Add opt-in RBAC management UI via rbacManagement flag

api/v1/manager_types.go

@@ -26,6 +26,37 @@ type ManagerSpec struct {
 	// ManagerDeployment configures the Manager Deployment.
 	// +optional
 	ManagerDeployment *ManagerDeployment `json:"managerDeployment,omitempty"`
+
+	// RBACUI configures the RBAC management UI feature.
+	// +optional
+	RBACUI *RBACUI `json:"rbacUI,omitempty"`
+}
+
+// +kubebuilder:validation:Enum=Enabled;Disabled
+type RBACUIStatusType string
+
+const (
+	RBACUIDisabled RBACUIStatusType = "Disabled"
+	RBACUIEnabled  RBACUIStatusType = "Enabled"
+)
+
+// RBACUI configures the RBAC management UI. This is a separate control plane
+// for Calico Enterprise RBAC that lives alongside, and does not replace, the
+// user's ability to configure RBAC themselves.
+type RBACUI struct {
+	// State turns the RBAC management UI on or off. Defaults to Disabled.
+	// +optional
+	State *RBACUIStatusType `json:"state,omitempty"`
+}
+
+// RBACManagementEnabled returns true when the Manager CR enables the RBAC
+// management UI. Safe to call on a nil receiver; returns false for a nil
+// Manager, an unset RBACUI, or any state other than Enabled.
+func (m *Manager) RBACManagementEnabled() bool {
+	if m == nil || m.Spec.RBACUI == nil || m.Spec.RBACUI.State == nil {
+		return false
+	}
+	return *m.Spec.RBACUI.State == RBACUIEnabled
 }
 
 // ManagerDeployment is the configuration for the Manager Deployment.

api/v1/manager_types_test.go

@@ -0,0 +1,51 @@
+// Copyright (c) 2026 Tigera, Inc. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package v1
+
+import "testing"
+
+func TestRBACManagementEnabled(t *testing.T) {
+	state := func(s RBACUIStatusType) *RBACUIStatusType { return &s }
+
+	for _, tc := range []struct {
+		name string
+		m    *Manager
+		want bool
+	}{
+		// Nil paths: RBACManagementEnabled is called as managerCR.RBACManagementEnabled()
+		// where managerCR is nil when no Manager CR exists, so a nil receiver (and each
+		// nil field below) must return false rather than panic.
+		{name: "nil Manager", m: nil, want: false},
+		{name: "nil RBACUI", m: &Manager{}, want: false},
+		{name: "nil State", m: &Manager{Spec: ManagerSpec{RBACUI: &RBACUI{}}}, want: false},
+
+		{name: "State Enabled", m: &Manager{Spec: ManagerSpec{RBACUI: &RBACUI{State: state(RBACUIEnabled)}}}, want: true},
+		{name: "State Disabled", m: &Manager{Spec: ManagerSpec{RBACUI: &RBACUI{State: state(RBACUIDisabled)}}}, want: false},
+		// Any value other than Enabled is off (the Enum marker rejects this at the
+		// apiserver, but the helper must not treat a non-empty value as enabled).
+		{name: "State unrecognized value", m: &Manager{Spec: ManagerSpec{RBACUI: &RBACUI{State: state("SomethingElse")}}}, want: false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			defer func() {
+				if r := recover(); r != nil {
+					t.Fatalf("RBACManagementEnabled panicked on %s: %v", tc.name, r)
+				}
+			}()
+			if got := tc.m.RBACManagementEnabled(); got != tc.want {
+				t.Errorf("RBACManagementEnabled() = %v, want %v", got, tc.want)
+			}
+		})
+	}
+}

pkg/controller/apiserver/apiserver_controller.go

@@ -122,6 +122,13 @@ func Add(mgr manager.Manager, opts options.ControllerOptions) error {
 			return fmt.Errorf("apiserver-controller failed to watch primary resource: %v", err)
 		}
 
