logstorage: stop deleting the tigera-linseed RoleBinding it no longer owns#5056
Open
hjiawei wants to merge 1 commit into
Open
logstorage: stop deleting the tigera-linseed RoleBinding it no longer owns#5056hjiawei wants to merge 1 commit into
hjiawei wants to merge 1 commit into
Conversation
tianfeng92
approved these changes
Jul 16, 2026
… owns The managed-cluster cleanup still listed the tigera-linseed RoleBinding in calico-system as deprecated, but the apiserver and logcollector controllers render it again in managed clusters so guardian can manage Linseed token secrets. The delete fought their create on every reconcile, intermittently revoking guardian's token permissions. Fixes EV-6837. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
hjiawei
force-pushed
the
logstorage-keep-linseed-rolebinding
branch
from
July 17, 2026 04:08
16aae90 to
93ce48d
Compare
hjiawei
commented
Jul 17, 2026
| TypeMeta: metav1.TypeMeta{Kind: "ClusterRole", APIVersion: "rbac.authorization.k8s.io/v1"}, | ||
| ObjectMeta: metav1.ObjectMeta{Name: "tigera-linseed-configmap"}, | ||
| }, | ||
| &rbacv1.RoleBinding{ |
Contributor
Author
There was a problem hiding this comment.
This is added in apiserver render: https://github.com/tigera/operator/pull/4786/changes#diff-88957f5c859486b2cbf260254b87b36b75fadbc99bfd38c01ea29dc0ac22a260R1345.
Contributor
There was a problem hiding this comment.
Pull request overview
Fixes a managed-cluster reconciliation conflict in the logstorage renderer by stopping logstorage from attempting to delete a RoleBinding/tigera-linseed in calico-system that is now actively rendered/owned by other controllers (so it no longer “fights” their desired state during reconcile).
Changes:
- Removed
RoleBinding/tigera-linseed(incalico-system) from the managed-cluster logstoragedeprecatedObjects()delete list. - Updated the logstorage render test to ensure the RoleBinding is not expected in the delete set.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| pkg/render/logstorage.go | Drops RoleBinding/tigera-linseed in calico-system from managed-cluster deprecated cleanup to prevent reconcile flapping. |
| pkg/render/logstorage_test.go | Updates expected delete resources to match the new cleanup behavior (RoleBinding no longer deleted). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Bug fix for managed Enterprise clusters (EV-6837).
The managed-cluster logstorage cleanup still lists the
tigera-linseedRoleBinding incalico-systemindeprecatedObjects(), but that object is live again: the apiserver controller renders it for the MCM queryserver wiring (#4786) and the logcollector controller renders it since fluent-bit moved intocalico-system(#4910), both so guardian's identity can manage Linseed token secrets there. The delete fought their create on every reconcile, so the RoleBinding flapped and guardian intermittently lost permission to provision Linseed tokens for calico-system components.The entry was correct when it was added: the guardian RBAC consolidation (#3969, #4021) obsoleted logstorage's namespace-scoped bindings, and the cleanup removed the stragglers on upgrade. It just was never pruned when new controllers started rendering the same object again.
Found by a static audit of objects rendered by more than one controller (follow-up to #5055's
tigera-ca-bundlefix — same root pattern: the component handler replaces object state wholesale, so two controllers with different desired state fight). The render test now pins the RoleBinding's absence from the delete list.Release Note
No release note: both renders of this RoleBinding (#4786 and the fluent-bit migration #4910) are unreleased, so the create/delete fight never shipped.
For PR author
make gen-filesmake gen-versionsFor PR reviewers
A note for code reviewers - all pull requests must have the following:
kind/bugif this PR fixes a bug🤖 Generated with Claude Code