diff --git a/api/v1/manager_types.go b/api/v1/manager_types.go
index d6e7223844..f338ce0d99 100644
--- a/api/v1/manager_types.go
+++ b/api/v1/manager_types.go
@@ -26,6 +26,37 @@ type ManagerSpec struct {
 	// ManagerDeployment configures the Manager Deployment.
 	// +optional
 	ManagerDeployment *ManagerDeployment `json:"managerDeployment,omitempty"`
+
+	// RBACUI configures the RBAC management UI feature.
+	// +optional
+	RBACUI *RBACUI `json:"rbacUI,omitempty"`
+}
+
+// +kubebuilder:validation:Enum=Enabled;Disabled
+type RBACUIStatusType string
+
+const (
+	RBACUIDisabled RBACUIStatusType = "Disabled"
+	RBACUIEnabled  RBACUIStatusType = "Enabled"
+)
+
+// RBACUI configures the RBAC management UI. This is a separate control plane
+// for Calico Enterprise RBAC that lives alongside, and does not replace, the
+// user's ability to configure RBAC themselves.
+type RBACUI struct {
+	// State turns the RBAC management UI on or off. Defaults to Disabled.
+	// +optional
+	State *RBACUIStatusType `json:"state,omitempty"`
+}
+
+// RBACManagementEnabled returns true when the Manager CR enables the RBAC
+// management UI. Safe to call on a nil receiver; returns false for a nil
+// Manager, an unset RBACUI, or any state other than Enabled.
+func (m *Manager) RBACManagementEnabled() bool {
+	if m == nil || m.Spec.RBACUI == nil || m.Spec.RBACUI.State == nil {
+		return false
+	}
+	return *m.Spec.RBACUI.State == RBACUIEnabled
 }
 
 // ManagerDeployment is the configuration for the Manager Deployment.
diff --git a/api/v1/manager_types_test.go b/api/v1/manager_types_test.go
new file mode 100644
index 0000000000..9a59442dff
--- /dev/null
+++ b/api/v1/manager_types_test.go
@@ -0,0 +1,51 @@
+// Copyright (c) 2026 Tigera, Inc. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package v1
+
+import "testing"
+
+func TestRBACManagementEnabled(t *testing.T) {
+	state := func(s RBACUIStatusType) *RBACUIStatusType { return &s }
+
+	for _, tc := range []struct {
+		name string
+		m    *Manager
+		want bool
+	}{
+		// Nil paths: RBACManagementEnabled is called as managerCR.RBACManagementEnabled()
+		// where managerCR is nil when no Manager CR exists, so a nil receiver (and each
+		// nil field below) must return false rather than panic.
+		{name: "nil Manager", m: nil, want: false},
+		{name: "nil RBACUI", m: &Manager{}, want: false},
+		{name: "nil State", m: &Manager{Spec: ManagerSpec{RBACUI: &RBACUI{}}}, want: false},
+
+		{name: "State Enabled", m: &Manager{Spec: ManagerSpec{RBACUI: &RBACUI{State: state(RBACUIEnabled)}}}, want: true},
+		{name: "State Disabled", m: &Manager{Spec: ManagerSpec{RBACUI: &RBACUI{State: state(RBACUIDisabled)}}}, want: false},
+		// Any value other than Enabled is off (the Enum marker rejects this at the
+		// apiserver, but the helper must not treat a non-empty value as enabled).
+		{name: "State unrecognized value", m: &Manager{Spec: ManagerSpec{RBACUI: &RBACUI{State: state("SomethingElse")}}}, want: false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			defer func() {
+				if r := recover(); r != nil {
+					t.Fatalf("RBACManagementEnabled panicked on %s: %v", tc.name, r)
+				}
+			}()
+			if got := tc.m.RBACManagementEnabled(); got != tc.want {
+				t.Errorf("RBACManagementEnabled() = %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
diff --git a/api/v1/zz_generated.deepcopy.go b/api/v1/zz_generated.deepcopy.go
index f010edf7ee..00e122a473 100644
--- a/api/v1/zz_generated.deepcopy.go
+++ b/api/v1/zz_generated.deepcopy.go
@@ -7917,6 +7917,11 @@ func (in *ManagerSpec) DeepCopyInto(out *ManagerSpec) {
 		*out = new(ManagerDeployment)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.RBACUI != nil {
+		in, out := &in.RBACUI, &out.RBACUI
+		*out = new(RBACUI)
+		(*in).DeepCopyInto(*out)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ManagerSpec.
@@ -9011,6 +9016,26 @@ func (in *QueryServerLogging) DeepCopy() *QueryServerLogging {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RBACUI) DeepCopyInto(out *RBACUI) {
+	*out = *in
+	if in.State != nil {
+		in, out := &in.State, &out.State
+		*out = new(RBACUIStatusType)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RBACUI.
+func (in *RBACUI) DeepCopy() *RBACUI {
+	if in == nil {
+		return nil
+	}
+	out := new(RBACUI)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Retention) DeepCopyInto(out *Retention) {
 	*out = *in
diff --git a/pkg/controller/apiserver/apiserver_controller.go b/pkg/controller/apiserver/apiserver_controller.go
index 668756cc10..c2b34492c0 100644
--- a/pkg/controller/apiserver/apiserver_controller.go
+++ b/pkg/controller/apiserver/apiserver_controller.go
@@ -122,6 +122,13 @@ func Add(mgr manager.Manager, opts options.ControllerOptions) error {
 			return fmt.Errorf("apiserver-controller failed to watch primary resource: %v", err)
 		}
 
+		// Watch the Manager CR so toggling spec.rbac re-runs the apiserver
+		// reconcile (the tigera-network-admin RBAC is gated on it).
+		err = c.WatchObject(&operatorv1.Manager{}, &handler.EnqueueRequestForObject{})
+		if err != nil {
+			return fmt.Errorf("apiserver-controller failed to watch Manager: %v", err)
+		}
+
 		for _, namespace := range []string{common.OperatorNamespace(), render.APIServerNamespace} {
 			for _, secretName := range []string{render.VoltronTunnelSecretName, render.ManagerTLSSecretName} {
 				if err = utils.AddSecretsWatch(c, secretName, namespace); err != nil {
@@ -342,6 +349,7 @@ func (r *ReconcileAPIServer) Reconcile(ctx context.Context, request reconcile.Re
 	var managementCluster *operatorv1.ManagementCluster
 	var managementClusterConnection *operatorv1.ManagementClusterConnection
 	var keyValidatorConfig authentication.KeyValidatorConfig
+	var managerCR *operatorv1.Manager
 	includeV3NetworkPolicy := false
 
 	if installationSpec.Variant.IsEnterprise() {
@@ -370,6 +378,12 @@ func (r *ReconcileAPIServer) Reconcile(ctx context.Context, request reconcile.Re
 			return reconcile.Result{}, err
 		}
 
+		managerCR, err = utils.GetManager(ctx, r.client, false, "")
+		if err != nil {
+			r.status.SetDegraded(operatorv1.ResourceReadError, "Error reading Manager", err, reqLogger)
+			return reconcile.Result{}, err
+		}
+
 		if managementClusterConnection != nil && managementCluster != nil {
 			err = fmt.Errorf("having both a ManagementCluster and a ManagementClusterConnection is not supported")
 			r.status.SetDegraded(operatorv1.ResourceValidationError, "", err, reqLogger)
@@ -497,6 +511,7 @@ func (r *ReconcileAPIServer) Reconcile(ctx context.Context, request reconcile.Re
 		KubernetesVersion:            r.opts.KubernetesVersion,
 		ClusterDomain:                r.opts.ClusterDomain,
 		RequiresAggregationServer:    !r.opts.UseV3CRDs,
+		RBACManagementEnabled:        managerCR.RBACManagementEnabled(),
 		QueryServerTLSKeyPairCertificateManagementOnly: queryServerTLSSecretCertificateManagementOnly,
 	}
 
diff --git a/pkg/controller/installation/core_controller.go b/pkg/controller/installation/core_controller.go
index c4dcdd6aaa..6105249448 100644
--- a/pkg/controller/installation/core_controller.go
+++ b/pkg/controller/installation/core_controller.go
@@ -252,6 +252,14 @@ func Add(mgr manager.Manager, opts options.ControllerOptions) error {
 			return fmt.Errorf("tigera-installation-controller failed to watch primary resource: %v", err)
 		}
 
+		// Watch the Manager CR so changes to spec.rbac re-run the installation
+		// reconcile (the rbacsync controller in calico-kube-controllers is
+		// gated on it).
+		err = c.WatchObject(&operatorv1.Manager{}, &handler.EnqueueRequestForObject{})
+		if err != nil {
+			return fmt.Errorf("tigera-installation-controller failed to watch Manager: %v", err)
+		}
+
 		// watch for change to primary resource LogCollector
 		err = c.WatchObject(&operatorv1.LogCollector{}, &handler.EnqueueRequestForObject{})
 		if err != nil {
@@ -1049,6 +1057,7 @@ func (r *ReconcileInstallation) Reconcile(ctx context.Context, request reconcile
 
 	var managementCluster *operatorv1.ManagementCluster
 	var managementClusterConnection *operatorv1.ManagementClusterConnection
+	var managerCR *operatorv1.Manager
 	var logCollector *operatorv1.LogCollector
 	if r.enterpriseCRDsExist {
 		logCollector, err = utils.GetLogCollector(ctx, r.client)
@@ -1071,6 +1080,12 @@ func (r *ReconcileInstallation) Reconcile(ctx context.Context, request reconcile
 			return reconcile.Result{}, err
 		}
 
+		managerCR, err = utils.GetManager(ctx, r.client, false, "")
+		if err != nil {
+			r.status.SetDegraded(operatorv1.ResourceReadError, "Error reading Manager", err, reqLogger)
+			return reconcile.Result{}, err
+		}
+
 		if managementClusterConnection != nil && managementCluster != nil {
 			err = fmt.Errorf("having both a managementCluster and a managementClusterConnection is not supported")
 			r.status.SetDegraded(operatorv1.ResourceValidationError, "", err, reqLogger)
@@ -1705,7 +1720,8 @@ func (r *ReconcileInstallation) Reconcile(ctx context.Context, request reconcile
 		// the kube-controllers component (and deleted when the WAF extension is
 		// disabled); the caBundle is the operator CA that issued the serving
 		// cert above.
-		WAFWebhookCABundle: certificateManager.KeyPair().GetCertificatePEM(),
+		WAFWebhookCABundle:    certificateManager.KeyPair().GetCertificatePEM(),
+		RBACManagementEnabled: managerCR.RBACManagementEnabled(),
 	}
 	components = append(components, kubecontrollers.NewCalicoKubeControllers(&kubeControllersCfg))
 
diff --git a/pkg/controller/manager/manager_controller.go b/pkg/controller/manager/manager_controller.go
index a60537cc5e..5f637b92d7 100644
--- a/pkg/controller/manager/manager_controller.go
+++ b/pkg/controller/manager/manager_controller.go
@@ -233,23 +233,6 @@ type ReconcileManager struct {
 	opts            options.ControllerOptions
 }
 
-// GetManager returns the default manager instance with defaults populated.
-func GetManager(ctx context.Context, cli client.Client, mt bool, ns string) (*operatorv1.Manager, error) {
-	key := client.ObjectKey{Name: "tigera-secure"}
-	if mt {
-		key.Namespace = ns
-	}
-
-	// Fetch the manager instance. We only support a single instance named "tigera-secure".
-	instance := &operatorv1.Manager{}
-	err := cli.Get(ctx, key, instance)
-	if err != nil {
-		return nil, err
-	}
-
-	return instance, nil
-}
-
 // Reconcile reads that state of the cluster for a Manager object and makes changes based on the state read
 // and what is in the Manager.Spec
 // The Controller will requeue the Request to be processed again if the returned error is non-nil or
@@ -276,16 +259,16 @@ func (r *ReconcileManager) Reconcile(ctx context.Context, request reconcile.Requ
 	}
 
 	// Fetch the Manager instance that corresponds with this reconcile trigger.
-	instance, err := GetManager(ctx, r.client, r.opts.MultiTenant, request.Namespace)
+	instance, err := utils.GetManager(ctx, r.client, r.opts.MultiTenant, request.Namespace)
 	if err != nil {
-		if errors.IsNotFound(err) {
-			logc.Info("Manager object not found")
-			r.status.OnCRNotFound()
-			return reconcile.Result{}, nil
-		}
 		r.status.SetDegraded(operatorv1.ResourceReadError, "Error querying Manager", err, logc)
 		return reconcile.Result{}, err
 	}
+	if instance == nil {
+		logc.Info("Manager object not found")
+		r.status.OnCRNotFound()
+		return reconcile.Result{}, nil
+	}
 	logc.V(2).Info("Loaded config", "config", instance)
 	r.status.OnCRFound()
 
@@ -719,6 +702,7 @@ func (r *ReconcileManager) Reconcile(ctx context.Context, request reconcile.Requ
 		BindingNamespaces:          namespaces,
 		OSSTenantNamespaces:        ossTenantNamespaces,
 		Manager:                    instance,
+		Authentication:             authenticationCR,
 		KibanaEnabled:              kibanaEnabled,
 		CACertCommonName:           certificateManager.CACertCommonName(),
 	}
diff --git a/pkg/controller/manager/manager_controller_test.go b/pkg/controller/manager/manager_controller_test.go
index a825885f4a..b3960fa4c7 100644
--- a/pkg/controller/manager/manager_controller_test.go
+++ b/pkg/controller/manager/manager_controller_test.go
@@ -88,7 +88,7 @@ var _ = Describe("Manager controller tests", func() {
 		}
 		err := c.Create(ctx, instance)
 		Expect(err).NotTo(HaveOccurred())
-		instance, err = GetManager(ctx, c, false, "")
+		instance, err = utils.GetManager(ctx, c, false, "")
 		Expect(err).NotTo(HaveOccurred())
 	})
 
