From 7c57bc015d868ef12130ec4733c8735884f9106f Mon Sep 17 00:00:00 2001
From: Jathavedhan <118891669+carterpewpew@users.noreply.github.com>
Date: Mon, 12 Oct 2026 09:31:34 +0530
Subject: [PATCH] Enable Calico loadbalancer controller in
 calico-kube-controllers (#13611)

calico-kube-controllers ran without the loadbalancer controller, so
Service LoadBalancer IPs were never allocated from Calico IP pools.
Add it to both datastore lists on Calico 3.30.0 and later, where the
controller exists, and make the lists configurable.

Signed-off-by: Jathavedhan M <jathavedhan.m@ibm.com>
---
 inventory/sample/group_vars/k8s_cluster/k8s-net-calico.yml   | 5 +++++
 .../policy_controller/calico/defaults/main.yml               | 5 +++++
 .../calico/templates/calico-kube-controllers.yml.j2          | 4 ++--
 3 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/inventory/sample/group_vars/k8s_cluster/k8s-net-calico.yml b/inventory/sample/group_vars/k8s_cluster/k8s-net-calico.yml
index cbe8c2a98..c3f8ee018 100644
--- a/inventory/sample/group_vars/k8s_cluster/k8s-net-calico.yml
+++ b/inventory/sample/group_vars/k8s_cluster/k8s-net-calico.yml
@@ -63,6 +63,11 @@ calico_pool_blocksize: 26
 # Choose data store type for calico: "etcd" or "kdd" (kubernetes datastore)
 # calico_datastore: "kdd"
 
+# Controllers run by calico-kube-controllers (ENABLED_CONTROLLERS), per datastore
+# (the defaults below are for Calico 3.30+; on 3.29 there is no loadbalancer controller)
+# calico_policy_controller_enabled_controllers_kdd: "node,loadbalancer"
+# calico_policy_controller_enabled_controllers_etcd: "policy,namespace,serviceaccount,workloadendpoint,node,loadbalancer"
+
 # Choose Calico iptables backend: "Legacy", "Auto" or "NFT"
 # calico_iptables_backend: "Auto"
 
diff --git a/roles/kubernetes-apps/policy_controller/calico/defaults/main.yml b/roles/kubernetes-apps/policy_controller/calico/defaults/main.yml
index 82991028f..be590c349 100644
--- a/roles/kubernetes-apps/policy_controller/calico/defaults/main.yml
+++ b/roles/kubernetes-apps/policy_controller/calico/defaults/main.yml
@@ -7,5 +7,10 @@ calico_policy_controller_memory_requests: 64M
 calico_policy_controller_deployment_nodeselector: "kubernetes.io/os: linux"
 calico_policy_controller_log_level: info
 
+# Controllers run by calico-kube-controllers (ENABLED_CONTROLLERS), per datastore.
+# The loadbalancer controller was added in Calico 3.30.0.
+calico_policy_controller_enabled_controllers_kdd: "node{{ ',loadbalancer' if calico_version is version('3.30.0', '>=') else '' }}"
+calico_policy_controller_enabled_controllers_etcd: "policy,namespace,serviceaccount,workloadendpoint,node{{ ',loadbalancer' if calico_version is version('3.30.0', '>=') else '' }}"
+
 # SSL
 calico_cert_dir: "/etc/calico/certs"
diff --git a/roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-controllers.yml.j2 b/roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-controllers.yml.j2
index 36c22f18e..e20a01bfa 100644
--- a/roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-controllers.yml.j2
+++ b/roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-controllers.yml.j2
@@ -68,12 +68,12 @@ spec:
               value: {{ calico_policy_controller_log_level }}
 {% if calico_datastore == "kdd" %}
             - name: ENABLED_CONTROLLERS
-              value: node
+              value: {{ calico_policy_controller_enabled_controllers_kdd }}
             - name: DATASTORE_TYPE
               value: kubernetes
 {% else %}
             - name: ENABLED_CONTROLLERS
-              value: policy,namespace,serviceaccount,workloadendpoint,node
+              value: {{ calico_policy_controller_enabled_controllers_etcd }}
             - name: ETCD_ENDPOINTS
               value: "{{ etcd_access_addresses }}"
             - name: ETCD_CA_CERT_FILE