diff --git a/calico-enterprise_versioned_docs/version-3.23-2/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/helm.mdx b/calico-enterprise_versioned_docs/version-3.23-2/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/helm.mdx index 69516120df..9bedc3ec32 100644 --- a/calico-enterprise_versioned_docs/version-3.23-2/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/helm.mdx +++ b/calico-enterprise_versioned_docs/version-3.23-2/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/helm.mdx @@ -52,6 +52,10 @@ owned resources being garbage collected by Kubernetes. $[prodname] creates a default-deny for the calico-system namespace. If you deploy workloads into the calico-system namespace, you must create policy that allows the required traffic for your workloads prior to upgrade. +### License agent + +The license agent is installed from a manifest and is not managed by the operator, so this upgrade leaves it on its current version. If you installed it, follow [Upgrade the license agent](../../../../operations/monitor/metrics/license-agent.mdx#upgrade-the-license-agent) after you upgrade. + ## Upgrade from 3.19 or later :::note diff --git a/calico-enterprise_versioned_docs/version-3.23-2/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/operator.mdx b/calico-enterprise_versioned_docs/version-3.23-2/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/operator.mdx index 071aed6957..48e0486569 100644 --- a/calico-enterprise_versioned_docs/version-3.23-2/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/operator.mdx +++ b/calico-enterprise_versioned_docs/version-3.23-2/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/operator.mdx @@ -77,6 +77,10 @@ These steps differ based on your cluster type. If you are unsure of your cluster ::: +### License agent + +The license agent is installed from a manifest and is not managed by the operator, so this upgrade leaves it on its current version. If you installed it, follow [Upgrade the license agent](../../../../operations/monitor/metrics/license-agent.mdx#upgrade-the-license-agent) after you upgrade. + ## Upgrade Calico Enterprise diff --git a/calico-enterprise_versioned_docs/version-3.23-2/getting-started/upgrading/upgrading-enterprise/openshift-upgrade.mdx b/calico-enterprise_versioned_docs/version-3.23-2/getting-started/upgrading/upgrading-enterprise/openshift-upgrade.mdx index e2c8409a68..2db8bd0806 100644 --- a/calico-enterprise_versioned_docs/version-3.23-2/getting-started/upgrading/upgrading-enterprise/openshift-upgrade.mdx +++ b/calico-enterprise_versioned_docs/version-3.23-2/getting-started/upgrading/upgrading-enterprise/openshift-upgrade.mdx @@ -87,6 +87,10 @@ pod-security.kubernetes.io/enforce-version: latest security.openshift.io/scc.podSecurityLabelSync: "false" ``` +### License agent + +The license agent is installed from a manifest and is not managed by the operator, so this upgrade leaves it on its current version. If you installed it, follow [Upgrade the license agent](../../../operations/monitor/metrics/license-agent.mdx#upgrade-the-license-agent) after you upgrade. + ## Download the new manifests Make a manifests directory. diff --git a/calico-enterprise_versioned_docs/version-3.23-2/operations/monitor/metrics/license-agent.mdx b/calico-enterprise_versioned_docs/version-3.23-2/operations/monitor/metrics/license-agent.mdx index 4acbf50c18..1b28520f5e 100644 --- a/calico-enterprise_versioned_docs/version-3.23-2/operations/monitor/metrics/license-agent.mdx +++ b/calico-enterprise_versioned_docs/version-3.23-2/operations/monitor/metrics/license-agent.mdx @@ -27,6 +27,7 @@ The **License Agent** is a containerized application that monitors the following ## How to - [Add license agent in your Kubernetes cluster](#add-license-agent-in-your-kubernetes-cluster) +- [Upgrade the license agent](#upgrade-the-license-agent) - [Create alerts using Prometheus metrics](#create-alerts-using-prometheus-metrics) ### Add license agent in your Kubernetes cluster @@ -48,6 +49,24 @@ To add the license-agent component in a Kubernetes cluster for license metrics, kubectl apply -f $[filesUrl]/manifests/licenseagent.yaml ``` +### Upgrade the license agent + +The license agent is installed from a manifest and is not managed by the $[prodname] operator. Upgrading $[prodname] leaves the license agent running the image from the manifest you last applied, so you must upgrade the license agent yourself after every $[prodname] upgrade. Until you do, license metrics come from the old version of the agent. + +1. Apply the manifest for the version of $[prodname] you upgraded to. + ``` + kubectl apply -f $[filesUrl]/manifests/licenseagent.yaml + ``` +1. If you upgraded from a version earlier than $[prodname] v3.23, delete the license agent's network policy from the `allow-tigera` tier. From v3.23 the manifest creates this policy in the `calico-system` tier instead, and because the name of a policy includes the name of its tier, applying the new manifest adds a second policy rather than replacing the first: the same rule ends up in both tiers. + ``` + kubectl delete networkpolicies.projectcalico.org allow-tigera.tigera-license-agent-access -n tigera-license-agent + ``` +1. Check whether any policy is left in the `allow-tigera` tier. + ``` + kubectl get networkpolicies.projectcalico.org,globalnetworkpolicies.projectcalico.org -A | grep allow-tigera + ``` + The operator removes the deprecated `allow-tigera` tier once no policy is left in it. While any policy remains, the tier stays and the operator logs `Cannot delete a non-empty tier` on every reconcile. So deleting the license agent's policy is enough only if nothing else is left: if the command above still lists policies, expect the tier to remain until those are removed as well. Contact Support if you are unsure what created a policy that is still listed. + ### Create alerts using Prometheus metrics In the following example, an alert is configured when the license expiry is fewer than 15 days.