@@ -102,7 +102,7 @@ var _ = Describe("Manager controller tests", func() {
 		}
 		err := c.Create(ctx, instanceA)
 		Expect(err).NotTo(HaveOccurred())
-		instance, err = GetManager(ctx, c, true, tenantANamespace)
+		instance, err = utils.GetManager(ctx, c, true, tenantANamespace)
 		Expect(err).NotTo(HaveOccurred())
 
 		tenantBNamespace := "tenant-b"
@@ -112,14 +112,14 @@ var _ = Describe("Manager controller tests", func() {
 		}
 		err = c.Create(ctx, instanceB)
 		Expect(err).NotTo(HaveOccurred())
-		instance, err = GetManager(ctx, c, true, tenantBNamespace)
+		instance, err = utils.GetManager(ctx, c, true, tenantBNamespace)
 		Expect(err).NotTo(HaveOccurred())
 	})
 
-	It("should return expected error when querying namespace that does not contain a manager instance", func() {
+	It("should return a nil instance and no error when querying a namespace that does not contain a manager instance", func() {
 		nsWithoutManager := "non-manager-ns"
-		instance, err := GetManager(ctx, c, true, nsWithoutManager)
-		Expect(kerror.IsNotFound(err)).To(BeTrue())
+		instance, err := utils.GetManager(ctx, c, true, nsWithoutManager)
+		Expect(err).NotTo(HaveOccurred())
 		Expect(instance).To(BeNil())
 	})
 
@@ -819,7 +819,7 @@ var _ = Describe("Manager controller tests", func() {
 						Namespace: "",
 					}})
 					Expect(err).ShouldNot(HaveOccurred())
-					instance, err := GetManager(ctx, r.client, false, "")
+					instance, err := utils.GetManager(ctx, r.client, false, "")
 					Expect(err).ShouldNot(HaveOccurred())
 
 					Expect(instance.Status.Conditions).To(HaveLen(1))
@@ -843,7 +843,7 @@ var _ = Describe("Manager controller tests", func() {
 						Namespace: "",
 					}})
 					Expect(err).ShouldNot(HaveOccurred())
-					instance, err := GetManager(ctx, r.client, false, "")
+					instance, err := utils.GetManager(ctx, r.client, false, "")
 					Expect(err).ShouldNot(HaveOccurred())
 
 					Expect(instance.Status.Conditions).To(HaveLen(0))
@@ -887,7 +887,7 @@ var _ = Describe("Manager controller tests", func() {
 						Namespace: "",
 					}})
 					Expect(err).ShouldNot(HaveOccurred())
-					instance, err := GetManager(ctx, r.client, false, "")
+					instance, err := utils.GetManager(ctx, r.client, false, "")
 					Expect(err).ShouldNot(HaveOccurred())
 
 					Expect(instance.Status.Conditions).To(HaveLen(3))
@@ -948,7 +948,7 @@ var _ = Describe("Manager controller tests", func() {
 						Namespace: "",
 					}})
 					Expect(err).ShouldNot(HaveOccurred())
-					instance, err := GetManager(ctx, r.client, false, "")
+					instance, err := utils.GetManager(ctx, r.client, false, "")
 					Expect(err).ShouldNot(HaveOccurred())
 
 					Expect(instance.Status.Conditions).To(HaveLen(3))
diff --git a/pkg/controller/utils/utils.go b/pkg/controller/utils/utils.go
index f67fb94c12..9405b93206 100644
--- a/pkg/controller/utils/utils.go
+++ b/pkg/controller/utils/utils.go
@@ -487,6 +487,27 @@ func GetIstio(ctx context.Context, c client.Client) (*operatorv1.Istio, error) {
 	return istio, nil
 }
 
