diff --git a/calico/_includes/content/_rule.mdx b/calico/_includes/content/_rule.mdx index 54a04d392e..bec9a7da4c 100644 --- a/calico/_includes/content/_rule.mdx +++ b/calico/_includes/content/_rule.mdx @@ -17,9 +17,10 @@ are executed in order. After a `Log` action, processing continues with the next rule; `Allow` and `Deny` are immediate and final and no further rules are processed. -An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` will skip over the remaining policies and jump to the -first [profile](../../reference/resources/profile.mdx) assigned to the endpoint, applying the policy configured in the -profile; if there are no Profiles configured for the endpoint the default applied action is `Deny`. +An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` skips the remaining policies in the policy's tier. +The packet is then evaluated by the next [tier](../../reference/resources/tier.mdx) that contains a policy that applies to the endpoint. +If no later tier applies, $[prodname] applies the [profiles](../../reference/resources/profile.mdx) assigned to the endpoint. +If there are no profiles configured for the endpoint, the default applied action is `Deny`. ### RuleMetadata diff --git a/calico/reference/resources/networkpolicy.mdx b/calico/reference/resources/networkpolicy.mdx index b65ee62b57..2e9c4c1b69 100644 --- a/calico/reference/resources/networkpolicy.mdx +++ b/calico/reference/resources/networkpolicy.mdx @@ -79,7 +79,8 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | ---------------------- | --------------------------------------------- | -| order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | +| order | Controls the order of precedence within the policy's tier. $[prodname] applies the policy with the lowest value first. | | float | | +| tier | Name of the [tier](tier.mdx) this policy belongs to. The tier must exist before you create the policy. | | string | `default` | | selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() | | types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | | ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | | diff --git a/calico_versioned_docs/version-3.31/_includes/content/_rule.mdx b/calico_versioned_docs/version-3.31/_includes/content/_rule.mdx index 54a04d392e..bec9a7da4c 100644 --- a/calico_versioned_docs/version-3.31/_includes/content/_rule.mdx +++ b/calico_versioned_docs/version-3.31/_includes/content/_rule.mdx @@ -17,9 +17,10 @@ are executed in order. After a `Log` action, processing continues with the next rule; `Allow` and `Deny` are immediate and final and no further rules are processed. -An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` will skip over the remaining policies and jump to the -first [profile](../../reference/resources/profile.mdx) assigned to the endpoint, applying the policy configured in the -profile; if there are no Profiles configured for the endpoint the default applied action is `Deny`. +An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` skips the remaining policies in the policy's tier. +The packet is then evaluated by the next [tier](../../reference/resources/tier.mdx) that contains a policy that applies to the endpoint. +If no later tier applies, $[prodname] applies the [profiles](../../reference/resources/profile.mdx) assigned to the endpoint. +If there are no profiles configured for the endpoint, the default applied action is `Deny`. ### RuleMetadata diff --git a/calico_versioned_docs/version-3.31/reference/resources/networkpolicy.mdx b/calico_versioned_docs/version-3.31/reference/resources/networkpolicy.mdx index 68ba747077..bc5dedb725 100644 --- a/calico_versioned_docs/version-3.31/reference/resources/networkpolicy.mdx +++ b/calico_versioned_docs/version-3.31/reference/resources/networkpolicy.mdx @@ -79,7 +79,8 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | ---------------------- | --------------------------------------------- | -| order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | +| order | Controls the order of precedence within the policy's tier. $[prodname] applies the policy with the lowest value first. | | float | | +| tier | Name of the [tier](tier.mdx) this policy belongs to. The tier must exist before you create the policy. If the tier isn't `default`, the policy name must have the form `.`. | | string | `default` | | selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() | | types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | | ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | | diff --git a/calico_versioned_docs/version-3.32/_includes/content/_rule.mdx b/calico_versioned_docs/version-3.32/_includes/content/_rule.mdx index 6ed49affa9..fd6a4671d4 100644 --- a/calico_versioned_docs/version-3.32/_includes/content/_rule.mdx +++ b/calico_versioned_docs/version-3.32/_includes/content/_rule.mdx @@ -17,9 +17,10 @@ are executed in order. After a `Log` action, processing continues with the next rule; `Allow` and `Deny` are immediate and final and no further rules are processed. -An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` will skip over the remaining policies and jump to the -first [profile](../../reference/resources/profile.mdx) assigned to the endpoint, applying the policy configured in the -profile; if there are no Profiles configured for the endpoint the default applied action is `Deny`. +An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` skips the remaining policies in the policy's tier. +The packet is then evaluated by the next [tier](../../reference/resources/tier.mdx) that contains a policy that applies to the endpoint. +If no later tier applies, $[prodname] applies the [profiles](../../reference/resources/profile.mdx) assigned to the endpoint. +If there are no profiles configured for the endpoint, the default applied action is `Deny`. ### RuleMetadata diff --git a/calico_versioned_docs/version-3.32/reference/resources/networkpolicy.mdx b/calico_versioned_docs/version-3.32/reference/resources/networkpolicy.mdx index 3da3ca0d7f..bfd4f3fd8f 100644 --- a/calico_versioned_docs/version-3.32/reference/resources/networkpolicy.mdx +++ b/calico_versioned_docs/version-3.32/reference/resources/networkpolicy.mdx @@ -79,7 +79,8 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | ---------------------- | --------------------------------------------- | -| order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | +| order | Controls the order of precedence within the policy's tier. $[prodname] applies the policy with the lowest value first. | | float | | +| tier | Name of the [tier](tier.mdx) this policy belongs to. The tier must exist before you create the policy. | | string | `default` | | selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() | | types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | | ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | | diff --git a/calico_versioned_docs/version-3.33/_includes/content/_rule.mdx b/calico_versioned_docs/version-3.33/_includes/content/_rule.mdx index 54a04d392e..bec9a7da4c 100644 --- a/calico_versioned_docs/version-3.33/_includes/content/_rule.mdx +++ b/calico_versioned_docs/version-3.33/_includes/content/_rule.mdx @@ -17,9 +17,10 @@ are executed in order. After a `Log` action, processing continues with the next rule; `Allow` and `Deny` are immediate and final and no further rules are processed. -An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` will skip over the remaining policies and jump to the -first [profile](../../reference/resources/profile.mdx) assigned to the endpoint, applying the policy configured in the -profile; if there are no Profiles configured for the endpoint the default applied action is `Deny`. +An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` skips the remaining policies in the policy's tier. +The packet is then evaluated by the next [tier](../../reference/resources/tier.mdx) that contains a policy that applies to the endpoint. +If no later tier applies, $[prodname] applies the [profiles](../../reference/resources/profile.mdx) assigned to the endpoint. +If there are no profiles configured for the endpoint, the default applied action is `Deny`. ### RuleMetadata diff --git a/calico_versioned_docs/version-3.33/reference/resources/networkpolicy.mdx b/calico_versioned_docs/version-3.33/reference/resources/networkpolicy.mdx index 8679413f54..c89c277ee9 100644 --- a/calico_versioned_docs/version-3.33/reference/resources/networkpolicy.mdx +++ b/calico_versioned_docs/version-3.33/reference/resources/networkpolicy.mdx @@ -79,7 +79,8 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | ---------------------- | --------------------------------------------- | -| order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | +| order | Controls the order of precedence within the policy's tier. $[prodname] applies the policy with the lowest value first. | | float | | +| tier | Name of the [tier](tier.mdx) this policy belongs to. The tier must exist before you create the policy. | | string | `default` | | selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() | | types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | | ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | |