From 83f5ff0b53e1ae26879d84bb78248ab99d807609 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Mon, 12 Oct 2026 15:23:26 +0100 Subject: [PATCH 1/2] DOCS-3097: Fix the StagedNetworkPolicy reference against the API --- .../resources/stagednetworkpolicy.mdx | 22 +++++++++++++++++++ .../resources/stagednetworkpolicy.mdx | 22 +++++++++++++++++++ .../resources/stagednetworkpolicy.mdx | 22 +++++++++++++++++++ .../resources/stagednetworkpolicy.mdx | 22 +++++++++++++++++++ 4 files changed, 88 insertions(+) diff --git a/calico/reference/resources/stagednetworkpolicy.mdx b/calico/reference/resources/stagednetworkpolicy.mdx index d0f2e6d860..c2a5e406b1 100644 --- a/calico/reference/resources/stagednetworkpolicy.mdx +++ b/calico/reference/resources/stagednetworkpolicy.mdx @@ -4,6 +4,8 @@ description: Reference for the StagedNetworkPolicy resource in Calico Open Sourc # Staged network policy +import Httpmatch from '@site/calico/_includes/content/_httpmatch.mdx'; + import Servicematch from '@site/calico/_includes/content/_servicematch.mdx'; import Serviceaccountmatch from '@site/calico/_includes/content/_serviceaccountmatch.mdx'; @@ -81,6 +83,7 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | --------------------- | --------------------------------------------- | +| stagedAction | Change that the staged policy previews. `Set` previews creating or updating the enforced policy with the same name. `Delete` previews deleting it, and requires all other spec fields except `tier` to be empty. | `Set`, `Delete`, `Learn`, `Ignore` | string | `Set` | | order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | | tier | Name of the [tier](tier.mdx) this policy belongs to. | | string | `default` | | selector | Selects the endpoints to which this policy applies. | | [selector](#selector) | all() | @@ -139,6 +142,25 @@ process it more efficiently. Currently only one hint is defined: the policy on every node so that there is less work to do when the first endpoint matching the policy shows up. It also prevents work from being done to tear down the policy when the last endpoint is drained. +## Application layer policy + +Application layer policy is an optional feature of $[prodname] and +[must be enabled](../../network-policy/istio/app-layer-policy.mdx) +to use the following match criteria. + +:::note + +Application layer policy match criteria are supported with the following restrictions. + +- Only ingress policy is supported. Egress policy must not contain any application layer policy match clauses. +- Rules must have the action `Allow` if they contain application layer policy match clauses. + +::: + +### HTTPMatch + + + ## Supported operations | Datastore type | Create/Delete | Update | Get/List | Notes | diff --git a/calico_versioned_docs/version-3.31/reference/resources/stagednetworkpolicy.mdx b/calico_versioned_docs/version-3.31/reference/resources/stagednetworkpolicy.mdx index bda071a127..dd938d8cbf 100644 --- a/calico_versioned_docs/version-3.31/reference/resources/stagednetworkpolicy.mdx +++ b/calico_versioned_docs/version-3.31/reference/resources/stagednetworkpolicy.mdx @@ -4,6 +4,8 @@ description: API for this resource. # Staged network policy +import Httpmatch from '@site/calico_versioned_docs/version-3.31/_includes/content/_httpmatch.mdx'; + import Servicematch from '@site/calico_versioned_docs/version-3.31/_includes/content/_servicematch.mdx'; import Serviceaccountmatch from '@site/calico_versioned_docs/version-3.31/_includes/content/_serviceaccountmatch.mdx'; @@ -81,6 +83,7 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | --------------------- | --------------------------------------------- | +| stagedAction | Change that the staged policy previews. `Set` previews creating or updating the enforced policy with the same name. `Delete` previews deleting it, and requires all other spec fields except `tier` to be empty. | `Set`, `Delete`, `Learn`, `Ignore` | string | `Set` | | order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | | tier | Name of the [tier](tier.mdx) this policy belongs to. | | string | `default` | | selector | Selects the endpoints to which this policy applies. | | [selector](#selector) | all() | @@ -139,6 +142,25 @@ process it more efficiently. Currently only one hint is defined: the policy on every node so that there is less work to do when the first endpoint matching the policy shows up. It also prevents work from being done to tear down the policy when the last endpoint is drained. +## Application layer policy + +Application layer policy is an optional feature of $[prodname] and +[must be enabled](../../network-policy/istio/app-layer-policy.mdx) +to use the following match criteria. + +:::note + +Application layer policy match criteria are supported with the following restrictions. + +- Only ingress policy is supported. Egress policy