Enforce static tier default action

[mazdakn]

Description

Related issues/PRs

Todos

• Tests
• Documentation
• Release note

Release Note

TBD

Reminder for the reviewer

Make sure that this PR has the correct labels and milestone set.

Every PR needs one docs-* label.

• docs-pr-required: This change requires a change to the documentation that has not been completed yet.
• docs-completed: This change has all necessary documentation completed.
• docs-not-required: This change has no user-facing impact and requires no docs.

Every PR needs one release-note-* label.

• release-note-required: This PR has user-facing changes. Most PRs should have this label.
• release-note-not-required: This PR has no user-facing changes.

Other optional labels:

• cherry-pick-candidate: This PR should be cherry-picked to an earlier release. For bug fixes only.
• needs-operator-pr: This PR is related to install and requires a corresponding change to the operator.

[Copilot]

Pull request overview

This PR adds validation to enforce that static Calico tiers (default, kube-admin, and kube-baseline) have the correct default action values in addition to their existing order validation. The default tier must use Deny, while kube-admin and kube-baseline tiers must use Pass.

Key Changes:

• Refactored tier validation to use a helper function validateTierSpec that validates both order and default action
• Added validation logic to enforce specific default action values for static tiers
• Expanded test coverage to include default action validation scenarios for all three static tiers

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
libcalico-go/lib/validator/v3/validator.go	Refactored tier validation logic to validate both order and default action for static tiers using a new helper function; added redundant import
libcalico-go/lib/validator/v3/validator_test.go	Added comprehensive test cases for default action validation on all static tiers; reorganized variable declarations

Comments suppressed due to low confidence (1)

libcalico-go/lib/validator/v3/validator.go:26

• This import is redundant. The package github.com/projectcalico/api/pkg/apis/projectcalico/v3 is already imported on line 25 with the alias api. You can use api.DefaultTierOrder, api.Deny, etc. instead of importing it again as v3. Remove this line and replace v3. references in the code below with api..

	"github.com/projectcalico/api/pkg/lib/numorstring"

[Copilot]

The first argument to ReportError should be the actual field value (wrapped in reflect.ValueOf() if needed), not its string representation. Currently, tierOrderStr is being passed, which is a string representation of the order value or "nil". This should be:

structLevel.ReportError(
    reflect.ValueOf(tier.Spec.Order),
    "TierSpec.Order",
    "",
    reason(fmt.Sprintf("%v tier order must be %v", tier.Name, expectedOrder)),
    "",
)

This matches the pattern used in the original code (lines 1684-1690) and ensures proper error reporting.

[Copilot]

The first argument to ReportError should be the actual field value (wrapped in reflect.ValueOf() if needed), not its string representation. Currently, tierDefaultActionStr is being passed, which is a string representation of the default action value or "nil". This should be:

structLevel.ReportError(
    reflect.ValueOf(tier.Spec.DefaultAction),
    "TierSpec.DefaultAction",
    "",
    reason(fmt.Sprintf("%v tier default action must be %v", tier.Name, expectedDefaultAction)),
    "",
)

This ensures consistency with how other validation errors are reported in this file.

[Copilot]

Missing test coverage for static tiers with nil DefaultAction. The validator code would reject static tiers (default, kube-admin, kube-baseline) when DefaultAction is nil, but there are no explicit test cases for this scenario. Consider adding test cases like:

Entry("Tier: disallow default tier with nil default action", &api.Tier{
    ObjectMeta: v1.ObjectMeta{Name: names.DefaultTierName},
    Spec: api.TierSpec{
        Order: &defaultTierOrder,
    }}, false),

Similar test cases should be added for kube-admin and kube-baseline tiers to explicitly verify this validation requirement.