Support enterprise whisker-backend with Linseed upstream

[hjiawei]

Summary

• Enable whisker-backend for Calico Enterprise by configuring it to use Linseed as the flow data source instead of Goldmane
• Add RBAC (ClusterRole/ClusterRoleBinding) for Linseed flows, TokenReview, and SubjectAccessReview so whisker-backend can authenticate users and filter flows by RBAC
• Wire up network policies: Linseed egress, kube-apiserver egress, Manager ingress for whisker; Linseed ingress from whisker; Manager egress to whisker
• Add mTLS client certs and cluster ID support for Linseed communication

Notes

• Whisker frontend enterprise deployment (enterprise image, WHISKER_FEATURES env var) is intentionally excluded — it will be handled separately once the UI team integrates Whisker as a ui-module in Manager
• This PR only covers the whisker-backend container changes needed for enterprise Linseed integration

[Copilot]

Pull request overview

Adds enterprise support to the whisker-backend by wiring it to Linseed (instead of Goldmane) for flow data, including RBAC, mTLS, and network policy plumbing for enterprise variants. Non-enterprise (Calico) paths still render Goldmane env/policy as before.

Changes:

• Render enterprise Whisker ClusterRole/ClusterRoleBinding and Linseed-specific env vars (LINSEED_URL, LINSEED_CA_PATH, LINSEED_TOKEN_PATH, LINSEED_CLUSTER_ID, LINSEED_CLIENT_CERT/KEY_PATH); split network policy into enterprise (Manager ingress + Linseed/kube-apiserver egress) vs Calico (Goldmane egress).
• Controller: skip Goldmane CR requirement for enterprise, watch TigeraLinseedSecret, switch trusted bundle source to Linseed for enterprise, and add a missing return after SetDegraded in trusted bundle creation.
• Wire Manager → Whisker egress and Linseed ← Whisker ingress via new WhiskerEntityRule/WhiskerSourceEntityRule helpers; update expected policy JSON fixtures and Manager test egress count.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
pkg/render/whisker/component.go	Adds enterprise constants, RBAC objects, Linseed env vars, ingress/egress rules in network policy
pkg/render/whisker/component_test.go	Adds enterprise object count, deployment, RBAC, and network policy test cases
pkg/render/manager.go	Adds Manager egress rule to Whisker
pkg/render/manager_test.go	Updates expected egress rule count from 11 to 12
pkg/render/logstorage/linseed/linseed.go	Adds Whisker as ingress source to Linseed
pkg/render/common/networkpolicy/networkpolicy.go	Adds WhiskerEntityRule and WhiskerSourceEntityRule helpers
pkg/controller/whisker/controller.go	Skips Goldmane CR requirement for enterprise, watches Linseed secret, switches trusted bundle source, adds missing return on error
pkg/render/testutils/expected_policies/manager.json	Adds Manager→Whisker egress entry
pkg/render/testutils/expected_policies/manager_ocp.json	Adds Manager→Whisker egress entry
pkg/render/testutils/expected_policies/linseed.json	Adds Whisker ingress entry
pkg/render/testutils/expected_policies/linseed_ocp.json	Adds Whisker ingress entry
pkg/render/testutils/expected_policies/linseed_dpi_enabled.json	Adds Whisker ingress entry
pkg/render/testutils/expected_policies/linseed_ocp_dpi_enabled.json	Adds Whisker ingress entry

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

This PR is stale because it has been open for 60 days with no activity.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated no new comments.

Suppressed comments (2)

pkg/controller/whisker/controller.go:222

• Avoid hard-coding the backend Service name here. Using the shared constant keeps certificate SAN generation aligned with the rendered Service name and prevents drift if the Service name changes in the renderer.

	whiskerBackendCertificateNames := dns.GetServiceDNSNames("whisker-backend", whisker.WhiskerNamespace, r.clusterDomain)

pkg/render/manager.go:114

• These Whisker-related constants are duplicated from pkg/render/whisker (notably namespace/service name/ports). This creates a drift risk over time; consider moving the shared Service coordinates into the pkg/render package (or another shared package) so both manager rendering and whisker rendering reference the same single source of truth without an import cycle.

	// Whisker-backend Service coordinates, mirroring pkg/render/whisker —
	// importing that package here would create an import cycle (it imports
	// render).
	WhiskerNamespace          = "calico-system"
	WhiskerDeploymentName     = "whisker"
	WhiskerBackendServiceName = "whisker-backend"
	WhiskerBackendServicePort = 8443
	WhiskerBackendTargetPort  = 3002

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated no new comments.

Suppressed comments (2)

pkg/controller/whisker/controller.go:223

• Avoid hard-coding the whisker-backend Service name here. The renderer already defines whisker.WhiskerBackendServiceName, and using the constant prevents drift if the Service name is ever changed.

	whiskerBackendCertificateNames := dns.GetServiceDNSNames("whisker-backend", whisker.WhiskerNamespace, r.clusterDomain)
	whiskerBackendCertificateNames = append(whiskerBackendCertificateNames, "localhost", "127.0.0.1")

pkg/render/manager.go:114

• These Whisker constants duplicate values defined in pkg/render/whisker/component.go, which risks the Manager↔Whisker wiring drifting over time. Consider moving the whisker-backend Service coordinates to a shared location (e.g., exported consts in pkg/render) so both packages reference the same definition without an import cycle.

	// Whisker-backend Service coordinates, mirroring pkg/render/whisker —
	// importing that package here would create an import cycle (it imports
	// render).
	WhiskerNamespace          = "calico-system"
	WhiskerDeploymentName     = "whisker"
	WhiskerBackendServiceName = "whisker-backend"
	WhiskerBackendServicePort = 8443
	WhiskerBackendTargetPort  = 3002

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.