[release-v1.43] fix(apiserver): allow queryserver egress to Linseed via guardian on managed clusters

[tianfeng92]

Description

Cherry-pick of #5240.

A managed cluster runs no local Linseed, so the query server reaches it through guardian —
the URL LinseedEndpoint returns as LINSEED_URL. The calico-system.apiserver-access
policy permitted only the local Linseed pods, whose selector matches nothing on a managed
cluster, so the connection fell through to the policy's trailing Pass. The calico-system
tier's default-deny excludes calico-apiserver by design, so the traffic is then evaluated
against the customer's tiers, where any default-deny drops it. The Manager policy board
renders empty and policy activity requests return 500.

This branch predates the pkg/enterprise/apiserver extension mechanism (#4871), so the rule
is branched directly in calicoSystemAPIServerPolicy on cfg.ManagementClusterConnection —
the same condition LINSEED_URL already uses a few hundred lines away in the same file.

The calico-system policy table already had for managed entries, but
SelectPolicyByProvider only switches on the provider, so both managed cases were asserting
the unmanaged fixture and could not have caught this. The table now uses
SelectPolicyByClusterTypeAndProvider against new apiserver_managed.json and
apiserver_managed_ocp.json fixtures.

The inert local-Linseed rule is left in place. It selects no pods on a managed cluster, so it
is harmless, and removing it would churn the base fixtures across every backport branch.

release-v1.41 (CE v3.23.0-1.0) carries neither the egress rule nor LINSEED_URL, so the
affected range starts here.

Addresses CI-2048.

Testing

Verified on a live managed cluster on the master change (#5240): with the customer's
default-deny in a tier after calico-system, the original operator returned the reported 500
on GET /policies after a 19.5s guardian timeout, and the fixed operator returned 200 in
0.58s with the calico-system tier present. The deny stayed applied across both runs and only
the operator image changed.

On this branch: full pkg/render suite green, make static-checks reports 0 issues, and new
specs cover the rule being rendered ahead of the trailing Pass on a managed cluster and
absent otherwise.

Release Note

Fixed the Manager policy board rendering empty on managed clusters, where the query server was not permitted egress to Linseed through guardian.

For PR author

• Tests for change.
• If changing pkg/apis/, run make gen-files
• If changing versions, run make gen-versions

For PR reviewers

A note for code reviewers - all pull requests must have the following:

• Milestone set according to targeted release.
• Appropriate labels:
  • kind/bug if this is a bugfix.
  • kind/enhancement if this is a a new feature.
  • enterprise if this PR applies to Calico Enterprise only.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Fixes a managed-cluster connectivity gap where the API server’s query server could not reach Linseed via Guardian due to the calico-system.apiserver-access policy only allowing egress to the (non-existent) local Linseed pods on managed clusters, causing policy-related UI/API calls to fail under customer default-deny tiers.

Changes:

• Add an explicit egress allow rule to Guardian when ManagementClusterConnection is present (managed cluster case), ensuring it is evaluated before the trailing Pass.
• Add managed-cluster expected-policy fixtures (standard + OpenShift DNS variants).
• Update the calico-system policy rendering table test to select expected fixtures by both cluster type and provider, and add targeted unit tests for the Guardian egress rule.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
pkg/render/apiserver.go	Conditionally appends Guardian egress allow rule for managed clusters before adding the trailing Pass rule.
pkg/render/apiserver_test.go	Adds unit tests for the managed Guardian egress rule and updates fixture selection logic to cover managed/unmanaged + OpenShift combinations.
pkg/render/testutils/expected_policies/apiserver_managed.json	New expected calico-system apiserver-access policy fixture for managed (non-OpenShift DNS) clusters, including Guardian egress allow.
pkg/render/testutils/expected_policies/apiserver_managed_ocp.json	New expected fixture for managed OpenShift clusters, including OpenShift DNS rules and Guardian egress allow.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.