v3 v3.13.0
 github.com/fxamacker/cbor/v2 v2.9.0
 github.com/go-logr/logr v1.4.3
-github.com/go-openapi/jsonpointer v0.22.4
-github.com/go-openapi/jsonreference v0.21.4
+github.com/go-openapi/jsonpointer v0.22.5
+github.com/go-openapi/jsonreference v0.21.5
 github.com/go-openapi/swag v0.23.1
 github.com/google/gnostic-models v0.7.0
 github.com/google/uuid v1.6.0
@@ -25,29 +25,30 @@ github.com/spf13/pflag v1.0.10
 github.com/x448/float16 v0.8.4
 go.yaml.in/yaml/v2 v2.4.4
 go.yaml.in/yaml/v3 v3.0.4
-golang.org/x/net v0.52.0
+golang.org/x/net v0.53.0
 golang.org/x/oauth2 v0.36.0
-golang.org/x/sys v0.42.0
-golang.org/x/term v0.41.0
-golang.org/x/text v0.35.0
+golang.org/x/sys v0.43.0
+golang.org/x/term v0.42.0
+golang.org/x/text v0.36.0
 golang.org/x/time v0.15.0
 google.golang.org/protobuf v1.36.11
 gopkg.in/evanphx/json-patch.v4 v4.13.0
 gopkg.in/inf.v0 v0.9.1
 gopkg.in/yaml.v3 v3.0.1
-k8s.io/api v0.35.3
-k8s.io/apiextensions-apiserver v0.35.3
-k8s.io/apimachinery v0.35.3
-k8s.io/apiserver v0.35.3
-k8s.io/client-go v0.35.3
+k8s.io/api v0.35.4
+k8s.io/apiextensions-apiserver v0.35.4
+k8s.io/apimachinery v0.35.4
+k8s.io/apiserver v0.35.4
+k8s.io/client-go v0.35.4
 k8s.io/klog v0.2.0
 k8s.io/klog/v2 v2.140.0
 k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912
 k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730
 sigs.k8s.io/randfill v1.0.0
-sigs.k8s.io/structured-merge-diff/v6 v6.3.2
+sigs.k8s.io/structured-merge-diff/v6 v6.4.0
 sigs.k8s.io/yaml v1.6.0
 
+local:api/pkg/apis/projectcalico/v3
 local:api/pkg/lib/numorstring
 local:api/pkg/openapi

go.mod

@@ -1,19 +1,19 @@
 module github.com/tigera/api
 
-go 1.26.1
+go 1.26.2
 
 require (
 	github.com/jinzhu/copier v0.4.0
-	github.com/onsi/ginkgo/v2 v2.28.1
-	github.com/onsi/gomega v1.39.1
-	github.com/projectcalico/api v0.0.0-20260303210141-543421943355
-	k8s.io/api v0.35.3
-	k8s.io/apiextensions-apiserver v0.35.3
-	k8s.io/apimachinery v0.35.3
-	k8s.io/apiserver v0.35.3
-	k8s.io/client-go v0.35.3
+	github.com/onsi/ginkgo/v2 v2.28.3
+	github.com/onsi/gomega v1.40.0
+	github.com/projectcalico/api v0.0.0-20260415222737-ebf7b29bd308
+	k8s.io/api v0.35.4
+	k8s.io/apiextensions-apiserver v0.35.4
+	k8s.io/apimachinery v0.35.4
+	k8s.io/apiserver v0.35.4
+	k8s.io/client-go v0.35.4
 	k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912
-	sigs.k8s.io/structured-merge-diff/v6 v6.3.0
+	sigs.k8s.io/structured-merge-diff/v6 v6.4.0
 	sigs.k8s.io/yaml v1.6.0
 )
 
