From 18c6033ab213da90ea08a7db43f37a49b518a49b Mon Sep 17 00:00:00 2001 From: Patrick Zhan Date: Wed, 29 Jul 2026 15:40:33 -0700 Subject: [PATCH] Document that the license agent is not upgraded with Calico Enterprise The license agent is installed from a manifest and is not managed by the operator, so an upgrade leaves it on the image it was installed with. The 3.23 docs never said so, and never said what to do about the network policy it leaves behind in the allow-tigera tier: the name of a policy embeds its tier, so applying the 3.23 manifest adds a calico-system copy without removing the old one, and the operator cannot remove the deprecated tier while any policy is left in it. Add an "Upgrade the license agent" section covering all three steps, and point at it from the operator, Helm and OpenShift upgrade pages. Co-Authored-By: Claude Opus 5 (1M context) --- .../kubernetes-upgrade-tsee/helm.mdx | 4 ++++ .../kubernetes-upgrade-tsee/operator.mdx | 4 ++++ .../openshift-upgrade.mdx | 4 ++++ .../monitor/metrics/license-agent.mdx | 19 +++++++++++++++++++ 4 files changed, 31 insertions(+) diff --git a/calico-enterprise_versioned_docs/version-3.23-2/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/helm.mdx b/calico-enterprise_versioned_docs/version-3.23-2/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/helm.mdx index 69516120df..9bedc3ec32 100644 --- a/calico-enterprise_versioned_docs/version-3.23-2/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/helm.mdx +++ b/calico-enterprise_versioned_docs/version-3.23-2/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/helm.mdx @@ -52,6 +52,10 @@ owned resources being garbage collected by Kubernetes. $[prodname] creates a default-deny for the calico-system namespace. If you deploy workloads into the calico-system namespace, you must create policy that allows the required traffic for your workloads prior to upgrade. +### License agent + +The license agent is installed from a manifest and is not managed by the operator, so this upgrade leaves it on its current version. If you installed it, follow [Upgrade the license agent](../../../../operations/monitor/metrics/license-agent.mdx#upgrade-the-license-agent) after you upgrade. + ## Upgrade from 3.19 or later :::note diff --git a/calico-enterprise_versioned_docs/version-3.23-2/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/operator.mdx b/calico-enterprise_versioned_docs/version-3.23-2/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/operator.mdx index 071aed6957..48e0486569 100644 --- a/calico-enterprise_versioned_docs/version-3.23-2/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/operator.mdx +++ b/calico-enterprise_versioned_docs/version-3.23-2/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/operator.mdx @@ -77,6 +77,10 @@ These steps differ based on your cluster type. If you are unsure of your cluster ::: +### License agent + +The license agent is installed from a manifest and is not managed by the operator, so this upgrade leaves it on its current version. If you installed it, follow [Upgrade the license agent](../../../../operations/monitor/metrics/license-agent.mdx#upgrade-the-license-agent) after you upgrade. + ## Upgrade Calico Enterprise diff --git a/calico-enterprise_versioned_docs/version-3.23-2/getting-started/upgrading/upgrading-enterprise/openshift-upgrade.mdx b/calico-enterprise_versioned_docs/version-3.23-2/getting-started/upgrading/upgrading-enterprise/openshift-upgrade.mdx index e2c8409a68..2db8bd0806 100644 --- a/calico-enterprise_versioned_docs/version-3.23-2/getting-started/upgrading/upgrading-enterprise/openshift-upgrade.mdx +++ b/calico-enterprise_versioned_docs/version-3.23-2/getting-started/upgrading/upgrading-enterprise/openshift-upgrade.mdx @@ -87,6 +87,10 @@ pod-security.kubernetes.io/enforce-version: latest security.openshift.io/scc.podSecurityLabelSync: "false" ``` +### License agent + +The license agent is installed from a manifest and is not managed by the operator, so this upgrade leaves it on its current version. If you installed it, follow [Upgrade the license agent](../../../operations/monitor/metrics/license-agent.mdx#upgrade-the-license-agent) after you upgrade. + ## Download the new manifests Make a manifests directory. diff --git a/calico-enterprise_versioned_docs/version-3.23-2/operations/monitor/metrics/license-agent.mdx b/calico-enterprise_versioned_docs/version-3.23-2/operations/monitor/metrics/license-agent.mdx index 4acbf50c18..1b28520f5e 100644 --- a/calico-enterprise_versioned_docs/version-3.23-2/operations/monitor/metrics/license-agent.mdx +++ b/calico-enterprise_versioned_docs/version-3.23-2/operations/monitor/metrics/license-agent.mdx @@ -27,6 +27,7 @@ The **License Agent** is a containerized application that monitors the following ## How to - [Add license agent in your Kubernetes cluster](#add-license-agent-in-your-kubernetes-cluster) +- [Upgrade the license agent](#upgrade-the-license-agent) - [Create alerts using Prometheus metrics](#create-alerts-using-prometheus-metrics) ### Add license agent in your Kubernetes cluster @@ -48,6 +49,24 @@ To add the license-agent component in a Kubernetes cluster for license metrics, kubectl apply -f $[filesUrl]/manifests/licenseagent.yaml ``` +### Upgrade the license agent + +The license agent is installed from a manifest and is not managed by the $[prodname] operator. Upgrading $[prodname] leaves the license agent running the image from the manifest you last applied, so you must upgrade the license agent yourself after every $[prodname] upgrade. Until you do, license metrics come from the old version of the agent. + +1. Apply the manifest for the version of $[prodname] you upgraded to. + ``` + kubectl apply -f $[filesUrl]/manifests/licenseagent.yaml + ``` +1. If you upgraded from a version earlier than $[prodname] v3.23, delete the license agent's network policy from the `allow-tigera` tier. From v3.23 the manifest creates this policy in the `calico-system` tier instead, and because the name of a policy includes the name of its tier, applying the new manifest adds a second policy rather than replacing the first: the same rule ends up in both tiers. + ``` + kubectl delete networkpolicies.projectcalico.org allow-tigera.tigera-license-agent-access -n tigera-license-agent + ``` +1. Check whether any policy is left in the `allow-tigera` tier. + ``` + kubectl get networkpolicies.projectcalico.org,globalnetworkpolicies.projectcalico.org -A | grep allow-tigera + ``` + The operator removes the deprecated `allow-tigera` tier once no policy is left in it. While any policy remains, the tier stays and the operator logs `Cannot delete a non-empty tier` on every reconcile. So deleting the license agent's policy is enough only if nothing else is left: if the command above still lists policies, expect the tier to remain until those are removed as well. Contact Support if you are unsure what created a policy that is still listed. + ### Create alerts using Prometheus metrics In the following example, an alert is configured when the license expiry is fewer than 15 days.