Skip to content

DOCS-3089: Fix inaccuracies on the IPPool reference - #3124

Draft
ctauchen wants to merge 4 commits into
tigera:mainfrom
ctauchen:DOCS-3089-fact-check-ippool
Draft

ctauchen wants to merge 4 commits into
tigera:mainfrom
ctauchen:DOCS-3089-fact-check-ippool

Conversation

@ctauchen

Copy link
Copy Markdown
Collaborator

Fixes inaccuracies on the IPPool reference page, found and verified with the calico-fact-check skill.

  • name: lowercase only, and no underscores.
  • cidr is marked Required.
  • ipipMode and vxlanMode can both be set, as long as only one of them is enabled.
  • natOutgoing also masquerades traffic to addresses in a LoadBalancer IP pool.
  • Adds the missing namespaceSelector row. Both selectors must match, and it cannot be used when allowedUses includes Tunnel.
  • assignmentMode is a single string, not a list.
  • Removing Tunnel from allowedUses releases that pool's tunnel addresses. Workload addresses stay allocated.
  • The ipAddrs annotation does not override allowedUses (3.33 and next only; at 3.32 and 3.31 the old text is correct).
  • CIDR overlap: a new install of 3.33 uses native v3 CRDs, so API server mode is not the default (3.33 and next). Overlap validation is asynchronous only for pools created with kubectl, since calicoctl still rejects an overlap at create time. An overlapping pool gets an Allocatable condition set to False with reason CIDROverlap, not a Disabled condition (3.33, next and 3.32).

Changes next, 3.33, 3.32 and 3.31. Each fix was reproduced on a kind cluster running that tree's release: v3.33.0 for next and 3.33, v3.32.2 for 3.32, v3.31.7 for 3.31. The CIDR overlap fixes were reproduced in both API server mode and native v3 CRD mode.

Not changed, for follow-up:

  • An overlapping pool created with disabled: true reports reason PoolDisabled, not CIDROverlap.
  • In native v3 CRD mode, the allowedUses default may be ["Workload"] when namespaceSelector is set. This was not verified.
  • In native v3 CRD mode at 3.32, the CRD does not enforce the blockSize range, the link-local ban or the namespaceSelector and Tunnel rule, so kubectl can store values the page calls invalid.

Previous attempt: #3079.

Copilot AI lite review requested due to automatic review settings October 16, 2026 15:56
@netlify

netlify Bot commented Oct 16, 2026 •

Copy link
Copy Markdown

✅ Deploy Preview for calico-docs-preview-next ready!

Name Link
🔨 Latest commit 280a20c
🔍 Latest deploy log https://app.netlify.com/projects/calico-docs-preview-next/deploys/6ad2493fa0da0424ff9bec91
😎 Deploy Preview https://deploy-preview-3124--calico-docs-preview-next.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
🤖 Make changes Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

@netlify

netlify Bot commented Oct 16, 2026 •

Copy link
Copy Markdown

✅ Deploy Preview succeeded!

Built without sensitive environment variables

Name Link
🔨 Latest commit 280a20c
🔍 Latest deploy log https://app.netlify.com/projects/tigera/deploys/6ad2493fabaf332facaaeaa1
😎 Deploy Preview https://deploy-preview-3124--tigera.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
Lighthouse
Lighthouse
1 paths audited
Performance: 66 (🔴 down 7 from production)
Accessibility: 98 (no change from production)
Best Practices: 92 (no change from production)
SEO: 100 (no change from production)
PWA: -
View the detailed breakdown and full score reports
🤖 Make changes Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Resolve remaining documentation inconsistencies around overlap status terminology and version-specific behavior.

3 open findings
What changed in this PR

Updates Calico IPPool reference documentation across current, 3.33, 3.32, and 3.31.

Changes:

  • Corrects field constraints, types, selectors, and allocation rules.
  • Clarifies networking, NAT, and annotation behavior.
  • Documents version-specific CIDR overlap handling and status conditions.
File Summary
calico/​reference/​resources/​ippool.mdx Updates current IPPool reference.
calico_versioned_docs/​version-3.33/​reference/​resources/​ippool.mdx Updates 3.33 IPPool reference.
calico_versioned_docs/​version-3.32/​reference/​resources/​ippool.mdx Updates 3.32 IPPool reference.
calico_versioned_docs/​version-3.31/​reference/​resources/​ippool.mdx Updates 3.31 IPPool reference.

🧠 Review effort: Lite


💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

In API server mode, creating an IPPool with a CIDR that overlaps an existing pool is rejected synchronously at creation time.

When using [native v3 CRDs](../../operations/native-v3-crds.mdx), CIDR overlap validation is **asynchronous**. Pools with overlapping CIDRs are created successfully but receive a `Disabled` status condition. IPAM does not allocate addresses from disabled pools. Check the IPPool status to identify any pools that have been disabled due to CIDR overlap.
When using [native v3 CRDs](../../operations/native-v3-crds.mdx), CIDR overlap validation for pools created with `kubectl` is **asynchronous**. Pools with overlapping CIDRs are created successfully but receive an `Allocatable` status condition set to `False` with reason `CIDROverlap`. IPAM does not allocate addresses from disabled pools. Check the IPPool status to identify any pools that have been disabled due to CIDR overlap.
By default (API server mode), creating an IPPool with a CIDR that overlaps an existing pool is rejected synchronously at creation time.

When using [native v3 CRDs](../../operations/native-v3-crds.mdx), CIDR overlap validation is **asynchronous**. Pools with overlapping CIDRs are created successfully but receive a `Disabled` status condition. IPAM does not allocate addresses from disabled pools. Check the IPPool status to identify any pools that have been disabled due to CIDR overlap.
When using [native v3 CRDs](../../operations/native-v3-crds.mdx), CIDR overlap validation for pools created with `kubectl` is **asynchronous**. Pools with overlapping CIDRs are created successfully but receive an `Allocatable` status condition set to `False` with reason `CIDROverlap`. IPAM does not allocate addresses from disabled pools. Check the IPPool status to identify any pools that have been disabled due to CIDR overlap.
In API server mode, creating an IPPool with a CIDR that overlaps an existing pool is rejected synchronously at creation time.

When using [native v3 CRDs](../../operations/native-v3-crds.mdx), CIDR overlap validation is **asynchronous**. Pools with overlapping CIDRs are created successfully but receive a `Disabled` status condition. IPAM does not allocate addresses from disabled pools. Check the IPPool status to identify any pools that have been disabled due to CIDR overlap.
When using [native v3 CRDs](../../operations/native-v3-crds.mdx), CIDR overlap validation for pools created with `kubectl` is **asynchronous**. Pools with overlapping CIDRs are created successfully but receive an `Allocatable` status condition set to `False` with reason `CIDROverlap`. IPAM does not allocate addresses from disabled pools. Check the IPPool status to identify any pools that have been disabled due to CIDR overlap.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants