types/ptr: deprecate ptr.To, use Go 1.26 new

Updates #18682

Change-Id: I62f6aa0de2a15ef8c1435032c6aa74a181c25f8f
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>

cmd/cloner/cloner.go

@@ -141,14 +141,12 @@ func gen(buf *bytes.Buffer, it *codegen.ImportTracker, typ *types.Named) {
 					writef("if src.%s[i] == nil { dst.%s[i] = nil } else {", fname, fname)
 					if codegen.ContainsPointers(ptr.Elem()) {
 						if _, isIface := ptr.Elem().Underlying().(*types.Interface); isIface {
-							it.Import("", "tailscale.com/types/ptr")
-							writef("\tdst.%s[i] = ptr.To((*src.%s[i]).Clone())", fname, fname)
+							writef("\tdst.%s[i] = new((*src.%s[i]).Clone())", fname, fname)
 						} else {
 							writef("\tdst.%s[i] = src.%s[i].Clone()", fname, fname)
 						}
 					} else {
-						it.Import("", "tailscale.com/types/ptr")
-						writef("\tdst.%s[i] = ptr.To(*src.%s[i])", fname, fname)
+						writef("\tdst.%s[i] = new(*src.%s[i])", fname, fname)
 					}
 					writef("}")
 				} else if ft.Elem().String() == "encoding/json.RawMessage" {
@@ -170,12 +168,11 @@ func gen(buf *bytes.Buffer, it *codegen.ImportTracker, typ *types.Named) {
 				writef("dst.%s = src.%s.Clone()", fname, fname)
 				continue
 			}
-			it.Import("", "tailscale.com/types/ptr")
 			writef("if dst.%s != nil {", fname)
 			if _, isIface := base.Underlying().(*types.Interface); isIface && hasPtrs {
-				writef("\tdst.%s = ptr.To((*src.%s).Clone())", fname, fname)
+				writef("\tdst.%s = new((*src.%s).Clone())", fname, fname)
 			} else if !hasPtrs {
-				writef("\tdst.%s = ptr.To(*src.%s)", fname, fname)
+				writef("\tdst.%s = new(*src.%s)", fname, fname)
 			} else {
 				writef("\t" + `panic("TODO pointers in pointers")`)
 			}
@@ -293,14 +290,12 @@ func writeMapValueClone(params mapValueCloneParams) {
 		writef("if %s == nil { %s = nil } else {", params.SrcExpr, params.DstExpr)
 		if base := elem.Elem().Underlying(); codegen.ContainsPointers(base) {
 			if _, isIface := base.(*types.Interface); isIface {
-				params.It.Import("", "tailscale.com/types/ptr")
-				writef("\t%s = ptr.To((*%s).Clone())", params.DstExpr, params.SrcExpr)
+				writef("\t%s = new((*%s).Clone())", params.DstExpr, params.SrcExpr)
 			} else {
 				writef("\t%s = %s.Clone()", params.DstExpr, params.SrcExpr)
 			}
 		} else {
-			params.It.Import("", "tailscale.com/types/ptr")
-			writef("\t%s = ptr.To(*%s)", params.DstExpr, params.SrcExpr)
+			writef("\t%s = new(*%s)", params.DstExpr, params.SrcExpr)
 		}
 		writef("}")
 

cmd/cloner/clonerex/clonerex_clone.go

@@ -7,8 +7,6 @@ package clonerex
 
 import (
 	"maps"
-
-	"tailscale.com/types/ptr"
 )
 
 // Clone makes a deep copy of SliceContainer.
@@ -25,7 +23,7 @@ func (src *SliceContainer) Clone() *SliceContainer {
 			if src.Slice[i] == nil {
 				dst.Slice[i] = nil
 			} else {
-				dst.Slice[i] = ptr.To(*src.Slice[i])
+				dst.Slice[i] = new(*src.Slice[i])
 			}
 		}
 	}
@@ -70,7 +68,7 @@ func (src *MapWithPointers) Clone() *MapWithPointers {
 			if v == nil {
 				dst.Nested[k] = nil
 			} else {
-				dst.Nested[k] = ptr.To(*v)
+				dst.Nested[k] = new(*v)
 			}
 		}
 	}

cmd/containerboot/main.go

@@ -147,7 +147,6 @@ import (
 	"tailscale.com/tailcfg"
 	"tailscale.com/types/logger"
 	"tailscale.com/types/netmap"
-	"tailscale.com/types/ptr"
 	"tailscale.com/util/deephash"
 	"tailscale.com/util/dnsname"
 	"tailscale.com/util/linuxfw"
@@ -612,7 +611,7 @@ runLoop:
 					if cd == "" {
 						cd = kubetypes.ValueNoHTTPS
 					}
-					prev := certDomain.Swap(ptr.To(cd))
+					prev := certDomain.Swap(new(cd))
 					if prev == nil || *prev != cd {
 						select {
 						case certDomainChanged <- true:

cmd/containerboot/main_test.go

@@ -38,7 +38,6 @@ import (
 	"tailscale.com/tailcfg"
 	"tailscale.com/tstest"
 	"tailscale.com/types/netmap"
-	"tailscale.com/types/ptr"
 )
 
 func TestContainerBoot(t *testing.T) {
@@ -95,7 +94,7 @@ func TestContainerBoot(t *testing.T) {
 		EndpointStatuses map[string]int
 	}
 	runningNotify := &ipn.Notify{
-		State: ptr.To(ipn.Running),
+		State: new(ipn.Running),
 		NetMap: &netmap.NetworkMap{
 			SelfNode: (&tailcfg.Node{
 				StableID:  tailcfg.StableNodeID("myID"),
@@ -373,7 +372,7 @@ func TestContainerBoot(t *testing.T) {
 					},
 					{
 						Notify: &ipn.Notify{
-							State: ptr.To(ipn.Running),
+							State: new(ipn.Running),
 							NetMap: &netmap.NetworkMap{
 								SelfNode: (&tailcfg.Node{
 									StableID:  tailcfg.StableNodeID("myID"),
@@ -390,7 +389,7 @@ func TestContainerBoot(t *testing.T) {
 							},
 						},
 						WantLog:      "no forwarding rules for egress addresses [::1/128], host supports IPv6: false",
-						WantExitCode: ptr.To(1),
+						WantExitCode: new(1),
 					},
 				},
 			}
@@ -409,7 +408,7 @@ func TestContainerBoot(t *testing.T) {
 					},
 					{
 						Notify: &ipn.Notify{
-							State: ptr.To(ipn.NeedsLogin),
+							State: new(ipn.NeedsLogin),
 						},
 						WantCmds: []string{
 							"/usr/bin/tailscale --socket=/tmp/tailscaled.sock up --accept-dns=false --authkey=tskey-key",
@@ -440,7 +439,7 @@ func TestContainerBoot(t *testing.T) {
 					},
 					{
 						Notify: &ipn.Notify{
-							State: ptr.To(ipn.NeedsLogin),
+							State: new(ipn.NeedsLogin),
 						},
 						WantCmds: []string{
 							"/usr/bin/tailscale --socket=/tmp/tailscaled.sock up --accept-dns=true --authkey=tskey-key",
@@ -564,7 +563,7 @@ func TestContainerBoot(t *testing.T) {
 					},
 					{
 						Notify: &ipn.Notify{
-							State: ptr.To(ipn.NeedsLogin),
+							State: new(ipn.NeedsLogin),
 						},
 						WantCmds: []string{
 							"/usr/bin/tailscale --socket=/tmp/tailscaled.sock up --accept-dns=false --authkey=tskey-key",
@@ -621,7 +620,7 @@ func TestContainerBoot(t *testing.T) {
 					},
 					{
 						Notify: &ipn.Notify{
-							State: ptr.To(ipn.Running),
+							State: new(ipn.Running),
 							NetMap: &netmap.NetworkMap{
 								SelfNode: (&tailcfg.Node{
 									StableID:  tailcfg.StableNodeID("newID"),
@@ -964,7 +963,7 @@ func TestContainerBoot(t *testing.T) {
 					},
 					{
 						Notify: &ipn.Notify{
-							State: ptr.To(ipn.Running),
+							State: new(ipn.Running),
 							NetMap: &netmap.NetworkMap{
 								SelfNode: (&tailcfg.Node{
 									StableID:  tailcfg.StableNodeID("myID"),
@@ -1004,7 +1003,7 @@ func TestContainerBoot(t *testing.T) {
 				Phases: []phase{
 					{
 						WantLog:      "TS_EGRESS_PROXIES_CONFIG_PATH is only supported for Tailscale running on Kubernetes",
-						WantExitCode: ptr.To(1),
+						WantExitCode: new(1),
 					},
 				},
 			}
@@ -1053,7 +1052,7 @@ func TestContainerBoot(t *testing.T) {
 					{
 						// SIGTERM before state is finished writing, should wait for
 						// consistent state before propagating SIGTERM to tailscaled.
-						Signal: ptr.To(unix.SIGTERM),
+						Signal: new(unix.SIGTERM),
 						UpdateKubeSecret: map[string]string{
 							"_machinekey":  "foo",
 							"_profiles":    "foo",
@@ -1083,7 +1082,7 @@ func TestContainerBoot(t *testing.T) {
 							kubetypes.KeyCapVer: capver,
 						},
 						WantLog:      "HTTP server at [::]:9002 closed",
-						WantExitCode: ptr.To(0),
+						WantExitCode: new(0),
 					},
 				},
 			}
@@ -1661,7 +1660,7 @@ func newTestEnv(t *testing.T) testEnv {
 	kube.Start(t)
 	t.Cleanup(kube.Close)
 
-	tailscaledConf := &ipn.ConfigVAlpha{AuthKey: ptr.To("foo"), Version: "alpha0"}
+	tailscaledConf := &ipn.ConfigVAlpha{AuthKey: new("foo"), Version: "alpha0"}
 	serveConf := ipn.ServeConfig{TCP: map[uint16]*ipn.TCPPortHandler{80: {HTTP: true}}}
 	serveConfWithServices := ipn.ServeConfig{
 		TCP: map[uint16]*ipn.TCPPortHandler{80: {HTTP: true}},

cmd/derper/depaware.txt

@@ -138,7 +138,6 @@ tailscale.com/cmd/derper dependencies: (generated by github.com/tailscale/depawa
         tailscale.com/types/opt                                      from tailscale.com/envknob+
         tailscale.com/types/persist                                  from tailscale.com/ipn+
         tailscale.com/types/preftype                                 from tailscale.com/ipn
-        tailscale.com/types/ptr                                      from tailscale.com/hostinfo+
         tailscale.com/types/result                                   from tailscale.com/util/lineiter
         tailscale.com/types/structs                                  from tailscale.com/ipn+
         tailscale.com/types/tkatype                                  from tailscale.com/client/local+

cmd/k8s-operator/api-server-proxy-pg_test.go

@@ -25,7 +25,6 @@ import (
 	"tailscale.com/tailcfg"
 	"tailscale.com/tstest"
 	"tailscale.com/types/opt"
-	"tailscale.com/types/ptr"
 )
 
 func TestAPIServerProxyReconciler(t *testing.T) {
@@ -57,7 +56,7 @@ func TestAPIServerProxyReconciler(t *testing.T) {
 	initialCfg := &conf.VersionedConfig{
 		Version: "v1alpha1",
 		ConfigV1Alpha1: &conf.ConfigV1Alpha1{
-			AuthKey: ptr.To("test-key"),
+			AuthKey: new("test-key"),
 			APIServerProxy: &conf.APIServerProxyConfig{
 				Enabled: opt.NewBool(true),
 			},
@@ -174,7 +173,7 @@ func TestAPIServerProxyReconciler(t *testing.T) {
 	tsoperator.SetProxyGroupCondition(pg, tsapi.KubeAPIServerProxyConfigured, metav1.ConditionFalse, reasonKubeAPIServerProxyNoBackends, "", 1, r.clock, r.logger)
 	expectEqual(t, fc, pg, omitPGStatusConditionMessages)
 
-	expectedCfg.APIServerProxy.ServiceName = ptr.To(tailcfg.ServiceName("svc:" + pgName))
+	expectedCfg.APIServerProxy.ServiceName = new(tailcfg.ServiceName("svc:" + pgName))
 	expectCfg(&expectedCfg)
 
 	expectEqual(t, fc, certSecret(pgName, ns, defaultDomain, pg))
@@ -230,7 +229,7 @@ func TestAPIServerProxyReconciler(t *testing.T) {
 		t.Fatalf("expected Tailscale Service to be %+v, got %+v", expectedTSSvc, tsSvc)
 	}
 	// Check cfg and status reset until TLS certs are available again.
-	expectedCfg.APIServerProxy.ServiceName = ptr.To(updatedServiceName)
+	expectedCfg.APIServerProxy.ServiceName = new(updatedServiceName)
 	expectedCfg.AdvertiseServices = nil
 	expectCfg(&expectedCfg)
 	tsoperator.SetProxyGroupCondition(pg, tsapi.KubeAPIServerProxyConfigured, metav1.ConditionFalse, reasonKubeAPIServerProxyNoBackends, "", 1, r.clock, r.logger)

cmd/k8s-operator/api-server-proxy.go

@@ -11,7 +11,6 @@ import (
 	"os"
 