+// GetManager returns the Manager CR, or nil if it is not found. When
+// multiTenant is true the tenant-scoped instance is read from ns; otherwise the
+// cluster-scoped instance is read and ns is ignored. A NoMatchError (the
+// Manager CRD is not registered) is returned to the caller rather than treated
+// as not-found: absence of the CRD is distinct from the user not having created
+// a Manager, and the caller decides how to handle it.
+func GetManager(ctx context.Context, cli client.Client, multiTenant bool, ns string) (*operatorv1.Manager, error) {
+	key := DefaultEnterpriseInstanceKey
+	if multiTenant {
+		key.Namespace = ns
+	}
+	instance := &operatorv1.Manager{}
+	if err := cli.Get(ctx, key, instance); err != nil {
+		if errors.IsNotFound(err) {
+			return nil, nil
+		}
+		return nil, err
+	}
+	return instance, nil
+}
+
 // Return the ManagementCluster CR if present. No error is returned if it was not found.
 func GetManagementCluster(ctx context.Context, c client.Client) (*operatorv1.ManagementCluster, error) {
 	managementCluster := &operatorv1.ManagementCluster{}
diff --git a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgpconfigurations.yaml b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgpconfigurations.yaml
index 610ead12b6..0d4ed1fa83 100644
--- a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgpconfigurations.yaml
+++ b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgpconfigurations.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: BGPConfigurationList
     plural: bgpconfigurations
     singular: bgpconfiguration
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgpfilters.yaml b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgpfilters.yaml
index 102c9a5aa7..f78c2d13b1 100644
--- a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgpfilters.yaml
+++ b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgpfilters.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: BGPFilterList
     plural: bgpfilters
     singular: bgpfilter
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgppeers.yaml b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgppeers.yaml
index d022d314cb..734d550ed2 100644
--- a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgppeers.yaml
+++ b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgppeers.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: BGPPeerList
     plural: bgppeers
     singular: bgppeer
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_blockaffinities.yaml b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_blockaffinities.yaml
index e3a3faf635..16a8480670 100644
--- a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_blockaffinities.yaml
+++ b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_blockaffinities.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: BlockAffinityList
     plural: blockaffinities
     singular: blockaffinity
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_caliconodestatuses.yaml b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_caliconodestatuses.yaml
index 05b627f171..4f3ee58405 100644
--- a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_caliconodestatuses.yaml
+++ b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_caliconodestatuses.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: CalicoNodeStatusList
     plural: caliconodestatuses
     singular: caliconodestatus
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_clusterinformations.yaml b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_clusterinformations.yaml
index 0f792329e7..d3aabcbab9 100644
--- a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_clusterinformations.yaml
+++ b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_clusterinformations.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: ClusterInformationList
     plural: clusterinformations
     singular: clusterinformation
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_felixconfigurations.yaml b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_felixconfigurations.yaml
index 85623d87e4..7bcd372618 100644
--- a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_felixconfigurations.yaml
+++ b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_felixconfigurations.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: FelixConfigurationList
     plural: felixconfigurations
     singular: felixconfiguration
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
@@ -1191,7 +1190,7 @@ spec:
                 prometheusMetricsClientAuth:
                   description: |-
                     PrometheusMetricsClientAuth specifies the client authentication type for the /metrics endpoint.
-                    This determines how the server validates client certificates. Default is "RequireAndVerifyClientCert".
+                    This determines how the server validates client certificates. Default is "NoClientCert".
                   type: string
                 prometheusMetricsEnabled:
                   description:
diff --git a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_globalnetworkpolicies.yaml b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_globalnetworkpolicies.yaml
index 1ef49017b1..498e2822cd 100644
--- a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_globalnetworkpolicies.yaml
+++ b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_globalnetworkpolicies.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: GlobalNetworkPolicyList
     plural: globalnetworkpolicies
     singular: globalnetworkpolicy
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_globalnetworksets.yaml b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_globalnetworksets.yaml
index 7c3cd530d3..71241bcfd5 100644
--- a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_globalnetworksets.yaml
+++ b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_globalnetworksets.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: GlobalNetworkSetList
     plural: globalnetworksets
     singular: globalnetworkset
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_hostendpoints.yaml b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_hostendpoints.yaml
index 375c82431a..83fc3c3a5d 100644
--- a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_hostendpoints.yaml
+++ b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_hostendpoints.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: HostEndpointList
     plural: hostendpoints
     singular: hostendpoint
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_ipamblocks.yaml b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_ipamblocks.yaml
index 2e772ee8f6..018e1996ca 100644
--- a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_ipamblocks.yaml
+++ b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_ipamblocks.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: IPAMBlockList
     plural: ipamblocks
     singular: ipamblock
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_ipamconfigs.yaml b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_ipamconfigs.yaml
index 377593615d..09bb2adf29 100644
--- a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_ipamconfigs.yaml
+++ b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_ipamconfigs.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: IPAMConfigList
     plural: ipamconfigs
     singular: ipamconfig
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_ipamhandles.yaml b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_ipamhandles.yaml
index d80a2d2e5d..3816fd731d 100644
--- a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_ipamhandles.yaml
+++ b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_ipamhandles.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: IPAMHandleList
     plural: ipamhandles
     singular: ipamhandle
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_ippools.yaml b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_ippools.yaml
index 186575493e..169c0d1b72 100644
--- a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_ippools.yaml
+++ b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_ippools.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: IPPoolList
     plural: ippools
     singular: ippool
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_ipreservations.yaml b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_ipreservations.yaml
index 22991934d4..1c69e562cb 100644
--- a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_ipreservations.yaml
+++ b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_ipreservations.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: IPReservationList
     plural: ipreservations
     singular: ipreservation
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_kubecontrollersconfigurations.yaml b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_kubecontrollersconfigurations.yaml
index db0d85b85e..4408ad5bf8 100644
--- a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_kubecontrollersconfigurations.yaml
+++ b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_kubecontrollersconfigurations.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: KubeControllersConfigurationList
     plural: kubecontrollersconfigurations
     singular: kubecontrollersconfiguration
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_networkpolicies.yaml b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_networkpolicies.yaml
index 21dc5b937f..078ae30237 100644
--- a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_networkpolicies.yaml
+++ b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_networkpolicies.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: NetworkPolicyList
     plural: networkpolicies
     singular: networkpolicy
-  preserveUnknownFields: false
   scope: Namespaced
   versions:
     - name: v1
diff --git a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_networksets.yaml b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_networksets.yaml
index 173756dd71..e657429082 100644
--- a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_networksets.yaml
+++ b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_networksets.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: NetworkSetList
     plural: networksets
     singular: networkset
-  preserveUnknownFields: false
   scope: Namespaced
   versions:
     - name: v1
diff --git a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_stagedglobalnetworkpolicies.yaml b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_stagedglobalnetworkpolicies.yaml
index 259384b753..5f8137a7bc 100644
--- a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_stagedglobalnetworkpolicies.yaml
+++ b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_stagedglobalnetworkpolicies.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: StagedGlobalNetworkPolicyList
     plural: stagedglobalnetworkpolicies
     singular: stagedglobalnetworkpolicy
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_stagedkubernetesnetworkpolicies.yaml b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_stagedkubernetesnetworkpolicies.yaml
index e5851adbd1..e6c0f7132f 100644
--- a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_stagedkubernetesnetworkpolicies.yaml
+++ b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_stagedkubernetesnetworkpolicies.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: StagedKubernetesNetworkPolicyList
     plural: stagedkubernetesnetworkpolicies
     singular: stagedkubernetesnetworkpolicy
-  preserveUnknownFields: false
   scope: Namespaced
   versions:
     - name: v1
diff --git a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_stagednetworkpolicies.yaml b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_stagednetworkpolicies.yaml
index 5c37ddac03..c2992279fb 100644
--- a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_stagednetworkpolicies.yaml
+++ b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_stagednetworkpolicies.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: StagedNetworkPolicyList
     plural: stagednetworkpolicies
     singular: stagednetworkpolicy
-  preserveUnknownFields: false
   scope: Namespaced
   versions:
     - name: v1
diff --git a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_tiers.yaml b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_tiers.yaml
index b2567ece66..deb3fbaa4f 100644
--- a/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_tiers.yaml
+++ b/pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_tiers.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: TierList
     plural: tiers
     singular: tier
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_bgpconfigurations.yaml b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_bgpconfigurations.yaml
index ebf7a35a8c..5a6063c10f 100644
--- a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_bgpconfigurations.yaml
+++ b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_bgpconfigurations.yaml
@@ -14,7 +14,6 @@ spec:
       - bgpconfig
       - bgpconfigs
     singular: bgpconfiguration
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v3
diff --git a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_bgpfilters.yaml b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_bgpfilters.yaml
index f734bf8a5e..d57f10aebb 100644
--- a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_bgpfilters.yaml
+++ b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_bgpfilters.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: BGPFilterList
     plural: bgpfilters
     singular: bgpfilter
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v3
diff --git a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_bgppeers.yaml b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_bgppeers.yaml
index f7695183e4..1141236788 100644
--- a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_bgppeers.yaml
+++ b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_bgppeers.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: BGPPeerList
     plural: bgppeers
     singular: bgppeer
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - additionalPrinterColumns:
diff --git a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_blockaffinities.yaml b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_blockaffinities.yaml
index d95679581a..60e6e5f67e 100644
--- a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_blockaffinities.yaml
+++ b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_blockaffinities.yaml
@@ -14,7 +14,6 @@ spec:
       - affinity
       - affinities
     singular: blockaffinity
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - additionalPrinterColumns:
diff --git a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_caliconodestatuses.yaml b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_caliconodestatuses.yaml
index d52d68e9f8..929ec8a9e4 100644
--- a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_caliconodestatuses.yaml
+++ b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_caliconodestatuses.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: CalicoNodeStatusList
     plural: caliconodestatuses
     singular: caliconodestatus
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - additionalPrinterColumns:
diff --git a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_clusterinformations.yaml b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_clusterinformations.yaml
index 8b83de58ef..46cddc1f92 100644
--- a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_clusterinformations.yaml
+++ b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_clusterinformations.yaml
@@ -14,7 +14,6 @@ spec:
       - clusterinfo
       - clusterinfos
     singular: clusterinformation
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - additionalPrinterColumns:
diff --git a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_felixconfigurations.yaml b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_felixconfigurations.yaml
index 77342d58c8..fbea5d30e7 100644
--- a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_felixconfigurations.yaml
+++ b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_felixconfigurations.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: FelixConfigurationList
     plural: felixconfigurations
     singular: felixconfiguration
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v3
@@ -1190,7 +1189,7 @@ spec:
                 prometheusMetricsClientAuth:
                   description: |-
                     PrometheusMetricsClientAuth specifies the client authentication type for the /metrics endpoint.
-                    This determines how the server validates client certificates. Default is "RequireAndVerifyClientCert".
+                    This determines how the server validates client certificates. Default is "NoClientCert".
                   type: string
                 prometheusMetricsEnabled:
                   description:
diff --git a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_globalnetworkpolicies.yaml b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_globalnetworkpolicies.yaml
index 61714163ce..6db6a1c661 100644
--- a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_globalnetworkpolicies.yaml
+++ b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_globalnetworkpolicies.yaml
@@ -14,7 +14,6 @@ spec:
       - gnp
       - cgnp
     singular: globalnetworkpolicy
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - additionalPrinterColumns:
diff --git a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_globalnetworksets.yaml b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_globalnetworksets.yaml
index 79624494a7..17717dc9b3 100644
--- a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_globalnetworksets.yaml
+++ b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_globalnetworksets.yaml
@@ -13,7 +13,6 @@ spec:
     shortNames:
       - gns
     singular: globalnetworkset
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - additionalPrinterColumns:
diff --git a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_hostendpoints.yaml b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_hostendpoints.yaml
index 3f55368288..176a837703 100644
--- a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_hostendpoints.yaml
+++ b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_hostendpoints.yaml
@@ -14,7 +14,6 @@ spec:
       - hep
       - heps
     singular: hostendpoint
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - additionalPrinterColumns:
diff --git a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_ipamblocks.yaml b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_ipamblocks.yaml
index 927febc51b..e7b4a5b293 100644
--- a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_ipamblocks.yaml
+++ b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_ipamblocks.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: IPAMBlockList
     plural: ipamblocks
     singular: ipamblock
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - additionalPrinterColumns:
diff --git a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_ipamconfigurations.yaml b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_ipamconfigurations.yaml
index c67ca32418..2eac4f5baf 100644
--- a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_ipamconfigurations.yaml
+++ b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_ipamconfigurations.yaml
@@ -14,7 +14,6 @@ spec:
       - ipamconfig
       - ipamconfigs
     singular: ipamconfiguration
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - additionalPrinterColumns:
diff --git a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_ipamhandles.yaml b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_ipamhandles.yaml
index b1b75eae59..0e77395a85 100644
--- a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_ipamhandles.yaml
+++ b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_ipamhandles.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: IPAMHandleList
     plural: ipamhandles
     singular: ipamhandle
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - additionalPrinterColumns:
diff --git a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_ippools.yaml b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_ippools.yaml
index 435dbf1cb5..c082728455 100644
--- a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_ippools.yaml
+++ b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_ippools.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: IPPoolList
     plural: ippools
     singular: ippool
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - additionalPrinterColumns:
diff --git a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_ipreservations.yaml b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_ipreservations.yaml
index dc522cdd8a..e4d2af0a7f 100644
--- a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_ipreservations.yaml
+++ b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_ipreservations.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: IPReservationList
     plural: ipreservations
     singular: ipreservation
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v3
diff --git a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_kubecontrollersconfigurations.yaml b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_kubecontrollersconfigurations.yaml
index 5cbc88076c..3e8fd4a0b6 100644
--- a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_kubecontrollersconfigurations.yaml
+++ b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_kubecontrollersconfigurations.yaml
@@ -14,7 +14,6 @@ spec:
       - kcc
       - kccs
     singular: kubecontrollersconfiguration
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v3
diff --git a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_networkpolicies.yaml b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_networkpolicies.yaml
index f71d867edf..0ab66e503d 100644
--- a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_networkpolicies.yaml
+++ b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_networkpolicies.yaml
@@ -14,7 +14,6 @@ spec:
       - cnp
       - caliconetworkpolicy
     singular: networkpolicy
-  preserveUnknownFields: false
   scope: Namespaced
   versions:
     - additionalPrinterColumns:
diff --git a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_networksets.yaml b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_networksets.yaml
index 6ddf977c32..5e561184aa 100644
--- a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_networksets.yaml
+++ b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_networksets.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: NetworkSetList
     plural: networksets
     singular: networkset
-  preserveUnknownFields: false
   scope: Namespaced
   versions:
     - name: v3
diff --git a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_stagedglobalnetworkpolicies.yaml b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_stagedglobalnetworkpolicies.yaml
index ef3f9087d5..0744bde5f3 100644
--- a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_stagedglobalnetworkpolicies.yaml
+++ b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_stagedglobalnetworkpolicies.yaml
@@ -13,7 +13,6 @@ spec:
     shortNames:
       - sgnp
     singular: stagedglobalnetworkpolicy
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - additionalPrinterColumns:
diff --git a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_stagedkubernetesnetworkpolicies.yaml b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_stagedkubernetesnetworkpolicies.yaml
index 5381cfa7fd..2b21474b9f 100644
--- a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_stagedkubernetesnetworkpolicies.yaml
+++ b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_stagedkubernetesnetworkpolicies.yaml
@@ -13,7 +13,6 @@ spec:
     shortNames:
       - sknp
     singular: stagedkubernetesnetworkpolicy
-  preserveUnknownFields: false
   scope: Namespaced
   versions:
     - name: v3
diff --git a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_stagednetworkpolicies.yaml b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_stagednetworkpolicies.yaml
index a916ccbe36..11eba2f2e5 100644
--- a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_stagednetworkpolicies.yaml
+++ b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_stagednetworkpolicies.yaml
@@ -14,7 +14,6 @@ spec:
       - scnp
       - snp
     singular: stagednetworkpolicy
-  preserveUnknownFields: false
   scope: Namespaced
   versions:
     - additionalPrinterColumns:
diff --git a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_tiers.yaml b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_tiers.yaml
index 0136cb1c95..abd4aeabc9 100644
--- a/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_tiers.yaml
+++ b/pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_tiers.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: TierList
     plural: tiers
     singular: tier
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - additionalPrinterColumns:
diff --git a/pkg/imports/crds/enterprise/applicationlayer.projectcalico.org/applicationlayer.projectcalico.org_globalwafplugins.yaml b/pkg/imports/crds/enterprise/applicationlayer.projectcalico.org/applicationlayer.projectcalico.org_globalwafplugins.yaml
index 66ace9e0e7..6d7ce3d75c 100644
--- a/pkg/imports/crds/enterprise/applicationlayer.projectcalico.org/applicationlayer.projectcalico.org_globalwafplugins.yaml
+++ b/pkg/imports/crds/enterprise/applicationlayer.projectcalico.org/applicationlayer.projectcalico.org_globalwafplugins.yaml
@@ -13,7 +13,6 @@ spec:
     shortNames:
       - gwafplugin
     singular: globalwafplugin
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - additionalPrinterColumns:
diff --git a/pkg/imports/crds/enterprise/applicationlayer.projectcalico.org/applicationlayer.projectcalico.org_globalwafpolicies.yaml b/pkg/imports/crds/enterprise/applicationlayer.projectcalico.org/applicationlayer.projectcalico.org_globalwafpolicies.yaml
index 966ca50f3e..8298fce200 100644
--- a/pkg/imports/crds/enterprise/applicationlayer.projectcalico.org/applicationlayer.projectcalico.org_globalwafpolicies.yaml
+++ b/pkg/imports/crds/enterprise/applicationlayer.projectcalico.org/applicationlayer.projectcalico.org_globalwafpolicies.yaml
@@ -13,7 +13,6 @@ spec:
     shortNames:
       - gwafp
     singular: globalwafpolicy
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - additionalPrinterColumns:
diff --git a/pkg/imports/crds/enterprise/applicationlayer.projectcalico.org/applicationlayer.projectcalico.org_globalwafvalidationpolicies.yaml b/pkg/imports/crds/enterprise/applicationlayer.projectcalico.org/applicationlayer.projectcalico.org_globalwafvalidationpolicies.yaml
index b2007a4b17..40cfd0ac71 100644
--- a/pkg/imports/crds/enterprise/applicationlayer.projectcalico.org/applicationlayer.projectcalico.org_globalwafvalidationpolicies.yaml
+++ b/pkg/imports/crds/enterprise/applicationlayer.projectcalico.org/applicationlayer.projectcalico.org_globalwafvalidationpolicies.yaml
@@ -13,7 +13,6 @@ spec:
     shortNames:
       - gwafvp
     singular: globalwafvalidationpolicy
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - additionalPrinterColumns:
diff --git a/pkg/imports/crds/enterprise/applicationlayer.projectcalico.org/applicationlayer.projectcalico.org_wafplugins.yaml b/pkg/imports/crds/enterprise/applicationlayer.projectcalico.org/applicationlayer.projectcalico.org_wafplugins.yaml
index d88e6646c9..fa8b562fad 100644
--- a/pkg/imports/crds/enterprise/applicationlayer.projectcalico.org/applicationlayer.projectcalico.org_wafplugins.yaml
+++ b/pkg/imports/crds/enterprise/applicationlayer.projectcalico.org/applicationlayer.projectcalico.org_wafplugins.yaml
@@ -13,7 +13,6 @@ spec:
     shortNames:
       - wafplugin
     singular: wafplugin
-  preserveUnknownFields: false
   scope: Namespaced
   versions:
     - additionalPrinterColumns:
diff --git a/pkg/imports/crds/enterprise/applicationlayer.projectcalico.org/applicationlayer.projectcalico.org_wafpolicies.yaml b/pkg/imports/crds/enterprise/applicationlayer.projectcalico.org/applicationlayer.projectcalico.org_wafpolicies.yaml
index 8b476229e6..5537bcbf1d 100644
--- a/pkg/imports/crds/enterprise/applicationlayer.projectcalico.org/applicationlayer.projectcalico.org_wafpolicies.yaml
+++ b/pkg/imports/crds/enterprise/applicationlayer.projectcalico.org/applicationlayer.projectcalico.org_wafpolicies.yaml
@@ -13,7 +13,6 @@ spec:
     shortNames:
       - wafp
     singular: wafpolicy
-  preserveUnknownFields: false
   scope: Namespaced
   versions:
     - additionalPrinterColumns:
diff --git a/pkg/imports/crds/enterprise/applicationlayer.projectcalico.org/applicationlayer.projectcalico.org_wafvalidationpolicies.yaml b/pkg/imports/crds/enterprise/applicationlayer.projectcalico.org/applicationlayer.projectcalico.org_wafvalidationpolicies.yaml
index d1f2ec91d9..489f8fa1b2 100644
--- a/pkg/imports/crds/enterprise/applicationlayer.projectcalico.org/applicationlayer.projectcalico.org_wafvalidationpolicies.yaml
+++ b/pkg/imports/crds/enterprise/applicationlayer.projectcalico.org/applicationlayer.projectcalico.org_wafvalidationpolicies.yaml
@@ -13,7 +13,6 @@ spec:
     shortNames:
       - wafvp
     singular: wafvalidationpolicy
-  preserveUnknownFields: false
   scope: Namespaced
   versions:
     - additionalPrinterColumns:
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_alertexceptions.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_alertexceptions.yaml
index 9fefbc9722..5a1335ae4d 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_alertexceptions.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_alertexceptions.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: AlertExceptionList
     plural: alertexceptions
     singular: alertexception
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_bfdconfigurations.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_bfdconfigurations.yaml
index 174ff7d72a..58508c51ad 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_bfdconfigurations.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_bfdconfigurations.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: BFDConfigurationList
     plural: bfdconfigurations
     singular: bfdconfiguration
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_bgpconfigurations.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_bgpconfigurations.yaml
index a555861dbd..51f725b16d 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_bgpconfigurations.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_bgpconfigurations.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: BGPConfigurationList
     plural: bgpconfigurations
     singular: bgpconfiguration
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_bgpfilters.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_bgpfilters.yaml
index 102c9a5aa7..f78c2d13b1 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_bgpfilters.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_bgpfilters.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: BGPFilterList
     plural: bgpfilters
     singular: bgpfilter
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_bgppeers.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_bgppeers.yaml
index 1b70cb0318..af0adc7235 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_bgppeers.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_bgppeers.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: BGPPeerList
     plural: bgppeers
     singular: bgppeer
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_blockaffinities.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_blockaffinities.yaml
index e3a3faf635..16a8480670 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_blockaffinities.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_blockaffinities.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: BlockAffinityList
     plural: blockaffinities
     singular: blockaffinity
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_caliconodestatuses.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_caliconodestatuses.yaml
index 05b627f171..4f3ee58405 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_caliconodestatuses.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_caliconodestatuses.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: CalicoNodeStatusList
     plural: caliconodestatuses
     singular: caliconodestatus
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_clusterinformations.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_clusterinformations.yaml
index 8ceb6a8bfa..f7bff032a9 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_clusterinformations.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_clusterinformations.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: ClusterInformationList
     plural: clusterinformations
     singular: clusterinformation
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_deeppacketinspections.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_deeppacketinspections.yaml
index 34b6c300af..f29f99624b 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_deeppacketinspections.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_deeppacketinspections.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: DeepPacketInspectionList
     plural: deeppacketinspections
     singular: deeppacketinspection
-  preserveUnknownFields: false
   scope: Namespaced
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_egressgatewaypolicies.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_egressgatewaypolicies.yaml
index 1e9e5462c8..eb997b898c 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_egressgatewaypolicies.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_egressgatewaypolicies.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: EgressGatewayPolicyList
     plural: egressgatewaypolicies
     singular: egressgatewaypolicy
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_externalnetworks.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_externalnetworks.yaml
index 987f82f633..adc155ed0b 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_externalnetworks.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_externalnetworks.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: ExternalNetworkList
     plural: externalnetworks
     singular: externalnetwork
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_felixconfigurations.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_felixconfigurations.yaml
index cc05ab79b7..7e9996e066 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_felixconfigurations.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_felixconfigurations.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: FelixConfigurationList
     plural: felixconfigurations
     singular: felixconfiguration
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
@@ -1397,12 +1396,14 @@ spec:
                     - Disabled
                   type: string
                 istioDSCPMark:
+                  anyOf:
+                    - type: integer
+                    - type: string
                   description: |-
                     IstioDSCPMark sets the value to use when directing traffic to Istio ZTunnel, when Istio is enabled. The mark is set only on
                     SYN packets at the final hop to avoid interference with other protocols. This value is reserved by Calico and must not be used
                     with other Istio installation. [Default: 23]
                   pattern: ^.*
-                  type: integer
                   x-kubernetes-int-or-string: true
                 kubeMasqueradeBit:
                   description: |-
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_globalalerts.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_globalalerts.yaml
index 2bf83b8060..f2a03b345d 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_globalalerts.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_globalalerts.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: GlobalAlertList
     plural: globalalerts
     singular: globalalert
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_globalalerttemplates.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_globalalerttemplates.yaml
index 7f24a5b074..4e20d4eb2a 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_globalalerttemplates.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_globalalerttemplates.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: GlobalAlertTemplateList
     plural: globalalerttemplates
     singular: globalalerttemplate
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_globalnetworkpolicies.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_globalnetworkpolicies.yaml
index c4b9129a10..6ed943eaa1 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_globalnetworkpolicies.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_globalnetworkpolicies.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: GlobalNetworkPolicyList
     plural: globalnetworkpolicies
     singular: globalnetworkpolicy
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_globalnetworksets.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_globalnetworksets.yaml
index 472eaa6c3d..0e4f4bf011 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_globalnetworksets.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_globalnetworksets.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: GlobalNetworkSetList
     plural: globalnetworksets
     singular: globalnetworkset
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_globalreports.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_globalreports.yaml
index 53c7e53e23..7fe813ea75 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_globalreports.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_globalreports.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: GlobalReportList
     plural: globalreports
     singular: globalreport
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_globalreporttypes.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_globalreporttypes.yaml
index 04ecdae290..ba16596e02 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_globalreporttypes.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_globalreporttypes.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: GlobalReportTypeList
     plural: globalreporttypes
     singular: globalreporttype
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_globalthreatfeeds.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_globalthreatfeeds.yaml
index 6522f98f8c..95dd3d2d74 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_globalthreatfeeds.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_globalthreatfeeds.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: GlobalThreatFeedList
     plural: globalthreatfeeds
