[release-v1.44] fix(apiserver): allow queryserver egress to Linseed via guardian on managed clusters

[tianfeng92]

Description

Clean cherry-pick of #5240, no adaptation needed — this branch carries the
pkg/enterprise/apiserver extension mechanism (#4871), so the commit applies as-is.

A managed cluster runs no local Linseed, so the query server reaches it through guardian —
the URL LinseedEndpoint returns as LINSEED_URL. The calico-system.apiserver-access
policy permitted only the local Linseed pods, whose selector matches nothing on a managed
cluster, so the connection fell through to the policy's trailing Pass. The calico-system
tier's default-deny excludes calico-apiserver by design, so the traffic is then evaluated
against the customer's tiers, where any default-deny drops it. The Manager policy board
renders empty and policy activity requests return 500.

The rule is branched in modifyAPIServerPolicy on managementClusterConnection, which is the
same condition the LINSEED_URL env var already uses in that file.

Addresses CI-2048.

Testing

Verified on a live managed cluster on the master change (#5240): with the customer's
default-deny in a tier after calico-system, the original operator returned the reported 500
on GET /policies after a 19.5s guardian timeout, and the fixed operator returned 200 in
0.58s with the calico-system tier present. The deny stayed applied across both runs and only
the operator image changed.

On this branch: pkg/enterprise/apiserver suite green, including the specs covering the rule
being rendered ahead of the trailing Pass on a managed cluster and absent otherwise.

Release Note

Fixed the Manager policy board rendering empty on managed clusters, where the query server was not permitted egress to Linseed through guardian.

For PR author

• Tests for change.
• If changing pkg/apis/, run make gen-files
• If changing versions, run make gen-versions

For PR reviewers

A note for code reviewers - all pull requests must have the following:

• Milestone set according to targeted release.
• Appropriate labels:
  • kind/bug if this is a bugfix.
  • kind/enhancement if this is a a new feature.
  • enterprise if this PR applies to Calico Enterprise only.

🤖 Generated with Claude Code

---

---

Second commit — CRD regeneration. make gen-versions produces changes against the
committed CRDs on this branch, so dirty-check fails. A separate chore(crds) commit carries
the regenerated output; it is isolated so it can be reviewed or dropped on its own.

FV is red on this branch regardless of this change — #5211 and #5229 both fail FV with no
CRD change at all. Note that the regenerated IPPool CRD is rejected by the API server on CEL
cost (x-kubernetes-validations[9].rule: estimated rule cost exceeds budget by factor of more than 100x), so FV now fails at deploy-crds rather than on individual specs. That rule needs
bounding with maxItems/maxLength where the CRD is generated upstream; fixing it there is
what turns FV green for this branch and for #5211 and #5229.

[Copilot]

Pull request overview

This PR fixes managed-cluster Manager policy board failures by ensuring the API server’s network policy allows the query server to reach Linseed via Guardian when ManagementClusterConnection is present, and includes a separate CRD regeneration commit (from make gen-versions) that updates several Calico/Enterprise CRD schemas.

Changes:

• Add a managed-cluster-specific egress allow rule to Guardian in the API server enterprise policy modifier (inserted before the trailing Pass rule).
• Add unit tests covering presence/absence of the Guardian egress rule depending on whether the cluster is managed.
• Regenerate imported CRD YAMLs (FelixConfiguration/BGPConfiguration docs/enums, plus additional IPPool CEL validations and description updates).

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
pkg/enterprise/apiserver/extension.go	Adds helper to insert egress rules before Pass and adds Guardian egress allow on managed clusters.
pkg/enterprise/apiserver/extension_test.go	Adds tests asserting Guardian egress rule is inserted before trailing Pass only on managed clusters.
pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_felixconfigurations.yaml	CRD regen: updates bpfAttachType docs/enums and expands programClusterRoutes docs/enums/default text.
pkg/imports/crds/enterprise/v3.projectcalico.org/projectcalico.org_bgpconfigurations.yaml	CRD regen: expands programClusterRoutes docs/enums/default text.
pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_felixconfigurations.yaml	CRD regen: same FelixConfiguration schema/doc updates as v3.
pkg/imports/crds/enterprise/v1.crd.projectcalico.org/crd.projectcalico.org_bgpconfigurations.yaml	CRD regen: same BGPConfiguration schema/doc updates as v1.
pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_ippools.yaml	CRD regen: updates IPPool blockSize description and adds additional CEL validations.
pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_felixconfigurations.yaml	CRD regen: updates bpfAttachType docs/enums/default text to include Netkit.
pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_ippools.yaml	CRD regen: same IPPool blockSize description and CEL validation updates as v3.
pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_felixconfigurations.yaml	CRD regen: same bpfAttachType docs/enums/default text to include Netkit.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

Suppressed comments (2)

pkg/imports/crds/calico/v3.projectcalico.org/projectcalico.org_ippools.yaml:97

• The updated blockSize description says it must be between 20–32 (IPv4) / 116–128 (IPv6), but the schema still allows 0 and the CEL validation explicitly allows blockSize==0. The description should mention that 0 is permitted (and what it means) to avoid confusing users.

                blockSize:
                  description: |-
                    The block size to use for IP address assignments from this pool. Defaults to 26 for IPv4 and 122 for IPv6.
                    The block size must be between 20 and 32 for IPv4 and between 116 and 128 for IPv6. It must also be smaller
                    than or equal to the size of the pool CIDR.

pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_ippools.yaml:72

• The updated blockSize description says it must be between 20–32 (IPv4) / 116–128 (IPv6), but the schema still allows 0 and the CEL validation explicitly allows blockSize==0. The description should mention that 0 is permitted (and what it means) to avoid confusing users.

                blockSize:
                  description: |-
                    The block size to use for IP address assignments from this pool. Defaults to 26 for IPv4 and 122 for IPv6.
                    The block size must be between 20 and 32 for IPv4 and between 116 and 128 for IPv6. It must also be smaller
                    than or equal to the size of the pool CIDR.