Skip to content

DOCS-3077: Fix the NetworkPolicy resource reference #3072

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
ctauchen wants to merge 2 commits into from
Closed

DOCS-3077: Fix the NetworkPolicy resource reference #3072

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6cdf001
DOCS-3077: Add tier field and fix Pass action in NetworkPolicy reference
ctauchen Oct 12, 2026
b0ed199
DOCS-3077: Address review findings
ctauchen Oct 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions calico/_includes/content/_rule.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,9 +17,10 @@ are executed in order.
After a `Log` action, processing continues with the next rule; `Allow` and `Deny` are immediate
and final and no further rules are processed.

An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` will skip over the remaining policies and jump to the
first [profile](../../reference/resources/profile.mdx) assigned to the endpoint, applying the policy configured in the
profile; if there are no Profiles configured for the endpoint the default applied action is `Deny`.
An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` skips the remaining policies in the policy's tier.
The packet is then evaluated by the next [tier](../../reference/resources/tier.mdx) that contains a policy that applies to the endpoint.
If no later tier applies, $[prodname] applies the [profiles](../../reference/resources/profile.mdx) assigned to the endpoint.
If there are no profiles configured for the endpoint, the default applied action is `Deny`.

### RuleMetadata

Expand Down
3 changes: 2 additions & 1 deletion calico/reference/resources/networkpolicy.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,8 @@ spec:

| Field | Description | Accepted Values | Schema | Default |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | ---------------------- | --------------------------------------------- |
| order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | |
| order | Controls the order of precedence within the policy's tier. $[prodname] applies the policy with the lowest value first. | | float | |
| tier | Name of the [tier](tier.mdx) this policy belongs to. The tier must exist before you create the policy. | | string | `default` |
| selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() |
| types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* |
| ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | |
Expand Down
7 changes: 4 additions & 3 deletions calico_versioned_docs/version-3.31/_includes/content/_rule.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,9 +17,10 @@ are executed in order.
After a `Log` action, processing continues with the next rule; `Allow` and `Deny` are immediate
and final and no further rules are processed.

An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` will skip over the remaining policies and jump to the
first [profile](../../reference/resources/profile.mdx) assigned to the endpoint, applying the policy configured in the
profile; if there are no Profiles configured for the endpoint the default applied action is `Deny`.
An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` skips the remaining policies in the policy's tier.
The packet is then evaluated by the next [tier](../../reference/resources/tier.mdx) that contains a policy that applies to the endpoint.
If no later tier applies, $[prodname] applies the [profiles](../../reference/resources/profile.mdx) assigned to the endpoint.
If there are no profiles configured for the endpoint, the default applied action is `Deny`.

### RuleMetadata

Expand Down
3 changes: 2 additions & 1 deletion calico_versioned_docs/version-3.31/reference/resources/networkpolicy.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,8 @@ spec:

| Field | Description | Accepted Values | Schema | Default |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | ---------------------- | --------------------------------------------- |
| order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | |
| order | Controls the order of precedence within the policy's tier. $[prodname] applies the policy with the lowest value first. | | float | |
| tier | Name of the [tier](tier.mdx) this policy belongs to. The tier must exist before you create the policy. If the tier isn't `default`, the policy name must have the form `<tier>.<name>`. | | string | `default` |
| selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() |
| types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* |
| ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | |
Expand Down
7 changes: 4 additions & 3 deletions calico_versioned_docs/version-3.32/_includes/content/_rule.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,9 +17,10 @@ are executed in order.
After a `Log` action, processing continues with the next rule; `Allow` and `Deny` are immediate
and final and no further rules are processed.

An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` will skip over the remaining policies and jump to the
first [profile](../../reference/resources/profile.mdx) assigned to the endpoint, applying the policy configured in the
profile; if there are no Profiles configured for the endpoint the default applied action is `Deny`.
An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` skips the remaining policies in the policy's tier.
The packet is then evaluated by the next [tier](../../reference/resources/tier.mdx) that contains a policy that applies to the endpoint.
If no later tier applies, $[prodname] applies the [profiles](../../reference/resources/profile.mdx) assigned to the endpoint.
If there are no profiles configured for the endpoint, the default applied action is `Deny`.

### RuleMetadata

Expand Down
3 changes: 2 additions & 1 deletion calico_versioned_docs/version-3.32/reference/resources/networkpolicy.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,8 @@ spec:

| Field | Description | Accepted Values | Schema | Default |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | ---------------------- | --------------------------------------------- |
| order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | |
| order | Controls the order of precedence within the policy's tier. $[prodname] applies the policy with the lowest value first. | | float | |
| tier | Name of the [tier](tier.mdx) this policy belongs to. The tier must exist before you create the policy. | | string | `default` |
| selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() |
| types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* |
| ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | |
Expand Down
7 changes: 4 additions & 3 deletions calico_versioned_docs/version-3.33/_includes/content/_rule.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,9 +17,10 @@ are executed in order.
After a `Log` action, processing continues with the next rule; `Allow` and `Deny` are immediate
and final and no further rules are processed.

An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` will skip over the remaining policies and jump to the
first [profile](../../reference/resources/profile.mdx) assigned to the endpoint, applying the policy configured in the
profile; if there are no Profiles configured for the endpoint the default applied action is `Deny`.
An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` skips the remaining policies in the policy's tier.
The packet is then evaluated by the next [tier](../../reference/resources/tier.mdx) that contains a policy that applies to the endpoint.
If no later tier applies, $[prodname] applies the [profiles](../../reference/resources/profile.mdx) assigned to the endpoint.
If there are no profiles configured for the endpoint, the default applied action is `Deny`.

### RuleMetadata

Expand Down
3 changes: 2 additions & 1 deletion calico_versioned_docs/version-3.33/reference/resources/networkpolicy.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,8 @@ spec:

| Field | Description | Accepted Values | Schema | Default |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | ---------------------- | --------------------------------------------- |
| order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | |
| order | Controls the order of precedence within the policy's tier. $[prodname] applies the policy with the lowest value first. | | float | |
| tier | Name of the [tier](tier.mdx) this policy belongs to. The tier must exist before you create the policy. | | string | `default` |
| selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() |
| types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* |
| ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | |
Expand Down
Loading