     singular: globalthreatfeed
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_hostendpoints.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_hostendpoints.yaml
index 375c82431a..83fc3c3a5d 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_hostendpoints.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_hostendpoints.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: HostEndpointList
     plural: hostendpoints
     singular: hostendpoint
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_ipamblocks.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_ipamblocks.yaml
index f6003b241c..018e1996ca 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_ipamblocks.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_ipamblocks.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: IPAMBlockList
     plural: ipamblocks
     singular: ipamblock
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
@@ -54,10 +53,8 @@ spec:
                     For non-nil entries at index i, the index is the ordinal of the allocation within this block
                     and the value is the index of the associated attributes in the Attributes array.
                   items:
-                    type: integer
-                    # TODO: This nullable is manually added in. We should update controller-gen
-                    # to handle []*int properly itself.
                     nullable: true
+                    type: integer
                   type: array
                 attributes:
                   description: |-
@@ -76,6 +73,13 @@ spec:
                       handle_id:
                         description: HandleID is the primary identifier for the allocation.
                         type: string
+                      releasedAt:
+                        description: |-
+                          ReleasedAt is the time this allocation was released, and is set during the allocation's
+                          "cooldown" phase. After `IPCooldownSeconds` have elapsed, the IP is deallocated (moved
+                          from `Allocated` to `Unallocated`).
+                        format: date-time
+                        type: string
                       secondary:
                         additionalProperties:
                           type: string
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_ipamconfigs.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_ipamconfigs.yaml
index 34185d9005..09bb2adf29 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_ipamconfigs.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_ipamconfigs.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: IPAMConfigList
     plural: ipamconfigs
     singular: ipamconfig
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
@@ -42,6 +41,14 @@ spec:
               properties:
                 autoAllocateBlocks:
                   type: boolean
+                ipCooldownSeconds:
+                  description: |-
+                    IPCooldownSeconds is the minimum age of a released IP in a block before it is re-used.
+                    If set to zero, IPs can be re-used immediately (but are still handled with a FIFO queue to
+                    minimize immediate reuse).
+                  maximum: 1200
+                  minimum: 0
+                  type: integer
                 kubeVirtVMAddressPersistence:
                   description: |-
                     KubeVirtVMAddressPersistence controls whether KubeVirt VirtualMachine workloads
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_ipamhandles.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_ipamhandles.yaml
index d80a2d2e5d..3816fd731d 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_ipamhandles.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_ipamhandles.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: IPAMHandleList
     plural: ipamhandles
     singular: ipamhandle
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_ippools.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_ippools.yaml
index df2abcd4da..7e6841bbfe 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_ippools.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_ippools.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: IPPoolList
     plural: ippools
     singular: ippool
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_ipreservations.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_ipreservations.yaml
index 22991934d4..1c69e562cb 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_ipreservations.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_ipreservations.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: IPReservationList
     plural: ipreservations
     singular: ipreservation
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_kubecontrollersconfigurations.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_kubecontrollersconfigurations.yaml
index 6da8f9f3b5..a10593fc03 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_kubecontrollersconfigurations.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_kubecontrollersconfigurations.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: KubeControllersConfigurationList
     plural: kubecontrollersconfigurations
     singular: kubecontrollersconfiguration
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_licensekeys.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_licensekeys.yaml
index db528be78a..6c5cd9a674 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_licensekeys.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_licensekeys.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: LicenseKeyList
     plural: licensekeys
     singular: licensekey
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_managedclusters.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_managedclusters.yaml
index 3d984f14b7..caf465ad75 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_managedclusters.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_managedclusters.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: ManagedClusterList
     plural: managedclusters
     singular: managedcluster
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - additionalPrinterColumns:
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_networkpolicies.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_networkpolicies.yaml
index b0ef3a86a0..f41d32ce73 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_networkpolicies.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_networkpolicies.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: NetworkPolicyList
     plural: networkpolicies
     singular: networkpolicy
-  preserveUnknownFields: false
   scope: Namespaced
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_networks.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_networks.yaml
index ac0aaea2cc..d3955d4fe0 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_networks.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_networks.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: NetworkList
     plural: networks
     singular: network
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_networksets.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_networksets.yaml
index e765f05954..bf6cb1abf6 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_networksets.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_networksets.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: NetworkSetList
     plural: networksets
     singular: networkset
-  preserveUnknownFields: false
   scope: Namespaced
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_packetcaptures.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_packetcaptures.yaml
index 75fcf1bb8a..0d3eb06136 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_packetcaptures.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_packetcaptures.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: PacketCaptureList
     plural: packetcaptures
     singular: packetcapture
-  preserveUnknownFields: false
   scope: Namespaced
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_policyrecommendationscopes.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_policyrecommendationscopes.yaml
index b33e1d7648..c4b3618296 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_policyrecommendationscopes.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_policyrecommendationscopes.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: PolicyRecommendationScopeList
     plural: policyrecommendationscopes
     singular: policyrecommendationscope
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_remoteclusterconfigurations.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_remoteclusterconfigurations.yaml
index 46be027547..f9e8d13123 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_remoteclusterconfigurations.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_remoteclusterconfigurations.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: RemoteClusterConfigurationList
     plural: remoteclusterconfigurations
     singular: remoteclusterconfiguration
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_securityeventwebhooks.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_securityeventwebhooks.yaml
index ba61ad2421..6b95748a3e 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_securityeventwebhooks.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_securityeventwebhooks.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: SecurityEventWebhookList
     plural: securityeventwebhooks
     singular: securityeventwebhook
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_stagedglobalnetworkpolicies.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_stagedglobalnetworkpolicies.yaml
index c305396091..7f4f787300 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_stagedglobalnetworkpolicies.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_stagedglobalnetworkpolicies.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: StagedGlobalNetworkPolicyList
     plural: stagedglobalnetworkpolicies
     singular: stagedglobalnetworkpolicy
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_stagedkubernetesnetworkpolicies.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_stagedkubernetesnetworkpolicies.yaml
index e5851adbd1..e6c0f7132f 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_stagedkubernetesnetworkpolicies.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_stagedkubernetesnetworkpolicies.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: StagedKubernetesNetworkPolicyList
     plural: stagedkubernetesnetworkpolicies
     singular: stagedkubernetesnetworkpolicy
-  preserveUnknownFields: false
   scope: Namespaced
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_stagednetworkpolicies.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_stagednetworkpolicies.yaml
index 2256961697..d054319f89 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_stagednetworkpolicies.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_stagednetworkpolicies.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: StagedNetworkPolicyList
     plural: stagednetworkpolicies
     singular: stagednetworkpolicy
-  preserveUnknownFields: false
   scope: Namespaced
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_tiers.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_tiers.yaml
index b2567ece66..deb3fbaa4f 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_tiers.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_tiers.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: TierList
     plural: tiers
     singular: tier
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_uisettings.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_uisettings.yaml
index c4af5edb46..e5f948e0d7 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_uisettings.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_uisettings.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: UISettingsList
     plural: uisettings
     singular: uisettings
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_uisettingsgroups.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_uisettingsgroups.yaml
index b1d6ce9970..01dabd70a5 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_uisettingsgroups.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_uisettingsgroups.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: UISettingsGroupList
     plural: uisettingsgroups
     singular: uisettingsgroup
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/usage.tigera.io_licenseusagereports.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/usage.tigera.io_licenseusagereports.yaml
index 59d3c0974b..264b8edec0 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/usage.tigera.io_licenseusagereports.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/usage.tigera.io_licenseusagereports.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: LicenseUsageReportList
     plural: licenseusagereports
     singular: licenseusagereport
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_alertexceptions.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_alertexceptions.yaml
index 1dcd44c189..f030d268dd 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_alertexceptions.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_alertexceptions.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: AlertExceptionList
     plural: alertexceptions
     singular: alertexception
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v3
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_bfdconfigurations.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_bfdconfigurations.yaml
index fb7629540b..f0265265fc 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_bfdconfigurations.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_bfdconfigurations.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: BFDConfigurationList
     plural: bfdconfigurations
     singular: bfdconfiguration
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v3
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_bgpconfigurations.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_bgpconfigurations.yaml
index 6a11cd0b79..37c52893a2 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_bgpconfigurations.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_bgpconfigurations.yaml
@@ -14,7 +14,6 @@ spec:
       - bgpconfig
       - bgpconfigs
     singular: bgpconfiguration
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v3
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_bgpfilters.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_bgpfilters.yaml
index f734bf8a5e..d57f10aebb 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_bgpfilters.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_bgpfilters.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: BGPFilterList
     plural: bgpfilters
     singular: bgpfilter
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v3
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_bgppeers.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_bgppeers.yaml
index 6d6436bb43..bf7c0ced63 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_bgppeers.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_bgppeers.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: BGPPeerList
     plural: bgppeers
     singular: bgppeer
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - additionalPrinterColumns:
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_blockaffinities.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_blockaffinities.yaml
index d95679581a..60e6e5f67e 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_blockaffinities.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_blockaffinities.yaml
@@ -14,7 +14,6 @@ spec:
       - affinity
       - affinities
     singular: blockaffinity
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - additionalPrinterColumns:
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_caliconodestatuses.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_caliconodestatuses.yaml
index d52d68e9f8..929ec8a9e4 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_caliconodestatuses.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_caliconodestatuses.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: CalicoNodeStatusList
     plural: caliconodestatuses
     singular: caliconodestatus
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - additionalPrinterColumns:
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_clusterinformations.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_clusterinformations.yaml
index 2e47062909..5507328ca0 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_clusterinformations.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_clusterinformations.yaml
@@ -14,7 +14,6 @@ spec:
       - clusterinfo
       - clusterinfos
     singular: clusterinformation
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - additionalPrinterColumns:
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_deeppacketinspections.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_deeppacketinspections.yaml
index a9afe9dd3b..ecf060fa00 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_deeppacketinspections.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_deeppacketinspections.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: DeepPacketInspectionList
     plural: deeppacketinspections
     singular: deeppacketinspection
-  preserveUnknownFields: false
   scope: Namespaced
   versions:
     - name: v3
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_egressgatewaypolicies.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_egressgatewaypolicies.yaml
index cae3c4ecbf..132963a214 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_egressgatewaypolicies.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_egressgatewaypolicies.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: EgressGatewayPolicyList
     plural: egressgatewaypolicies
     singular: egressgatewaypolicy
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v3
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_externalnetworks.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_externalnetworks.yaml
index 6ddc032b1d..796d321ccd 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_externalnetworks.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_externalnetworks.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: ExternalNetworkList
     plural: externalnetworks
     singular: externalnetwork
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v3
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_felixconfigurations.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_felixconfigurations.yaml
index 8a759548e1..627134ee57 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_felixconfigurations.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_felixconfigurations.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: FelixConfigurationList
     plural: felixconfigurations
     singular: felixconfiguration
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v3
@@ -1396,12 +1395,14 @@ spec:
                     - Disabled
                   type: string
                 istioDSCPMark:
+                  anyOf:
+                    - type: integer
+                    - type: string
                   description: |-
                     IstioDSCPMark sets the value to use when directing traffic to Istio ZTunnel, when Istio is enabled. The mark is set only on
                     SYN packets at the final hop to avoid interference with other protocols. This value is reserved by Calico and must not be used
                     with other Istio installation. [Default: 23]
                   pattern: ^.*
-                  type: integer
                   x-kubernetes-int-or-string: true
                 kubeMasqueradeBit:
                   description: |-
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_globalalerts.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_globalalerts.yaml
index 5583399d28..8b50489c30 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_globalalerts.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_globalalerts.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: GlobalAlertList
     plural: globalalerts
     singular: globalalert
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v3
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_globalalerttemplates.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_globalalerttemplates.yaml
index a449bbe2ee..578bc0fae3 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_globalalerttemplates.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_globalalerttemplates.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: GlobalAlertTemplateList
     plural: globalalerttemplates
     singular: globalalerttemplate
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v3
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_globalnetworkpolicies.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_globalnetworkpolicies.yaml
index b62610e3c8..00e4a609a5 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_globalnetworkpolicies.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_globalnetworkpolicies.yaml
@@ -14,7 +14,6 @@ spec:
       - gnp
       - cgnp
     singular: globalnetworkpolicy
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - additionalPrinterColumns:
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_globalnetworksets.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_globalnetworksets.yaml
index b43344cd3b..b7729ad2c4 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_globalnetworksets.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_globalnetworksets.yaml
@@ -13,7 +13,6 @@ spec:
     shortNames:
       - gns
     singular: globalnetworkset
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - additionalPrinterColumns:
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_globalreports.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_globalreports.yaml
index 355df8ebc9..24d0992507 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_globalreports.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_globalreports.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: GlobalReportList
     plural: globalreports
     singular: globalreport
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v3
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_globalreporttypes.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_globalreporttypes.yaml
index e4bcefbf8a..cc6e66aed6 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_globalreporttypes.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_globalreporttypes.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: GlobalReportTypeList
     plural: globalreporttypes
     singular: globalreporttype
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v3
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_globalthreatfeeds.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_globalthreatfeeds.yaml
index 19894b4a2e..0d11a78bda 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_globalthreatfeeds.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_globalthreatfeeds.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: GlobalThreatFeedList
     plural: globalthreatfeeds
     singular: globalthreatfeed
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v3
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_hostendpoints.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_hostendpoints.yaml
index 3f55368288..176a837703 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_hostendpoints.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_hostendpoints.yaml
@@ -14,7 +14,6 @@ spec:
       - hep
       - heps
     singular: hostendpoint
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - additionalPrinterColumns:
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_ipamblocks.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_ipamblocks.yaml
index d4bf6eb7cb..e7b4a5b293 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_ipamblocks.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_ipamblocks.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: IPAMBlockList
     plural: ipamblocks
     singular: ipamblock
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - additionalPrinterColumns:
@@ -69,10 +68,8 @@ spec:
                     For non-nil entries at index i, the index is the ordinal of the allocation within this block
                     and the value is the index of the associated attributes in the Attributes array.
                   items:
-                    type: integer
-                    # TODO: This nullable is manually added in. We should update controller-gen
-                    # to handle []*int properly itself.
                     nullable: true
+                    type: integer
                   type: array
                   x-kubernetes-list-type: atomic
                 attributes:
@@ -97,6 +94,13 @@ spec:
                           HandleID is the ID of the IPAM handle that owns
                           this allocation.
                         type: string
+                      releasedAt:
+                        description: |-
+                          ReleasedAt is the time this allocation was released, and is set during the allocation's
+                          "cooldown" phase. After `IPCooldownSeconds` have elapsed, the IP is deallocated (moved
+                          from `Allocated` to `Unallocated`).
+                        format: date-time
+                        type: string
                       secondary:
                         additionalProperties:
                           type: string
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_ipamconfigurations.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_ipamconfigurations.yaml
index e8505eff59..2eac4f5baf 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_ipamconfigurations.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_ipamconfigurations.yaml
@@ -14,7 +14,6 @@ spec:
       - ipamconfig
       - ipamconfigs
     singular: ipamconfiguration
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - additionalPrinterColumns:
@@ -63,6 +62,15 @@ spec:
                   default: true
                   description: Whether or not to auto allocate blocks to hosts.
                   type: boolean
+                ipCooldownSeconds:
+                  description: |-
+                    IPCooldownSeconds is the minimum age of a released IP in a block before it is re-used.
+                    If set to zero, IPs can be re-used immediately (but are still handled with a FIFO queue to
+                    minimize immediate reuse).
+                  format: int32
+                  maximum: 1200
+                  minimum: 0
+                  type: integer
                 kubeVirtVMAddressPersistence:
                   description: |-
                     KubeVirtVMAddressPersistence controls whether KubeVirt VirtualMachine workloads
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_ipamhandles.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_ipamhandles.yaml
index b1b75eae59..0e77395a85 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_ipamhandles.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_ipamhandles.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: IPAMHandleList
     plural: ipamhandles
     singular: ipamhandle
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - additionalPrinterColumns:
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_ippools.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_ippools.yaml
index e9bfd125c7..3832d23b80 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_ippools.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_ippools.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: IPPoolList
     plural: ippools
     singular: ippool
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - additionalPrinterColumns:
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_ipreservations.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_ipreservations.yaml
index dc522cdd8a..e4d2af0a7f 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_ipreservations.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_ipreservations.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: IPReservationList
     plural: ipreservations
     singular: ipreservation
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v3
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_kubecontrollersconfigurations.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_kubecontrollersconfigurations.yaml
index e523fb35e3..a589e445cc 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_kubecontrollersconfigurations.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_kubecontrollersconfigurations.yaml
@@ -14,7 +14,6 @@ spec:
       - kcc
       - kccs
     singular: kubecontrollersconfiguration
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v3
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_licensekeys.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_licensekeys.yaml
index c93478b44a..6bec97f908 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_licensekeys.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_licensekeys.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: LicenseKeyList
     plural: licensekeys
     singular: licensekey
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - additionalPrinterColumns:
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_managedclusters.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_managedclusters.yaml
index c6f1590fcd..d6a4f95a28 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_managedclusters.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_managedclusters.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: ManagedClusterList
     plural: managedclusters
     singular: managedcluster
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - additionalPrinterColumns:
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_networkpolicies.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_networkpolicies.yaml
index e6600678d1..9a594dbde9 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_networkpolicies.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_networkpolicies.yaml
@@ -14,7 +14,6 @@ spec:
       - cnp
       - caliconetworkpolicy
     singular: networkpolicy
-  preserveUnknownFields: false
   scope: Namespaced
   versions:
     - additionalPrinterColumns:
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_networks.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_networks.yaml
index 7e2846d2a5..993faf23ca 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_networks.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_networks.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: NetworkList
     plural: networks
     singular: network
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v3
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_networksets.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_networksets.yaml
index f5935ce086..5a277a87ef 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_networksets.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_networksets.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: NetworkSetList
     plural: networksets
     singular: networkset
-  preserveUnknownFields: false
   scope: Namespaced
   versions:
     - name: v3
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_packetcaptures.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_packetcaptures.yaml
index d36ec49f0b..5752af9de5 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_packetcaptures.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_packetcaptures.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: PacketCaptureList
     plural: packetcaptures
     singular: packetcapture
-  preserveUnknownFields: false
   scope: Namespaced
   versions:
     - name: v3
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_policyrecommendationscopes.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_policyrecommendationscopes.yaml
index cbe38ad4a7..171b407330 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_policyrecommendationscopes.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_policyrecommendationscopes.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: PolicyRecommendationScopeList
     plural: policyrecommendationscopes
     singular: policyrecommendationscope
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v3
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_remoteclusterconfigurations.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_remoteclusterconfigurations.yaml
index 6198011dad..967e852e23 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_remoteclusterconfigurations.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_remoteclusterconfigurations.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: RemoteClusterConfigurationList
     plural: remoteclusterconfigurations
     singular: remoteclusterconfiguration
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v3
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_securityeventwebhooks.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_securityeventwebhooks.yaml
index b701e292b7..b7927f9bf9 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_securityeventwebhooks.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_securityeventwebhooks.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: SecurityEventWebhookList
     plural: securityeventwebhooks
     singular: securityeventwebhook
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v3
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_stagedglobalnetworkpolicies.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_stagedglobalnetworkpolicies.yaml
index 4df3ca5956..412897d1d0 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_stagedglobalnetworkpolicies.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_stagedglobalnetworkpolicies.yaml
@@ -13,7 +13,6 @@ spec:
     shortNames:
       - sgnp
     singular: stagedglobalnetworkpolicy
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - additionalPrinterColumns:
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_stagedkubernetesnetworkpolicies.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_stagedkubernetesnetworkpolicies.yaml
index 5381cfa7fd..2b21474b9f 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_stagedkubernetesnetworkpolicies.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_stagedkubernetesnetworkpolicies.yaml
@@ -13,7 +13,6 @@ spec:
     shortNames:
       - sknp
     singular: stagedkubernetesnetworkpolicy
-  preserveUnknownFields: false
   scope: Namespaced
   versions:
     - name: v3
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_stagednetworkpolicies.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_stagednetworkpolicies.yaml
index 7147c2d0e9..a879ffb2cf 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_stagednetworkpolicies.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_stagednetworkpolicies.yaml
@@ -14,7 +14,6 @@ spec:
       - scnp
       - snp
     singular: stagednetworkpolicy
-  preserveUnknownFields: false
   scope: Namespaced
   versions:
     - additionalPrinterColumns:
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_tiers.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_tiers.yaml
index 0136cb1c95..abd4aeabc9 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_tiers.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_tiers.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: TierList
     plural: tiers
     singular: tier
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - additionalPrinterColumns:
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_uisettings.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_uisettings.yaml
index d78c5049a0..405bb43188 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_uisettings.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_uisettings.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: UISettingsList
     plural: uisettings
     singular: uisettings
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v3
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_uisettingsgroups.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_uisettingsgroups.yaml
index 5027068e9b..e9eaaacc6e 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_uisettingsgroups.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_uisettingsgroups.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: UISettingsGroupList
     plural: uisettingsgroups
     singular: uisettingsgroup
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v3
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/usage.tigera.io_licenseusagereports.yaml b/pkg/imports/crds/enterprise/v3.projectcalico.org/usage.tigera.io_licenseusagereports.yaml
index 59d3c0974b..264b8edec0 100644
--- a/pkg/imports/crds/enterprise/v3.projectcalico.org/usage.tigera.io_licenseusagereports.yaml
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/usage.tigera.io_licenseusagereports.yaml
@@ -11,7 +11,6 @@ spec:
     listKind: LicenseUsageReportList
     plural: licenseusagereports
     singular: licenseusagereport
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1
diff --git a/pkg/imports/crds/operator/operator.tigera.io_managers.yaml b/pkg/imports/crds/operator/operator.tigera.io_managers.yaml
index 5e77333404..66c1345bf4 100644
--- a/pkg/imports/crds/operator/operator.tigera.io_managers.yaml
+++ b/pkg/imports/crds/operator/operator.tigera.io_managers.yaml
@@ -298,6 +298,18 @@ spec:
                           type: object
                       type: object
                   type: object
+                rbacUI:
+                  description: RBACUI configures the RBAC management UI feature.
+                  properties:
+                    state:
+                      description:
+                        State turns the RBAC management UI on or off. Defaults
+                        to Disabled.
+                      enum:
+                        - Enabled
+                        - Disabled
+                      type: string
+                  type: object
               type: object
             status:
               description: Most recently observed state for the Calico Enterprise manager.
diff --git a/pkg/render/apiserver.go b/pkg/render/apiserver.go
index 5be75e7ebd..1d7e6ff4b6 100644
--- a/pkg/render/apiserver.go
+++ b/pkg/render/apiserver.go
@@ -143,6 +143,10 @@ type APIServerConfiguration struct {
 	KubernetesVersion            *common.VersionInfo
 	ClusterDomain                string
 
