From 93ce48db5488608a2ac229afd84fdc362369ee1a Mon Sep 17 00:00:00 2001 From: Jiawei Huang Date: Thu, 16 Jul 2026 16:03:58 -0700 Subject: [PATCH] logstorage: stop deleting the tigera-linseed RoleBinding it no longer owns The managed-cluster cleanup still listed the tigera-linseed RoleBinding in calico-system as deprecated, but the apiserver and logcollector controllers render it again in managed clusters so guardian can manage Linseed token secrets. The delete fought their create on every reconcile, intermittently revoking guardian's token permissions. Fixes EV-6837. Co-Authored-By: Claude Fable 5 --- pkg/render/logstorage.go | 4 ---- pkg/render/logstorage_test.go | 1 - 2 files changed, 5 deletions(-) diff --git a/pkg/render/logstorage.go b/pkg/render/logstorage.go index e845a25b2c..0df01e1885 100644 --- a/pkg/render/logstorage.go +++ b/pkg/render/logstorage.go @@ -1372,10 +1372,6 @@ func (m *managedClusterLogStorage) deprecatedObjects() []client.Object { TypeMeta: metav1.TypeMeta{Kind: "ClusterRole", APIVersion: "rbac.authorization.k8s.io/v1"}, ObjectMeta: metav1.ObjectMeta{Name: "tigera-linseed-configmap"}, }, - &rbacv1.RoleBinding{ - TypeMeta: metav1.TypeMeta{Kind: "RoleBinding", APIVersion: "rbac.authorization.k8s.io/v1"}, - ObjectMeta: metav1.ObjectMeta{Name: "tigera-linseed", Namespace: "calico-system"}, - }, // Remove legacy ExternalName service pointing to Guardian for linseed &corev1.Service{ diff --git a/pkg/render/logstorage_test.go b/pkg/render/logstorage_test.go index 2358cf2b3e..d7a677e858 100644 --- a/pkg/render/logstorage_test.go +++ b/pkg/render/logstorage_test.go @@ -625,7 +625,6 @@ var _ = Describe("Elasticsearch rendering tests", func() { &rbacv1.ClusterRole{ObjectMeta: metav1.ObjectMeta{Name: "tigera-linseed-namespaces"}}, &rbacv1.ClusterRoleBinding{ObjectMeta: metav1.ObjectMeta{Name: "tigera-linseed"}}, &rbacv1.ClusterRole{ObjectMeta: metav1.ObjectMeta{Name: "tigera-linseed-configmap"}}, - &rbacv1.RoleBinding{ObjectMeta: metav1.ObjectMeta{Name: "tigera-linseed", Namespace: "calico-system"}}, &corev1.Service{TypeMeta: metav1.TypeMeta{Kind: "Service", APIVersion: "v1"}, ObjectMeta: metav1.ObjectMeta{Name: "tigera-linseed", Namespace: "tigera-elasticsearch"}}, &corev1.Service{TypeMeta: metav1.TypeMeta{Kind: "Service", APIVersion: "v1"}, ObjectMeta: metav1.ObjectMeta{Name: "tigera-secure-es-gateway-http", Namespace: "tigera-elasticsearch"}}, &corev1.Namespace{TypeMeta: metav1.TypeMeta{Kind: "Namespace", APIVersion: "v1"}, ObjectMeta: metav1.ObjectMeta{Name: "tigera-elasticsearch"}},