Document that the license agent is not upgraded with Calico Enterprise - #2887
Open
xiumozhan wants to merge 1 commit into
Open
Document that the license agent is not upgraded with Calico Enterprise#2887xiumozhan wants to merge 1 commit into
xiumozhan wants to merge 1 commit into
Conversation
The license agent is installed from a manifest and is not managed by the operator, so an upgrade leaves it on the image it was installed with. The 3.23 docs never said so, and never said what to do about the network policy it leaves behind in the allow-tigera tier: the name of a policy embeds its tier, so applying the 3.23 manifest adds a calico-system copy without removing the old one, and the operator cannot remove the deprecated tier while any policy is left in it. Add an "Upgrade the license agent" section covering all three steps, and point at it from the operator, Helm and OpenShift upgrade pages. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
✅ Deploy Preview for calico-docs-preview-next ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview succeeded!Built without sensitive environment variables
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the Calico Enterprise v3.23-2 versioned documentation to clearly state that the license agent is not upgraded by the operator and must be manually upgraded after every Calico Enterprise upgrade, including guidance for cleaning up pre-3.23 tiered policy leftovers.
Changes:
- Adds an “Upgrade the license agent” section to the license metrics page, including re-applying the version-matched manifest and checking/removing
allow-tigeratier leftovers after upgrades from pre-3.23. - Adds brief “License agent” callouts to Kubernetes (operator + Helm) and OpenShift upgrade pages, linking readers directly to the new upgrade guidance.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| calico-enterprise_versioned_docs/version-3.23-2/operations/monitor/metrics/license-agent.mdx | Adds explicit license-agent upgrade procedure and tier cleanup/check guidance for pre-3.23 upgrades. |
| calico-enterprise_versioned_docs/version-3.23-2/getting-started/upgrading/upgrading-enterprise/openshift-upgrade.mdx | Adds upgrade-time callout pointing to license-agent upgrade instructions. |
| calico-enterprise_versioned_docs/version-3.23-2/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/operator.mdx | Adds upgrade-time callout pointing to license-agent upgrade instructions. |
| calico-enterprise_versioned_docs/version-3.23-2/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/helm.mdx | Adds upgrade-time callout pointing to license-agent upgrade instructions. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this fixes
The license agent is installed from a manifest and is not managed by the operator, so upgrading Calico Enterprise leaves it running the image it was installed with. Nothing in the docs said so, which is how a cluster ends up on the previous agent image after an upgrade and stops reporting license metrics.
The 3.23 tier rename makes it worse. The name of a tiered policy embeds its tier, so
licenseagent.yamlmoved fromallow-tigera.tigera-license-agent-accesstocalico-system.tigera-license-agent-access. Applying the 3.23 manifest creates the new policy and leaves the old one in place, so the same rule ends up in both tiers, and the operator cannot remove the deprecatedallow-tigeratier while any policy is left in it — it logsCannot delete a non-empty tieron every reconcile instead. Deleting the license agent's own policy is not always enough, because other leftovers can hold the tier open, so the section says to check rather than to assume.Changes
All in
version-3.23-2, since that is the version being upgraded to and the version where the license agent is still documented. The standalone page was removed fromnextin 0964008, where license metrics now come from the operator, so there is nothing to add there.operations/monitor/metrics/license-agent.mdx: new Upgrade the license agent section — re-apply the version-matched manifest, delete the staleallow-tigerapolicy if the upgrade came from before 3.23, then check whether anything is still holding the tier open.getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/operator.mdx,.../helm.mdx,openshift-upgrade.mdx: a short License agent subsection pointing at it, so the reader learns about it while upgrading rather than afterwards.kubectl only, no Helm flow on the task page.
Verification
yarn buildpasses. The config hasonBrokenLinks: 'throw'andonBrokenMarkdownLinks: 'throw', so the three relative links resolve;onBrokenAnchorsis'ignore', so I checked the anchor by hand — all three render ashref=/calico-enterprise/latest/operations/monitor/metrics/license-agent#upgrade-the-license-agent, andid=upgrade-the-license-agentexists on that page. I also read the rendered section: the steps and code blocks come out right, and$[filesUrl]resolves to the v3.23.1 manifest.Both commands in the new section were run against a live Calico Enterprise cluster in the form they are published.
Related
licenseagent.yamladmits ingress fromapp == 'prometheus', a label no pod carries, so the scrape is denied by policy as well./metricsport unbound when no certificate is configured.