Default new installs to v3 CRD mode when the cluster supports it - #4973
Merged
caseydavenport merged 7 commits intoJul 23, 2026
Conversation
caseydavenport
force-pushed
the
casey-v3-crd-default
branch
from
June 30, 2026 19:29
3ca9288 to
c605ca0
Compare
caseydavenport
force-pushed
the
casey-v3-crd-default
branch
from
July 21, 2026 21:29
c605ca0 to
15de260
Compare
The protected tier list changed upstream (kube-admin/kube-baseline -> adminnetworkpolicy/baselineadminnetworkpolicy). Regenerated with make gen-versions to clear the validate-gen-versions dirty-check.
v3 mode relies on a MutatingAdmissionPolicy to default policy types. Every path that concludes v3 - an existing v3 install, the CALICO_API_GROUP override, and a converged datastore migration - now errors out if the cluster can't serve MAP instead of running degraded. Greenfield installs still fall back to v1.
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the operator’s API-group selection logic so brand-new installs default to projectcalico.org/v3 CRD mode when the cluster serves MutatingAdmissionPolicy (required for v3-mode defaulting), while keeping existing/upgraded installs in v1 / aggregation API-server mode.
Changes:
- Add MutatingAdmissionPolicy-based gating to v3 CRD-mode selection, including an explicit error when v3 is required but MAP isn’t served.
- Add unit tests covering the v1/v3/MAP decision matrix and discovery-based selection.
- Extend API server rendering tests to ensure the aggregated APIService isn’t registered when aggregation isn’t required, and update the enterprise “protect built-in tiers” admission policy tier list/comments.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| pkg/apis/version.go | Implements MAP-aware v3/v1 selection logic, with helpers to make discovery and decision logic testable. |
| pkg/apis/version_test.go | Adds unit tests for v3/v1/MAP decision logic and discovery-driven selection. |
| pkg/render/apiserver_test.go | Adds rendering tests ensuring the APIService registration is omitted when aggregation isn’t required (including Enterprise case where Deployment remains). |
| pkg/imports/admission/enterprise/protect-builtin-tiers.yaml | Updates protected tier list and clarifies Enterprise tier behavior in v3-mode admission policy. |
Brian-McM
reviewed
Jul 23, 2026
UseV3CRDS builds the clients and hands them to useV3CRDs, which the tests exercise with fakes. Discovery errors while looking for MutatingAdmissionPolicy are now only tolerated when partial.
Brian-McM
approved these changes
Jul 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Makes a brand-new operator-managed install default to v3 CRD mode (projectcalico.org/v3 served directly by CRDs, no aggregation API server) when the cluster can support it. Existing and upgraded clusters are unaffected - if Calico v1 CRDs are already present, the install stays in API-server mode.
The default only flips on a greenfield cluster (no Calico CRDs of either kind yet) that serves MutatingAdmissionPolicy, which v3 mode relies on to default policy types (Kubernetes 1.32+). On older clusters a greenfield install stays on the API server. An admin can still opt a new install back to API-server mode by applying the v1 CRDs before creating the Installation.
This is the operator-only piece of CORE-12574. The Helm and manifest defaults, and the docs updates, are tracked separately. libcalico-go's detection is deliberately left unchanged - components only run after the operator has installed the CRDs, so the existing rule resolves correctly once one set is present.