 	"tailscale.com/kube/kubetypes"
-	"tailscale.com/types/ptr"
 )
 
 func parseAPIProxyMode() *kubetypes.APIServerProxyMode {
@@ -23,18 +22,18 @@ func parseAPIProxyMode() *kubetypes.APIServerProxyMode {
 	case haveAuthProxyEnv:
 		var authProxyEnv = defaultBool("AUTH_PROXY", false) // deprecated
 		if authProxyEnv {
-			return ptr.To(kubetypes.APIServerProxyModeAuth)
+			return new(kubetypes.APIServerProxyModeAuth)
 		}
 		return nil
 	case haveAPIProxyEnv:
 		var apiProxyEnv = defaultEnv("APISERVER_PROXY", "") // true, false or "noauth"
 		switch apiProxyEnv {
 		case "true":
-			return ptr.To(kubetypes.APIServerProxyModeAuth)
+			return new(kubetypes.APIServerProxyModeAuth)
 		case "false", "":
 			return nil
 		case "noauth":
-			return ptr.To(kubetypes.APIServerProxyModeNoAuth)
+			return new(kubetypes.APIServerProxyModeNoAuth)
 		default:
 			panic(fmt.Sprintf("unknown APISERVER_PROXY value %q", apiProxyEnv))
 		}

cmd/k8s-operator/connector_test.go

@@ -22,7 +22,6 @@ import (
 	tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
 	"tailscale.com/kube/kubetypes"
 	"tailscale.com/tstest"
-	"tailscale.com/types/ptr"
 	"tailscale.com/util/mak"
 )
 
@@ -39,7 +38,7 @@ func TestConnector(t *testing.T) {
 			APIVersion: "tailscale.com/v1alpha1",
 		},
 		Spec: tsapi.ConnectorSpec{
-			Replicas: ptr.To[int32](1),
+			Replicas: new(int32(1)),
 			SubnetRouter: &tsapi.SubnetRouter{
 				AdvertiseRoutes: []tsapi.Route{"10.40.0.0/14"},
 			},
@@ -166,7 +165,7 @@ func TestConnector(t *testing.T) {
 			APIVersion: "tailscale.io/v1alpha1",
 		},
 		Spec: tsapi.ConnectorSpec{
-			Replicas: ptr.To[int32](1),
+			Replicas: new(int32(1)),
 			SubnetRouter: &tsapi.SubnetRouter{
 				AdvertiseRoutes: []tsapi.Route{"10.40.0.0/14"},
 			},
@@ -229,7 +228,7 @@ func TestConnectorWithProxyClass(t *testing.T) {
 			APIVersion: "tailscale.io/v1alpha1",
 		},
 		Spec: tsapi.ConnectorSpec{
-			Replicas: ptr.To[int32](1),
+			Replicas: new(int32(1)),
 			SubnetRouter: &tsapi.SubnetRouter{
 				AdvertiseRoutes: []tsapi.Route{"10.40.0.0/14"},
 			},
@@ -326,7 +325,7 @@ func TestConnectorWithAppConnector(t *testing.T) {
 			APIVersion: "tailscale.io/v1alpha1",
 		},
 		Spec: tsapi.ConnectorSpec{
-			Replicas:     ptr.To[int32](1),
+			Replicas:     new(int32(1)),
 			AppConnector: &tsapi.AppConnector{},
 		},
 	}
@@ -425,7 +424,7 @@ func TestConnectorWithMultipleReplicas(t *testing.T) {
 			APIVersion: "tailscale.io/v1alpha1",
 		},
 		Spec: tsapi.ConnectorSpec{
-			Replicas:       ptr.To[int32](3),
+			Replicas:       new(int32(3)),
 			AppConnector:   &tsapi.AppConnector{},
 			HostnamePrefix: "test-connector",
 		},
@@ -496,7 +495,7 @@ func TestConnectorWithMultipleReplicas(t *testing.T) {
 
 	// 5. We'll scale the connector down by 1 replica and make sure its secret is cleaned up
 	mustUpdate[tsapi.Connector](t, fc, "", "test", func(conn *tsapi.Connector) {
-		conn.Spec.Replicas = ptr.To[int32](2)
+		conn.Spec.Replicas = new(int32(2))
 	})
 	expectReconciled(t, cr, "", "test")
 	names = findGenNames(t, fc, "", "test", "connector")

cmd/k8s-operator/depaware.txt

@@ -927,7 +927,6 @@ tailscale.com/cmd/k8s-operator dependencies: (generated by github.com/tailscale/
         tailscale.com/types/opt                                      from tailscale.com/client/tailscale+
         tailscale.com/types/persist                                  from tailscale.com/control/controlclient+
         tailscale.com/types/preftype                                 from tailscale.com/ipn+
-        tailscale.com/types/ptr                                      from tailscale.com/cmd/k8s-operator+
         tailscale.com/types/result                                   from tailscale.com/util/lineiter
         tailscale.com/types/structs                                  from tailscale.com/control/controlclient+
         tailscale.com/types/tkatype                                  from tailscale.com/client/local+

cmd/k8s-operator/dnsrecords_test.go

@@ -25,7 +25,6 @@ import (
 	tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
 	"tailscale.com/kube/kubetypes"
 	"tailscale.com/tstest"
-	"tailscale.com/types/ptr"
 )
 
 func TestDNSRecordsReconciler(t *testing.T) {
@@ -44,7 +43,7 @@ func TestDNSRecordsReconciler(t *testing.T) {
 			Namespace: "test",
 		},
 		Spec: networkingv1.IngressSpec{
-			IngressClassName: ptr.To("tailscale"),
+			IngressClassName: new("tailscale"),
 		},
 		Status: networkingv1.IngressStatus{
 			LoadBalancer: networkingv1.IngressLoadBalancerStatus{
@@ -150,7 +149,7 @@ func TestDNSRecordsReconciler(t *testing.T) {
 
 	// 7. A not-ready Endpoint is removed from DNS config.
 	mustUpdate(t, fc, ep.Namespace, ep.Name, func(ep *discoveryv1.EndpointSlice) {
-		ep.Endpoints[0].Conditions.Ready = ptr.To(false)
+		ep.Endpoints[0].Conditions.Ready = new(false)
 		ep.Endpoints = append(ep.Endpoints, discoveryv1.Endpoint{
 			Addresses: []string{"1.2.3.4"},
 		})
@@ -220,13 +219,13 @@ func TestDNSRecordsReconciler(t *testing.T) {
 		Endpoints: []discoveryv1.Endpoint{{
 			Addresses: []string{"10.1.0.100", "10.1.0.101", "10.1.0.102"}, // Pod IPs that should NOT be used
 			Conditions: discoveryv1.EndpointConditions{
-				Ready:       ptr.To(true),
-				Serving:     ptr.To(true),
-				Terminating: ptr.To(false),
+				Ready:       new(true),
+				Serving:     new(true),
+				Terminating: new(false),
 			},
 		}},
 		Ports: []discoveryv1.EndpointPort{{
-			Port: ptr.To(int32(10443)),
+			Port: new(int32(10443)),
 		}},
 	}
 
@@ -316,7 +315,7 @@ func TestDNSRecordsReconcilerDualStack(t *testing.T) {
 			Namespace: "test",
 		},
 		Spec: networkingv1.IngressSpec{
-			IngressClassName: ptr.To("tailscale"),
+			IngressClassName: new("tailscale"),
 		},
 		Status: networkingv1.IngressStatus{
 			LoadBalancer: networkingv1.IngressLoadBalancerStatus{
@@ -447,9 +446,9 @@ func endpointSliceForService(svc *corev1.Service, ip string, fam discoveryv1.Add
 		Endpoints: []discoveryv1.Endpoint{{
 			Addresses: []string{ip},
 			Conditions: discoveryv1.EndpointConditions{
-				Ready:       ptr.To(true),
-				Serving:     ptr.To(true),
-				Terminating: ptr.To(false),
+				Ready:       new(true),
+				Serving:     new(true),
+				Terminating: new(false),
 			},
 		}},
 	}

cmd/k8s-operator/e2e/ingress_test.go

@@ -22,7 +22,6 @@ import (
 	"tailscale.com/cmd/testwrapper/flakytest"
 	kube "tailscale.com/k8s-operator"
 	"tailscale.com/tstest"
-	"tailscale.com/types/ptr"
 	"tailscale.com/util/httpm"
 )
 
@@ -44,7 +43,7 @@ func TestIngress(t *testing.T) {
 				},
 			},
 			Spec: appsv1.DeploymentSpec{
-				Replicas: ptr.To[int32](1),
+				Replicas: new(int32(1)),
 				Selector: &metav1.LabelSelector{
 					MatchLabels: map[string]string{
 						"app.kubernetes.io/name": "nginx",

cmd/k8s-operator/e2e/pebble.go

@@ -12,8 +12,6 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/intstr"
 	"sigs.k8s.io/controller-runtime/pkg/client"
-
-	"tailscale.com/types/ptr"
 )
 
 func applyPebbleResources(ctx context.Context, cl client.Client) error {
@@ -46,7 +44,7 @@ func pebbleDeployment(tag string) *appsv1.Deployment {
 			Namespace: ns,
 		},
 		Spec: appsv1.DeploymentSpec{
-			Replicas: ptr.To[int32](1),
+			Replicas: new(int32(1)),
 			Selector: &metav1.LabelSelector{
 				MatchLabels: map[string]string{
 					"app": "pebble",

cmd/k8s-operator/e2e/proxygrouppolicy_test.go

@@ -13,7 +13,6 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
-	"tailscale.com/types/ptr"
 )
 
 // See [TestMain] for test requirements.
@@ -82,7 +81,7 @@ func TestProxyGroupPolicy(t *testing.T) {
 		},
 		Spec: corev1.ServiceSpec{
 			Type:              corev1.ServiceTypeLoadBalancer,
-			LoadBalancerClass: ptr.To("tailscale"),
+			LoadBalancerClass: new("tailscale"),
 			Ports: []corev1.ServicePort{
 				{
 					Port:     8080,
@@ -112,7 +111,7 @@ func TestProxyGroupPolicy(t *testing.T) {
 			},
 		},
 		Spec: networkingv1.IngressSpec{
-			IngressClassName: ptr.To("tailscale"),
+			IngressClassName: new("tailscale"),
 			DefaultBackend: &networkingv1.IngressBackend{
 				Service: &networkingv1.IngressServiceBackend{
 					Name: "nginx",

cmd/k8s-operator/e2e/ssh.go

@@ -26,7 +26,6 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	tailscaleroot "tailscale.com"
-	"tailscale.com/types/ptr"
 )
 
 const (
@@ -206,7 +205,7 @@ func applySSHResources(ctx context.Context, cl client.Client, alpineTag string,
 
 func cleanupSSHResources(ctx context.Context, cl client.Client) error {
 	noGrace := &client.DeleteOptions{
-		GracePeriodSeconds: ptr.To[int64](0),
+		GracePeriodSeconds: new(int64(0)),
 	}
 	if err := cl.Delete(ctx, sshDeployment("", nil), noGrace); err != nil {
 		return fmt.Errorf("failed to delete ssh-server Deployment: %w", err)
@@ -232,7 +231,7 @@ func sshDeployment(tag string, pubKey []byte) *appsv1.Deployment {
 			Namespace: ns,
 		},
 		Spec: appsv1.DeploymentSpec{
-			Replicas: ptr.To[int32](1),
+			Replicas: new(int32(1)),
 			Selector: &metav1.LabelSelector{
 				MatchLabels: map[string]string{
 					"app": "ssh-server",

cmd/k8s-operator/egress-eps.go

@@ -21,7 +21,6 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 	"tailscale.com/kube/egressservices"
-	"tailscale.com/types/ptr"
 )
 
