Add CalicoEnterprise variant and deprecate TigeraSecureEnterprise (tigera#4607)

Author: caseydavenport

api/v1/imageset_types.go

@@ -1,4 +1,4 @@
-// Copyright (c) 2022-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2022-2026 Tigera, Inc. All rights reserved.
 /*
 
 Licensed under the Apache License, Version 2.0 (the "License");
@@ -49,7 +49,7 @@ type Image struct {
 // ImageSet is used to specify image digests for the images that the operator deploys.
 // The name of the ImageSet is expected to be in the format `<variant>-<release>`.
 // The `variant` used is `enterprise` if the InstallationSpec Variant is
-// `TigeraSecureEnterprise` otherwise it is `calico`.
+// `CalicoEnterprise` or `TigeraSecureEnterprise`, otherwise it is `calico`.
 // The `release` must match the version of the variant that the operator is built to deploy,
 // this version can be obtained by passing the `--version` flag to the operator binary.
 type ImageSet struct {

api/v1/installation_types.go

@@ -47,10 +47,11 @@ type Installation struct {
 
 // InstallationSpec defines configuration for a Calico or Calico Enterprise installation.
 type InstallationSpec struct {
-	// Variant is the product to install - one of Calico or TigeraSecureEnterprise
+	// Variant is the product to install - one of Calico or CalicoEnterprise.
+	// TigeraSecureEnterprise is also accepted as a deprecated alias for CalicoEnterprise.
 	// Default: Calico
 	// +optional
-	// +kubebuilder:validation:Enum=Calico;TigeraSecureEnterprise
+	// +kubebuilder:validation:Enum=Calico;CalicoEnterprise;TigeraSecureEnterprise
 	Variant ProductVariant `json:"variant,omitempty"`
 
 	// Registry is the default Docker registry used for component Docker images.
@@ -460,14 +461,23 @@ func (p Provider) IsKind() bool {
 
 // ProductVariant represents the variant of the product.
 //
-// One of: Calico, TigeraSecureEnterprise
+// One of: Calico, CalicoEnterprise.
+// TigeraSecureEnterprise is a deprecated alias for CalicoEnterprise.
 type ProductVariant string
 
 var (
-	Calico                 ProductVariant = "Calico"
+	Calico           ProductVariant = "Calico"
+	CalicoEnterprise ProductVariant = "CalicoEnterprise"
+
+	// Deprecated: Use CalicoEnterprise instead.
 	TigeraSecureEnterprise ProductVariant = "TigeraSecureEnterprise"
 )
 
+// IsEnterprise returns true if the variant is an enterprise variant (either CalicoEnterprise or TigeraSecureEnterprise).
+func (v ProductVariant) IsEnterprise() bool {
+	return v == CalicoEnterprise || v == TigeraSecureEnterprise
+}
+
 // NonPrivilegedType specifies whether Calico runs as permissioned or not
 //
 // One of: Enabled, Disabled
@@ -982,8 +992,9 @@ type CNISpec struct {
 
 // InstallationStatus defines the observed state of the Calico or Calico Enterprise installation.
 type InstallationStatus struct {
-	// Variant is the most recently observed installed variant - one of Calico or TigeraSecureEnterprise
-	// +kubebuilder:validation:Enum=Calico;TigeraSecureEnterprise
+	// Variant is the most recently observed installed variant - one of Calico or CalicoEnterprise.
+	// TigeraSecureEnterprise is a deprecated alias for CalicoEnterprise.
+	// +kubebuilder:validation:Enum=Calico;CalicoEnterprise;TigeraSecureEnterprise
 	Variant ProductVariant `json:"variant,omitempty"`
 
 	// MTU is the most recently observed value for pod network MTU. This may be an explicitly

cmd/main.go

@@ -178,7 +178,7 @@ If a value other than 'all' is specified, the first CRD with a prefix of the spe
 	}
 
 	if printEnterpriseCRDs != "" {
-		if err := showCRDs(operatortigeraiov1.TigeraSecureEnterprise, printEnterpriseCRDs); err != nil {
+		if err := showCRDs(operatortigeraiov1.CalicoEnterprise, printEnterpriseCRDs); err != nil {
 			fmt.Println(err)
 			os.Exit(1)
 		}

docs/common_tasks.md

@@ -113,7 +113,7 @@ Then, modify the installation CR (e.g., with `kubectl edit installations`) to in
 
 ```
 spec:
-  variant: TigeraSecureEnterprise
+  variant: CalicoEnterprise
   imagePullSecrets:
   - name: tigera-pull-secret
 ```

docs/controller-dependency-graph.svg

@@ -27,7 +27,7 @@ def main():
     # This is still a manual process at the moment.
     # [APIServer] --> [ClusterConnection]
     # [APIServer] -> [Installation]
-    graph.add_edge(Edge('apiserver', 'clusterconnection', label='TSEE', style='dashed'))
+    graph.add_edge(Edge('apiserver', 'clusterconnection', label='Enterprise', style='dashed'))
     graph.add_edge(Edge('apiserver', 'installation'))
     # [ApplicationLayer] -> [Installation]
     graph.add_edge(Edge('applicationlayer', 'installation'))

docs/generate-controller-dependency-graph.py

@@ -104,7 +104,7 @@ func Add(mgr manager.Manager, opts options.ControllerOptions) error {
 
 	if opts.EnterpriseCRDExists {
 		// Watch for changes to ApplicationLayer
-		err = c.WatchObject(&operatorv1.ApplicationLayer{ObjectMeta: metav1.ObjectMeta{Name: utils.DefaultTSEEInstanceKey.Name}}, &handler.EnqueueRequestForObject{})
+		err = c.WatchObject(&operatorv1.ApplicationLayer{ObjectMeta: metav1.ObjectMeta{Name: utils.DefaultEnterpriseInstanceKey.Name}}, &handler.EnqueueRequestForObject{})
 		if err != nil {
 			return fmt.Errorf("apiserver-controller failed to watch ApplicationLayer resource: %v", err)
 		}
@@ -337,7 +337,7 @@ func (r *ReconcileAPIServer) Reconcile(ctx context.Context, request reconcile.Re
 	var keyValidatorConfig authentication.KeyValidatorConfig
 	includeV3NetworkPolicy := false
 
-	if installationSpec.Variant == operatorv1.TigeraSecureEnterprise {
+	if installationSpec.Variant.IsEnterprise() {
 		trustedBundle, err = certificateManager.CreateNamedTrustedBundleFromSecrets(render.APIServerResourceName, r.client,
 			common.OperatorNamespace(), false)
 		if err != nil {

pkg/controller/apiserver/apiserver_controller.go

@@ -93,12 +93,12 @@ var _ = Describe("apiserver controller tests", func() {
 				Generation: 2,
 			},
 			Status: operatorv1.InstallationStatus{
-				Variant:  operatorv1.TigeraSecureEnterprise,
+				Variant:  operatorv1.CalicoEnterprise,
 				Computed: &operatorv1.InstallationSpec{},
 			},
 			Spec: operatorv1.InstallationSpec{
 				ControlPlaneReplicas: &replicas,
-				Variant:              operatorv1.TigeraSecureEnterprise,
+				Variant:              operatorv1.CalicoEnterprise,
 				Registry:             "some.registry.org/",
 			},
 		}
@@ -468,7 +468,7 @@ var _ = Describe("apiserver controller tests", func() {
 
 		It("should create the cert secrets in the correct namespace when migrating from calico to enterprise", func() {
 			Expect(netv1.SchemeBuilder.AddToScheme(scheme)).ShouldNot(HaveOccurred())
-			installation.Spec.Variant = operatorv1.TigeraSecureEnterprise
+			installation.Spec.Variant = operatorv1.CalicoEnterprise
 			installation.Status.Variant = operatorv1.Calico
 			Expect(cli.Create(ctx, installation)).To(BeNil())
 			Expect(cli.Delete(ctx, &v3.Tier{ObjectMeta: metav1.ObjectMeta{Name: "calico-system"}})).NotTo(HaveOccurred())

pkg/controller/apiserver/apiserver_controller_test.go

@@ -229,8 +229,8 @@ func (r *ReconcileApplicationLayer) Reconcile(ctx context.Context, request recon
 		return reconcile.Result{}, err
 	}
 
-	if variant != operatorv1.TigeraSecureEnterprise {
-		r.status.SetDegraded(operatorv1.ResourceNotReady, fmt.Sprintf("Waiting for network to be %s", operatorv1.TigeraSecureEnterprise), nil, reqLogger)
+	if !variant.IsEnterprise() {
+		r.status.SetDegraded(operatorv1.ResourceNotReady, "Waiting for network to be an enterprise variant", nil, reqLogger)
 		return reconcile.Result{}, nil
 	}
 
@@ -447,7 +447,7 @@ func (r *ReconcileApplicationLayer) getWAFRulesetConfig(ctx context.Context) (*c
 // getApplicationLayer returns the default ApplicationLayer instance.
 func getApplicationLayer(ctx context.Context, cli client.Client) (*operatorv1.ApplicationLayer, error) {
 	instance := &operatorv1.ApplicationLayer{}
-	err := cli.Get(ctx, utils.DefaultTSEEInstanceKey, instance)
+	err := cli.Get(ctx, utils.DefaultEnterpriseInstanceKey, instance)
 	if err != nil {
 		return nil, err
 	}

pkg/controller/applicationlayer/applicationlayer_controller.go

@@ -69,11 +69,11 @@ var _ = Describe("Application layer controller tests", func() {
 			installation = &operatorv1.Installation{
 				ObjectMeta: metav1.ObjectMeta{Name: "default"},
 				Spec: operatorv1.InstallationSpec{
-					Variant:  operatorv1.TigeraSecureEnterprise,
+					Variant:  operatorv1.CalicoEnterprise,
 					Registry: "some.registry.org/",
 				},
 				Status: operatorv1.InstallationStatus{
-					Variant: operatorv1.TigeraSecureEnterprise,
+					Variant: operatorv1.CalicoEnterprise,
 					Computed: &operatorv1.InstallationSpec{
 						Registry: "my-reg",
 						// The test is provider agnostic.