[v3.32] Add calicoctl datastore migrate-policy-names command - #13288
Merged
nelljerram merged 2 commits intoJul 23, 2026
Merged
Conversation
nelljerram
added
release-note-required
Contributor
There was a problem hiding this comment.
Pull request overview
This PR backports the addition of a calicoctl datastore migrate-policy-names command onto release-v3.32, to rewrite legacy default-tier policy keys in an etcdv3 datastore so their stored names match the v3 resource names introduced in v3.32. It also factors the underlying create-then-delete migration logic into shared functions used by both kube-controllers and calicoctl.
Changes:
- Add shared migration helpers (
NeedsMigration,MigratePolicyKVP,PolicyKinds) in kube-controllers’ networkpolicy controller package. - Add
calicoctl datastore migrate-policy-namescommand + unit tests, reusing the shared migration helpers. - Update calicoctl command dispatch and adjust Semaphore change-detection inputs for the calicoctl block.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| kube-controllers/pkg/controllers/networkpolicy/policymigrate.go | New shared policy-name migration primitives used by both controller and CLI. |
| kube-controllers/pkg/controllers/networkpolicy/policy_name_migrator.go | Switch controller to use the extracted shared migration helpers + shared backend accessor interface. |
| calicoctl/calicoctl/commands/datastore/migrate/policyname.go | New CLI command implementation for migrating legacy policy datastore names. |
| calicoctl/calicoctl/commands/datastore/migrate/policyname_test.go | Unit tests validating idempotent migration behavior over a fake backend. |
| calicoctl/calicoctl/commands/datastore.go | Wire the new migrate-policy-names subcommand into calicoctl datastore. |
| .semaphore/semaphore.yml | Update calicoctl block change-detection to include the new dependency surface. |
Comment on lines
+86
to
+90
| logrus.WithFields(logrus.Fields{ | ||
| "kind": k.Kind, | ||
| "oldName": k.Name, | ||
| "newName": newKey.Name, | ||
| }).Info("Migrated policy datastore name") |
Member
Author
|
Docs at tigera/docs#2851 |
caseydavenport
approved these changes
Jul 22, 2026
nelljerram
force-pushed
the
auto-pick-of-#13257-origin-release-v3.32
branch
from
July 22, 2026 23:10
da67e09 to
cb859b7
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cherry-pick history
Policies created before v3.32 on an etcdv3 datastore (for example OpenStack) keep their old tier-prefixed name in the datastore after an in-place upgrade. calicoctl can't fetch them by the name it displays, and the tier prefix leaks into Felix log prefixes. kube-controllers already fixes this on Kubernetes datastores, but etcdv3 deployments don't run kube-controllers.
This adds
calicoctl datastore migrate-policy-names, which rewrites default-tier policy names in the datastore to match their v3 names. It's safe to re-run.The create-then-delete migration logic is extracted into shared functions owned by the migration controller, so the controller and the CLI can't drift.
Related: CORE-13170