Implement Cluster Network Policy

[mazdakn]

Description

This PR implements ClusterNetwokrPolicy. It includes:

• Adding two new tier defined at the start of cluster, named kube-admin, and kube-baseline.
• Convert ClusterNetworkPolicy resources to GlobalNetworkPolicy.
  • ClusterNetworkPolicies with Tier set to Admin is placed into Calico kube-admin tier.
  • ClusterNetworkPolicies with Tier set to Baseline is placed into Calico kube-baseline tier.

This PR tracks the main branch of upstream repo: https://github.com/kubernetes-sigs/network-policy-api/tree/main
A follow up PR will pin to a specific tag when it's created upstream.

Related issues/PRs

Operator: tigera/operator#4155
Removing ANP/BANP: #11144
Goldmane support: #11417
Docs: tigera/docs#2416

Pick to private: https://github.com/tigera/calico-private/pull/10621

Todos

• Tests
• Documentation
• Release note

Release Note

Add support for the standard and experimental (networks peers and named ports) functionalities of the new k8s ClusterNetworkPolicy API.
Two new static tiers named kube-admin(order 1,000) and kube-baseline(order 10,000,000) are created at startup where ClusterNetworkPolicy resources in Admin tier, and ClusterNetworkPolicy in Baseline resources in Baseline tier are enforced respectively. 

Reminder for the reviewer

Make sure that this PR has the correct labels and milestone set.

Every PR needs one docs-* label.

• docs-pr-required: This change requires a change to the documentation that has not been completed yet.
• docs-completed: This change has all necessary documentation completed.
• docs-not-required: This change has no user-facing impact and requires no docs.

Every PR needs one release-note-* label.

• release-note-required: This PR has user-facing changes. Most PRs should have this label.
• release-note-not-required: This PR has no user-facing changes.

Other optional labels:

• cherry-pick-candidate: This PR should be cherry-picked to an earlier release. For bug fixes only.
• needs-operator-pr: This PR is related to install and requires a corresponding change to the operator.

[Copilot]

Pull Request Overview

This PR introduces support for Kubernetes Cluster Network Policy (ClusterNetworkPolicy) from the network-policy-api v1alpha2. The implementation adds new tiers (admin and baseline) for cluster-scoped network policies and integrates ClusterNetworkPolicy handling into the Calico data path.

Key changes:

• Adds new admin and baseline tier constants and initialization logic
• Implements ClusterNetworkPolicy client and conversion functions
• Updates dependency versions for Kubernetes and network-policy-api

Reviewed Changes

Copilot reviewed 11 out of 12 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
libcalico-go/lib/names/policy.go	Adds tier names and policy name prefixes for admin/baseline cluster policies
libcalico-go/lib/clientv3/client.go	Initializes admin and baseline tiers during client setup
libcalico-go/lib/backend/syncersv1/felixsyncer/felixsyncerv1.go	Registers ClusterNetworkPolicy resource type for Felix syncing
libcalico-go/lib/backend/model/resource.go	Registers ClusterNetworkPolicy resource info
libcalico-go/lib/backend/model/kubeclusternetworkpolicy.go	Defines ClusterNetworkPolicy kind constant
libcalico-go/lib/backend/k8s/resources/kubeclusternetworkpolicy.go	Implements K8s client for ClusterNetworkPolicy resources
libcalico-go/lib/backend/k8s/k8s.go	Adds ClusterNetworkPolicy client initialization
libcalico-go/lib/backend/k8s/conversion/conversion.go	Adds conversion interface for ClusterNetworkPolicy
go.mod	Updates Kubernetes dependencies and adds network-policy-api dependency
felix/fv/infrastructure/infra_k8s.go	Updates tier cleanup to include new static tiers
api/pkg/apis/projectcalico/v3/tier.go	Adds tier order constants for admin and baseline tiers

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[atlassian]

🔗 Link your GitHub account to Atlassian

To enable Code Reviewer, please link your GitHub account to your Atlassian account.

Click here to connect your accounts

This is a one-time setup that takes less than a minute.

[Copilot]

Pull Request Overview

Copilot reviewed 63 out of 64 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (3)

[mazdakn]

Will revert this change when the operator PR is merged: tigera/operator#4155

[fasaxc]

LGTM, remember to fix OPERATOR_BRANCH.