diff --git a/Makefile b/Makefile
index 36fe3ad6e3..01dc97dd33 100644
--- a/Makefile
+++ b/Makefile
@@ -290,21 +290,21 @@ clean:
 ###############################################################################
 UT_DIR?=./pkg
 FV_DIR?=./test
-GINKGO_ARGS?= -v
+GINKGO_ARGS?= -v -trace -r
 GINKGO_FOCUS?=.*
 
 .PHONY: ut
 ut:
 	-mkdir -p .go-pkg-cache report
 	$(CONTAINERIZED) $(CALICO_BUILD) sh -c '$(GIT_CONFIG_SSH) \
-	ginkgo -trace -r -focus="$(GINKGO_FOCUS)" $(GINKGO_ARGS) "$(UT_DIR)"'
+	ginkgo -focus="$(GINKGO_FOCUS)" $(GINKGO_ARGS) "$(UT_DIR)"'
 
 ## Run the functional tests
 fv: cluster-create load-container-images run-fvs cluster-destroy
 run-fvs:
 	-mkdir -p .go-pkg-cache report
 	$(CONTAINERIZED) $(CALICO_BUILD) sh -c '$(GIT_CONFIG_SSH) \
-	ginkgo -trace -r -focus="$(GINKGO_FOCUS)" $(GINKGO_ARGS) "$(FV_DIR)"'
+	ginkgo -focus="$(GINKGO_FOCUS)" $(GINKGO_ARGS) "$(FV_DIR)"'
 
 ## Create a local kind dual stack cluster.
 KIND_KUBECONFIG?=./kubeconfig.yaml
diff --git a/pkg/controller/logstorage/secrets/secret_controller.go b/pkg/controller/logstorage/secrets/secret_controller.go
index 9580d5f127..b2a9146526 100644
--- a/pkg/controller/logstorage/secrets/secret_controller.go
+++ b/pkg/controller/logstorage/secrets/secret_controller.go
@@ -195,8 +195,6 @@ func (r *SecretSubController) Reconcile(ctx context.Context, request reconcile.R
 		return reconcile.Result{}, err
 	}
 
-	// TODO: Do we need to handle managed clusters differently? Should this controller run at all?
-
 	// Wait for the initializing controller to indicate that the LogStorage object is actionable.
 	if ls.Status.State != operatorv1.TigeraStatusReady {
 		r.status.SetDegraded(operatorv1.ResourceNotReady, "Waiting for LogStorage to be ready", nil, reqLogger)
diff --git a/pkg/controller/logstorage/secrets/secret_controller_test.go b/pkg/controller/logstorage/secrets/secret_controller_test.go
index 0686f7beb1..77ddf0f30c 100644
--- a/pkg/controller/logstorage/secrets/secret_controller_test.go
+++ b/pkg/controller/logstorage/secrets/secret_controller_test.go
@@ -473,6 +473,30 @@ var _ = Describe("LogStorage Secrets controller", func() {
 		Expect(err).ShouldNot(HaveOccurred())
 		Expect(result).Should(Equal(successResult))
 	})
+
+	It("should not take any action in managed cluster", func() {
+		// Create a LogStorage instance with a default configuration.
+		ls := &operatorv1.LogStorage{}
+		ls.Name = "tigera-secure"
+		ls.Status.State = operatorv1.TigeraStatusReady
+		CreateLogStorage(cli, ls)
+
+		// Create a ManagementClusterConnection object
+		mcc := &operatorv1.ManagementClusterConnection{}
+		mcc.Name = "tigera-secure"
+		Expect(cli.Create(ctx, mcc)).ShouldNot(HaveOccurred())
+
+		// Run the reconciler.
+		r, err := NewSecretControllerWithShims(cli, scheme, mockStatus, operatorv1.ProviderNone, dns.DefaultClusterDomain)
+		Expect(err).ShouldNot(HaveOccurred())
+		_, err = r.Reconcile(ctx, reconcile.Request{})
+		Expect(err).ShouldNot(HaveOccurred())
+
+		// Query all secrets, the returned list should only contain the CA secret created in BeforeEach
+		var secrets corev1.SecretList
+		Expect(cli.List(ctx, &secrets)).ShouldNot(HaveOccurred())
+		Expect(len(secrets.Items)).To(Equal(1))
+	})
 })
 
 // CreateLogStorage creates a LogStorage object with the given parameters after filling in defaults,