 // egressEpsReconciler reconciles EndpointSlices for tailnet services exposed to cluster via egress ProxyGroup proxies.
@@ -120,9 +119,9 @@ func (er *egressEpsReconciler) Reconcile(ctx context.Context, req reconcile.Requ
 			Hostname:  (*string)(&pod.UID),
 			Addresses: []string{podIP},
 			Conditions: discoveryv1.EndpointConditions{
-				Ready:       ptr.To(true),
-				Serving:     ptr.To(true),
-				Terminating: ptr.To(false),
+				Ready:       new(true),
+				Serving:     new(true),
+				Terminating: new(false),
 			},
 		})
 	}

cmd/k8s-operator/egress-pod-readiness_test.go

@@ -24,7 +24,6 @@ import (
 	tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
 	"tailscale.com/kube/kubetypes"
 	"tailscale.com/tstest"
-	"tailscale.com/types/ptr"
 )
 
 func TestEgressPodReadiness(t *testing.T) {
@@ -48,7 +47,7 @@ func TestEgressPodReadiness(t *testing.T) {
 		},
 		Spec: tsapi.ProxyGroupSpec{
 			Type:     "egress",
-			Replicas: ptr.To(int32(3)),
+			Replicas: new(int32(3)),
 		},
 	}
 	mustCreate(t, fc, pg)

cmd/k8s-operator/ingress-for-pg_test.go

@@ -33,7 +33,6 @@ import (
 	tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
 	"tailscale.com/kube/kubetypes"
 	"tailscale.com/tailcfg"
-	"tailscale.com/types/ptr"
 )
 
 func TestIngressPGReconciler(t *testing.T) {
@@ -50,7 +49,7 @@ func TestIngressPGReconciler(t *testing.T) {
 			},
 		},
 		Spec: networkingv1.IngressSpec{
-			IngressClassName: ptr.To("tailscale"),
+			IngressClassName: new("tailscale"),
 			DefaultBackend: &networkingv1.IngressBackend{
 				Service: &networkingv1.IngressServiceBackend{
 					Name: "test",
@@ -117,7 +116,7 @@ func TestIngressPGReconciler(t *testing.T) {
 			},
 		},
 		Spec: networkingv1.IngressSpec{
-			IngressClassName: ptr.To("tailscale"),
+			IngressClassName: new("tailscale"),
 			DefaultBackend: &networkingv1.IngressBackend{
 				Service: &networkingv1.IngressServiceBackend{
 					Name: "test",
@@ -242,7 +241,7 @@ func TestIngressPGReconciler(t *testing.T) {
 			},
 		},
 		Spec: networkingv1.IngressSpec{
-			IngressClassName: ptr.To("tailscale"),
+			IngressClassName: new("tailscale"),
 			DefaultBackend: &networkingv1.IngressBackend{
 				Service: &networkingv1.IngressServiceBackend{
 					Name: "test",
@@ -286,7 +285,7 @@ func TestIngressPGReconciler_UpdateIngressHostname(t *testing.T) {
 			},
 		},
 		Spec: networkingv1.IngressSpec{
-			IngressClassName: ptr.To("tailscale"),
+			IngressClassName: new("tailscale"),
 			DefaultBackend: &networkingv1.IngressBackend{
 				Service: &networkingv1.IngressServiceBackend{
 					Name: "test",
@@ -341,7 +340,7 @@ func TestValidateIngress(t *testing.T) {
 			},
 		},
 		Spec: networkingv1.IngressSpec{
-			IngressClassName: ptr.To("tailscale"),
+			IngressClassName: new("tailscale"),
 			TLS: []networkingv1.IngressTLS{
 				{Hosts: []string{"test"}},
 			},
@@ -475,7 +474,7 @@ func TestValidateIngress(t *testing.T) {
 					},
 				},
 				Spec: networkingv1.IngressSpec{
-					IngressClassName: ptr.To("tailscale"),
+					IngressClassName: new("tailscale"),
 					TLS: []networkingv1.IngressTLS{
 						{Hosts: []string{"test"}},
 					},
@@ -522,7 +521,7 @@ func TestIngressPGReconciler_HTTPEndpoint(t *testing.T) {
 			},
 		},
 		Spec: networkingv1.IngressSpec{
-			IngressClassName: ptr.To("tailscale"),
+			IngressClassName: new("tailscale"),
 			DefaultBackend: &networkingv1.IngressBackend{
 				Service: &networkingv1.IngressServiceBackend{
 					Name: "test",
@@ -651,7 +650,7 @@ func TestIngressPGReconciler_HTTPRedirect(t *testing.T) {
 			},
 		},
 		Spec: networkingv1.IngressSpec{
-			IngressClassName: ptr.To("tailscale"),
+			IngressClassName: new("tailscale"),
 			DefaultBackend: &networkingv1.IngressBackend{
 				Service: &networkingv1.IngressServiceBackend{
 					Name: "test",
@@ -775,7 +774,7 @@ func TestIngressPGReconciler_HTTPEndpointAndRedirectConflict(t *testing.T) {
 			},
 		},
 		Spec: networkingv1.IngressSpec{
-			IngressClassName: ptr.To("tailscale"),
+			IngressClassName: new("tailscale"),
 			DefaultBackend: &networkingv1.IngressBackend{
 				Service: &networkingv1.IngressServiceBackend{
 					Name: "test",
@@ -864,7 +863,7 @@ func TestIngressPGReconciler_MultiCluster(t *testing.T) {
 			},
 		},
 		Spec: networkingv1.IngressSpec{
-			IngressClassName: ptr.To("tailscale"),
+			IngressClassName: new("tailscale"),
 			TLS: []networkingv1.IngressTLS{
 				{Hosts: []string{"my-svc"}},
 			},

cmd/k8s-operator/ingress_test.go

@@ -25,7 +25,6 @@ import (
 	tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
 	"tailscale.com/kube/kubetypes"
 	"tailscale.com/tstest"
-	"tailscale.com/types/ptr"
 	"tailscale.com/util/mak"
 )
 
@@ -59,7 +58,7 @@ func TestTailscaleIngress(t *testing.T) {
 
 	fullName, shortName := findGenName(t, fc, "default", "test", "ingress")
 	opts := configOpts{
-		replicas:   ptr.To[int32](1),
+		replicas:   new(int32(1)),
 		stsName:    shortName,
 		secretName: fullName,
 		namespace:  "default",
@@ -109,7 +108,7 @@ func TestTailscaleIngress(t *testing.T) {
 
 	// 4. Resources get cleaned up when Ingress class is unset
 	mustUpdate(t, fc, "default", "test", func(ing *networkingv1.Ingress) {
-		ing.Spec.IngressClassName = ptr.To("nginx")
+		ing.Spec.IngressClassName = new("nginx")
 	})
 	expectReconciled(t, ingR, "default", "test")
 	expectReconciled(t, ingR, "default", "test") // deleting Ingress STS requires two reconciles
@@ -639,7 +638,7 @@ func TestEmptyPath(t *testing.T) {
 			name: "empty_path_with_prefix_type",
 			paths: []networkingv1.HTTPIngressPath{
 				{
-					PathType: ptrPathType(networkingv1.PathTypePrefix),
+					PathType: new(networkingv1.PathTypePrefix),
 					Path:     "",
 					Backend:  *backend(),
 				},
@@ -652,7 +651,7 @@ func TestEmptyPath(t *testing.T) {
 			name: "empty_path_with_implementation_specific_type",
 			paths: []networkingv1.HTTPIngressPath{
 				{
-					PathType: ptrPathType(networkingv1.PathTypeImplementationSpecific),
+					PathType: new(networkingv1.PathTypeImplementationSpecific),
 					Path:     "",
 					Backend:  *backend(),
 				},
@@ -665,7 +664,7 @@ func TestEmptyPath(t *testing.T) {
 			name: "empty_path_with_exact_type",
 			paths: []networkingv1.HTTPIngressPath{
 				{
-					PathType: ptrPathType(networkingv1.PathTypeExact),
+					PathType: new(networkingv1.PathTypeExact),
 					Path:     "",
 					Backend:  *backend(),
 				},
@@ -679,12 +678,12 @@ func TestEmptyPath(t *testing.T) {
 			name: "two_competing_but_not_identical_paths_including_one_empty",
 			paths: []networkingv1.HTTPIngressPath{
 				{
-					PathType: ptrPathType(networkingv1.PathTypeImplementationSpecific),
+					PathType: new(networkingv1.PathTypeImplementationSpecific),
 					Path:     "",
 					Backend:  *backend(),
 				},
 				{
-					PathType: ptrPathType(networkingv1.PathTypeImplementationSpecific),
+					PathType: new(networkingv1.PathTypeImplementationSpecific),
 					Path:     "/",
 					Backend:  *backend(),
 				},
@@ -760,11 +759,6 @@ func TestEmptyPath(t *testing.T) {
 	}
 }
 
-// ptrPathType is a helper function to return a pointer to the pathtype string (required for TestEmptyPath)
-func ptrPathType(p networkingv1.PathType) *networkingv1.PathType {
-	return &p
-}
-
 func ingressClass() *networkingv1.IngressClass {
 	return &networkingv1.IngressClass{
 		ObjectMeta: metav1.ObjectMeta{Name: "tailscale"},
@@ -799,7 +793,7 @@ func ingress() *networkingv1.Ingress {
 			UID:       "1234-UID",
 		},
 		Spec: networkingv1.IngressSpec{
-			IngressClassName: ptr.To("tailscale"),
+			IngressClassName: new("tailscale"),
 			DefaultBackend:   backend(),
 			TLS: []networkingv1.IngressTLS{
 				{Hosts: []string{"default-test"}},
@@ -817,7 +811,7 @@ func ingressWithPaths(paths []networkingv1.HTTPIngressPath) *networkingv1.Ingres
 			UID:       types.UID("1234-UID"),
 		},
 		Spec: networkingv1.IngressSpec{
-			IngressClassName: ptr.To("tailscale"),
+			IngressClassName: new("tailscale"),
 			Rules: []networkingv1.IngressRule{
 				{
 					Host: "foo.tailnetxyz.ts.net",
@@ -878,7 +872,7 @@ func TestTailscaleIngressWithHTTPRedirect(t *testing.T) {
 
 	fullName, shortName := findGenName(t, fc, "default", "test", "ingress")
 	opts := configOpts{
-		replicas:   ptr.To[int32](1),
+		replicas:   new(int32(1)),
 		stsName:    shortName,
 		secretName: fullName,
 		namespace:  "default",

cmd/k8s-operator/nameserver.go

@@ -31,7 +31,6 @@ import (
 	tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
 	"tailscale.com/kube/kubetypes"
 	"tailscale.com/tstime"
-	"tailscale.com/types/ptr"
 	"tailscale.com/util/clientmetric"
 	"tailscale.com/util/set"
 )
@@ -245,7 +244,7 @@ var (
 			if err := yaml.Unmarshal(deployYaml, &d); err != nil {
 				return fmt.Errorf("error unmarshalling Deployment yaml: %w", err)
 			}
-			d.Spec.Replicas = ptr.To(cfg.replicas)
+			d.Spec.Replicas = new(cfg.replicas)
 			d.Spec.Template.Spec.Containers[0].Image = fmt.Sprintf("%s:%s", cfg.imageRepo, cfg.imageTag)
 			d.ObjectMeta.Namespace = cfg.namespace
 			d.ObjectMeta.Labels = cfg.labels

cmd/k8s-operator/nameserver_test.go

@@ -23,7 +23,6 @@ import (
 	operatorutils "tailscale.com/k8s-operator"
 	tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
 	"tailscale.com/tstest"
-	"tailscale.com/types/ptr"
 	"tailscale.com/util/mak"
 )
 
@@ -35,7 +34,7 @@ func TestNameserverReconciler(t *testing.T) {
 		},
 		Spec: tsapi.DNSConfigSpec{
 			Nameserver: &tsapi.Nameserver{
-				Replicas: ptr.To[int32](3),
+				Replicas: new(int32(3)),
 				Image: &tsapi.NameserverImage{
 					Repo: "test",
 					Tag:  "v0.0.1",
@@ -87,7 +86,7 @@ func TestNameserverReconciler(t *testing.T) {
 		}
 		wantsDeploy.OwnerReferences = []metav1.OwnerReference{*ownerReference}
 		wantsDeploy.Spec.Template.Spec.Containers[0].Image = "test:v0.0.1"
-		wantsDeploy.Spec.Replicas = ptr.To[int32](3)
+		wantsDeploy.Spec.Replicas = new(int32(3))
 		wantsDeploy.Namespace = tsNamespace
 		wantsDeploy.ObjectMeta.Labels = nameserverLabels
 		wantsDeploy.Spec.Template.Spec.Tolerations = []corev1.Toleration{

cmd/k8s-operator/operator_test.go

@@ -30,7 +30,6 @@ import (
 	"tailscale.com/net/dns/resolvconffile"
 	"tailscale.com/tstest"
 	"tailscale.com/tstime"
-	"tailscale.com/types/ptr"
 	"tailscale.com/util/dnsname"
 	"tailscale.com/util/mak"
 )
@@ -71,7 +70,7 @@ func TestLoadBalancerClass(t *testing.T) {
 		Spec: corev1.ServiceSpec{
 			ClusterIP:         "10.20.30.40",
 			Type:              corev1.ServiceTypeLoadBalancer,
-			LoadBalancerClass: ptr.To("tailscale"),
+			LoadBalancerClass: new("tailscale"),
 		},
 	})
 