+		// Watch the Manager CR so toggling spec.rbac re-runs the apiserver
+		// reconcile (the tigera-network-admin RBAC is gated on it).
+		err = c.WatchObject(&operatorv1.Manager{}, &handler.EnqueueRequestForObject{})
+		if err != nil {
+			return fmt.Errorf("apiserver-controller failed to watch Manager: %v", err)
+		}
+
 		for _, namespace := range []string{common.OperatorNamespace(), render.APIServerNamespace} {
 			for _, secretName := range []string{render.VoltronTunnelSecretName, render.ManagerTLSSecretName} {
 				if err = utils.AddSecretsWatch(c, secretName, namespace); err != nil {
@@ -342,6 +349,7 @@ func (r *ReconcileAPIServer) Reconcile(ctx context.Context, request reconcile.Re
 	var managementCluster *operatorv1.ManagementCluster
 	var managementClusterConnection *operatorv1.ManagementClusterConnection
 	var keyValidatorConfig authentication.KeyValidatorConfig
+	var managerCR *operatorv1.Manager
 	includeV3NetworkPolicy := false
 
 	if installationSpec.Variant.IsEnterprise() {
@@ -370,6 +378,12 @@ func (r *ReconcileAPIServer) Reconcile(ctx context.Context, request reconcile.Re
 			return reconcile.Result{}, err
 		}
 
+		managerCR, err = utils.GetManager(ctx, r.client, false, "")
+		if err != nil {
+			r.status.SetDegraded(operatorv1.ResourceReadError, "Error reading Manager", err, reqLogger)
+			return reconcile.Result{}, err
+		}
+
 		if managementClusterConnection != nil && managementCluster != nil {
 			err = fmt.Errorf("having both a ManagementCluster and a ManagementClusterConnection is not supported")
 			r.status.SetDegraded(operatorv1.ResourceValidationError, "", err, reqLogger)
@@ -497,6 +511,7 @@ func (r *ReconcileAPIServer) Reconcile(ctx context.Context, request reconcile.Re
 		KubernetesVersion:            r.opts.KubernetesVersion,
 		ClusterDomain:                r.opts.ClusterDomain,
 		RequiresAggregationServer:    !r.opts.UseV3CRDs,
+		RBACManagementEnabled:        managerCR.RBACManagementEnabled(),
 		QueryServerTLSKeyPairCertificateManagementOnly: queryServerTLSSecretCertificateManagementOnly,
 	}
 

pkg/controller/installation/core_controller.go

@@ -252,6 +252,14 @@ func Add(mgr manager.Manager, opts options.ControllerOptions) error {
 			return fmt.Errorf("tigera-installation-controller failed to watch primary resource: %v", err)
 		}
 
+		// Watch the Manager CR so changes to spec.rbac re-run the installation
+		// reconcile (the rbacsync controller in calico-kube-controllers is
+		// gated on it).
+		err = c.WatchObject(&operatorv1.Manager{}, &handler.EnqueueRequestForObject{})
+		if err != nil {
+			return fmt.Errorf("tigera-installation-controller failed to watch Manager: %v", err)
+		}
+
 		// watch for change to primary resource LogCollector
 		err = c.WatchObject(&operatorv1.LogCollector{}, &handler.EnqueueRequestForObject{})
 		if err != nil {
@@ -1049,6 +1057,7 @@ func (r *ReconcileInstallation) Reconcile(ctx context.Context, request reconcile
 
 	var managementCluster *operatorv1.ManagementCluster
 	var managementClusterConnection *operatorv1.ManagementClusterConnection
+	var managerCR *operatorv1.Manager
 	var logCollector *operatorv1.LogCollector
 	if r.enterpriseCRDsExist {
 		logCollector, err = utils.GetLogCollector(ctx, r.client)
@@ -1071,6 +1080,12 @@ func (r *ReconcileInstallation) Reconcile(ctx context.Context, request reconcile
 			return reconcile.Result{}, err
 		}
 
+		managerCR, err = utils.GetManager(ctx, r.client, false, "")
+		if err != nil {
+			r.status.SetDegraded(operatorv1.ResourceReadError, "Error reading Manager", err, reqLogger)
+			return reconcile.Result{}, err
+		}
+
 		if managementClusterConnection != nil && managementCluster != nil {
 			err = fmt.Errorf("having both a managementCluster and a managementClusterConnection is not supported")
 			r.status.SetDegraded(operatorv1.ResourceValidationError, "", err, reqLogger)
@@ -1705,7 +1720,8 @@ func (r *ReconcileInstallation) Reconcile(ctx context.Context, request reconcile
 		// the kube-controllers component (and deleted when the WAF extension is
 		// disabled); the caBundle is the operator CA that issued the serving
 		// cert above.
-		WAFWebhookCABundle: certificateManager.KeyPair().GetCertificatePEM(),
+		WAFWebhookCABundle:    certificateManager.KeyPair().GetCertificatePEM(),
+		RBACManagementEnabled: managerCR.RBACManagementEnabled(),
 	}
 	components = append(components, kubecontrollers.NewCalicoKubeControllers(&kubeControllersCfg))
 

pkg/controller/manager/manager_controller.go

@@ -233,23 +233,6 @@ type ReconcileManager struct {
 	opts            options.ControllerOptions
 }
 