+	// RBACManagementEnabled gates the RBAC management UI permissions on
+	// tigera-network-admin.
+	RBACManagementEnabled bool
+
 	// Whether or not we should run the aggregation API server for projectcalico.org/v3 APIs
 	// as part of this component.
 	RequiresAggregationServer bool
@@ -2056,6 +2060,25 @@ func (c *apiServerComponent) tigeraNetworkAdminClusterRole() *rbacv1.ClusterRole
 		},
 	}
 
+	// Role/binding access for the RBAC management UI. ui-apis writes these
+	// impersonating the caller, so the apiserver enforces escalation against the
+	// user's own permissions. The UI reads the role catalogue and manages group
+	// membership through both cluster- and namespace-scoped bindings.
+	if c.cfg.RBACManagementEnabled {
+		rules = append(rules,
+			rbacv1.PolicyRule{
+				APIGroups: []string{"rbac.authorization.k8s.io"},
+				Resources: []string{"clusterroles", "roles"},
+				Verbs:     []string{"get", "list", "watch"},
+			},
+			rbacv1.PolicyRule{
+				APIGroups: []string{"rbac.authorization.k8s.io"},
+				Resources: []string{"clusterrolebindings", "rolebindings"},
+				Verbs:     []string{"get", "list", "watch", "create", "update", "delete"},
+			},
+		)
+	}
+
 	// Privileges for lma.tigera.io have no effect on managed clusters.
 	if c.cfg.ManagementClusterConnection == nil {
 		// Access to flow logs, audit logs, and statistics.
diff --git a/pkg/render/apiserver_test.go b/pkg/render/apiserver_test.go
index 9878c7ed1b..d53aba7cfd 100644
--- a/pkg/render/apiserver_test.go
+++ b/pkg/render/apiserver_test.go
@@ -384,6 +384,29 @@ var _ = Describe("API server rendering tests (Calico Enterprise)", func() {
 		Entry("custom cluster domain", "custom-domain.internal"),
 	)
 
+	It("should gate the RBAC management UI rule on RBACManagementEnabled", func() {
+		// Disabled (default): tigera-network-admin must not carry the
+		// escalation-capable RBAC management rule.
+		component, err := render.APIServer(cfg)
+		Expect(err).NotTo(HaveOccurred())
+		resources, _ := component.Objects()
+		clusterRole := rtest.GetResource(resources, "tigera-network-admin", "", "rbac.authorization.k8s.io", "v1", "ClusterRole").(*rbacv1.ClusterRole)
+		for _, rule := range rbacManagementNetworkAdminRules {
+			Expect(clusterRole.Rules).NotTo(ContainElement(rule))
+		}
+
+		// Enabled: the rules are appended.
+		cfg.RBACManagementEnabled = true
+		component, err = render.APIServer(cfg)
+		Expect(err).NotTo(HaveOccurred())
+		resources, _ = component.Objects()
+		clusterRole = rtest.GetResource(resources, "tigera-network-admin", "", "rbac.authorization.k8s.io", "v1", "ClusterRole").(*rbacv1.ClusterRole)
+		for _, rule := range rbacManagementNetworkAdminRules {
+			Expect(clusterRole.Rules).To(ContainElement(rule))
+		}
+		Expect(clusterRole.Rules).To(ConsistOf(append(networkAdminPolicyRules, rbacManagementNetworkAdminRules...)))
+	})
+
 	It("should render resources without an aggregation server", func() {
 		cfg.RequiresAggregationServer = false
 