must not contain any application layer policy match clauses. +- Rules must have the action `Allow` if they contain application layer policy match clauses. + +::: + +### HTTPMatch + + + ## Supported operations | Datastore type | Create/Delete | Update | Get/List | Notes | diff --git a/calico_versioned_docs/version-3.32/reference/resources/stagednetworkpolicy.mdx b/calico_versioned_docs/version-3.32/reference/resources/stagednetworkpolicy.mdx index 418b49be86..af00d6a1ea 100644 --- a/calico_versioned_docs/version-3.32/reference/resources/stagednetworkpolicy.mdx +++ b/calico_versioned_docs/version-3.32/reference/resources/stagednetworkpolicy.mdx @@ -4,6 +4,8 @@ description: Reference for the StagedNetworkPolicy resource in Calico Open Sourc # Staged network policy +import Httpmatch from '@site/calico_versioned_docs/version-3.32/_includes/content/_httpmatch.mdx'; + import Servicematch from '@site/calico_versioned_docs/version-3.32/_includes/content/_servicematch.mdx'; import Serviceaccountmatch from '@site/calico_versioned_docs/version-3.32/_includes/content/_serviceaccountmatch.mdx'; @@ -81,6 +83,7 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | --------------------- | --------------------------------------------- | +| stagedAction | Change that the staged policy previews. `Set` previews creating or updating the enforced policy with the same name. `Delete` previews deleting it, and requires all other spec fields except `tier` to be empty. | `Set`, `Delete`, `Learn`, `Ignore` | string | `Set` | | order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | | tier | Name of the [tier](tier.mdx) this policy belongs to. | | string | `default` | | selector | Selects the endpoints to which this policy applies. | | [selector](#selector) | all() | @@ -139,6 +142,25 @@ process it more efficiently. Currently only one hint is defined: the policy on every node so that there is less work to do when the first endpoint matching the policy shows up. It also prevents work from being done to tear down the policy when the last endpoint is drained. +## Application layer policy + +Application layer policy is an optional feature of $[prodname] and +[must be enabled](../../network-policy/istio/app-layer-policy.mdx) +to use the following match criteria. + +:::note + +Application layer policy match criteria are supported with the following restrictions. + +- Only ingress policy is supported. Egress policy must not contain any application layer policy match clauses. +- Rules must have the action `Allow` if they contain application layer policy match clauses. + +::: + +### HTTPMatch + + + ## Supported operations | Datastore type | Create/Delete | Update | Get/List | Notes | diff --git a/calico_versioned_docs/version-3.33/reference/resources/stagednetworkpolicy.mdx b/calico_versioned_docs/version-3.33/reference/resources/stagednetworkpolicy.mdx index ea48502546..702fb1cdeb 100644 --- a/calico_versioned_docs/version-3.33/reference/resources/stagednetworkpolicy.mdx +++ b/calico_versioned_docs/version-3.33/reference/resources/stagednetworkpolicy.mdx @@ -4,6 +4,8 @@ description: Reference for the StagedNetworkPolicy resource in Calico Open Sourc # Staged network policy +import Httpmatch from '@site/calico_versioned_docs/version-3.33/_includes/content/_httpmatch.mdx'; + import Servicematch from '@site/calico_versioned_docs/version-3.33/_includes/content/_servicematch.mdx'; import Serviceaccountmatch from '@site/calico_versioned_docs/version-3.33/_includes/content/_serviceaccountmatch.mdx'; @@ -81,6 +83,7 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | --------------------- | --------------------------------------------- | +| stagedAction | Change that the staged policy previews. `Set` previews creating or updating the enforced policy with the same name. `Delete` previews deleting it, and requires all other spec fields except `tier` to be empty. | `Set`, `Delete`, `Learn`, `Ignore` | string | `Set` | | order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | | tier | Name of the [tier](tier.mdx) this policy belongs to. | | string | `default` | | selector | Selects the endpoints to which this policy applies. | | [selector](#selector) | all() | @@ -139,6 +142,25 @@ process it more efficiently. Currently only one hint is defined: the policy on every node so that there is less work to do when the first endpoint matching the policy shows up. It also prevents work from being done to tear down the policy when the last endpoint is drained. +## Application layer policy + +Application layer policy is an optional feature of $[prodname] and +[must be enabled](../../network-policy/istio/app-layer-policy.mdx) +to use the following match criteria. + +:::note + +Application layer policy match criteria are supported with the following restrictions. + +- Only ingress policy is supported. Egress