@@ -94,7 +93,7 @@ func TestLoadBalancerClass(t *testing.T) {
 		Spec: corev1.ServiceSpec{
 			ClusterIP:         "10.20.30.40",
 			Type:              corev1.ServiceTypeLoadBalancer,
-			LoadBalancerClass: ptr.To("tailscale"),
+			LoadBalancerClass: new("tailscale"),
 		},
 		Status: corev1.ServiceStatus{
 			Conditions: []metav1.Condition{{
@@ -119,7 +118,7 @@ func TestLoadBalancerClass(t *testing.T) {
 
 	fullName, shortName := findGenName(t, fc, "default", "test", "svc")
 	opts := configOpts{
-		replicas:        ptr.To[int32](1),
+		replicas:        new(int32(1)),
 		stsName:         shortName,
 		secretName:      fullName,
 		namespace:       "default",
@@ -259,7 +258,7 @@ func TestTailnetTargetFQDNAnnotation(t *testing.T) {
 
 	fullName, shortName := findGenName(t, fc, "default", "test", "svc")
 	o := configOpts{
-		replicas:          ptr.To[int32](1),
+		replicas:          new(int32(1)),
 		stsName:           shortName,
 		secretName:        fullName,
 		namespace:         "default",
@@ -369,7 +368,7 @@ func TestTailnetTargetIPAnnotation(t *testing.T) {
 
 	fullName, shortName := findGenName(t, fc, "default", "test", "svc")
 	o := configOpts{
-		replicas:        ptr.To[int32](1),
+		replicas:        new(int32(1)),
 		stsName:         shortName,
 		secretName:      fullName,
 		namespace:       "default",
@@ -466,7 +465,7 @@ func TestTailnetTargetIPAnnotation_IPCouldNotBeParsed(t *testing.T) {
 		Spec: corev1.ServiceSpec{
 			ClusterIP:         "10.20.30.40",
 			Type:              corev1.ServiceTypeLoadBalancer,
-			LoadBalancerClass: ptr.To("tailscale"),
+			LoadBalancerClass: new("tailscale"),
 		},
 	})
 
@@ -486,7 +485,7 @@ func TestTailnetTargetIPAnnotation_IPCouldNotBeParsed(t *testing.T) {
 		Spec: corev1.ServiceSpec{
 			ClusterIP:         "10.20.30.40",
 			Type:              corev1.ServiceTypeLoadBalancer,
-			LoadBalancerClass: ptr.To("tailscale"),
+			LoadBalancerClass: new("tailscale"),
 		},
 		Status: corev1.ServiceStatus{
 			Conditions: []metav1.Condition{{
@@ -534,7 +533,7 @@ func TestTailnetTargetIPAnnotation_InvalidIP(t *testing.T) {
 		Spec: corev1.ServiceSpec{
 			ClusterIP:         "10.20.30.40",
 			Type:              corev1.ServiceTypeLoadBalancer,
-			LoadBalancerClass: ptr.To("tailscale"),
+			LoadBalancerClass: new("tailscale"),
 		},
 	})
 
@@ -554,7 +553,7 @@ func TestTailnetTargetIPAnnotation_InvalidIP(t *testing.T) {
 		Spec: corev1.ServiceSpec{
 			ClusterIP:         "10.20.30.40",
 			Type:              corev1.ServiceTypeLoadBalancer,
-			LoadBalancerClass: ptr.To("tailscale"),
+			LoadBalancerClass: new("tailscale"),
 		},
 		Status: corev1.ServiceStatus{
 			Conditions: []metav1.Condition{{
@@ -612,7 +611,7 @@ func TestAnnotations(t *testing.T) {
 
 	fullName, shortName := findGenName(t, fc, "default", "test", "svc")
 	o := configOpts{
-		replicas:        ptr.To[int32](1),
+		replicas:        new(int32(1)),
 		stsName:         shortName,
 		secretName:      fullName,
 		namespace:       "default",
@@ -716,7 +715,7 @@ func TestAnnotationIntoLB(t *testing.T) {
 
 	fullName, shortName := findGenName(t, fc, "default", "test", "svc")
 	o := configOpts{
-		replicas:        ptr.To[int32](1),
+		replicas:        new(int32(1)),
 		stsName:         shortName,
 		secretName:      fullName,
 		namespace:       "default",
@@ -767,7 +766,7 @@ func TestAnnotationIntoLB(t *testing.T) {
 	mustUpdate(t, fc, "default", "test", func(s *corev1.Service) {
 		delete(s.ObjectMeta.Annotations, "tailscale.com/expose")
 		s.Spec.Type = corev1.ServiceTypeLoadBalancer
-		s.Spec.LoadBalancerClass = ptr.To("tailscale")
+		s.Spec.LoadBalancerClass = new("tailscale")
 	})
 	expectReconciled(t, sr, "default", "test")
 	// None of the proxy machinery should have changed...
@@ -785,7 +784,7 @@ func TestAnnotationIntoLB(t *testing.T) {
 		Spec: corev1.ServiceSpec{
 			ClusterIP:         "10.20.30.40",
 			Type:              corev1.ServiceTypeLoadBalancer,
-			LoadBalancerClass: ptr.To("tailscale"),
+			LoadBalancerClass: new("tailscale"),
 		},
 		Status: corev1.ServiceStatus{
 			LoadBalancer: corev1.LoadBalancerStatus{
@@ -836,7 +835,7 @@ func TestLBIntoAnnotation(t *testing.T) {
 		Spec: corev1.ServiceSpec{
 			ClusterIP:         "10.20.30.40",
 			Type:              corev1.ServiceTypeLoadBalancer,
-			LoadBalancerClass: ptr.To("tailscale"),
+			LoadBalancerClass: new("tailscale"),
 		},
 	})
 
@@ -844,7 +843,7 @@ func TestLBIntoAnnotation(t *testing.T) {
 
 	fullName, shortName := findGenName(t, fc, "default", "test", "svc")
 	o := configOpts{
-		replicas:        ptr.To[int32](1),
+		replicas:        new(int32(1)),
 		stsName:         shortName,
 		secretName:      fullName,
 		namespace:       "default",
@@ -880,7 +879,7 @@ func TestLBIntoAnnotation(t *testing.T) {
 		Spec: corev1.ServiceSpec{
 			ClusterIP:         "10.20.30.40",
 			Type:              corev1.ServiceTypeLoadBalancer,
-			LoadBalancerClass: ptr.To("tailscale"),
+			LoadBalancerClass: new("tailscale"),
 		},
 		Status: corev1.ServiceStatus{
 			LoadBalancer: corev1.LoadBalancerStatus{
@@ -982,7 +981,7 @@ func TestCustomHostname(t *testing.T) {
 
 	fullName, shortName := findGenName(t, fc, "default", "test", "svc")
 	o := configOpts{
-		replicas:        ptr.To[int32](1),
+		replicas:        new(int32(1)),
 		stsName:         shortName,
 		secretName:      fullName,
 		namespace:       "default",
@@ -1092,7 +1091,7 @@ func TestCustomPriorityClassName(t *testing.T) {
 
 	fullName, shortName := findGenName(t, fc, "default", "test", "svc")
 	o := configOpts{
-		replicas:          ptr.To[int32](1),
+		replicas:          new(int32(1)),
 		stsName:           shortName,
 		secretName:        fullName,
 		namespace:         "default",
@@ -1332,13 +1331,13 @@ func TestProxyClassForService(t *testing.T) {
 		Spec: corev1.ServiceSpec{
 			ClusterIP:         "10.20.30.40",
 			Type:              corev1.ServiceTypeLoadBalancer,
-			LoadBalancerClass: ptr.To("tailscale"),
+			LoadBalancerClass: new("tailscale"),
 		},
 	})
 	expectReconciled(t, sr, "default", "test")
 	fullName, shortName := findGenName(t, fc, "default", "test", "svc")
 	opts := configOpts{
-		replicas:        ptr.To[int32](1),
+		replicas:        new(int32(1)),
 		stsName:         shortName,
 		secretName:      fullName,
 		namespace:       "default",
@@ -1431,7 +1430,7 @@ func TestDefaultLoadBalancer(t *testing.T) {
 
 	expectEqual(t, fc, expectedHeadlessService(shortName, "svc"))
 	o := configOpts{
-		replicas:        ptr.To[int32](1),
+		replicas:        new(int32(1)),
 		stsName:         shortName,
 		secretName:      fullName,
 		namespace:       "default",
@@ -1484,7 +1483,7 @@ func TestProxyFirewallMode(t *testing.T) {
 
 	fullName, shortName := findGenName(t, fc, "default", "test", "svc")
 	o := configOpts{
-		replicas:        ptr.To[int32](1),
+		replicas:        new(int32(1)),
 		stsName:         shortName,
 		secretName:      fullName,
 		namespace:       "default",
@@ -1596,7 +1595,7 @@ func Test_serviceHandlerForIngress(t *testing.T) {
 			Name:      "ing-1",
 			Namespace: "ns-1",
 		},
-		Spec: networkingv1.IngressSpec{IngressClassName: ptr.To(tailscaleIngressClassName)},
+		Spec: networkingv1.IngressSpec{IngressClassName: new(tailscaleIngressClassName)},
 	})
 	svc1 := &corev1.Service{
 		ObjectMeta: metav1.ObjectMeta{
@@ -1628,7 +1627,7 @@ func Test_serviceHandlerForIngress(t *testing.T) {
 			DefaultBackend: &networkingv1.IngressBackend{
 				Service: &networkingv1.IngressServiceBackend{Name: "def-backend"},
 			},
-			IngressClassName: ptr.To(tailscaleIngressClassName),
+			IngressClassName: new(tailscaleIngressClassName),
 		},
 	})
 	backendSvc := &corev1.Service{
@@ -1652,7 +1651,7 @@ func Test_serviceHandlerForIngress(t *testing.T) {
 			Namespace: "ns-3",
 		},
 		Spec: networkingv1.IngressSpec{
-			IngressClassName: ptr.To(tailscaleIngressClassName),
+			IngressClassName: new(tailscaleIngressClassName),
 			Rules: []networkingv1.IngressRule{{IngressRuleValue: networkingv1.IngressRuleValue{HTTP: &networkingv1.HTTPIngressRuleValue{
 				Paths: []networkingv1.HTTPIngressPath{
 					{Backend: networkingv1.IngressBackend{Service: &networkingv1.IngressServiceBackend{Name: "backend"}}},
@@ -1727,7 +1726,7 @@ func Test_serviceHandlerForIngress_multipleIngressClasses(t *testing.T) {
 	mustCreate(t, fc, &networkingv1.Ingress{
 		ObjectMeta: metav1.ObjectMeta{Name: "nginx-ing", Namespace: "default"},
 		Spec: networkingv1.IngressSpec{
-			IngressClassName: ptr.To("nginx"),
+			IngressClassName: new("nginx"),
 			DefaultBackend:   &networkingv1.IngressBackend{Service: &networkingv1.IngressServiceBackend{Name: "backend"}},
 		},
 	})
@@ -1735,7 +1734,7 @@ func Test_serviceHandlerForIngress_multipleIngressClasses(t *testing.T) {
 	mustCreate(t, fc, &networkingv1.Ingress{
 		ObjectMeta: metav1.ObjectMeta{Name: "ts-ing", Namespace: "default"},
 		Spec: networkingv1.IngressSpec{
-			IngressClassName: ptr.To("tailscale"),
+			IngressClassName: new("tailscale"),
 			DefaultBackend:   &networkingv1.IngressBackend{Service: &networkingv1.IngressServiceBackend{Name: "backend"}},
 		},
 	})
@@ -1844,7 +1843,7 @@ func Test_authKeyRemoval(t *testing.T) {
 		Spec: corev1.ServiceSpec{
 			ClusterIP:         "10.20.30.40",
 			Type:              corev1.ServiceTypeLoadBalancer,
-			LoadBalancerClass: ptr.To("tailscale"),
+			LoadBalancerClass: new("tailscale"),
 		},
 	})
 
@@ -1859,7 +1858,7 @@ func Test_authKeyRemoval(t *testing.T) {
 		hostname:        "default-test",
 		clusterTargetIP: "10.20.30.40",
 		app:             kubetypes.AppIngressProxy,
-		replicas:        ptr.To[int32](1),
+		replicas:        new(int32(1)),
 	}
 
 	expectEqual(t, fc, expectedSecret(t, fc, opts))
@@ -1924,7 +1923,7 @@ func Test_externalNameService(t *testing.T) {
 
 	fullName, shortName := findGenName(t, fc, "default", "test", "svc")
 	opts := configOpts{
-		replicas:         ptr.To[int32](1),
+		replicas:         new(int32(1)),
 		stsName:          shortName,
 		secretName:       fullName,
 		namespace:        "default",
@@ -1969,7 +1968,7 @@ func Test_metricsResourceCreation(t *testing.T) {
 		Spec: corev1.ServiceSpec{
 			ClusterIP:         "10.20.30.40",
 			Type:              corev1.ServiceTypeLoadBalancer,
-			LoadBalancerClass: ptr.To("tailscale"),
+			LoadBalancerClass: new("tailscale"),
 		},
 	}
 	crd := &apiextensionsv1.CustomResourceDefinition{ObjectMeta: metav1.ObjectMeta{Name: serviceMonitorCRD}}

cmd/k8s-operator/proxygroup.go

@@ -42,7 +42,6 @@ import (
 	"tailscale.com/tailcfg"
 	"tailscale.com/tstime"
 	"tailscale.com/types/opt"
-	"tailscale.com/types/ptr"
 	"tailscale.com/util/clientmetric"
 	"tailscale.com/util/mak"
 	"tailscale.com/util/set"
@@ -624,7 +623,7 @@ func (r *ProxyGroupReconciler) ensureNodePortServiceCreated(ctx context.Context,
 		}
 	}
 
-	return svcToNodePorts, ptr.To(tailscaledPort), nil
+	return svcToNodePorts, new(tailscaledPort), nil
 }
 