-// GetManager returns the default manager instance with defaults populated.
-func GetManager(ctx context.Context, cli client.Client, mt bool, ns string) (*operatorv1.Manager, error) {
-	key := client.ObjectKey{Name: "tigera-secure"}
-	if mt {
-		key.Namespace = ns
-	}
-
-	// Fetch the manager instance. We only support a single instance named "tigera-secure".
-	instance := &operatorv1.Manager{}
-	err := cli.Get(ctx, key, instance)
-	if err != nil {
-		return nil, err
-	}
-
-	return instance, nil
-}
-
 // Reconcile reads that state of the cluster for a Manager object and makes changes based on the state read
 // and what is in the Manager.Spec
 // The Controller will requeue the Request to be processed again if the returned error is non-nil or
@@ -276,16 +259,16 @@ func (r *ReconcileManager) Reconcile(ctx context.Context, request reconcile.Requ
 	}
 
 	// Fetch the Manager instance that corresponds with this reconcile trigger.
-	instance, err := GetManager(ctx, r.client, r.opts.MultiTenant, request.Namespace)
+	instance, err := utils.GetManager(ctx, r.client, r.opts.MultiTenant, request.Namespace)
 	if err != nil {
-		if errors.IsNotFound(err) {
-			logc.Info("Manager object not found")
-			r.status.OnCRNotFound()
-			return reconcile.Result{}, nil
-		}
 		r.status.SetDegraded(operatorv1.ResourceReadError, "Error querying Manager", err, logc)
 		return reconcile.Result{}, err
 	}
+	if instance == nil {
+		logc.Info("Manager object not found")
+		r.status.OnCRNotFound()
+		return reconcile.Result{}, nil
+	}
 	logc.V(2).Info("Loaded config", "config", instance)
 	r.status.OnCRFound()
 
@@ -719,6 +702,7 @@ func (r *ReconcileManager) Reconcile(ctx context.Context, request reconcile.Requ
 		BindingNamespaces:          namespaces,
 		OSSTenantNamespaces:        ossTenantNamespaces,
 		Manager:                    instance,
+		Authentication:             authenticationCR,
 		KibanaEnabled:              kibanaEnabled,
 		CACertCommonName:           certificateManager.CACertCommonName(),
 	}

pkg/controller/manager/manager_controller_test.go

@@ -88,7 +88,7 @@ var _ = Describe("Manager controller tests", func() {
 		}
 		err := c.Create(ctx, instance)
 		Expect(err).NotTo(HaveOccurred())
-		instance, err = GetManager(ctx, c, false, "")
+		instance, err = utils.GetManager(ctx, c, false, "")
 		Expect(err).NotTo(HaveOccurred())
 	})
 
@@ -102,7 +102,7 @@ var _ = Describe("Manager controller tests", func() {
 		}
 		err := c.Create(ctx, instanceA)
 		Expect(err).NotTo(HaveOccurred())
-		instance, err = GetManager(ctx, c, true, tenantANamespace)
+		instance, err = utils.GetManager(ctx, c, true, tenantANamespace)
 		Expect(err).NotTo(HaveOccurred())
 
 		tenantBNamespace := "tenant-b"
@@ -112,14 +112,14 @@ var _ = Describe("Manager controller tests", func() {
 		}
 		err = c.Create(ctx, instanceB)
 		Expect(err).NotTo(HaveOccurred())
-		instance, err = GetManager(ctx, c, true, tenantBNamespace)
+		instance, err = utils.GetManager(ctx, c, true, tenantBNamespace)
 		Expect(err).NotTo(HaveOccurred())
 	})
 