policy must not contain any application layer policy match clauses. +- Rules must have the action `Allow` if they contain application layer policy match clauses. + +::: + +### HTTPMatch + + + ## Supported operations | Datastore type | Create/Delete | Update | Get/List | Notes | From 5dd776b90e349c75a5b4764157531e5fd37c97fe Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Mon, 12 Oct 2026 16:07:58 +0100 Subject: [PATCH 2/2] DOCS-3097: Address review findings --- calico/reference/resources/stagednetworkpolicy.mdx | 10 +++++----- .../reference/resources/stagednetworkpolicy.mdx | 10 +++++----- .../reference/resources/stagednetworkpolicy.mdx | 10 +++++----- .../reference/resources/stagednetworkpolicy.mdx | 10 +++++----- 4 files changed, 20 insertions(+), 20 deletions(-) diff --git a/calico/reference/resources/stagednetworkpolicy.mdx b/calico/reference/resources/stagednetworkpolicy.mdx index c2a5e406b1..1bc7523b48 100644 --- a/calico/reference/resources/stagednetworkpolicy.mdx +++ b/calico/reference/resources/stagednetworkpolicy.mdx @@ -21,7 +21,7 @@ import Icmp from '@site/calico/_includes/content/_icmp.mdx'; import Rule from '@site/calico/_includes/content/_rule.mdx'; A staged network policy resource (`StagedNetworkPolicy`) represents an ordered set of rules which are applied -to a collection of endpoints that match a [label selector](#selector). These rules are used to preview network behavior and do +to a collection of endpoints that match a [label selector](#selectors). These rules are used to preview network behavior and do not enforce network traffic. For enforcing network traffic, see [network policy resource](networkpolicy.mdx). `StagedNetworkPolicy` is a namespaced resource. `StagedNetworkPolicy` in a specific namespace @@ -83,14 +83,14 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | --------------------- | --------------------------------------------- | -| stagedAction | Change that the staged policy previews. `Set` previews creating or updating the enforced policy with the same name. `Delete` previews deleting it, and requires all other spec fields except `tier` to be empty. | `Set`, `Delete`, `Learn`, `Ignore` | string | `Set` | +| stagedAction | How $[prodname] handles the staged policy. With `Set`, $[prodname] evaluates the policy as if it were enforced, alongside the enforced policies, and reports the result in the `policies.pending` field of [flow logs](../../observability/view-flow-logs.mdx). It doesn't replace an enforced policy that has the same name. With `Delete`, $[prodname] ignores the staged policy, and all other spec fields except `tier` must be empty. The API also accepts `Learn` and `Ignore`, which $[prodname] treats like `Set`. | `Set`, `Delete`, `Learn`, `Ignore` | string | `Set` | | order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | | tier | Name of the [tier](tier.mdx) this policy belongs to. | | string | `default` | -| selector | Selects the endpoints to which this policy applies. | | [selector](#selector) | all() | +| selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() | | types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | | ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | | | egress | Ordered list of egress rules applied by this policy. | | List of [Rule](#rule) | | -| serviceAccountSelector | Selects the service account(s) to which this policy applies. Select a specific service account by name using the `projectcalico.org/name` label. | | [selector](#selector) | all() | +| serviceAccountSelector | Selects the service account(s) to which this policy applies. Select a specific service account by name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() | | performanceHints | Contains a list of hints to Calico's policy engine to help process the policy more efficiently. Hints never change the enforcement behaviour of the policy. The available hints are described [below](#performance-hints). | `AssumeNeededOnEveryNode` | List of strings | | \* If `types` has no value, $[prodname] defaults as follows. @@ -114,7 +114,7 @@ spec: -### Selector +### Selectors diff --git a/calico_versioned_docs/version-3.31/reference/resources/stagednetworkpolicy.mdx b/calico_versioned_docs/version-3.31/reference/resources/stagednetworkpolicy.mdx index dd938d8cbf..b15cb7f008 100644 --- a/calico_versioned_docs/version-3.31/reference/resources/stagednetworkpolicy.mdx +++ b/calico_versioned_docs/version-3.31/reference/resources/stagednetworkpolicy.mdx @@ -21,7 +21,7 @@ import Icmp from '@site/calico_versioned_docs/version-3.31/_includes/content/_ic import Rule from '@site/calico_versioned_docs/version-3.31/_includes/content/_rule.mdx'; A staged network policy resource (`StagedNetworkPolicy`) represents an ordered set of rules which are applied -to a collection of endpoints that match a [label selector](#selector). These