 // cleanupDanglingResources ensures we don't leak config secrets, state secrets, and
@@ -837,9 +836,9 @@ func (r *ProxyGroupReconciler) ensureConfigSecretsCreated(
 				Version: "v1alpha1",
 				ConfigV1Alpha1: &conf.ConfigV1Alpha1{
 					AuthKey:  authKey,
-					State:    ptr.To(fmt.Sprintf("kube:%s", pgPodName(pg.Name, i))),
-					App:      ptr.To(kubetypes.AppProxyGroupKubeAPIServer),
-					LogLevel: ptr.To(logger.Level().String()),
+					State:    new(fmt.Sprintf("kube:%s", pgPodName(pg.Name, i))),
+					App:      new(kubetypes.AppProxyGroupKubeAPIServer),
+					LogLevel: new(logger.Level().String()),
 
 					// Reloadable fields.
 					Hostname: &hostname,
@@ -850,7 +849,7 @@ func (r *ProxyGroupReconciler) ensureConfigSecretsCreated(
 						// as containerboot does for ingress-pg-reconciler.
 						IssueCerts: opt.NewBool(i == 0),
 					},
-					LocalPort:          ptr.To(uint16(9002)),
+					LocalPort:          new(uint16(9002)),
 					HealthCheckEnabled: opt.NewBool(true),
 				},
 			}
@@ -1021,7 +1020,7 @@ func getStaticEndpointAddress(a *corev1.NodeAddress, port uint16) *netip.AddrPor
 		return nil
 	}
 
-	return ptr.To(netip.AddrPortFrom(addr, port))
+	return new(netip.AddrPortFrom(addr, port))
 }
 
 // ensureAddedToGaugeForProxyGroup ensures the gauge metric for the ProxyGroup resource is updated when the ProxyGroup
@@ -1062,7 +1061,7 @@ func pgTailscaledConfig(pg *tsapi.ProxyGroup, pc *tsapi.ProxyClass, idx int32, a
 		AcceptDNS:         "false",
 		AcceptRoutes:      "false", // AcceptRoutes defaults to true
 		Locked:            "false",
-		Hostname:          ptr.To(pgHostname(pg, idx)),
+		Hostname:          new(pgHostname(pg, idx)),
 		AdvertiseServices: oldAdvertiseServices,
 		AuthKey:           authKey,
 	}

cmd/k8s-operator/proxygroup_specs.go

@@ -22,7 +22,6 @@ import (
 	"tailscale.com/kube/egressservices"
 	"tailscale.com/kube/ingressservices"
 	"tailscale.com/kube/kubetypes"
-	"tailscale.com/types/ptr"
 )
 
 const (
@@ -87,7 +86,7 @@ func pgStatefulSet(pg *tsapi.ProxyGroup, namespace, image, tsFirewallMode string
 		Labels:          pgLabels(pg.Name, nil),
 		OwnerReferences: pgOwnerReference(pg),
 	}
-	ss.Spec.Replicas = ptr.To(pgReplicas(pg))
+	ss.Spec.Replicas = new(pgReplicas(pg))
 	ss.Spec.Selector = &metav1.LabelSelector{
 		MatchLabels: pgLabels(pg.Name, nil),
 	}
@@ -98,7 +97,7 @@ func pgStatefulSet(pg *tsapi.ProxyGroup, namespace, image, tsFirewallMode string
 		Name:                       pg.Name,
 		Namespace:                  namespace,
 		Labels:                     pgLabels(pg.Name, nil),
-		DeletionGracePeriodSeconds: ptr.To[int64](10),
+		DeletionGracePeriodSeconds: new(int64(10)),
 	}
 	tmpl.Spec.ServiceAccountName = pg.Name
 	tmpl.Spec.InitContainers[0].Image = image
@@ -282,7 +281,7 @@ func pgStatefulSet(pg *tsapi.ProxyGroup, namespace, image, tsFirewallMode string
 		}
 		// Set the deletion grace period to 6 minutes to ensure that the pre-stop hook has enough time to terminate
 		// gracefully.
-		ss.Spec.Template.DeletionGracePeriodSeconds = ptr.To(deletionGracePeriodSeconds)
+		ss.Spec.Template.DeletionGracePeriodSeconds = new(deletionGracePeriodSeconds)
 	}
 
 	return ss, nil
@@ -297,7 +296,7 @@ func kubeAPIServerStatefulSet(pg *tsapi.ProxyGroup, namespace, image string, por
 			OwnerReferences: pgOwnerReference(pg),
 		},
 		Spec: appsv1.StatefulSetSpec{
-			Replicas: ptr.To(pgReplicas(pg)),
+			Replicas: new(pgReplicas(pg)),
 			Selector: &metav1.LabelSelector{
 				MatchLabels: pgLabels(pg.Name, nil),
 			},
@@ -306,7 +305,7 @@ func kubeAPIServerStatefulSet(pg *tsapi.ProxyGroup, namespace, image string, por
 					Name:                       pg.Name,
 					Namespace:                  namespace,
 					Labels:                     pgLabels(pg.Name, nil),
-					DeletionGracePeriodSeconds: ptr.To[int64](10),
+					DeletionGracePeriodSeconds: new(int64(10)),
 				},
 				Spec: corev1.PodSpec{
 					ServiceAccountName: pgServiceAccountName(pg),

cmd/k8s-operator/proxygroup_test.go

@@ -36,7 +36,6 @@ import (
 	"tailscale.com/tailcfg"
 	"tailscale.com/tstest"
 	"tailscale.com/types/opt"
-	"tailscale.com/types/ptr"
 )
 
 const (
@@ -49,7 +48,7 @@ var (
 		"some-annotation": "from-the-proxy-class",
 	}
 
-	defaultReplicas             = ptr.To(int32(2))
+	defaultReplicas             = new(int32(2))
 	defaultStaticEndpointConfig = &tsapi.StaticEndpointsConfig{
 		NodePort: &tsapi.NodePortConfig{
 			Ports: []tsapi.PortRange{
@@ -107,7 +106,7 @@ func TestProxyGroupWithStaticEndpoints(t *testing.T) {
 							},
 						},
 					},
-					replicas: ptr.To(int32(4)),
+					replicas: new(int32(4)),
 					nodes: []testNode{
 						{
 							name:      "foobar",
@@ -150,7 +149,7 @@ func TestProxyGroupWithStaticEndpoints(t *testing.T) {
 							},
 						},
 					},
-					replicas: ptr.To(int32(4)),
+					replicas: new(int32(4)),
 					nodes: []testNode{
 						{
 							name:      "foobar",
@@ -192,7 +191,7 @@ func TestProxyGroupWithStaticEndpoints(t *testing.T) {
 							},
 						},
 					},
-					replicas: ptr.To(int32(4)),
+					replicas: new(int32(4)),
 					nodes: []testNode{
 						{
 							name:      "foobar",
@@ -234,7 +233,7 @@ func TestProxyGroupWithStaticEndpoints(t *testing.T) {
 							},
 						},
 					},
-					replicas: ptr.To(int32(3)),
+					replicas: new(int32(3)),
 					nodes: []testNode{
 						{name: "node1", addresses: []testNodeAddr{{ip: "10.0.0.1", addrType: corev1.NodeExternalIP}}, labels: map[string]string{"foo/bar": "baz"}},
 						{name: "node2", addresses: []testNodeAddr{{ip: "10.0.0.2", addrType: corev1.NodeExternalIP}}, labels: map[string]string{"foo/bar": "baz"}},
@@ -294,7 +293,7 @@ func TestProxyGroupWithStaticEndpoints(t *testing.T) {
 							},
 						},
 					},
-					replicas: ptr.To(int32(4)),
+					replicas: new(int32(4)),
 					nodes: []testNode{
 						{
 							name:      "foobar",
@@ -942,7 +941,7 @@ func TestProxyGroup(t *testing.T) {
 	})
 
 	t.Run("scale_up_to_3", func(t *testing.T) {
-		pg.Spec.Replicas = ptr.To[int32](3)
+		pg.Spec.Replicas = new(int32(3))
 		mustUpdate(t, fc, "", pg.Name, func(p *tsapi.ProxyGroup) {
 			p.Spec = pg.Spec
 		})
@@ -965,7 +964,7 @@ func TestProxyGroup(t *testing.T) {
 	})
 
 	t.Run("scale_down_to_1", func(t *testing.T) {
-		pg.Spec.Replicas = ptr.To[int32](1)
+		pg.Spec.Replicas = new(int32(1))
 		mustUpdate(t, fc, "", pg.Name, func(p *tsapi.ProxyGroup) {
 			p.Spec = pg.Spec
 		})
@@ -1062,7 +1061,7 @@ func TestProxyGroupTypes(t *testing.T) {
 			},
 			Spec: tsapi.ProxyGroupSpec{
 				Type:     tsapi.ProxyGroupTypeEgress,
-				Replicas: ptr.To[int32](0),
+				Replicas: new(int32(0)),
 			},
 		}
 		mustCreate(t, fc, pg)
@@ -1137,7 +1136,7 @@ func TestProxyGroupTypes(t *testing.T) {
 			},
 			Spec: tsapi.ProxyGroupSpec{
 				Type:       tsapi.ProxyGroupTypeEgress,
-				Replicas:   ptr.To[int32](0),
+				Replicas:   new(int32(0)),
 				ProxyClass: "test",
 			},
 		}
@@ -1174,7 +1173,7 @@ func TestProxyGroupTypes(t *testing.T) {
 			},
 			Spec: tsapi.ProxyGroupSpec{
 				Type:     tsapi.ProxyGroupTypeIngress,
-				Replicas: ptr.To[int32](0),
+				Replicas: new(int32(0)),
 			},
 		}
 		if err := fc.Create(t.Context(), pg); err != nil {
@@ -1228,9 +1227,9 @@ func TestProxyGroupTypes(t *testing.T) {
 			},
 			Spec: tsapi.ProxyGroupSpec{
 				Type:     tsapi.ProxyGroupTypeKubernetesAPIServer,
-				Replicas: ptr.To[int32](2),
+				Replicas: new(int32(2)),
 				KubeAPIServer: &tsapi.KubeAPIServerConfig{
-					Mode: ptr.To(tsapi.APIServerProxyModeNoAuth),
+					Mode: new(tsapi.APIServerProxyModeNoAuth),
 				},
 			},
 		}
@@ -1268,9 +1267,9 @@ func TestKubeAPIServerStatusConditionFlow(t *testing.T) {
 		},
 		Spec: tsapi.ProxyGroupSpec{
 			Type:     tsapi.ProxyGroupTypeKubernetesAPIServer,
-			Replicas: ptr.To[int32](1),
+			Replicas: new(int32(1)),
 			KubeAPIServer: &tsapi.KubeAPIServerConfig{
-				Mode: ptr.To(tsapi.APIServerProxyModeNoAuth),
+				Mode: new(tsapi.APIServerProxyModeNoAuth),
 			},
 		},
 	}
@@ -1354,9 +1353,9 @@ func TestKubeAPIServerType_DoesNotOverwriteServicesConfig(t *testing.T) {
 		},
 		Spec: tsapi.ProxyGroupSpec{
 			Type:     tsapi.ProxyGroupTypeKubernetesAPIServer,
-			Replicas: ptr.To[int32](1),
+			Replicas: new(int32(1)),
 			KubeAPIServer: &tsapi.KubeAPIServerConfig{
-				Mode: ptr.To(tsapi.APIServerProxyModeNoAuth), // Avoid needing to pre-create the static ServiceAccount.
+				Mode: new(tsapi.APIServerProxyModeNoAuth), // Avoid needing to pre-create the static ServiceAccount.
 			},
 		},
 	}
@@ -1368,18 +1367,18 @@ func TestKubeAPIServerType_DoesNotOverwriteServicesConfig(t *testing.T) {
 	cfg := conf.VersionedConfig{
 		Version: "v1alpha1",
 		ConfigV1Alpha1: &conf.ConfigV1Alpha1{
-			AuthKey:  ptr.To("secret-authkey"),
-			State:    ptr.To(fmt.Sprintf("kube:%s", pgPodName(pg.Name, 0))),
-			App:      ptr.To(kubetypes.AppProxyGroupKubeAPIServer),
-			LogLevel: ptr.To("debug"),
+			AuthKey:  new("secret-authkey"),
+			State:    new(fmt.Sprintf("kube:%s", pgPodName(pg.Name, 0))),
+			App:      new(kubetypes.AppProxyGroupKubeAPIServer),
+			LogLevel: new("debug"),
 
-			Hostname: ptr.To("test-k8s-apiserver-0"),
+			Hostname: new("test-k8s-apiserver-0"),
 			APIServerProxy: &conf.APIServerProxyConfig{
 				Enabled:    opt.NewBool(true),
-				Mode:       ptr.To(kubetypes.APIServerProxyModeNoAuth),
+				Mode:       new(kubetypes.APIServerProxyModeNoAuth),
 				IssueCerts: opt.NewBool(true),
 			},
-			LocalPort:          ptr.To(uint16(9002)),
+			LocalPort:          new(uint16(9002)),
 			HealthCheckEnabled: opt.NewBool(true),
 		},
 	}
@@ -1403,7 +1402,7 @@ func TestKubeAPIServerType_DoesNotOverwriteServicesConfig(t *testing.T) {
 
