Skip to content

DOCS-3097: Fix the StagedNetworkPolicy resource reference #3082

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
ctauchen wants to merge 2 commits into from
Closed

DOCS-3097: Fix the StagedNetworkPolicy resource reference #3082

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
83f5ff0
DOCS-3097: Fix the StagedNetworkPolicy reference against the API
ctauchen Oct 12, 2026
5dd776b
DOCS-3097: Address review findings
ctauchen Oct 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 26 additions & 4 deletions calico/reference/resources/stagednetworkpolicy.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@

# Staged network policy

import Httpmatch from '@site/calico/_includes/content/_httpmatch.mdx';

import Servicematch from '@site/calico/_includes/content/_servicematch.mdx';

import Serviceaccountmatch from '@site/calico/_includes/content/_serviceaccountmatch.mdx';
Expand All @@ -19,7 +21,7 @@
import Rule from '@site/calico/_includes/content/_rule.mdx';

A staged network policy resource (`StagedNetworkPolicy`) represents an ordered set of rules which are applied
to a collection of endpoints that match a [label selector](#selector). These rules are used to preview network behavior and do
to a collection of endpoints that match a [label selector](#selectors). These rules are used to preview network behavior and do
not enforce network traffic. For enforcing network traffic, see [network policy resource](networkpolicy.mdx).

`StagedNetworkPolicy` is a namespaced resource. `StagedNetworkPolicy` in a specific namespace
Expand Down Expand Up @@ -81,13 +83,14 @@

| Field | Description | Accepted Values | Schema | Default |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | --------------------- | --------------------------------------------- |
| stagedAction | How $[prodname] handles the staged policy. With `Set`, $[prodname] evaluates the policy as if it were enforced, alongside the enforced policies, and reports the result in the `policies.pending` field of [flow logs](../../observability/view-flow-logs.mdx). It doesn't replace an enforced policy that has the same name. With `Delete`, $[prodname] ignores the staged policy, and all other spec fields except `tier` must be empty. The API also accepts `Learn` and `Ignore`, which $[prodname] treats like `Set`. | `Set`, `Delete`, `Learn`, `Ignore` | string | `Set` |

Check failure on line 86 in calico/reference/resources/stagednetworkpolicy.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'stagedAction'?

Raw Output:
{"message":"[Vale.Spelling] Did you really mean 'stagedAction'?","location":{"path":"calico/reference/resources/stagednetworkpolicy.mdx","range":{"start":{"line":86,"column":3},"end":{"line":86,"column":15}}},"severity":"ERROR","code":{"value":"Vale.Spelling"}}
| order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | |
| tier | Name of the [tier](tier.mdx) this policy belongs to. | | string | `default` |
| selector | Selects the endpoints to which this policy applies. | | [selector](#selector) | all() |
| selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() |
| types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* |
| ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | |
| egress | Ordered list of egress rules applied by this policy. | | List of [Rule](#rule) | |
| serviceAccountSelector | Selects the service account(s) to which this policy applies. Select a specific service account by name using the `projectcalico.org/name` label. | | [selector](#selector) | all() |
| serviceAccountSelector | Selects the service account(s) to which this policy applies. Select a specific service account by name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() |
| performanceHints | Contains a list of hints to Calico's policy engine to help process the policy more efficiently. Hints never change the enforcement behaviour of the policy. The available hints are described [below](#performance-hints). | `AssumeNeededOnEveryNode` | List of strings | |

\* If `types` has no value, $[prodname] defaults as follows.
Expand All @@ -111,7 +114,7 @@

<Entityrule global='false' />

### Selector
### Selectors

<Selectors />

Expand Down Expand Up @@ -139,6 +142,25 @@
the policy on every node so that there is less work to do when the first endpoint matching the policy shows up.
It also prevents work from being done to tear down the policy when the last endpoint is drained.

## Application layer policy

Application layer policy is an optional feature of $[prodname] and
[must be enabled](../../network-policy/istio/app-layer-policy.mdx)
to use the following match criteria.

:::note

Application layer policy match criteria are supported with the following restrictions.

- Only ingress policy is supported. Egress policy must not contain any application layer policy match clauses.
- Rules must have the action `Allow` if they contain application layer policy match clauses.