rules are used to preview network behavior and do +to a collection of endpoints that match a [label selector](#selectors). These rules are used to preview network behavior and do not enforce network traffic. For enforcing network traffic, see [network policy resource](networkpolicy.mdx). `StagedNetworkPolicy` is a namespaced resource. `StagedNetworkPolicy` in a specific namespace @@ -83,14 +83,14 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | --------------------- | --------------------------------------------- | -| stagedAction | Change that the staged policy previews. `Set` previews creating or updating the enforced policy with the same name. `Delete` previews deleting it, and requires all other spec fields except `tier` to be empty. | `Set`, `Delete`, `Learn`, `Ignore` | string | `Set` | +| stagedAction | How $[prodname] handles the staged policy. With `Set`, $[prodname] evaluates the policy as if it were enforced, alongside the enforced policies, and reports the result in the `policies.pending` field of [flow logs](../../observability/view-flow-logs.mdx). It doesn't replace an enforced policy that has the same name. With `Delete`, $[prodname] ignores the staged policy, and all other spec fields except `tier` must be empty. The API also accepts `Learn` and `Ignore`, which $[prodname] treats like `Set`. | `Set`, `Delete`, `Learn`, `Ignore` | string | `Set` | | order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | | tier | Name of the [tier](tier.mdx) this policy belongs to. | | string | `default` | -| selector | Selects the endpoints to which this policy applies. | | [selector](#selector) | all() | +| selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() | | types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | | ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | | | egress | Ordered list of egress rules applied by this policy. | | List of [Rule](#rule) | | -| serviceAccountSelector | Selects the service account(s) to which this policy applies. Select a specific service account by name using the `projectcalico.org/name` label. | | [selector](#selector) | all() | +| serviceAccountSelector | Selects the service account(s) to which this policy applies. Select a specific service account by name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() | | performanceHints | Contains a list of hints to Calico's policy engine to help process the policy more efficiently. Hints never change the enforcement behaviour of the policy. The available hints are described [below](#performance-hints). | `AssumeNeededOnEveryNode` | List of strings | | \* If `types` has no value, $[prodname] defaults as follows. @@ -114,7 +114,7 @@ spec: -### Selector +### Selectors diff --git a/calico_versioned_docs/version-3.32/reference/resources/stagednetworkpolicy.mdx b/calico_versioned_docs/version-3.32/reference/resources/stagednetworkpolicy.mdx index af00d6a1ea..cff110ea9c 100644 --- a/calico_versioned_docs/version-3.32/reference/resources/stagednetworkpolicy.mdx +++ b/calico_versioned_docs/version-3.32/reference/resources/stagednetworkpolicy.mdx @@ -21,7 +21,7 @@ import Icmp from '@site/calico_versioned_docs/version-3.32/_includes/content/_ic import Rule from '@site/calico_versioned_docs/version-3.32/_includes/content/_rule.mdx'; A staged network policy resource (`StagedNetworkPolicy`) represents an ordered set of rules which are applied -to a collection of endpoints that match a [label selector](#selector). These rules are used to preview network behavior and do +to a collection of endpoints that match a [label selector](#selectors). These rules are used to preview network behavior and do not enforce network traffic. For enforcing network traffic, see [network policy resource](networkpolicy.mdx). `StagedNetworkPolicy` is a namespaced resource. `StagedNetworkPolicy` in a specific namespace @@ -83,14 +83,14 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | --------------------- | --------------------------------------------- | -| stagedAction | Change that the staged policy previews. `Set` previews creating or updating the enforced policy with the same name. `Delete` previews deleting it, and requires all other spec fields except `tier` to be empty. | `Set`, `Delete`, `Learn`, `Ignore` | string | `Set` | +| stagedAction | How $[prodname] handles the staged policy. With `Set`, $[prodname] evaluates the policy as if it were enforced, alongside the enforced policies, and reports the result in the `policies.pending` field of [flow logs](../../observability/view-flow-logs.mdx). It doesn't replace an enforced policy that has the same name. With `Delete`, $[prodname] ignores the staged policy, and all other spec fields except `tier` must be empty. The API also accepts `Learn` and `Ignore`, which $[prodname] treats like `Set`. | `Set`, `Delete`, `Learn`, `Ignore` | string | `Set` | | order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | | tier | Name of the [tier](tier.mdx) this policy belongs to. | | string | `default` | -| selector | Selects the endpoints to which this policy applies. | | [selector](#selector) | all() | +| selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() | | types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | | ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | | | egress | Ordered list of egress rules applied by this policy. | | List of [Rule](#rule) | | -| serviceAccountSelector | Selects the service account(s) to which this policy applies. Select a specific service account by name using the `projectcalico.org/name` label. | | [selector](#selector) | all() | +| serviceAccountSelector | Selects the service account(s) to which this policy applies. Select a specific service account by name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() | | performanceHints | Contains a list of hints to Calico's policy engine to help process the policy more efficiently. Hints never change the enforcement behaviour of the policy. The available hints are described [below](#performance-hints). | `AssumeNeededOnEveryNode` | List of strings | | \* If `types` has no value, $[prodname] defaults as follows. @@ -114,7 +114,7 @@ spec: -### Selector +### Selectors diff --git a/calico_versioned_docs/version-3.33/reference/resources/stagednetworkpolicy.mdx b/calico_versioned_docs/version-3.33/reference/resources/stagednetworkpolicy.mdx index 702fb1cdeb..fc087c2d6a 100644 --- a/calico_versioned_docs/version-3.33/reference/resources/stagednetworkpolicy.mdx +++ b/calico_versioned_docs/version-3.33/reference/resources/stagednetworkpolicy.mdx @@ -21,7 +21,7 @@ import Icmp from '@site/calico_versioned_docs/version-3.33/_includes/content/_ic import Rule from '@site/calico_versioned_docs/version-3.33/_includes/content/_rule.mdx'; A staged network policy resource (`StagedNetworkPolicy`) represents an ordered set of rules which are applied -to a collection of endpoints that match a [label selector](#selector). These rules are used to preview network behavior and do +to a collection of endpoints that match a [label selector](#selectors). These rules are used to preview network behavior and do not enforce network traffic. For enforcing network traffic, see [network policy resource](networkpolicy.mdx). `StagedNetworkPolicy` is a namespaced resource. `StagedNetworkPolicy` in a specific namespace @@ -83,14 +83,14 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | --------------------- | --------------------------------------------- | -| stagedAction | Change that the staged policy previews. `Set` previews creating or updating the enforced policy with the same name. `Delete` previews deleting it, and requires all other spec fields except `tier` to be empty. | `Set`, `Delete`, `Learn`, `Ignore` | string | `Set` | +| stagedAction | How $[prodname] handles the staged policy. With `Set`, $[prodname] evaluates the policy as if it were enforced, alongside the enforced policies, and reports the result in the `policies.pending` field of [flow logs](../../observability/view-flow-logs.mdx). It doesn't replace an enforced policy that has the same name. With `Delete`, $[prodname] ignores the staged policy, and all other spec fields except `tier` must be empty. The API also accepts `Learn` and `Ignore`, which $[prodname] treats like `Set`. | `Set`, `Delete`, `Learn`, `Ignore` | string | `Set` | | order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | | tier | Name of the [tier](tier.mdx) this policy belongs to. | | string | `default` | -| selector | Selects the endpoints to which this policy applies. | | [selector](#selector) | all() | +| selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() | | types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | | ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | | | egress | Ordered list of egress rules applied by this policy. | | List of [Rule](#rule) | | -| serviceAccountSelector | Selects the service account(s) to which this policy applies. Select a specific service account by name using the `projectcalico.org/name` label. | | [selector](#selector) | all() | +| serviceAccountSelector | Selects the service account(s) to which this policy applies. Select a specific service account by name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() | | performanceHints | Contains a list of hints to Calico's policy engine to help process the policy more efficiently. Hints never change the enforcement behaviour of the policy. The available hints are described [below](#performance-hints). | `AssumeNeededOnEveryNode` | List of strings | | \* If `types` has no value, $[prodname] defaults as follows. @@ -114,7 +114,7 @@ spec: -### Selector +### Selectors