-	It("should return expected error when querying namespace that does not contain a manager instance", func() {
+	It("should return a nil instance and no error when querying a namespace that does not contain a manager instance", func() {
 		nsWithoutManager := "non-manager-ns"
-		instance, err := GetManager(ctx, c, true, nsWithoutManager)
-		Expect(kerror.IsNotFound(err)).To(BeTrue())
+		instance, err := utils.GetManager(ctx, c, true, nsWithoutManager)
+		Expect(err).NotTo(HaveOccurred())
 		Expect(instance).To(BeNil())
 	})
 
@@ -819,7 +819,7 @@ var _ = Describe("Manager controller tests", func() {
 						Namespace: "",
 					}})
 					Expect(err).ShouldNot(HaveOccurred())
-					instance, err := GetManager(ctx, r.client, false, "")
+					instance, err := utils.GetManager(ctx, r.client, false, "")
 					Expect(err).ShouldNot(HaveOccurred())
 
 					Expect(instance.Status.Conditions).To(HaveLen(1))
@@ -843,7 +843,7 @@ var _ = Describe("Manager controller tests", func() {
 						Namespace: "",
 					}})
 					Expect(err).ShouldNot(HaveOccurred())
-					instance, err := GetManager(ctx, r.client, false, "")
+					instance, err := utils.GetManager(ctx, r.client, false, "")
 					Expect(err).ShouldNot(HaveOccurred())
 
 					Expect(instance.Status.Conditions).To(HaveLen(0))
@@ -887,7 +887,7 @@ var _ = Describe("Manager controller tests", func() {
 						Namespace: "",
 					}})
 					Expect(err).ShouldNot(HaveOccurred())
-					instance, err := GetManager(ctx, r.client, false, "")
+					instance, err := utils.GetManager(ctx, r.client, false, "")
 					Expect(err).ShouldNot(HaveOccurred())
 
 					Expect(instance.Status.Conditions).To(HaveLen(3))
@@ -948,7 +948,7 @@ var _ = Describe("Manager controller tests", func() {
 						Namespace: "",
 					}})
 					Expect(err).ShouldNot(HaveOccurred())
-					instance, err := GetManager(ctx, r.client, false, "")
+					instance, err := utils.GetManager(ctx, r.client, false, "")
 					Expect(err).ShouldNot(HaveOccurred())
 
 					Expect(instance.Status.Conditions).To(HaveLen(3))

pkg/controller/utils/utils.go

@@ -487,6 +487,27 @@ func GetIstio(ctx context.Context, c client.Client) (*operatorv1.Istio, error) {
 	return istio, nil
 }
 
+// GetManager returns the Manager CR, or nil if it is not found. When
+// multiTenant is true the tenant-scoped instance is read from ns; otherwise the
+// cluster-scoped instance is read and ns is ignored. A NoMatchError (the
+// Manager CRD is not registered) is returned to the caller rather than treated
+// as not-found: absence of the CRD is distinct from the user not having created
+// a Manager, and the caller decides how to handle it.
+func GetManager(ctx context.Context, cli client.Client, multiTenant bool, ns string) (*operatorv1.Manager, error) {
+	key := DefaultEnterpriseInstanceKey
+	if multiTenant {
+		key.Namespace = ns
+	}
+	instance := &operatorv1.Manager{}
+	if err := cli.Get(ctx, key, instance); err != nil {
+		if errors.IsNotFound(err) {
+			return nil, nil
+		}
+		return nil, err
+	}
+	return instance, nil
+}
+
 // Return the ManagementCluster CR if present. No error is returned if it was not found.
 func GetManagementCluster(ctx context.Context, c client.Client) (*operatorv1.ManagementCluster, error) {
 	managementCluster := &operatorv1.ManagementCluster{}

pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgpconfigurations.yaml

@@ -11,7 +11,6 @@ spec:
     listKind: BGPConfigurationList
     plural: bgpconfigurations
     singular: bgpconfiguration
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1

pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgpfilters.yaml

@@ -11,7 +11,6 @@ spec:
     listKind: BGPFilterList
     plural: bgpfilters
     singular: bgpfilter
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1

pkg/imports/crds/calico/v1.crd.projectcalico.org/crd.projectcalico.org_bgppeers.yaml

@@ -11,7 +11,6 @@ spec:
     listKind: BGPPeerList
     plural: bgppeers
     singular: bgppeer
-  preserveUnknownFields: false
   scope: Cluster
   versions:
     - name: v1