Match the Enterprise product, not one of its two spellings

[fasaxc]

Problem

calico-private's kind clusters have been failing to come up since #4871 landed. Typha never goes ready, and its log fills with:

Failed to perform list of current data during resync ListRoot=".../v3/pc.org/licensekeys" cacheID=1
  error=connection is unauthorized: licensekeys.projectcalico.org is forbidden:
  User "system:serviceaccount:calico-system:calico-typha" cannot list resource "licensekeys"
  in API group "projectcalico.org" at the cluster scope

The same happens for networks, externalnetworks, egressgatewaypolicies, packetcaptures, bfdconfigurations, deeppacketinspections and remoteclusterconfigurations, on both calico-typha and calico-node. That set is exactly what modifyTypha and modifyNode add, so the Enterprise extensions were not running at all.

Cause

ProductVariant has two Enterprise spellings — CalicoEnterprise, and TigeraSecureEnterprise kept as a deprecated alias (#4607). enterprise.New switched on the constant:

switch variant {
case operatorv1.CalicoEnterprise:
	return extensions.New(extensions.Set{...})
case operatorv1.Calico:
	...
}
return extensions.Extensions{}

An Installation asking for TigeraSecureEnterprise matched neither case and fell through to the zero value, which extends nothing. Every Enterprise modifier — installation, windows, apiserver, clusterconnection — silently went missing. calico-private's hack/test/kind/infra/values.yaml sets variant: TigeraSecureEnterprise, so its kind clusters took the whole regression.

Fix

Match on variant.IsEnterprise() rather than the constant, and compare the same way in extensions.Decorate, so an Installation and an extension that spell the variant differently still pair up. pkg/render was already alias-safe: every other comparison tests against Calico, which has only one spelling.

Testing

pkg/controller/utils/component_enterprise_test.go already renders a real Typha through the handler and asserts licensekeys lands in the cluster role. It hardcoded CalicoEnterprise — the one spelling that worked — so it now runs over both, and fails on TigeraSecureEnterprise without this change.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR fixes a regression in the enterprise extension mechanism by making variant matching alias-safe, so TigeraSecureEnterprise (deprecated) and CalicoEnterprise (current) both correctly activate Enterprise modifiers and extensions.

Changes:

• Make Enterprise extension registration in pkg/enterprise match on variant.IsEnterprise() instead of a single constant.
• Make extension decoration (extensions.Decorate) treat both Enterprise spellings as the same product via a shared comparison helper.
• Expand tests to exercise the deprecated spelling through both the unit-level decoration tests and the Typha integration-style test.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
pkg/extensions/extensions_test.go	Adds coverage for the deprecated Enterprise spelling in Decorate behavior.
pkg/extensions/component.go	Updates Decorate to use an alias-safe Enterprise comparison (sameProduct).
pkg/enterprise/register.go	Fixes Enterprise extension set construction to use IsEnterprise() for variant matching.
pkg/controller/utils/component_enterprise_test.go	Extends the Typha modifier integration test to run for both Enterprise spellings.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.