 	// Now simulate the kube-apiserver services reconciler updating config,
 	// then check the proxygroup reconciler doesn't overwrite it.
-	cfg.APIServerProxy.ServiceName = ptr.To(tailcfg.ServiceName("svc:some-svc-name"))
+	cfg.APIServerProxy.ServiceName = new(tailcfg.ServiceName("svc:some-svc-name"))
 	cfg.AdvertiseServices = []string{"svc:should-not-be-overwritten"}
 	cfgB, err = json.Marshal(cfg)
 	if err != nil {
@@ -1459,7 +1458,7 @@ func TestIngressAdvertiseServicesConfigPreserved(t *testing.T) {
 		},
 		Spec: tsapi.ProxyGroupSpec{
 			Type:     tsapi.ProxyGroupTypeIngress,
-			Replicas: ptr.To[int32](1),
+			Replicas: new(int32(1)),
 		},
 	})
 	expectReconciled(t, reconciler, "", pgName)
@@ -1473,7 +1472,7 @@ func TestIngressAdvertiseServicesConfigPreserved(t *testing.T) {
 		AcceptDNS:    "false",
 		AcceptRoutes: "false",
 		Locked:       "false",
-		Hostname:     ptr.To(fmt.Sprintf("%s-%d", pgName, 0)),
+		Hostname:     new(fmt.Sprintf("%s-%d", pgName, 0)),
 	})
 	if err != nil {
 		t.Fatal(err)
@@ -1609,7 +1608,7 @@ func TestValidateProxyGroup(t *testing.T) {
 			}
 			if tc.noauth {
 				pg.Spec.KubeAPIServer = &tsapi.KubeAPIServerConfig{
-					Mode: ptr.To(tsapi.APIServerProxyModeNoAuth),
+					Mode: new(tsapi.APIServerProxyModeNoAuth),
 				}
 			}
 
@@ -1875,7 +1874,7 @@ func TestProxyGroupLetsEncryptStaging(t *testing.T) {
 				},
 				Spec: tsapi.ProxyGroupSpec{
 					Type:       tt.pgType,
-					Replicas:   ptr.To[int32](1),
+					Replicas:   new(int32(1)),
 					ProxyClass: tt.proxyClassPerResource,
 				},
 			}

cmd/k8s-operator/sts.go

@@ -38,7 +38,6 @@ import (
 	"tailscale.com/net/netutil"
 	"tailscale.com/tailcfg"
 	"tailscale.com/types/opt"
-	"tailscale.com/types/ptr"
 	"tailscale.com/util/mak"
 )
 
@@ -378,7 +377,7 @@ func (a *tailscaleSTSReconciler) reconcileHeadlessService(ctx context.Context, l
 			Selector: map[string]string{
 				"app": sts.ParentResourceUID,
 			},
-			IPFamilyPolicy: ptr.To(corev1.IPFamilyPolicyPreferDualStack),
+			IPFamilyPolicy: new(corev1.IPFamilyPolicyPreferDualStack),
 		},
 	}
 	logger.Debugf("reconciling headless service for StatefulSet")
@@ -526,7 +525,7 @@ func sanitizeConfig(c ipn.ConfigVAlpha) ipn.ConfigVAlpha {
 	// Explicitly redact AuthKey because we never want it appearing in logs. Never populate this with the
 	// actual auth key.
 	if c.AuthKey != nil {
-		c.AuthKey = ptr.To("**redacted**")
+		c.AuthKey = new("**redacted**")
 	}
 
 	return c
@@ -683,7 +682,7 @@ func (a *tailscaleSTSReconciler) reconcileSTS(ctx context.Context, logger *zap.S
 	}
 
 	if sts.Replicas > 0 {
-		ss.Spec.Replicas = ptr.To(sts.Replicas)
+		ss.Spec.Replicas = new(sts.Replicas)
 	}
 
 	// Generic containerboot configuration options.

cmd/k8s-operator/sts_test.go

@@ -22,7 +22,6 @@ import (
 	"sigs.k8s.io/yaml"
 	tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
 	"tailscale.com/kube/kubetypes"
-	"tailscale.com/types/ptr"
 )
 
 // Test_statefulSetNameBase tests that parent name portion in a StatefulSet name
@@ -69,7 +68,7 @@ func Test_applyProxyClassToStatefulSet(t *testing.T) {
 					Labels:      tsapi.Labels{"bar": "foo"},
 					Annotations: map[string]string{"bar.io/foo": "foo"},
 					SecurityContext: &corev1.PodSecurityContext{
-						RunAsUser: ptr.To(int64(0)),
+						RunAsUser: new(int64(0)),
 					},
 					ImagePullSecrets:  []corev1.LocalObjectReference{{Name: "docker-creds"}},
 					NodeName:          "some-node",
@@ -87,18 +86,18 @@ func Test_applyProxyClassToStatefulSet(t *testing.T) {
 							},
 						},
 					},
-					DNSPolicy: ptr.To(corev1.DNSClusterFirstWithHostNet),
+					DNSPolicy: new(corev1.DNSClusterFirstWithHostNet),
 					DNSConfig: &corev1.PodDNSConfig{
 						Nameservers: []string{"1.1.1.1", "8.8.8.8"},
 						Searches:    []string{"example.com", "test.local"},
 						Options: []corev1.PodDNSConfigOption{
-							{Name: "ndots", Value: ptr.To("2")},
+							{Name: "ndots", Value: new("2")},
 							{Name: "edns0"},
 						},
 					},
 					TailscaleContainer: &tsapi.Container{
 						SecurityContext: &corev1.SecurityContext{
-							Privileged: ptr.To(true),
+							Privileged: new(true),
 						},
 						Resources: corev1.ResourceRequirements{
 							Limits:   corev1.ResourceList{corev1.ResourceCPU: resource.MustParse("1000m"), corev1.ResourceMemory: resource.MustParse("128Mi")},
@@ -110,8 +109,8 @@ func Test_applyProxyClassToStatefulSet(t *testing.T) {
 					},
 					TailscaleInitContainer: &tsapi.Container{
 						SecurityContext: &corev1.SecurityContext{
-							Privileged: ptr.To(true),
-							RunAsUser:  ptr.To(int64(0)),
+							Privileged: new(true),
+							RunAsUser:  new(int64(0)),
 						},
 						Resources: corev1.ResourceRequirements{
 							Limits:   corev1.ResourceList{corev1.ResourceCPU: resource.MustParse("1000m"), corev1.ResourceMemory: resource.MustParse("128Mi")},
@@ -293,7 +292,7 @@ func Test_applyProxyClassToStatefulSet(t *testing.T) {
 		corev1.EnvVar{Name: "TS_ENABLE_METRICS", Value: "true"},
 	)
 	wantSS.Spec.Template.Spec.Containers[0].Ports = []corev1.ContainerPort{{Name: "metrics", Protocol: "TCP", ContainerPort: 9002}}
-	gotSS = applyProxyClassToStatefulSet(proxyClassWithMetricsDebug(true, ptr.To(false)), nonUserspaceProxySS.DeepCopy(), new(tailscaleSTSConfig), zl.Sugar())
+	gotSS = applyProxyClassToStatefulSet(proxyClassWithMetricsDebug(true, new(false)), nonUserspaceProxySS.DeepCopy(), new(tailscaleSTSConfig), zl.Sugar())
 	if diff := cmp.Diff(gotSS, wantSS); diff != "" {
 		t.Errorf("Unexpected result applying ProxyClass with metrics enabled to a StatefulSet (-got +want):\n%s", diff)
 	}
@@ -305,7 +304,7 @@ func Test_applyProxyClassToStatefulSet(t *testing.T) {
 		corev1.EnvVar{Name: "TS_TAILSCALED_EXTRA_ARGS", Value: "--debug=$(TS_DEBUG_ADDR_PORT)"},
 	)
 	wantSS.Spec.Template.Spec.Containers[0].Ports = []corev1.ContainerPort{{Name: "debug", Protocol: "TCP", ContainerPort: 9001}}
-	gotSS = applyProxyClassToStatefulSet(proxyClassWithMetricsDebug(false, ptr.To(true)), nonUserspaceProxySS.DeepCopy(), new(tailscaleSTSConfig), zl.Sugar())
+	gotSS = applyProxyClassToStatefulSet(proxyClassWithMetricsDebug(false, new(true)), nonUserspaceProxySS.DeepCopy(), new(tailscaleSTSConfig), zl.Sugar())
 	if diff := cmp.Diff(gotSS, wantSS); diff != "" {
 		t.Errorf("Unexpected result applying ProxyClass with metrics enabled to a StatefulSet (-got +want):\n%s", diff)
 	}

cmd/k8s-operator/svc-for-pg_test.go

@@ -28,7 +28,6 @@ import (
 	"tailscale.com/kube/ingressservices"
 	"tailscale.com/kube/kubetypes"
 	"tailscale.com/tstest"
-	"tailscale.com/types/ptr"
 	"tailscale.com/util/mak"
 
 	"tailscale.com/tailcfg"
@@ -235,7 +234,7 @@ func TestValidateService(t *testing.T) {
 		Spec: corev1.ServiceSpec{
 			ClusterIP:         "1.2.3.4",
 			Type:              corev1.ServiceTypeLoadBalancer,
-			LoadBalancerClass: ptr.To("tailscale"),
+			LoadBalancerClass: new("tailscale"),
 		},
 	}
 	svc2 := &corev1.Service{
@@ -252,7 +251,7 @@ func TestValidateService(t *testing.T) {
 		Spec: corev1.ServiceSpec{
 			ClusterIP:         "1.2.3.5",
 			Type:              corev1.ServiceTypeLoadBalancer,
-			LoadBalancerClass: ptr.To("tailscale"),
+			LoadBalancerClass: new("tailscale"),
 		},
 	}
 	wantSvc := &corev1.Service{
@@ -392,7 +391,7 @@ func setupTestService(t *testing.T, svcName string, hostname string, clusterIP s
 		},
 		Spec: corev1.ServiceSpec{
 			Type:              corev1.ServiceTypeLoadBalancer,
-			LoadBalancerClass: ptr.To("tailscale"),
+			LoadBalancerClass: new("tailscale"),
 			ClusterIP:         clusterIP,
 			ClusterIPs:        []string{clusterIP},
 		},
@@ -412,7 +411,7 @@ func setupTestService(t *testing.T, svcName string, hostname string, clusterIP s
 			{
 				Addresses: []string{"4.3.2.1"},
 				Conditions: discoveryv1.EndpointConditions{
-					Ready: ptr.To(true),
+					Ready: new(true),
 				},
 			},
 		},

cmd/k8s-operator/testutils_test.go

@@ -36,7 +36,6 @@ import (
 	tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
 	"tailscale.com/kube/kubetypes"
 	"tailscale.com/tailcfg"
-	"tailscale.com/types/ptr"
 	"tailscale.com/util/mak"
 )
 
@@ -96,7 +95,7 @@ func expectedSTS(t *testing.T, cl client.Client, opts configOpts) *appsv1.Statef
 			{Name: "TS_DEBUG_ACME_FORCE_RENEWAL", Value: "true"},
 		},
 		SecurityContext: &corev1.SecurityContext{
-			Privileged: ptr.To(true),
+			Privileged: new(true),
 		},
 		Resources: corev1.ResourceRequirements{
 			Requests: corev1.ResourceList{
@@ -231,7 +230,7 @@ func expectedSTS(t *testing.T, cl client.Client, opts configOpts) *appsv1.Statef
 			Template: corev1.PodTemplateSpec{
 				ObjectMeta: metav1.ObjectMeta{
 					Annotations:                annots,
-					DeletionGracePeriodSeconds: ptr.To[int64](10),
+					DeletionGracePeriodSeconds: new(int64(10)),
 					Labels: map[string]string{
 						"tailscale.com/managed":              "true",
 						"tailscale.com/parent-resource":      "test",
@@ -250,7 +249,7 @@ func expectedSTS(t *testing.T, cl client.Client, opts configOpts) *appsv1.Statef
 							Command: []string{"/bin/sh", "-c"},
 							Args:    []string{"sysctl -w net.ipv4.ip_forward=1 && if sysctl net.ipv6.conf.all.forwarding; then sysctl -w net.ipv6.conf.all.forwarding=1; fi"},
 							SecurityContext: &corev1.SecurityContext{
-								Privileged: ptr.To(true),
+								Privileged: new(true),
 							},
 						},
 					},
@@ -364,14 +363,14 @@ func expectedSTSUserspace(t *testing.T, cl client.Client, opts configOpts) *apps
 			},
 		},
 		Spec: appsv1.StatefulSetSpec{
-			Replicas: ptr.To[int32](1),
+			Replicas: new(int32(1)),
 			Selector: &metav1.LabelSelector{
 				MatchLabels: map[string]string{"app": "1234-UID"},
 			},
 			ServiceName: opts.stsName,
 			Template: corev1.PodTemplateSpec{
 				ObjectMeta: metav1.ObjectMeta{
-					DeletionGracePeriodSeconds: ptr.To[int64](10),
+					DeletionGracePeriodSeconds: new(int64(10)),
 					Labels: map[string]string{
 						"tailscale.com/managed":              "true",
 						"tailscale.com/parent-resource":      "test",
@@ -420,7 +419,7 @@ func expectedHeadlessService(name string, parentType string) *corev1.Service {
 				"app": "1234-UID",
 			},
 			ClusterIP:      "None",
-			IPFamilyPolicy: ptr.To(corev1.IPFamilyPolicyPreferDualStack),
+			IPFamilyPolicy: new(corev1.IPFamilyPolicyPreferDualStack),
 		},
 	}
 }
@@ -480,7 +479,7 @@ func expectedServiceMonitor(t *testing.T, opts configOpts) *unstructured.Unstruc
 			Namespace:       opts.tailscaleNamespace,
 			Labels:          smLabels,
 			ResourceVersion: opts.resourceVersion,
-			OwnerReferences: []metav1.OwnerReference{{APIVersion: "v1", Kind: "Service", Name: name, BlockOwnerDeletion: ptr.To(true), Controller: ptr.To(true)}},
+			OwnerReferences: []metav1.OwnerReference{{APIVersion: "v1", Kind: "Service", Name: name, BlockOwnerDeletion: new(true), Controller: new(true)}},
 		},
 		TypeMeta: metav1.TypeMeta{
 			Kind:       "ServiceMonitor",
@@ -529,7 +528,7 @@ func expectedSecret(t *testing.T, cl client.Client, opts configOpts) *corev1.Sec
 		AcceptDNS:           "false",
 		Hostname:            &opts.hostname,
 		Locked:              "false",
-		AuthKey:             ptr.To("secret-authkey"),
+		AuthKey:             new("secret-authkey"),
 		AcceptRoutes:        "false",
 		AppConnector:        &ipn.AppConnectorPrefs{Advertise: false},
 		NoStatefulFiltering: "true",