:::

### HTTPMatch

<Httpmatch />

## Supported operations

| Datastore type | Create/Delete | Update | Get/List | Notes |
Expand Down
30 changes: 26 additions & 4 deletions calico_versioned_docs/version-3.31/reference/resources/stagednetworkpolicy.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@

# Staged network policy

import Httpmatch from '@site/calico_versioned_docs/version-3.31/_includes/content/_httpmatch.mdx';

import Servicematch from '@site/calico_versioned_docs/version-3.31/_includes/content/_servicematch.mdx';

import Serviceaccountmatch from '@site/calico_versioned_docs/version-3.31/_includes/content/_serviceaccountmatch.mdx';
Expand All @@ -19,7 +21,7 @@
import Rule from '@site/calico_versioned_docs/version-3.31/_includes/content/_rule.mdx';

A staged network policy resource (`StagedNetworkPolicy`) represents an ordered set of rules which are applied
to a collection of endpoints that match a [label selector](#selector). These rules are used to preview network behavior and do
to a collection of endpoints that match a [label selector](#selectors). These rules are used to preview network behavior and do
not enforce network traffic. For enforcing network traffic, see [network policy resource](networkpolicy.mdx).

`StagedNetworkPolicy` is a namespaced resource. `StagedNetworkPolicy` in a specific namespace
Expand Down Expand Up @@ -81,13 +83,14 @@

| Field | Description | Accepted Values | Schema | Default |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | --------------------- | --------------------------------------------- |
| stagedAction | How $[prodname] handles the staged policy. With `Set`, $[prodname] evaluates the policy as if it were enforced, alongside the enforced policies, and reports the result in the `policies.pending` field of [flow logs](../../observability/view-flow-logs.mdx). It doesn't replace an enforced policy that has the same name. With `Delete`, $[prodname] ignores the staged policy, and all other spec fields except `tier` must be empty. The API also accepts `Learn` and `Ignore`, which $[prodname] treats like `Set`. | `Set`, `Delete`, `Learn`, `Ignore` | string | `Set` |

Check failure on line 86 in calico_versioned_docs/version-3.31/reference/resources/stagednetworkpolicy.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'stagedAction'?

Raw Output:
{"message":"[Vale.Spelling] Did you really mean 'stagedAction'?","location":{"path":"calico_versioned_docs/version-3.31/reference/resources/stagednetworkpolicy.mdx","range":{"start":{"line":86,"column":3},"end":{"line":86,"column":15}}},"severity":"ERROR","code":{"value":"Vale.Spelling"}}
| order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | |
| tier | Name of the [tier](tier.mdx) this policy belongs to. | | string | `default` |
| selector | Selects the endpoints to which this policy applies. | | [selector](#selector) | all() |
| selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() |
| types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* |
| ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | |
| egress | Ordered list of egress rules applied by this policy. | | List of [Rule](#rule) | |
| serviceAccountSelector | Selects the service account(s) to which this policy applies. Select a specific service account by name using the `projectcalico.org/name` label. | | [selector](#selector) | all() |
| serviceAccountSelector | Selects the service account(s) to which this policy applies. Select a specific service account by name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() |
| performanceHints | Contains a list of hints to Calico's policy engine to help process the policy more efficiently. Hints never change the enforcement behaviour of the policy. The available hints are described [below](#performance-hints). | `AssumeNeededOnEveryNode` | List of strings | |

\* If `types` has no value, $[prodname] defaults as follows.
Expand All @@ -111,7 +114,7 @@

<Entityrule global='false' />

### Selector
### Selectors

<Selectors />

Expand Down Expand Up @@ -139,6 +142,25 @@
the policy on every node so that there is less work to do when the first endpoint matching the policy shows up.
It also prevents work from being done to tear down the policy when the last endpoint is drained.

## Application layer policy

Application layer policy is an optional feature of $[prodname] and
[must be enabled](../../network-policy/istio/app-layer-policy.mdx)
to use the following match criteria.

:::note

Application layer policy match criteria are supported with the following restrictions.

- Only ingress policy is supported. Egress policy must not contain any application layer policy match clauses.
- Rules must have the action `Allow` if they contain application layer policy match clauses.

:::

### HTTPMatch

<Httpmatch />

## Supported operations

| Datastore type | Create/Delete | Update | Get/List | Notes |
Expand Down
Loading
Loading