[release-v1.43-2] fix(apiserver): allow queryserver egress to Linseed via guardian on managed clusters

[tianfeng92]

Description

Cherry-pick of #5240.

A managed cluster runs no local Linseed, so the query server reaches it through guardian —
the URL LinseedEndpoint returns as LINSEED_URL. The calico-system.apiserver-access
policy permitted only the local Linseed pods, whose selector matches nothing on a managed
cluster, so the connection fell through to the policy's trailing Pass. The calico-system
tier's default-deny excludes calico-apiserver by design, so the traffic is then evaluated
against the customer's tiers, where any default-deny drops it. The Manager policy board
renders empty and policy activity requests return 500.

This branch predates the pkg/enterprise/apiserver extension mechanism (#4871), so the rule
is branched directly in calicoSystemAPIServerPolicy on cfg.ManagementClusterConnection —
the same condition LINSEED_URL already uses a few hundred lines away in the same file.

The calico-system policy table already had for managed entries, but
SelectPolicyByProvider only switches on the provider, so both managed cases were asserting
the unmanaged fixture and could not have caught this. The table now uses
SelectPolicyByClusterTypeAndProvider against new apiserver_managed.json and
apiserver_managed_ocp.json fixtures.

The inert local-Linseed rule is left in place. It selects no pods on a managed cluster, so it
is harmless, and removing it would churn the base fixtures across every backport branch.

release-v1.41 (CE v3.23.0-1.0) carries neither the egress rule nor LINSEED_URL, so the
affected range starts here.

Addresses CI-2048.

Testing

Verified on a live managed cluster on the master change (#5240): with the customer's
default-deny in a tier after calico-system, the original operator returned the reported 500
on GET /policies after a 19.5s guardian timeout, and the fixed operator returned 200 in
0.58s with the calico-system tier present. The deny stayed applied across both runs and only
the operator image changed.

On this branch: full pkg/render suite green, make static-checks reports 0 issues, and new
specs cover the rule being rendered ahead of the trailing Pass on a managed cluster and
absent otherwise.

Release Note

Fixed the Manager policy board rendering empty on managed clusters, where the query server was not permitted egress to Linseed through guardian.

For PR author

• Tests for change.
• If changing pkg/apis/, run make gen-files
• If changing versions, run make gen-versions

For PR reviewers

A note for code reviewers - all pull requests must have the following:

• Milestone set according to targeted release.
• Appropriate labels:
  • kind/bug if this is a bugfix.
  • kind/enhancement if this is a a new feature.
  • enterprise if this PR applies to Calico Enterprise only.

🤖 Generated with Claude Code

---

Second commit — CRD regeneration. This branch fails validate-gen-versions for every
PR opened against it, because make gen-versions produces changes against the committed CRDs.
It is unrelated to the policy fix and predates it. A separate chore(crds) commit carries the
regenerated output so this PR can go green; it is isolated so it can be reviewed or dropped on
its own. The drift is upstream CRD movement only. make test-crds and the
pkg/imports/crds suite pass.

[Copilot]

Pull request overview

This PR fixes Calico Enterprise API server egress policy rendering on managed clusters so the query server can reach Linseed via Guardian (matching the managed-cluster LINSEED_URL), preventing customer-tier default-deny policies from inadvertently blocking the traffic after the calico-system tier’s trailing Pass.

Changes:

• Add a managed-cluster-specific egress Allow to Guardian in calico-system.apiserver-access when cfg.ManagementClusterConnection is set.
• Extend render tests and fixtures to cover managed vs unmanaged + OpenShift vs non-OpenShift variants using new managed policy fixtures.
• Regenerate/import updated Enterprise CRDs (including ECK bundle and schema updates) to address branch drift and keep validation jobs green.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
pkg/render/apiserver.go	Adds conditional Guardian egress rule for managed clusters before the trailing Pass.
pkg/render/apiserver_test.go	Adds managed-cluster egress assertions and switches fixture selection to include managed variants.
pkg/render/testutils/expected_policies/apiserver_managed.json	New expected policy fixture for managed, non-OpenShift scenario (includes Guardian egress allow).
pkg/render/testutils/expected_policies/apiserver_managed_ocp.json	New expected policy fixture for managed OpenShift scenario (includes Guardian egress allow).
pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_networks.yaml	CRD import regeneration (schema expanded, validations added).
pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_ippools.yaml	CRD import regeneration (allowedUses expanded, CEL validations added).
pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_networks.yaml	CRD import regeneration mirroring the v3 schema updates.
pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_ippools.yaml	CRD import regeneration mirroring the v3 schema updates.
pkg/imports/crds/enterprise/01-crd-eck-bundle.yaml	Regenerated ECK CRD bundle (metadata/version updates plus schema additions).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.