cmd/k8s-operator/tsrecorder_specs.go

@@ -14,7 +14,6 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
-	"tailscale.com/types/ptr"
 	"tailscale.com/version"
 )
 
@@ -33,7 +32,7 @@ func tsrStatefulSet(tsr *tsapi.Recorder, namespace string, loginServer string) *
 			Annotations:     tsr.Spec.StatefulSet.Annotations,
 		},
 		Spec: appsv1.StatefulSetSpec{
-			Replicas: ptr.To(replicas),
+			Replicas: new(replicas),
 			Selector: &metav1.LabelSelector{
 				MatchLabels: tsrLabels("recorder", tsr.Name, tsr.Spec.StatefulSet.Pod.Labels),
 			},

cmd/k8s-operator/tsrecorder_specs_test.go

@@ -14,7 +14,6 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
-	"tailscale.com/types/ptr"
 )
 
 func TestRecorderSpecs(t *testing.T) {
@@ -24,7 +23,7 @@ func TestRecorderSpecs(t *testing.T) {
 				Name: "test",
 			},
 			Spec: tsapi.RecorderSpec{
-				Replicas: ptr.To[int32](3),
+				Replicas: new(int32(3)),
 				StatefulSet: tsapi.RecorderStatefulSet{
 					Labels: map[string]string{
 						"ss-label-key": "ss-label-value",
@@ -51,7 +50,7 @@ func TestRecorderSpecs(t *testing.T) {
 							},
 						},
 						SecurityContext: &corev1.PodSecurityContext{
-							RunAsUser: ptr.To[int64](1000),
+							RunAsUser: new(int64(1000)),
 						},
 						ImagePullSecrets: []corev1.LocalObjectReference{{
 							Name: "img-pull",
@@ -62,7 +61,7 @@ func TestRecorderSpecs(t *testing.T) {
 						Tolerations: []corev1.Toleration{{
 							Key:               "key",
 							Value:             "value",
-							TolerationSeconds: ptr.To[int64](60),
+							TolerationSeconds: new(int64(60)),
 						}},
 						Container: tsapi.RecorderContainer{
 							Env: []tsapi.Env{{

cmd/k8s-operator/tsrecorder_test.go

@@ -25,7 +25,6 @@ import (
 	tsoperator "tailscale.com/k8s-operator"
 	tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
 	"tailscale.com/tstest"
-	"tailscale.com/types/ptr"
 )
 
 const (
@@ -40,7 +39,7 @@ func TestRecorder(t *testing.T) {
 			Finalizers: []string{"tailscale.com/finalizer"},
 		},
 		Spec: tsapi.RecorderSpec{
-			Replicas: ptr.To[int32](3),
+			Replicas: new(int32(3)),
 		},
 	}
 

cmd/k8s-proxy/internal/config/config.go

@@ -27,7 +27,6 @@ import (
 	clientcorev1 "k8s.io/client-go/kubernetes/typed/core/v1"
 	"tailscale.com/kube/k8s-proxy/conf"
 	"tailscale.com/kube/kubetypes"
-	"tailscale.com/types/ptr"
 	"tailscale.com/util/testenv"
 )
 
@@ -178,7 +177,7 @@ func (ld *configLoader) watchConfigSecretChanges(ctx context.Context, secretName
 		},
 		// Re-watch regularly to avoid relying on long-lived connections.
 		// See https://github.com/kubernetes-client/javascript/issues/596#issuecomment-786419380
-		TimeoutSeconds: ptr.To(int64(600)),
+		TimeoutSeconds: new(int64(600)),
 		FieldSelector:  fmt.Sprintf("metadata.name=%s", secretName),
 		Watch:          true,
 	})
@@ -216,7 +215,7 @@ func (ld *configLoader) watchConfigSecretChanges(ctx context.Context, secretName
 						Kind:       "Secret",
 						APIVersion: "v1",
 					},
-					TimeoutSeconds: ptr.To(int64(600)),
+					TimeoutSeconds: new(int64(600)),
 					FieldSelector:  fmt.Sprintf("metadata.name=%s", secretName),
 					Watch:          true,
 				})

cmd/k8s-proxy/internal/config/config_test.go

@@ -20,7 +20,6 @@ import (
 	ktesting "k8s.io/client-go/testing"
 	"tailscale.com/kube/k8s-proxy/conf"
 	"tailscale.com/kube/kubetypes"
-	"tailscale.com/types/ptr"
 )
 
 func TestWatchConfig(t *testing.T) {
@@ -52,7 +51,7 @@ func TestWatchConfig(t *testing.T) {
 					initialConfig: `{"version": "v1alpha1", "authKey": "abc123"}`,
 					phases: []phase{{
 						expectedConf: &conf.ConfigV1Alpha1{
-							AuthKey: ptr.To("abc123"),
+							AuthKey: new("abc123"),
 						},
 					}},
 				},
@@ -62,7 +61,7 @@ func TestWatchConfig(t *testing.T) {
 					phases: []phase{
 						{
 							expectedConf: &conf.ConfigV1Alpha1{
-								AuthKey: ptr.To("abc123"),
+								AuthKey: new("abc123"),
 							},
 						},
 						{
@@ -76,13 +75,13 @@ func TestWatchConfig(t *testing.T) {
 					phases: []phase{
 						{
 							expectedConf: &conf.ConfigV1Alpha1{
-								AuthKey: ptr.To("abc123"),
+								AuthKey: new("abc123"),
 							},
 						},
 						{
 							config: `{"version": "v1alpha1", "authKey": "def456"}`,
 							expectedConf: &conf.ConfigV1Alpha1{
-								AuthKey: ptr.To("def456"),
+								AuthKey: new("def456"),
 							},
 						},
 					},
@@ -93,7 +92,7 @@ func TestWatchConfig(t *testing.T) {
 					phases: []phase{
 						{
 							expectedConf: &conf.ConfigV1Alpha1{
-								AuthKey: ptr.To("abc123"),
+								AuthKey: new("abc123"),
 							},
 						},
 						{

cmd/stund/depaware.txt

@@ -71,7 +71,6 @@ tailscale.com/cmd/stund dependencies: (generated by github.com/tailscale/depawar
         tailscale.com/types/logger                                   from tailscale.com/tsweb+
         tailscale.com/types/opt                                      from tailscale.com/envknob+
         tailscale.com/types/persist                                  from tailscale.com/feature
-        tailscale.com/types/ptr                                      from tailscale.com/tailcfg+
         tailscale.com/types/result                                   from tailscale.com/util/lineiter
         tailscale.com/types/structs                                  from tailscale.com/tailcfg+
         tailscale.com/types/tkatype                                  from tailscale.com/tailcfg+

cmd/tailscale/cli/set.go

@@ -24,7 +24,6 @@ import (
 	"tailscale.com/safesocket"
 	"tailscale.com/tsconst"
 	"tailscale.com/types/opt"
-	"tailscale.com/types/ptr"
 	"tailscale.com/types/views"
 	"tailscale.com/util/set"
 	"tailscale.com/version"
@@ -247,7 +246,7 @@ func runSet(ctx context.Context, args []string) (retErr error) {
 		if err != nil {
 			return fmt.Errorf("failed to set relay server port: %v", err)
 		}
-		maskedPrefs.Prefs.RelayServerPort = ptr.To(uint16(uport))
+		maskedPrefs.Prefs.RelayServerPort = new(uint16(uport))
 	}
 
 	if setArgs.relayServerStaticEndpoints != "" {

cmd/tailscale/cli/set_test.go

@@ -11,7 +11,6 @@ import (
 
 	"tailscale.com/ipn"
 	"tailscale.com/net/tsaddr"
-	"tailscale.com/types/ptr"
 )
 
 func TestCalcAdvertiseRoutesForSet(t *testing.T) {
@@ -28,80 +27,80 @@ func TestCalcAdvertiseRoutesForSet(t *testing.T) {
 		},
 		{
 			name:    "advertise-exit",
-			setExit: ptr.To(true),
+			setExit: new(true),
 			want:    tsaddr.ExitRoutes(),
 		},
 		{
 			name:    "advertise-exit/already-routes",
 			was:     []netip.Prefix{pfx("34.0.0.0/16")},
-			setExit: ptr.To(true),
+			setExit: new(true),
 			want:    []netip.Prefix{pfx("34.0.0.0/16"), tsaddr.AllIPv4(), tsaddr.AllIPv6()},
 		},
 		{
 			name:    "advertise-exit/already-exit",
 			was:     tsaddr.ExitRoutes(),
-			setExit: ptr.To(true),
+			setExit: new(true),
 			want:    tsaddr.ExitRoutes(),
 		},
 		{
 			name:    "stop-advertise-exit",
 			was:     tsaddr.ExitRoutes(),
-			setExit: ptr.To(false),
+			setExit: new(false),
 			want:    nil,
 		},
 		{
 			name:    "stop-advertise-exit/with-routes",
 			was:     []netip.Prefix{pfx("34.0.0.0/16"), tsaddr.AllIPv4(), tsaddr.AllIPv6()},
-			setExit: ptr.To(false),
+			setExit: new(false),
 			want:    []netip.Prefix{pfx("34.0.0.0/16")},
 		},
 		{
 			name:      "advertise-routes",
-			setRoutes: ptr.To("10.0.0.0/24,192.168.0.0/16"),
+			setRoutes: new("10.0.0.0/24,192.168.0.0/16"),
 			want:      []netip.Prefix{pfx("10.0.0.0/24"), pfx("192.168.0.0/16")},
 		},
 		{
 			name:      "advertise-routes/already-exit",
 			was:       tsaddr.ExitRoutes(),
-			setRoutes: ptr.To("10.0.0.0/24,192.168.0.0/16"),
+			setRoutes: new("10.0.0.0/24,192.168.0.0/16"),
 			want:      []netip.Prefix{pfx("10.0.0.0/24"), pfx("192.168.0.0/16"), tsaddr.AllIPv4(), tsaddr.AllIPv6()},
 		},
 		{
 			name:      "advertise-routes/already-diff-routes",
 			was:       []netip.Prefix{pfx("34.0.0.0/16")},
-			setRoutes: ptr.To("10.0.0.0/24,192.168.0.0/16"),
+			setRoutes: new("10.0.0.0/24,192.168.0.0/16"),
 			want:      []netip.Prefix{pfx("10.0.0.0/24"), pfx("192.168.0.0/16")},
 		},
 		{
 			name:      "stop-advertise-routes",
 			was:       []netip.Prefix{pfx("34.0.0.0/16")},
-			setRoutes: ptr.To(""),
+			setRoutes: new(""),
 			want:      nil,
 		},
 		{
 			name:      "stop-advertise-routes/already-exit",
 			was:       []netip.Prefix{pfx("34.0.0.0/16"), tsaddr.AllIPv4(), tsaddr.AllIPv6()},
-			setRoutes: ptr.To(""),
+			setRoutes: new(""),
 			want:      tsaddr.ExitRoutes(),
 		},
 		{
 			name:      "advertise-routes-and-exit",
-			setExit:   ptr.To(true),
-			setRoutes: ptr.To("10.0.0.0/24,192.168.0.0/16"),
+			setExit:   new(true),
+			setRoutes: new("10.0.0.0/24,192.168.0.0/16"),
 			want:      []netip.Prefix{pfx("10.0.0.0/24"), pfx("192.168.0.0/16"), tsaddr.AllIPv4(), tsaddr.AllIPv6()},
 		},
 		{
 			name:      "advertise-routes-and-exit/already-exit",
 			was:       tsaddr.ExitRoutes(),
-			setExit:   ptr.To(true),
-			setRoutes: ptr.To("10.0.0.0/24,192.168.0.0/16"),
+			setExit:   new(true),
+			setRoutes: new("10.0.0.0/24,192.168.0.0/16"),
 			want:      []netip.Prefix{pfx("10.0.0.0/24"), pfx("192.168.0.0/16"), tsaddr.AllIPv4(), tsaddr.AllIPv6()},
 		},
 		{
 			name:      "advertise-routes-and-exit/already-routes",
 			was:       []netip.Prefix{pfx("10.0.0.0/24"), pfx("192.168.0.0/16")},
-			setExit:   ptr.To(true),
-			setRoutes: ptr.To("10.0.0.0/24,192.168.0.0/16"),
+			setExit:   new(true),
+			setRoutes: new("10.0.0.0/24,192.168.0.0/16"),
 			want:      []netip.Prefix{pfx("10.0.0.0/24"), pfx("192.168.0.0/16"), tsaddr.AllIPv4(), tsaddr.AllIPv6()},
 		},
 	}