@@ -29,7 +29,7 @@ require (
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
 	github.com/google/gnostic-models v0.7.0 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
-	github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83 // indirect
+	github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
@@ -42,15 +42,15 @@ require (
 	github.com/x448/float16 v0.8.4 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/mod v0.32.0 // indirect
-	golang.org/x/net v0.49.0 // indirect
+	golang.org/x/mod v0.35.0 // indirect
+	golang.org/x/net v0.53.0 // indirect
 	golang.org/x/oauth2 v0.30.0 // indirect
-	golang.org/x/sync v0.19.0 // indirect
-	golang.org/x/sys v0.40.0 // indirect
-	golang.org/x/term v0.39.0 // indirect
-	golang.org/x/text v0.33.0 // indirect
+	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/sys v0.43.0 // indirect
+	golang.org/x/term v0.42.0 // indirect
+	golang.org/x/text v0.36.0 // indirect
 	golang.org/x/time v0.9.0 // indirect
-	golang.org/x/tools v0.41.0 // indirect
+	golang.org/x/tools v0.44.0 // indirect
 	google.golang.org/protobuf v1.36.8 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
@@ -62,29 +62,29 @@ require (
 )
 
 replace (
-	k8s.io/api => k8s.io/api v0.35.3
-	k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.35.3
-	k8s.io/apimachinery => k8s.io/apimachinery v0.35.3
-	k8s.io/apiserver => k8s.io/apiserver v0.35.3
-	k8s.io/cli-runtime => k8s.io/cli-runtime v0.35.3
-	k8s.io/client-go => k8s.io/client-go v0.35.3
-	k8s.io/cloud-provider => k8s.io/cloud-provider v0.35.3
-	k8s.io/cluster-bootstrap => k8s.io/cluster-bootstrap v0.35.3
-	k8s.io/code-generator => k8s.io/code-generator v0.35.3
-	k8s.io/component-base => k8s.io/component-base v0.35.3
-	k8s.io/component-helpers => k8s.io/component-helpers v0.35.3
-	k8s.io/controller-manager => k8s.io/controller-manager v0.35.3
-	k8s.io/cri-api => k8s.io/cri-api v0.35.3
-	k8s.io/csi-translation-lib => k8s.io/csi-translation-lib v0.35.3
-	k8s.io/externaljwt => k8s.io/externaljwt v0.35.3
-	k8s.io/kube-aggregator => k8s.io/kube-aggregator v0.35.3
-	k8s.io/kube-controller-manager => k8s.io/kube-controller-manager v0.35.3
-	k8s.io/kube-proxy => k8s.io/kube-proxy v0.35.3
-	k8s.io/kube-scheduler => k8s.io/kube-scheduler v0.35.3
-	k8s.io/kubectl => k8s.io/kubectl v0.35.3
-	k8s.io/kubelet => k8s.io/kubelet v0.35.3
-	k8s.io/metrics => k8s.io/metrics v0.35.3
-	k8s.io/mount-utils => k8s.io/mount-utils v0.35.3
-	k8s.io/node-api => k8s.io/node-api v0.35.3
-	k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.35.3
+	k8s.io/api => k8s.io/api v0.35.4
+	k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.35.4
+	k8s.io/apimachinery => k8s.io/apimachinery v0.35.4
+	k8s.io/apiserver => k8s.io/apiserver v0.35.4
+	k8s.io/cli-runtime => k8s.io/cli-runtime v0.35.4
+	k8s.io/client-go => k8s.io/client-go v0.35.4
+	k8s.io/cloud-provider => k8s.io/cloud-provider v0.35.4
+	k8s.io/cluster-bootstrap => k8s.io/cluster-bootstrap v0.35.4
+	k8s.io/code-generator => k8s.io/code-generator v0.35.4
+	k8s.io/component-base => k8s.io/component-base v0.35.4
+	k8s.io/component-helpers => k8s.io/component-helpers v0.35.4
+	k8s.io/controller-manager => k8s.io/controller-manager v0.35.4
+	k8s.io/cri-api => k8s.io/cri-api v0.35.4
+	k8s.io/csi-translation-lib => k8s.io/csi-translation-lib v0.35.4
+	k8s.io/externaljwt => k8s.io/externaljwt v0.35.4
+	k8s.io/kube-aggregator => k8s.io/kube-aggregator v0.35.4
+	k8s.io/kube-controller-manager => k8s.io/kube-controller-manager v0.35.4
+	k8s.io/kube-proxy => k8s.io/kube-proxy v0.35.4
+	k8s.io/kube-scheduler => k8s.io/kube-scheduler v0.35.4
+	k8s.io/kubectl => k8s.io/kubectl v0.35.4
+	k8s.io/kubelet => k8s.io/kubelet v0.35.4
+	k8s.io/metrics => k8s.io/metrics v0.35.4
+	k8s.io/mount-utils => k8s.io/mount-utils v0.35.4
+	k8s.io/node-api => k8s.io/node-api v0.35.4
+	k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.35.4
 )