Support enterprise whisker-backend with Linseed upstream

[hjiawei]

Summary

• Enable whisker-backend for Calico Enterprise by configuring it to use Linseed as the flow data source instead of Goldmane
• Add RBAC (ClusterRole/ClusterRoleBinding) for Linseed flows, TokenReview, and SubjectAccessReview so whisker-backend can authenticate users and filter flows by RBAC
• Wire up network policies: Linseed egress, kube-apiserver egress, Manager ingress for whisker; Linseed ingress from whisker; Manager egress to whisker
• Add mTLS client certs and cluster ID support for Linseed communication

Notes

• Whisker frontend enterprise deployment (enterprise image, WHISKER_FEATURES env var) is intentionally excluded — it will be handled separately once the UI team integrates Whisker as a ui-module in Manager
• This PR only covers the whisker-backend container changes needed for enterprise Linseed integration

[Copilot]

Pull request overview

Adds enterprise support to the whisker-backend by wiring it to Linseed (instead of Goldmane) for flow data, including RBAC, mTLS, and network policy plumbing for enterprise variants. Non-enterprise (Calico) paths still render Goldmane env/policy as before.

Changes:

• Render enterprise Whisker ClusterRole/ClusterRoleBinding and Linseed-specific env vars (LINSEED_URL, LINSEED_CA_PATH, LINSEED_TOKEN_PATH, LINSEED_CLUSTER_ID, LINSEED_CLIENT_CERT/KEY_PATH); split network policy into enterprise (Manager ingress + Linseed/kube-apiserver egress) vs Calico (Goldmane egress).
• Controller: skip Goldmane CR requirement for enterprise, watch TigeraLinseedSecret, switch trusted bundle source to Linseed for enterprise, and add a missing return after SetDegraded in trusted bundle creation.
• Wire Manager → Whisker egress and Linseed ← Whisker ingress via new WhiskerEntityRule/WhiskerSourceEntityRule helpers; update expected policy JSON fixtures and Manager test egress count.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
pkg/render/whisker/component.go	Adds enterprise constants, RBAC objects, Linseed env vars, ingress/egress rules in network policy
pkg/render/whisker/component_test.go	Adds enterprise object count, deployment, RBAC, and network policy test cases
pkg/render/manager.go	Adds Manager egress rule to Whisker
pkg/render/manager_test.go	Updates expected egress rule count from 11 to 12
pkg/render/logstorage/linseed/linseed.go	Adds Whisker as ingress source to Linseed
pkg/render/common/networkpolicy/networkpolicy.go	Adds WhiskerEntityRule and WhiskerSourceEntityRule helpers
pkg/controller/whisker/controller.go	Skips Goldmane CR requirement for enterprise, watches Linseed secret, switches trusted bundle source, adds missing return on error
pkg/render/testutils/expected_policies/manager.json	Adds Manager→Whisker egress entry
pkg/render/testutils/expected_policies/manager_ocp.json	Adds Manager→Whisker egress entry
pkg/render/testutils/expected_policies/linseed.json	Adds Whisker ingress entry
pkg/render/testutils/expected_policies/linseed_ocp.json	Adds Whisker ingress entry
pkg/render/testutils/expected_policies/linseed_dpi_enabled.json	Adds Whisker ingress entry
pkg/render/testutils/expected_policies/linseed_ocp_dpi_enabled.json	Adds Whisker ingress entry

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.