cmd/tailscale/depaware.txt

@@ -253,7 +253,6 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
         tailscale.com/types/opt                                      from tailscale.com/client/tailscale+
         tailscale.com/types/persist                                  from tailscale.com/ipn+
         tailscale.com/types/preftype                                 from tailscale.com/cmd/tailscale/cli+
-        tailscale.com/types/ptr                                      from tailscale.com/hostinfo+
         tailscale.com/types/result                                   from tailscale.com/util/lineiter
         tailscale.com/types/structs                                  from tailscale.com/ipn+
         tailscale.com/types/tkatype                                  from tailscale.com/types/key+

cmd/tailscaled/depaware-min.txt

@@ -145,7 +145,6 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/types/opt                                      from tailscale.com/control/controlknobs+
         tailscale.com/types/persist                                  from tailscale.com/control/controlclient+
         tailscale.com/types/preftype                                 from tailscale.com/ipn+
-        tailscale.com/types/ptr                                      from tailscale.com/control/controlclient+
         tailscale.com/types/result                                   from tailscale.com/util/lineiter
         tailscale.com/types/structs                                  from tailscale.com/control/controlclient+
         tailscale.com/types/tkatype                                  from tailscale.com/control/controlclient+

cmd/tailscaled/depaware-minbox.txt

@@ -164,7 +164,6 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/types/opt                                      from tailscale.com/control/controlknobs+
         tailscale.com/types/persist                                  from tailscale.com/control/controlclient+
         tailscale.com/types/preftype                                 from tailscale.com/ipn+
-        tailscale.com/types/ptr                                      from tailscale.com/control/controlclient+
         tailscale.com/types/result                                   from tailscale.com/util/lineiter
         tailscale.com/types/structs                                  from tailscale.com/control/controlclient+
         tailscale.com/types/tkatype                                  from tailscale.com/control/controlclient+

cmd/tailscaled/depaware.txt

@@ -420,7 +420,6 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/types/opt                                      from tailscale.com/control/controlknobs+
         tailscale.com/types/persist                                  from tailscale.com/control/controlclient+
         tailscale.com/types/preftype                                 from tailscale.com/ipn+
-        tailscale.com/types/ptr                                      from tailscale.com/control/controlclient+
         tailscale.com/types/result                                   from tailscale.com/util/lineiter
         tailscale.com/types/structs                                  from tailscale.com/control/controlclient+
         tailscale.com/types/tkatype                                  from tailscale.com/tka+

cmd/tsidp/depaware.txt

@@ -328,7 +328,6 @@ tailscale.com/cmd/tsidp dependencies: (generated by github.com/tailscale/depawar
         tailscale.com/types/opt                                      from tailscale.com/cmd/tsidp+
         tailscale.com/types/persist                                  from tailscale.com/control/controlclient+
         tailscale.com/types/preftype                                 from tailscale.com/ipn+
-        tailscale.com/types/ptr                                      from tailscale.com/control/controlclient+
         tailscale.com/types/result                                   from tailscale.com/util/lineiter
         tailscale.com/types/structs                                  from tailscale.com/control/controlclient+
         tailscale.com/types/tkatype                                  from tailscale.com/client/local+

cmd/tta/fw_linux.go

@@ -8,7 +8,6 @@ import (
 
 	"github.com/google/nftables"
 	"github.com/google/nftables/expr"
-	"tailscale.com/types/ptr"
 )
 
 func init() {
@@ -35,7 +34,7 @@ func addFirewallLinux() error {
 		Type:     nftables.ChainTypeFilter,
 		Hooknum:  nftables.ChainHookInput,
 		Priority: nftables.ChainPriorityFilter,
-		Policy:   ptr.To(nftables.ChainPolicyDrop),
+		Policy:   new(nftables.ChainPolicyDrop),
 	}
 	c.AddChain(inputChain)
 

cmd/viewer/tests/tests.go

@@ -9,7 +9,6 @@ import (
 	"net/netip"
 
 	"golang.org/x/exp/constraints"
-	"tailscale.com/types/ptr"
 	"tailscale.com/types/views"
 )
 
@@ -135,7 +134,7 @@ func (c *Container[T]) Clone() *Container[T] {
 		return &Container[T]{cloner.Clone()}
 	}
 	if !views.ContainsPointers[T]() {
-		return ptr.To(*c)
+		return new(*c)
 	}
 	panic(fmt.Errorf("%T contains pointers, but is not cloneable", c.Item))
 }

cmd/viewer/tests/tests_clone.go

@@ -10,7 +10,6 @@ import (
 	"net/netip"
 
 	"golang.org/x/exp/constraints"
-	"tailscale.com/types/ptr"
 	"tailscale.com/types/views"
 )
 
@@ -23,13 +22,13 @@ func (src *StructWithPtrs) Clone() *StructWithPtrs {
 	dst := new(StructWithPtrs)
 	*dst = *src
 	if dst.Value != nil {
-		dst.Value = ptr.To(*src.Value)
+		dst.Value = new(*src.Value)
 	}
 	if dst.Int != nil {
-		dst.Int = ptr.To(*src.Int)
+		dst.Int = new(*src.Int)
 	}
 	if dst.NoView != nil {
-		dst.NoView = ptr.To(*src.NoView)
+		dst.NoView = new(*src.NoView)
 	}
 	return dst
 }
@@ -90,7 +89,7 @@ func (src *Map) Clone() *Map {
 			if v == nil {
 				dst.StructPtrWithoutPtr[k] = nil
 			} else {
-				dst.StructPtrWithoutPtr[k] = ptr.To(*v)
+				dst.StructPtrWithoutPtr[k] = new(*v)
 			}
 		}
 	}
@@ -156,7 +155,7 @@ func (src *StructWithSlices) Clone() *StructWithSlices {
 			if src.ValuePointers[i] == nil {
 				dst.ValuePointers[i] = nil
 			} else {
-				dst.ValuePointers[i] = ptr.To(*src.ValuePointers[i])
+				dst.ValuePointers[i] = new(*src.ValuePointers[i])
 			}
 		}
 	}
@@ -185,7 +184,7 @@ func (src *StructWithSlices) Clone() *StructWithSlices {
 			if src.Ints[i] == nil {
 				dst.Ints[i] = nil
 			} else {
-				dst.Ints[i] = ptr.To(*src.Ints[i])
+				dst.Ints[i] = new(*src.Ints[i])
 			}
 		}
 	}
@@ -248,7 +247,7 @@ func (src *GenericIntStruct[T]) Clone() *GenericIntStruct[T] {
 	dst := new(GenericIntStruct[T])
 	*dst = *src
 	if dst.Pointer != nil {
-		dst.Pointer = ptr.To(*src.Pointer)
+		dst.Pointer = new(*src.Pointer)
 	}
 	dst.Slice = append(src.Slice[:0:0], src.Slice...)
 	dst.Map = maps.Clone(src.Map)
@@ -258,7 +257,7 @@ func (src *GenericIntStruct[T]) Clone() *GenericIntStruct[T] {
 			if src.PtrSlice[i] == nil {
 				dst.PtrSlice[i] = nil
 			} else {
-				dst.PtrSlice[i] = ptr.To(*src.PtrSlice[i])
+				dst.PtrSlice[i] = new(*src.PtrSlice[i])
 			}
 		}
 	}
@@ -269,7 +268,7 @@ func (src *GenericIntStruct[T]) Clone() *GenericIntStruct[T] {
 			if v == nil {
 				dst.PtrValueMap[k] = nil
 			} else {
-				dst.PtrValueMap[k] = ptr.To(*v)
+				dst.PtrValueMap[k] = new(*v)
 			}
 		}
 	}
@@ -305,7 +304,7 @@ func (src *GenericNoPtrsStruct[T]) Clone() *GenericNoPtrsStruct[T] {
 	dst := new(GenericNoPtrsStruct[T])
 	*dst = *src
 	if dst.Pointer != nil {
-		dst.Pointer = ptr.To(*src.Pointer)
+		dst.Pointer = new(*src.Pointer)
 	}
 	dst.Slice = append(src.Slice[:0:0], src.Slice...)
 	dst.Map = maps.Clone(src.Map)
@@ -315,7 +314,7 @@ func (src *GenericNoPtrsStruct[T]) Clone() *GenericNoPtrsStruct[T] {
 			if src.PtrSlice[i] == nil {
 				dst.PtrSlice[i] = nil
 			} else {
-				dst.PtrSlice[i] = ptr.To(*src.PtrSlice[i])
+				dst.PtrSlice[i] = new(*src.PtrSlice[i])
 			}
 		}
 	}
@@ -326,7 +325,7 @@ func (src *GenericNoPtrsStruct[T]) Clone() *GenericNoPtrsStruct[T] {
 			if v == nil {
 				dst.PtrValueMap[k] = nil
 			} else {
-				dst.PtrValueMap[k] = ptr.To(*v)
+				dst.PtrValueMap[k] = new(*v)
 			}
 		}
 	}
@@ -375,7 +374,7 @@ func (src *GenericCloneableStruct[T, V]) Clone() *GenericCloneableStruct[T, V] {
 		}
 	}
 	if dst.Pointer != nil {
-		dst.Pointer = ptr.To((*src.Pointer).Clone())
+		dst.Pointer = new((*src.Pointer).Clone())
 	}
 	if src.PtrSlice != nil {
 		dst.PtrSlice = make([]*T, len(src.PtrSlice))
@@ -383,7 +382,7 @@ func (src *GenericCloneableStruct[T, V]) Clone() *GenericCloneableStruct[T, V] {
 			if src.PtrSlice[i] == nil {
 				dst.PtrSlice[i] = nil
 			} else {
-				dst.PtrSlice[i] = ptr.To((*src.PtrSlice[i]).Clone())
+				dst.PtrSlice[i] = new((*src.PtrSlice[i]).Clone())
 			}
 		}
 	}
@@ -394,7 +393,7 @@ func (src *GenericCloneableStruct[T, V]) Clone() *GenericCloneableStruct[T, V] {
 			if v == nil {
 				dst.PtrValueMap[k] = nil
 			} else {
-				dst.PtrValueMap[k] = ptr.To((*v).Clone())
+				dst.PtrValueMap[k] = new((*v).Clone())
 			}
 		}
 	}
@@ -457,7 +456,7 @@ func (src *StructWithTypeAliasFields) Clone() *StructWithTypeAliasFields {
 	dst.WithPtr = *src.WithPtr.Clone()
 	dst.WithPtrByPtr = src.WithPtrByPtr.Clone()
 	if dst.WithoutPtrByPtr != nil {
-		dst.WithoutPtrByPtr = ptr.To(*src.WithoutPtrByPtr)
+		dst.WithoutPtrByPtr = new(*src.WithoutPtrByPtr)
 	}
 	if src.SliceWithPtrs != nil {
 		dst.SliceWithPtrs = make([]*StructWithPtrsAlias, len(src.SliceWithPtrs))
@@ -475,7 +474,7 @@ func (src *StructWithTypeAliasFields) Clone() *StructWithTypeAliasFields {
 			if src.SliceWithoutPtrs[i] == nil {
 				dst.SliceWithoutPtrs[i] = nil
 			} else {
-				dst.SliceWithoutPtrs[i] = ptr.To(*src.SliceWithoutPtrs[i])
+				dst.SliceWithoutPtrs[i] = new(*src.SliceWithoutPtrs[i])
 			}
 		}
 	}
@@ -495,7 +494,7 @@ func (src *StructWithTypeAliasFields) Clone() *StructWithTypeAliasFields {
 			if v == nil {
 				dst.MapWithoutPtrs[k] = nil
 			} else {
-				dst.MapWithoutPtrs[k] = ptr.To(*v)
+				dst.MapWithoutPtrs[k] = new(*v)
 			}
 		}
 	}