Skip to content

Commit 93ce48d

Browse files
hjiaweiclaude
andcommitted
logstorage: stop deleting the tigera-linseed RoleBinding it no longer owns
The managed-cluster cleanup still listed the tigera-linseed RoleBinding in calico-system as deprecated, but the apiserver and logcollector controllers render it again in managed clusters so guardian can manage Linseed token secrets. The delete fought their create on every reconcile, intermittently revoking guardian's token permissions. Fixes EV-6837. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
1 parent a7cc613 commit 93ce48d

2 files changed

Lines changed: 0 additions & 5 deletions

File tree

pkg/render/logstorage.go

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1372,10 +1372,6 @@ func (m *managedClusterLogStorage) deprecatedObjects() []client.Object {
13721372
TypeMeta: metav1.TypeMeta{Kind: "ClusterRole", APIVersion: "rbac.authorization.k8s.io/v1"},
13731373
ObjectMeta: metav1.ObjectMeta{Name: "tigera-linseed-configmap"},
13741374
},
1375-
&rbacv1.RoleBinding{
1376-
TypeMeta: metav1.TypeMeta{Kind: "RoleBinding", APIVersion: "rbac.authorization.k8s.io/v1"},
1377-
ObjectMeta: metav1.ObjectMeta{Name: "tigera-linseed", Namespace: "calico-system"},
1378-
},
13791375

13801376
// Remove legacy ExternalName service pointing to Guardian for linseed
13811377
&corev1.Service{

pkg/render/logstorage_test.go

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -625,7 +625,6 @@ var _ = Describe("Elasticsearch rendering tests", func() {
625625
&rbacv1.ClusterRole{ObjectMeta: metav1.ObjectMeta{Name: "tigera-linseed-namespaces"}},
626626
&rbacv1.ClusterRoleBinding{ObjectMeta: metav1.ObjectMeta{Name: "tigera-linseed"}},
627627
&rbacv1.ClusterRole{ObjectMeta: metav1.ObjectMeta{Name: "tigera-linseed-configmap"}},
628-
&rbacv1.RoleBinding{ObjectMeta: metav1.ObjectMeta{Name: "tigera-linseed", Namespace: "calico-system"}},
629628
&corev1.Service{TypeMeta: metav1.TypeMeta{Kind: "Service", APIVersion: "v1"}, ObjectMeta: metav1.ObjectMeta{Name: "tigera-linseed", Namespace: "tigera-elasticsearch"}},
630629
&corev1.Service{TypeMeta: metav1.TypeMeta{Kind: "Service", APIVersion: "v1"}, ObjectMeta: metav1.ObjectMeta{Name: "tigera-secure-es-gateway-http", Namespace: "tigera-elasticsearch"}},
631630
&corev1.Namespace{TypeMeta: metav1.TypeMeta{Kind: "Namespace", APIVersion: "v1"}, ObjectMeta: metav1.ObjectMeta{Name: "tigera-elasticsearch"}},

0 commit comments

Comments
 (0)