@@ -1914,6 +1937,22 @@ var (
 			Verbs:         []string{"patch"},
 		},
 	}
+
+	// rbacManagementNetworkAdminRules are the extra tigera-network-admin rules
+	// added when rbac.ui is Enabled. See tigeraNetworkAdminClusterRole for the
+	// rationale behind the verb set.
+	rbacManagementNetworkAdminRules = []rbacv1.PolicyRule{
+		{
+			APIGroups: []string{"rbac.authorization.k8s.io"},
+			Resources: []string{"clusterroles", "roles"},
+			Verbs:     []string{"get", "list", "watch"},
+		},
+		{
+			APIGroups: []string{"rbac.authorization.k8s.io"},
+			Resources: []string{"clusterrolebindings", "rolebindings"},
+			Verbs:     []string{"get", "list", "watch", "create", "update", "delete"},
+		},
+	}
 )
 
 var _ = Describe("API server rendering tests (Calico)", func() {
diff --git a/pkg/render/kubecontrollers/kube-controllers.go b/pkg/render/kubecontrollers/kube-controllers.go
index 1f592f8358..b8cb885045 100644
--- a/pkg/render/kubecontrollers/kube-controllers.go
+++ b/pkg/render/kubecontrollers/kube-controllers.go
@@ -150,6 +150,10 @@ type KubeControllersConfiguration struct {
 	// caBundle so the apiserver can verify the in-process webhook endpoint.
 	// Only consulted when WAFGatewayExtensionEnabled is true.
 	WAFWebhookCABundle []byte
+
+	// RBACManagementEnabled mirrors Manager.spec.rbacUI.state and gates the
+	// rbacsync controller in calico-kube-controllers.
+	RBACManagementEnabled bool
 }
 
 func NewCalicoKubeControllersPolicy(cfg *KubeControllersConfiguration, defaultDeny *v3.NetworkPolicy) render.Component {
@@ -200,6 +204,13 @@ func NewCalicoKubeControllers(cfg *KubeControllersConfiguration) *kubeController
 		if cfg.WAFGatewayExtensionEnabled {
 			enabledControllers = append(enabledControllers, "applicationlayer")
 		}
+
+		// Runs the rbacsync controller to reconcile managed ClusterRoles and
+		// bindings against the tigera-idp-groups ConfigMap.
+		if cfg.RBACManagementEnabled {
+			enabledControllers = append(enabledControllers, "rbacsync")
+			kubeControllerRolePolicyRules = append(kubeControllerRolePolicyRules, rbacSyncControllerRules()...)
+		}
 	}
 
 	return &kubeControllersComponent{
@@ -330,6 +341,9 @@ func (c *kubeControllersComponent) Objects() ([]client.Object, []client.Object)
 		c.controllersClusterRoleBinding(),
 	)
 	objectsToCreate = append(objectsToCreate, c.managedClusterRoleBindings()...)
+	if c.cfg.RBACManagementEnabled {
+		objectsToCreate = append(objectsToCreate, c.rbacSyncIDPGroupsRole()...)
+	}
 
 	if len(c.enabledControllers) > 0 {
 		// There's something to run, so create the deployment.
@@ -658,6 +672,229 @@ func kubeControllersRoleEnterpriseCommonRules(cfg *KubeControllersConfiguration)
 	return rules
 }
 
+// rbacSyncIDPGroupsRole returns the Role + RoleBinding that grants rbacsync
+// read access to the tigera-idp-groups ConfigMap in calico-system, its only
+// namespaced dependency.
+func (c *kubeControllersComponent) rbacSyncIDPGroupsRole() []client.Object {
+	name := "calico-kube-controllers-rbac-sync"
+	return []client.Object{
+		&rbacv1.Role{
+			TypeMeta:   metav1.TypeMeta{Kind: "Role", APIVersion: "rbac.authorization.k8s.io/v1"},
+			ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: common.CalicoNamespace},
+			Rules: []rbacv1.PolicyRule{
+				{
+					APIGroups:     []string{""},
+					Resources:     []string{"configmaps"},
+					ResourceNames: []string{"tigera-idp-groups"},
+					Verbs:         []string{"get", "list", "watch"},
+				},
+			},
+		},
+		&rbacv1.RoleBinding{
+			TypeMeta:   metav1.TypeMeta{Kind: "RoleBinding", APIVersion: "rbac.authorization.k8s.io/v1"},
+			ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: common.CalicoNamespace},
+			RoleRef: rbacv1.RoleRef{
+				APIGroup: "rbac.authorization.k8s.io",
+				Kind:     "Role",
+				Name:     name,
+			},
+			Subjects: []rbacv1.Subject{
+				{
+					Kind:      "ServiceAccount",
+					Name:      c.kubeControllerServiceAccountName,
+					Namespace: c.cfg.Namespace,
+				},
+			},
+		},
+	}
+}
+
+// rbacSyncControllerRules returns the cluster-scoped rules the rbacsync
+// controller holds. The controller reconciles the ClusterRoles that back the
+// Manager UI's RBAC management feature, and each rule below lets it manage the
+// access one Calico Enterprise UI feature (and its view or modify state)
+// requires. The controller runs only when RBAC management is enabled.
+//
+// Under Kubernetes' privilege-escalation guard the controller can only grant
+// permissions it already holds, so each rule mirrors a grant made by one of the
+// managed calico-ui-* ClusterRoles the rbacsync controller generates in
+// calico-private (kube-controllers/pkg/controllers/rbacsync: resourceroles.go
+// defines the calico-ui-<feature>-{view,mod} and calico-ui-logs-view-* roles,
+// tierroles.go the calico-ui-{np,gnp}-{view,mod}-<tier> and calico-ui-cluster-
+// context roles). The comment on each rule names the managed role(s) it covers.
+//
+// Only the grants unique to the managed roles live here. Core resources those
+// roles also grant (namespaces, nodes, services, pods, clusterinformations,
+// hostendpoints, serviceaccounts, tiers) are already held by the common
+// kube-controllers rules above, which satisfy the escalation guard for them.
+func rbacSyncControllerRules() []rbacv1.PolicyRule {
+	return []rbacv1.PolicyRule{
+		// RBAC management: the ClusterRoles and bindings the controller
+		// reconciles for the feature. Not a mirrored grant — this is the
+		// controller's own reconcile target for every managed calico-ui-* role.
+		{
+			APIGroups: []string{"rbac.authorization.k8s.io"},
+			Resources: []string{"clusterroles", "clusterrolebindings", "rolebindings"},
+			Verbs:     []string{"get", "list", "watch", "create", "update", "patch", "delete"},
+		},
+		// Network Policy tiers, view and modify: the per-tier and all-tiers
+		// Policies and Global Policies roles cover the tiers and tier-scoped
+		// (tier.*) policy resources. The plain networkpolicies and
+		// stagednetworkpolicies come from Policy Recommendations, which
+		// references them directly. Mirrors calico-ui-{np,gnp}-{view,mod}-<tier>
+		// (and -all), calico-ui-get-tier-* and calico-ui-policy-recommendations-
+		// {view,mod}.
+		{
+			APIGroups: []string{"projectcalico.org"},
+			Resources: []string{
+				"tiers",
+				"tier.networkpolicies",
+				"tier.stagednetworkpolicies",
+				"tier.globalnetworkpolicies",
+				"tier.stagedglobalnetworkpolicies",
+				"stagedkubernetesnetworkpolicies",
+				"networkpolicies",
+				"stagednetworkpolicies",
+			},
+			Verbs: []string{"get", "list", "watch", "create", "update", "patch", "delete"},
+		},
+		// Network Policy tiers, view and modify: Kubernetes network policies
+		// within a tier. Mirrors calico-ui-np-{view,mod}-<tier> (and -all).
+		{
+			APIGroups: []string{"networking.k8s.io"},
+			Resources: []string{"networkpolicies"},
+			Verbs:     []string{"get", "list", "watch", "create", "update", "patch", "delete"},
+		},
+		// The per-feature pages, view and modify: Dashboards, Managed Clusters,
+		// Global Network Sets, Network Sets, Policy Recommendations, Packet
+		// Captures, Alerts and Security Events, Threat Feeds, Compliance
+		// Reports, Webhooks, Deep Packet Inspection, and Egress Gateways.
+		// Mirrors the matching calico-ui-<feature>-{view,mod} roles
+		// (e.g. calico-ui-managed-clusters-{view,mod}, calico-ui-alerts-
+		// {view,mod}, calico-ui-egress-gateways-{view,mod}).
+		{
+			APIGroups: []string{"projectcalico.org"},
+			Resources: []string{
+				"uisettings",
+				"uisettingsgroups",
+				"globalnetworksets",
+				"networksets",
+				"managedclusters",
+				"policyrecommendationscopes",
+				"policyrecommendationscopes/status",
+				"deeppacketinspections",
+				"deeppacketinspections/status",
+				"egressgatewaypolicies",
+				"externalnetworks",
+				"globalalerts",
+				"globalalerts/status",
+				"globalalerttemplates",
+				"alertexceptions",
+				"globalthreatfeeds",
+				"globalthreatfeeds/status",
+				"globalreports",
+				"globalreports/status",
+				"globalreporttypes",
+				"packetcaptures",
+				"packetcaptures/files",
+				"securityeventwebhooks",
+			},
+			Verbs: []string{"get", "list", "watch", "create", "update", "patch", "delete"},
+		},
+		// Dashboards, view and modify: the cluster-settings and user-settings
+		// dashboard layouts stored on the UISettingsGroups data subresource.
+		// Mirrors calico-ui-dashboards-{view,mod}.
+		{
+			APIGroups: []string{"projectcalico.org"},
+			Resources: []string{"uisettingsgroups/data"},
+			Verbs:     []string{"get", "list", "watch", "create", "update", "patch", "delete"},
+		},
+		// Manager UI load: the authorization self-check the UI runs on load.
+		// Packet Captures: authenticating a capture-file download. Mirrors the
+		// authorizationreviews grant on calico-ui-cluster-context and the
+		// authenticationreviews grant on calico-ui-packet-captures-{view,mod}.
+		{
+			APIGroups: []string{"projectcalico.org"},
+			Resources: []string{"authorizationreviews", "authenticationreviews"},
+			Verbs:     []string{"create"},
+		},
+		// Manager UI load: Felix configuration read for cluster-wide settings.
+		// Mirrors calico-ui-cluster-context.
+		{
+			APIGroups: []string{"projectcalico.org"},
+			Resources: []string{"felixconfigurations"},
+			Verbs:     []string{"get", "list", "watch"},
+		},
+		// Webhooks, modify: creating and updating the Secret that stores the
+		// webhook credentials. Mirrors calico-ui-webhooks-mod.
+		{
+			APIGroups: []string{""},
+			Resources: []string{"secrets"},
+			Verbs:     []string{"create"},
+		},
+		{
+			APIGroups:     []string{""},
+			Resources:     []string{"secrets"},
+			ResourceNames: []string{"webhooks-secret"},
+			Verbs:         []string{"patch"},
+		},
+		// Logs, view: Flow, DNS, Audit, L7, and Events log access, per managed
+		// cluster and for the management cluster. Mirrors calico-ui-logs-view-*
+		// (all/audit/dns/events/flows/l7, plus their per-cluster and
+		// all-clusters variants).
+		{
+			APIGroups: []string{"lma.tigera.io"},
+			Resources: []string{"cluster"},
+			Verbs:     []string{"get"},
+		},
+		// Manager UI load: the Compliance feature-enabled check. Mirrors the
+		// unscoped compliances grant on calico-ui-cluster-context. (The
+		// calico-ui-compliance-reports-{view,mod} roles also read compliances
+		// but scope it to the tigera-secure CR; this rule must stay unscoped to
+		// cover cluster-context, whose feature check is not resource-scoped.)
+		{
+			APIGroups: []string{"operator.tigera.io"},
+			Resources: []string{"compliances"},
+			Verbs:     []string{"get"},
+		},
+		// Manager UI load: feature-enabled checks for Application Layer / WAF,
+		// Packet Capture, and Intrusion Detection. Mirrors calico-ui-cluster-
+		// context (which bundles the compliances check above into the same rule).
+		{
+			APIGroups: []string{"operator.tigera.io"},
+			Resources: []string{"applicationlayers", "packetcaptureapis", "intrusiondetections"},
+			Verbs:     []string{"get"},
+		},
+		// Global Network Sets and Network Sets, view and modify: listing the
+		// pods a network set selects. Mirrors the pods grant on calico-ui-
+		// {global-network-sets,network-sets}-{view,mod} and calico-ui-service-
+		// graph-{view,mod}. (The common kube-controllers rules above already
+		// grant pods get/list/watch for IPAM GC, so this is also covered there.)
+		{
+			APIGroups: []string{""},
+			Resources: []string{"pods"},
+			Verbs:     []string{"list"},
+		},
+		// Service Graph: the service accounts the flow view references. The only
+		// managed role granting serviceaccounts, so mirrors calico-ui-service-
+		// graph-{view,mod}. (That role also grants services, namespaces and
+		// hostendpoints, all covered by the common kube-controllers rules above.)
+		{
+			APIGroups: []string{""},
+			Resources: []string{"serviceaccounts"},
+			Verbs:     []string{"get", "list"},
+		},
+		// Manager UI load: the statistics proxy to the Calico API server and
+		// the node Prometheus. Mirrors calico-ui-cluster-context.
+		{
+			APIGroups:     []string{""},
+			Resources:     []string{"services/proxy"},
+			ResourceNames: []string{"https:calico-api:8080", "calico-node-prometheus:9090"},
+			Verbs:         []string{"get", "create"},
+		},
+	}
+}
+
 func (c *kubeControllersComponent) controllersServiceAccount() *corev1.ServiceAccount {
 	return &corev1.ServiceAccount{
 		TypeMeta: metav1.TypeMeta{Kind: "ServiceAccount", APIVersion: "v1"},
diff --git a/pkg/render/kubecontrollers/kube-controllers_test.go b/pkg/render/kubecontrollers/kube-controllers_test.go
index 9f30802d99..0d6bab72d9 100644
--- a/pkg/render/kubecontrollers/kube-controllers_test.go
+++ b/pkg/render/kubecontrollers/kube-controllers_test.go
@@ -428,6 +428,47 @@ var _ = Describe("kube-controllers rendering tests", func() {
 		}
 	})
 
+	Context("RBAC management UI gate", func() {
+		BeforeEach(func() {
+			instance.Variant = operatorv1.CalicoEnterprise
+		})
+
+		It("does not enable rbacsync when RBACManagementEnabled is false", func() {
+			component := kubecontrollers.NewCalicoKubeControllers(&cfg)
+			Expect(component.ResolveImages(nil)).To(BeNil())
+			resources, _ := component.Objects()
+
+			dp := rtest.GetResource(resources, kubecontrollers.KubeController, common.CalicoNamespace, "apps", "v1", "Deployment").(*appsv1.Deployment)
+			envs := dp.Spec.Template.Spec.Containers[0].Env
+			Expect(envs).To(ContainElement(corev1.EnvVar{
+				Name: "ENABLED_CONTROLLERS", Value: "node,loadbalancer,service,federatedservices,usage",
+			}))
+
+			Expect(rtest.GetResource(resources, "calico-kube-controllers-rbac-sync", common.CalicoNamespace, "rbac.authorization.k8s.io", "v1", "Role")).To(BeNil())
+		})
+
+		It("enables rbacsync and adds the controller's RBAC when RBACManagementEnabled is true", func() {
+			cfg.RBACManagementEnabled = true
+			component := kubecontrollers.NewCalicoKubeControllers(&cfg)
+			Expect(component.ResolveImages(nil)).To(BeNil())
+			resources, _ := component.Objects()
+
+			dp := rtest.GetResource(resources, kubecontrollers.KubeController, common.CalicoNamespace, "apps", "v1", "Deployment").(*appsv1.Deployment)
+			envs := dp.Spec.Template.Spec.Containers[0].Env
+			Expect(envs).To(ContainElement(corev1.EnvVar{
+				Name: "ENABLED_CONTROLLERS", Value: "node,loadbalancer,service,federatedservices,usage,rbacsync",
+			}))
+
+			nsRole := rtest.GetResource(resources, "calico-kube-controllers-rbac-sync", common.CalicoNamespace, "rbac.authorization.k8s.io", "v1", "Role").(*rbacv1.Role)
+			Expect(nsRole.Rules).To(ContainElement(rbacv1.PolicyRule{
+				APIGroups:     []string{""},
+				Resources:     []string{"configmaps"},
+				ResourceNames: []string{"tigera-idp-groups"},
+				Verbs:         []string{"get", "list", "watch"},
+			}), "expected read-only access to tigera-idp-groups in calico-system")
+		})
+	})
+
 	It("should render all es-calico-kube-controllers resources for a default configuration (standalone) using CalicoEnterprise when logstorage and secrets exist", func() {
 		expectedResources := []struct {
 			name    string
diff --git a/pkg/render/manager.go b/pkg/render/manager.go
index 765918beb3..d634e22478 100644
--- a/pkg/render/manager.go
+++ b/pkg/render/manager.go
@@ -17,6 +17,7 @@ package render
 import (
 	"crypto/x509"
 	"fmt"
+	"net"
 	"strconv"
 	"strings"
 
@@ -77,6 +78,11 @@ const (
 	ManagerPolicyName            = networkpolicy.CalicoComponentPolicyPrefix + "manager-access"
 	ManagerPortName              = "https"
 
+	// RBACManagementLDAPConfigSecretName is the RBAC-UI LDAP directory-sync config
+	// Secret (calico-system) the rbacsync process reads to perform the sync.
+	// Keep in sync with ui-apis rbacmanagement/idp LDAPConfigSecretName.
+	RBACManagementLDAPConfigSecretName = "tigera-idp-ldap-config"
+
 	// The name of the TLS certificate used by Voltron to authenticate connections from managed
 	// cluster clients talking to Linseed.
 	VoltronLinseedTLS              = "calico-voltron-linseed-tls"
@@ -211,8 +217,9 @@ type ManagerConfiguration struct {
 	Tenant          *operatorv1.Tenant
 	ExternalElastic bool
 
-	Manager       *operatorv1.Manager
-	KibanaEnabled bool
+	Manager        *operatorv1.Manager
+	Authentication *operatorv1.Authentication
+	KibanaEnabled  bool
 
 	// CACertCommonName is the CommonName from the CA certificate used for operator-managed certificates.
 	// Passed to Voltron so it can identify the correct CA issuer public key.
@@ -277,10 +284,13 @@ func (c *managerComponent) Objects() ([]client.Object, []client.Object) {
 
 	objsToCreate = append(objsToCreate,
 		managerClusterRoleBinding(c.cfg.Tenant, c.cfg.BindingNamespaces, c.cfg.OSSTenantNamespaces),
-		managerClusterRole(false, c.cfg.Installation.KubernetesProvider, c.cfg.Tenant),
+		managerClusterRole(false, c.cfg.Installation.KubernetesProvider, c.cfg.Tenant, c.cfg.Manager.RBACManagementEnabled()),
 		c.managedClustersWatchRoleBinding(),
 	)
 	objsToCreate = append(objsToCreate, c.managedClustersUpdateRBAC()...)
+	if c.cfg.Manager.RBACManagementEnabled() && !c.cfg.Tenant.MultiTenant() {
+		objsToCreate = append(objsToCreate, c.rbacManagementUINamespacedRole()...)
+	}
 	if c.cfg.Tenant.MultiTenant() {
 		objsToCreate = append(objsToCreate, c.multiTenantManagedClustersAccess()...)
 	}
@@ -746,6 +756,7 @@ func (c *managerComponent) managerUIAPIsContainer() corev1.Container {
 		{Name: "LINSEED_CLIENT_KEY", Value: keyPath},
 		{Name: "ELASTIC_KIBANA_DISABLED", Value: strconv.FormatBool(c.cfg.Tenant.MultiTenant())},
 		{Name: "VOLTRON_URL", Value: ManagerService(c.cfg.Tenant)},
+		{Name: "RBAC_UI_ENABLED", Value: strconv.FormatBool(c.cfg.Manager.RBACManagementEnabled() && !c.cfg.Tenant.MultiTenant())},
 	}
 
 	// Determine the Linseed location. Use code default unless in multi-tenant mode,
@@ -955,7 +966,8 @@ func (c *managerComponent) managedClustersUpdateRBAC() []client.Object {
 }
 
 // managerClusterRole returns a clusterrole that allows authn/authz review requests.
-func managerClusterRole(managedCluster bool, kubernetesProvider operatorv1.Provider, tenant *operatorv1.Tenant) *rbacv1.ClusterRole {
+// When rbacManagementEnabled is true it also carries the RBAC management UI rules.
+func managerClusterRole(managedCluster bool, kubernetesProvider operatorv1.Provider, tenant *operatorv1.Tenant, rbacManagementEnabled bool) *rbacv1.ClusterRole {
 	// Different tenant types use different permission sets.
 	name := ManagerClusterRole
 	if tenant.ManagedClusterIsCalico() {
@@ -1161,6 +1173,13 @@ func managerClusterRole(managedCluster bool, kubernetesProvider operatorv1.Provi
 		},
 	}
 
+	// Not rendered on multi-tenant management clusters. Keep this condition in
+	// sync with the rbacManagementUINamespacedRole gate; the cluster rules and
+	// the namespaced grant are rendered together.
+	if rbacManagementEnabled && !tenant.MultiTenant() {
+		cr.Rules = append(cr.Rules, rbacManagementUIRules()...)
+	}
+
 	if tenant.MultiTenant() {
 		cr.Rules = append(cr.Rules,
 			rbacv1.PolicyRule{
@@ -1195,6 +1214,72 @@ func managerClusterRole(managedCluster bool, kubernetesProvider operatorv1.Provi
 	return cr
 }
 
+// rbacManagementUIRules returns the cluster-scoped rules the RBAC management
+// UI adds to calico-manager-role. Named-resource access is scoped separately
+// on rbacManagementUINamespacedRole.
+func rbacManagementUIRules() []rbacv1.PolicyRule {
+	return []rbacv1.PolicyRule{
+		{
+			// Lets ui-apis read the Compliance CR (the operator singleton) so the
+			// UI can tell whether compliance is installed before offering
+			// compliance-scoped RBAC.
+			APIGroups: []string{"operator.tigera.io"},
+			Resources: []string{"compliances"},
+			Verbs:     []string{"get"},
+		},
+	}
+}
+
+// rbacManagementUINamespacedRole returns the Role + RoleBinding that scopes
+// the RBAC management UI's Secret/ConfigMap access to calico-system, where
+// tigera-idp-groups and tigera-idp-ldap-config live.
+func (c *managerComponent) rbacManagementUINamespacedRole() []client.Object {
+	return []client.Object{
+		&rbacv1.Role{
+			TypeMeta:   metav1.TypeMeta{Kind: "Role", APIVersion: "rbac.authorization.k8s.io/v1"},
+			ObjectMeta: metav1.ObjectMeta{Name: ManagerClusterRole, Namespace: common.CalicoNamespace},
+			Rules: []rbacv1.PolicyRule{
+				{
+					// create carries the object name in the request body, not the
+					// URL path, so RBAC cannot restrict it by resource name; it is
+					// scoped to this namespace instead.
+					APIGroups: []string{""},
+					Resources: []string{"configmaps", "secrets"},
+					Verbs:     []string{"create"},
+				},
+				{
+					APIGroups:     []string{""},
+					Resources:     []string{"secrets"},
+					ResourceNames: []string{RBACManagementLDAPConfigSecretName},
+					Verbs:         []string{"get", "list", "watch", "update", "patch", "delete"},
+				},
+				{
+					APIGroups:     []string{""},
+					Resources:     []string{"configmaps"},
+					ResourceNames: []string{"tigera-idp-groups"},
+					Verbs:         []string{"get", "list", "watch", "update", "patch", "delete"},
+				},
+			},
+		},
+		&rbacv1.RoleBinding{
+			TypeMeta:   metav1.TypeMeta{Kind: "RoleBinding", APIVersion: "rbac.authorization.k8s.io/v1"},
+			ObjectMeta: metav1.ObjectMeta{Name: ManagerClusterRole, Namespace: common.CalicoNamespace},
+			RoleRef: rbacv1.RoleRef{
+				APIGroup: "rbac.authorization.k8s.io",
+				Kind:     "Role",
+				Name:     ManagerClusterRole,
+			},
+			Subjects: []rbacv1.Subject{
+				{
+					Kind:      "ServiceAccount",
+					Name:      ManagerServiceAccount,
+					Namespace: c.cfg.Namespace,
+				},
+			},
+		},
+	}
+}
+
 func (c *managerComponent) getTLSObjects() []client.Object {
 	objs := []client.Object{}
 	for _, s := range c.tlsSecrets {
@@ -1265,6 +1350,33 @@ func (c *managerComponent) managerCalicoSystemNetworkPolicy() *v3.NetworkPolicy
 		})
 	}
 
+	if c.cfg.Manager.RBACManagementEnabled() && !c.cfg.Tenant.MultiTenant() &&
+		c.cfg.Authentication != nil && c.cfg.Authentication.Spec.LDAP != nil {
+		// LDAP/AD egress (389, 636) for the RBAC-UI directory sync, gated on LDAP
+		// being configured on the Authentication CR. The destination is scoped to
+		// Authentication.spec.ldap.host — a domain match for a hostname or a
+		// /32/128 for a literal IP. Both standard ports stay open (the host may
+		// specify a non-standard port; scoping the port too would risk denying a
+		// valid config), so only the host is narrowed.
+		dest := v3.EntityRule{Ports: networkpolicy.Ports(389, 636)}
+		if host := ldapEgressHost(c.cfg.Authentication.Spec.LDAP.Host); host != "" {
+			if ip := net.ParseIP(host); ip != nil {
+				suffix := "/32"
+				if ip.To4() == nil {
+					suffix = "/128"
+				}
+				dest.Nets = []string{ip.String() + suffix}
+			} else {
+				dest.Domains = []string{host}
+			}
+		}
+		egressRules = append(egressRules, v3.Rule{
+			Action:      v3.Allow,
+			Protocol:    &networkpolicy.TCPProtocol,
+			Destination: dest,
+		})
+	}
+
 	egressRules = networkpolicy.AppendDNSEgressRules(egressRules, c.cfg.OpenShift)
 	egressRules = append(egressRules, v3.Rule{
 		Action:      v3.Allow,
@@ -1329,6 +1441,18 @@ func (c *managerComponent) managerCalicoSystemNetworkPolicy() *v3.NetworkPolicy
 	}
 }
 
