Repository navigation
DOCS-3077: Fix inaccuracies on the NetworkPolicy reference - #3114
Merged
ctauchen merged 17 commits intoOct 19, 2026
Merged
Conversation
✅ Deploy Preview for calico-docs-preview-next ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview succeeded!Built without sensitive environment variables
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
One or more issues must be addressed before approval.
1 open finding
What changed in this PR
Updates Calico OSS 3.33 NetworkPolicy documentation to reflect validated product behavior.
Changes:
- Corrects metadata name and
spec.typesguidance. - Clarifies selector scope, namespace network sets, performance, and syntax examples.
- Updates shared selector/entity-rule content used by related resource pages.
| File | Description |
|---|---|
| calico_versioned_docs/version-3.33/reference/resources/networkpolicy.mdx | Updated as part of this pull request. |
| calico_versioned_docs/version-3.33/_includes/content/_selectors.mdx | Updated as part of this pull request. |
| calico_versioned_docs/version-3.33/_includes/content/_entityrule.mdx | Updated as part of this pull request. |
🧠 Review effort: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| | order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | | ||
| | selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() | | ||
| | types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | | ||
| | types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `[Ingress]`. To apply the policy to outbound traffic, set to `[Egress]`. To apply the policy to both, set to `[Ingress, Egress]`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | |
This was referenced Oct 15, 2026
ctauchen
marked this pull request as ready for review
October 19, 2026 16:06
This reverts commit 62468c2.
This reverts commit 48bdc48.
…tworkPolicy reference
…tworkPolicy reference
The exact match compares the path after normalization, not the path as written. The prefix match works on whole path segments, so /keys does not match /keystore. Reproduced on kind with Istio and Dikastes on v3.33.0 and v3.32.2, with Envoy path normalization on and off.
Every version says the name is lowercase alphanumeric with optional hyphens and at most one period.
ctauchen
force-pushed
the
DOCS-3077-fact-check-networkpolicy
branch
from
October 19, 2026 16:17
62cfa30 to
f4704b8
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes statements on the Calico OSS NetworkPolicy reference that do not match the product, in next, 3.33, 3.32 and 3.31. Each fix below was reproduced on a kind cluster running that version's release: v3.33.0 for next and 3.33, v3.32.2 for 3.32, and v3.31.7 for 3.31.
Jira: https://tigera.atlassian.net/browse/DOCS-3077
Reproduced in the product:
tierfield, which defaults todefaultand must exist before you create the policy. In 3.31, a policy in a tier other thandefaultmust be named<tier>.<name>.types: the unbracketed valuesIngress,EgressandIngress, Egressare rejected. The description now uses list values._, and can contain only one., except names that start withknp.default.orossg.default.. Not changed in 3.31, where the rule is different.||is optimized when every branch requires the same label.exact: matches the path after normalization, not as written. For example,/foo//bar,/foo/x/../barand/foo/%62armatchexact: /foo/bar. Not changed in 3.31.prefix: matches at a path-segment boundary, so/keysmatches/keys/1but not/keystore. Not changed in 3.31.The HTTPMatch
exactandprefixfixes were reproduced on kind using the Istio and Dikastes setup from the application layer policy page, on v3.33.0 and v3.32.2, with Envoy path normalization both on and off. They are not changed in 3.31: in v3.31.7, Dikastes registers no policy check, so it denies every request and HTTPMatch cannot be observed. That is a separate problem with the 3.31 application layer policy page, for the docs team to follow up.The shared partials also change the GlobalNetworkPolicy, staged policy, IPPool, BGPPeer and KubeControllersConfiguration pages.
Previews:
Next: https://deploy-preview-3114--calico-docs-preview-next.netlify.app/calico/next/reference/resources/networkpolicy/
3.33: https://deploy-preview-3114--tigera.netlify.app/calico/latest/reference/resources/networkpolicy
3.32: https://deploy-preview-3114--tigera.netlify.app/calico/3.32/reference/resources/networkpolicy
3.31: https://deploy-preview-3114--tigera.netlify.app/calico/3.31/reference/resources/networkpolicy
In next and 3.33, the name rule now says to use at most one
., because calicoctl rejects more. With native v3 CRDs, kubectl accepts names with more dots.knp.default.names are no longer listed, because calicoctl refuses them.In next and 3.33, the
typesfootnote says to leave out an emptyingressoregresslist. With native v3 CRDs, kubectl countsingress: []as rules present, which can deny all ingress.Next and 3.33 were verified in both API server mode and native v3 CRD mode.
Not changed:
nets: []andselector: "". Not verified in the original run, so not changed.