Goldmane hard-codes FELIX_FLOWLOGSFLUSHINTERVAL=15, preventing FelixConfiguration override

Moved from https://github.com/tigera/operator/issues/5257, opened by @shashankm on 2026-08-26.

Original comment thread stays readable at the link above.

Description

When the operator-managed Goldmane/default resource exists, tigera-operator injects FELIX_FLOWLOGSFLUSHINTERVAL=15 into the calico-node DaemonSet. Felix environment variables have higher precedence than FelixConfiguration, so the supported FelixConfiguration.spec.flowLogsFlushInterval field becomes ineffective whenever Goldmane is enabled.

This prevents operators from tuning the flow-log flush interval without pausing tigera-operator and directly patching an operator-managed DaemonSet, maintaining a custom operator image, or manually deploying Goldmane. The inability to tune the interval matters on larger or connection-heavy clusters where Felix flow collection can add material CPU and memory usage.

Environment

• Calico v3.30.7
• tigera-operator v1.38.13
• Operator-managed Calico OSS installation
• Goldmane enabled through operator.tigera.io/v1 Goldmane/default

The same literal value is still present in inspected operator tags v1.38.16, v1.40.13, and v1.42.4.

Reproduction

With Goldmane enabled, confirm the rendered environment variable:

$ kubectl -n calico-system get ds calico-node \
    -o jsonpath='{range .spec.template.spec.containers[?(@.name=="calico-node")].env[?(@.name=="FELIX_FLOWLOGSFLUSHINTERVAL")]}{.name}={.value}{"\\n"}{end}'
FELIX_FLOWLOGSFLUSHINTERVAL=15

Set the documented FelixConfiguration field:

$ kubectl patch felixconfiguration default --type merge \
    -p '{"spec":{"flowLogsFlushInterval":"60s"}}'
felixconfiguration.projectcalico.org/default patched

$ kubectl get felixconfiguration default \
    -o jsonpath='{.spec.flowLogsFlushInterval}{"\\n"}'
1m0s

The DaemonSet remains unchanged at 15 seconds and Felix logs the precedence decision:

Parsed value for FlowLogsFlushInterval: 15s (from environment variable)
Parsed value for FlowLogsFlushInterval: 1m0s (from datastore (global))
Skipping config value for FlowLogsFlushInterval from datastore (global); already have a value from environment variable

The value remains ineffective after a periodic operator reconcile. No pod rollout occurs because the rendered DaemonSet remains unchanged.

Expected behavior

An explicitly configured FelixConfiguration.spec.flowLogsFlushInterval should control the effective Felix setting when Goldmane is enabled, or the Goldmane/operator API should expose an equivalent supported setting.

Actual behavior

The operator always injects the literal 15 at higher precedence, making the FelixConfiguration field ineffective.

Source

The value is hard-coded in pkg/render/node.go when Goldmane is running:

https://github.com/tigera/operator/blob/v1.38.13/pkg/render/node.go#L1454-L1466

There is relevant operator precedent in #2700. That change removed another operator-injected FELIX_* variable specifically because environment-variable precedence made subsequent FelixConfiguration tuning impossible:

https://github.com/tigera/operator/pull/2700

Suggested resolution

Follow the pattern from #2700:

1. Do not inject FELIX_FLOWLOGSFLUSHINTERVAL into the DaemonSet.
2. When Goldmane is enabled, default FelixConfiguration.spec.flowLogsFlushInterval to 15s only when the user has not supplied a value.

Alternatively, expose a field such as Goldmane.spec.flowLogsFlushInterval and reconcile it through FelixConfiguration. If Goldmane requires a fixed 15-second interval for correctness, please document that constraint and reject unsupported values rather than exposing an apparently configurable Felix field that is silently ignored.