+// ldapEgressHost returns the host (without port) from an
+// Authentication.spec.ldap.host value, used to scope the manager's LDAP egress
+// policy. The value carries an optional port (e.g. "ad.example.com:636"); when
+// no port is present the value is already the host. IPv6 literals are returned
+// unbracketed so the caller can parse them with net.ParseIP.
+func ldapEgressHost(host string) string {
+	if h, _, err := net.SplitHostPort(host); err == nil {
+		return h
+	}
+	return strings.TrimSuffix(strings.TrimPrefix(host, "["), "]")
+}
+
 func (c *managerComponent) multiTenantManagedClustersAccess() []client.Object {
 	var objects []client.Object
 
diff --git a/pkg/render/manager_test.go b/pkg/render/manager_test.go
index 618b815ca7..9c3177e94b 100644
--- a/pkg/render/manager_test.go
+++ b/pkg/render/manager_test.go
@@ -31,6 +31,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/utils/ptr"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	v3 "github.com/tigera/api/pkg/apis/projectcalico/v3"
@@ -161,6 +162,7 @@ var _ = Describe("Tigera Secure Manager rendering tests", func() {
 			{Name: "LINSEED_CLIENT_KEY", Value: "/internal-manager-tls/tls.key"},
 			{Name: "ELASTIC_KIBANA_DISABLED", Value: "false"},
 			{Name: "VOLTRON_URL", Value: render.ManagerService(nil)},
+			{Name: "RBAC_UI_ENABLED", Value: "false"},
 		}
 		Expect(uiAPIs.Env).To(Equal(uiAPIsExpectedEnvVars))
 
@@ -1730,6 +1732,235 @@ var _ = Describe("Tigera Secure Manager rendering tests", func() {
 			Expect(rtest.GetContainer(deployment.Spec.Template.Spec.Containers, render.DashboardAPIName)).To(BeNil())
 		})
 	})
+
+	Context("RBAC management UI", func() {
+		var installation *operatorv1.InstallationSpec
+		BeforeEach(func() {
+			replicas := int32(1)
+			installation = &operatorv1.InstallationSpec{
+				ControlPlaneReplicas: &replicas,
+				Variant:              operatorv1.CalicoEnterprise,
+				Registry:             "testregistry.com/",
+			}
+		})
+
+		rbacUIEnabledEnv := func(d *appsv1.Deployment) corev1.EnvVar {
+			for _, c := range d.Spec.Template.Spec.Containers {
+				if c.Name == render.UIAPIsName {
+					for _, e := range c.Env {
+						if e.Name == "RBAC_UI_ENABLED" {
+							return e
+						}
+					}
+				}
+			}
+			return corev1.EnvVar{}
+		}
+
+		// Namespaced Role carries the create rule on ConfigMaps/Secrets — this
+		// is the stable presence check for the RBAC management UI gate.
+		nsCreateRule := rbacv1.PolicyRule{
+			APIGroups: []string{""},
+			Resources: []string{"configmaps", "secrets"},
+			Verbs:     []string{"create"},
+		}
+
+		It("renders RBAC_UI_ENABLED=false and no namespaced RBAC UI role when rbac is unset", func() {
+			resources, _ := renderObjects(renderConfig{
+				installation: installation,
+				ns:           render.ManagerNamespace,
+			})
+			d := rtest.GetResource(resources, render.ManagerDeploymentName, render.ManagerNamespace, appsv1.GroupName, "v1", "Deployment").(*appsv1.Deployment)
+			Expect(rbacUIEnabledEnv(d)).To(Equal(corev1.EnvVar{Name: "RBAC_UI_ENABLED", Value: "false"}))
+
+			Expect(rtest.GetResource(resources, render.ManagerClusterRole, render.ManagerNamespace, rbacv1.GroupName, "v1", "Role")).To(BeNil())
+		})
+
+		It("renders RBAC_UI_ENABLED=false and no namespaced RBAC UI role when the Manager exists but rbacUI is unset", func() {
+			resources, _ := renderObjects(renderConfig{
+				installation: installation,
+				ns:           render.ManagerNamespace,
+				manager:      &operatorv1.Manager{Spec: operatorv1.ManagerSpec{}},
+			})
+			d := rtest.GetResource(resources, render.ManagerDeploymentName, render.ManagerNamespace, appsv1.GroupName, "v1", "Deployment").(*appsv1.Deployment)
+			Expect(rbacUIEnabledEnv(d)).To(Equal(corev1.EnvVar{Name: "RBAC_UI_ENABLED", Value: "false"}))
+
+			Expect(rtest.GetResource(resources, render.ManagerClusterRole, render.ManagerNamespace, rbacv1.GroupName, "v1", "Role")).To(BeNil())
+		})
+
+		It("renders RBAC_UI_ENABLED=true and the namespaced RBAC UI role when rbacUI.state is Enabled", func() {
+			resources, _ := renderObjects(renderConfig{
+				installation: installation,
+				ns:           render.ManagerNamespace,
+				manager: &operatorv1.Manager{
+					Spec: operatorv1.ManagerSpec{
+						RBACUI: &operatorv1.RBACUI{State: ptr.To(operatorv1.RBACUIEnabled)},
+					},
+				},
+			})
+			d := rtest.GetResource(resources, render.ManagerDeploymentName, render.ManagerNamespace, appsv1.GroupName, "v1", "Deployment").(*appsv1.Deployment)
+			Expect(rbacUIEnabledEnv(d)).To(Equal(corev1.EnvVar{Name: "RBAC_UI_ENABLED", Value: "true"}))
+
+			role := rtest.GetResource(resources, render.ManagerClusterRole, render.ManagerNamespace, rbacv1.GroupName, "v1", "Role").(*rbacv1.Role)
+			Expect(role.Rules).To(ContainElement(nsCreateRule))
+		})
+
+		It("renders RBAC_UI_ENABLED=false when rbacUI.state is Disabled", func() {
+			resources, _ := renderObjects(renderConfig{
+				installation: installation,
+				ns:           render.ManagerNamespace,
+				manager: &operatorv1.Manager{
+					Spec: operatorv1.ManagerSpec{
+						RBACUI: &operatorv1.RBACUI{State: ptr.To(operatorv1.RBACUIDisabled)},
+					},
+				},
+			})
+			d := rtest.GetResource(resources, render.ManagerDeploymentName, render.ManagerNamespace, appsv1.GroupName, "v1", "Deployment").(*appsv1.Deployment)
+			Expect(rbacUIEnabledEnv(d)).To(Equal(corev1.EnvVar{Name: "RBAC_UI_ENABLED", Value: "false"}))
+		})
+
+		It("does not add the manager-side RBAC rules in multi-tenant mode", func() {
+			resources, _ := renderObjects(renderConfig{
+				installation:      installation,
+				ns:                "tenant-a",
+				bindingNamespaces: []string{"tenant-a"},
+				tenant: &operatorv1.Tenant{
+					ObjectMeta: metav1.ObjectMeta{Name: "tenantA", Namespace: "tenant-a"},
+					Spec: operatorv1.TenantSpec{
+						ID:                    "tenant-a",
+						ManagedClusterVariant: &operatorv1.Calico,
+					},
+				},
+				manager: &operatorv1.Manager{
+					Spec: operatorv1.ManagerSpec{
+						RBACUI: &operatorv1.RBACUI{State: ptr.To(operatorv1.RBACUIEnabled)},
+					},
+				},
+			})
+			Expect(rtest.GetResource(resources, render.ManagerClusterRole, "tenant-a", rbacv1.GroupName, "v1", "Role")).To(BeNil())
+		})
+
+		Context("LDAP egress network policy gate", func() {
+			policyName := types.NamespacedName{Name: "calico-system.manager-access", Namespace: render.ManagerNamespace}
+			// ldapEgress is the fallback rule shape rendered when LDAP is configured
+			// on the Authentication CR but its host is empty: ports open, destination
+			// unscoped.
+			ldapEgress := v3.Rule{
+				Action:   v3.Allow,
+				Protocol: &networkpolicy.TCPProtocol,
+				Destination: v3.EntityRule{
+					Ports: networkpolicy.Ports(389, 636),
+				},
+			}
+			rbacUIManager := &operatorv1.Manager{
+				Spec: operatorv1.ManagerSpec{RBACUI: &operatorv1.RBACUI{State: ptr.To(operatorv1.RBACUIEnabled)}},
+			}
+
+			It("adds an unscoped LDAP egress when RBAC UI and LDAP auth are configured but no host is set", func() {
+				resources, _ := renderObjects(renderConfig{
+					installation: installation, ns: render.ManagerNamespace,
+					manager: rbacUIManager, ldapConfigured: true,
+				})
+				policy := testutils.GetCalicoSystemPolicyFromResources(policyName, resources)
+				Expect(policy.Spec.Egress).To(ContainElement(ldapEgress))
+			})
+
+			It("scopes LDAP egress to a Domains match when the LDAP host is a hostname", func() {
+				resources, _ := renderObjects(renderConfig{
+					installation: installation, ns: render.ManagerNamespace,
+					manager: rbacUIManager, ldapConfigured: true,
+					ldapHost: "ad.example.com:636",
+				})
+				policy := testutils.GetCalicoSystemPolicyFromResources(policyName, resources)
+				Expect(policy.Spec.Egress).To(ContainElement(v3.Rule{
+					Action:   v3.Allow,
+					Protocol: &networkpolicy.TCPProtocol,
+					Destination: v3.EntityRule{
+						Domains: []string{"ad.example.com"},
+						Ports:   networkpolicy.Ports(389, 636),
+					},
+				}))
+				// The unscoped fallback rule must not also be present.
+				Expect(policy.Spec.Egress).NotTo(ContainElement(ldapEgress))
+			})
+
+			It("scopes LDAP egress to a /32 Nets match when the LDAP host is an IPv4 address", func() {
+				resources, _ := renderObjects(renderConfig{
+					installation: installation, ns: render.ManagerNamespace,
+					manager: rbacUIManager, ldapConfigured: true,
+					ldapHost: "10.20.30.40:389",
+				})
+				policy := testutils.GetCalicoSystemPolicyFromResources(policyName, resources)
+				Expect(policy.Spec.Egress).To(ContainElement(v3.Rule{
+					Action:   v3.Allow,
+					Protocol: &networkpolicy.TCPProtocol,
+					Destination: v3.EntityRule{
+						Nets:  []string{"10.20.30.40/32"},
+						Ports: networkpolicy.Ports(389, 636),
+					},
+				}))
+				// The unscoped fallback rule must not also be present.
+				Expect(policy.Spec.Egress).NotTo(ContainElement(ldapEgress))
+			})
+
+			It("scopes LDAP egress to a /128 Nets match when the LDAP host is an IPv6 address", func() {
+				resources, _ := renderObjects(renderConfig{
+					installation: installation, ns: render.ManagerNamespace,
+					manager: rbacUIManager, ldapConfigured: true,
+					ldapHost: "[2001:db8::1]:636",
+				})
+				policy := testutils.GetCalicoSystemPolicyFromResources(policyName, resources)
+				Expect(policy.Spec.Egress).To(ContainElement(v3.Rule{
+					Action:   v3.Allow,
+					Protocol: &networkpolicy.TCPProtocol,
+					Destination: v3.EntityRule{
+						Nets:  []string{"2001:db8::1/128"},
+						Ports: networkpolicy.Ports(389, 636),
+					},
+				}))
+				// The unscoped fallback rule must not also be present.
+				Expect(policy.Spec.Egress).NotTo(ContainElement(ldapEgress))
+			})
+
+			It("omits LDAP egress when LDAP auth is not configured, even with RBAC UI enabled", func() {
+				resources, _ := renderObjects(renderConfig{
+					installation: installation, ns: render.ManagerNamespace,
+					manager: rbacUIManager, ldapConfigured: false,
+				})
+				policy := testutils.GetCalicoSystemPolicyFromResources(policyName, resources)
+				Expect(policy.Spec.Egress).NotTo(ContainElement(ldapEgress))
+			})
+
+			It("omits LDAP egress when LDAP auth is configured but RBAC UI is disabled", func() {
+				resources, _ := renderObjects(renderConfig{
+					installation: installation, ns: render.ManagerNamespace,
+					ldapConfigured: true,
+				})
+				policy := testutils.GetCalicoSystemPolicyFromResources(policyName, resources)
+				Expect(policy.Spec.Egress).NotTo(ContainElement(ldapEgress))
+			})
+
+			It("omits LDAP egress in multi-tenant mode even with RBAC UI enabled and LDAP auth configured", func() {
+				resources, _ := renderObjects(renderConfig{
+					installation:      installation,
+					ns:                "tenant-a",
+					bindingNamespaces: []string{"tenant-a"},
+					tenant: &operatorv1.Tenant{
+						ObjectMeta: metav1.ObjectMeta{Name: "tenantA", Namespace: "tenant-a"},
+						Spec: operatorv1.TenantSpec{
+							ID:                    "tenant-a",
+							ManagedClusterVariant: &operatorv1.Calico,
+						},
+					},
+					manager:        rbacUIManager,
+					ldapConfigured: true,
+				})
+				policy := testutils.GetCalicoSystemPolicyFromResources(
+					types.NamespacedName{Name: "calico-system.manager-access", Namespace: "tenant-a"}, resources)
+				Expect(policy.Spec.Egress).NotTo(ContainElement(ldapEgress))
+			})
+		})
+	})
 })
 
 type renderConfig struct {
@@ -1746,6 +1977,10 @@ type renderConfig struct {
 	tenant                  *operatorv1.Tenant
 	manager                 *operatorv1.Manager
 	externalElastic         bool
+	// ldapConfigured, when true, sets Authentication.spec.ldap (gating the RBAC-UI
+	// LDAP egress rule); ldapHost sets Authentication.spec.ldap.host (scoping it).
+	ldapConfigured bool
+	ldapHost       string
 }
 
 func renderObjects(roc renderConfig) ([]client.Object, []client.Object) {
@@ -1815,6 +2050,12 @@ func renderObjects(roc renderConfig) ([]client.Object, []client.Object) {
 		CACertCommonName:        certificateManager.CACertCommonName(),
 	}
 
+	if roc.ldapConfigured {
+		cfg.Authentication = &operatorv1.Authentication{
+			Spec: operatorv1.AuthenticationSpec{LDAP: &operatorv1.AuthenticationLDAP{Host: roc.ldapHost}},
+		}
+	}
+
 	if roc.tenant.MultiTenant() {
 		cfg.TruthNamespace = roc.ns
 	} else {