[v1.43-2] PMREQ-810: Let kube-controllers watch Networks - #5158
Merged
Conversation
The node controller's ipam_ippool_reserved metric now discounts an L2 Network's subnet edges and gateways as well as IPReservations, so it watches Network on its syncer. Without the verb the List still succeeds and the syncer reaches in-sync, so the symptom is a hot re-list rather than a stalled controller. Network is Enterprise / Cloud only, so the rule goes in the Enterprise common rules. CORE-13146 Co-authored-by: Claude Opus 5 <noreply@anthropic.com> (cherry picked from commit 1f3d8a7)
Contributor
There was a problem hiding this comment.
Pull request overview
Cherry-picks the RBAC update needed for kube-controllers to access Calico Enterprise/Cloud Network resources, preventing authorization failures that can stall kube-controllers’ data feed and break dependent features (e.g., L2 Network support / related e2e coverage).
Changes:
- Add
list/watchRBAC onnetworksfor kube-controllers (Enterprise common ClusterRole rules). - Update kube-controllers rendering tests to account for the additional ClusterRole rule.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| pkg/render/kubecontrollers/kube-controllers.go | Adds an Enterprise RBAC PolicyRule allowing kube-controllers to list/watch networks. |
| pkg/render/kubecontrollers/kube-controllers_test.go | Adjusts expected ClusterRole rule counts to reflect the newly added Networks rule. |
Suppressed comments (2)
pkg/render/kubecontrollers/kube-controllers_test.go:786
- This test update only changes the expected rule count. Please also assert the specific Networks RBAC rule is present so the test validates the intended permission rather than only the total number of rules.
Expect(clusterRole.Rules).To(HaveLen(37), "cluster role should have 37 rules")
pkg/render/kubecontrollers/kube-controllers_test.go:487
- This test update only changes the expected rule count. Please also assert the specific Networks RBAC rule is present so the test validates the intended permission rather than only the total number of rules.
Expect(clusterRole.Rules).To(HaveLen(37), "cluster role should have 37 rules")
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+561
to
+569
| { | ||
| // The node controller watches Networks so that it can discount an L2 | ||
| // network's subnet edges and gateways from the reserved-IP metric. | ||
| // The Network resource is only available in Enterprise / Cloud at | ||
| // this time. | ||
| APIGroups: []string{"projectcalico.org", "crd.projectcalico.org"}, | ||
| Resources: []string{"networks"}, | ||
| Verbs: []string{"list", "watch"}, | ||
| }, |
|
|
||
| clusterRole := rtest.GetResource(resources, kubecontrollers.KubeControllerRole, "", "rbac.authorization.k8s.io", "v1", "ClusterRole").(*rbacv1.ClusterRole) | ||
| Expect(clusterRole.Rules).To(HaveLen(38), "cluster role should have 38 rules") | ||
| Expect(clusterRole.Rules).To(HaveLen(39), "cluster role should have 39 rules") |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Picks the PMREQ-810 operator change that has already merged to master onto the
EP2 release branch, alongside the matching monorepo pick
(tigera/calico-private#13174) onto
release-calient-v3.24-2.Cherry-pick history
kube-controllers needs
list/watchonnetworksto serve the L2 Networkresource. Without it the
listis denied, and because a 403 stalls the wholeDataFeed rather than just that one syncer, the symptom shows up somewhere
unrelated — an
[Feature:AutoHEPs]e2e failure.Applied with only auto-merge; no conflicts.
Two related changes need no pick. Operator#4883, which grants Network access to
tigera-network-adminandtigera-ui-user, merged on 2026-06-03 and isalready an ancestor of this branch. The Network CRD's L2 bridge and VLAN fields
are absent from this branch today, but they arrive through the automated
Sync versions from Calico and Calico Enterprisejob — which runs onrelease-v1.43-2— once the monorepo pick lands onrelease-calient-v3.24-2. Hand-picking the generated CRDs would only conflictwith that job.
Testing
go test ./pkg/render/kubecontrollers/...passes.go build ./...is clean.PMREQ-810
Release note: