diff --git a/calico/_includes/content/_entityrule.mdx b/calico/_includes/content/_entityrule.mdx index 6172ecc91f..40aac6f3c4 100644 --- a/calico/_includes/content/_entityrule.mdx +++ b/calico/_includes/content/_entityrule.mdx @@ -5,7 +5,7 @@ to match. Packets can be matched on combinations of: Kubernetes `Service`. Selectors can match [workload endpoints](../../reference/resources/workloadendpoint.mdx), [host endpoints](../../reference/resources/hostendpoint.mdx) and ([namespaced](../../reference/resources/networkset.mdx) or [global](../../reference/resources/globalnetworkset.mdx)) network sets. -- Source/destination IP address, protocol and port. +- Source/destination IP address and port. If the rule contains multiple match criteria (for example, an IP and a port) then all match criteria must match for the rule as a whole to match a packet. @@ -16,7 +16,7 @@ for the rule as a whole to match a packet. | notNets | Negative match on CIDRs. Match packets with IP not in any of the listed CIDRs. | List of valid IPv4 CIDRs or list of valid IPv6 CIDRs (IPv4 and IPv6 CIDRs shouldn't be mixed in one rule) | list of cidrs | | selector | Positive match on selected endpoints. If a `namespaceSelector` is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces. | Valid selector | [selector](#selectors) | | | notSelector | Negative match on selected endpoints. If a `namespaceSelector` is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces. | Valid selector | [selector](#selectors) | | -| namespaceSelector | Positive match on selected namespaces. If specified, only workload endpoints in the selected Kubernetes namespaces are matched. Matches namespaces based on the labels that have been applied to the namespaces. Defines the scope that selectors will apply to, if not defined then selectors apply to the policy's namespace for a namespaced policy, and to all namespaces and non-namespaced resources for a global policy. Match a specific namespace by name using the `kubernetes.io/metadata.name` label. Select the non-namespaced resources like GlobalNetworkSet(s), host endpoints to which this policy applies by using `global()` selector. | Valid selector | [selector](#selectors) | | +| namespaceSelector | Positive match on selected namespaces. If specified, only workload endpoints and network sets in the selected Kubernetes namespaces are matched. Matches namespaces based on the labels that have been applied to the namespaces. Defines the scope that selectors will apply to, if not defined then selectors apply to the policy's namespace for a namespaced policy, and to all namespaces and non-namespaced resources for a global policy. Match a specific namespace by name using the `kubernetes.io/metadata.name` label. Select the non-namespaced resources like GlobalNetworkSet(s), host endpoints to which this policy applies by using `global()` selector. | Valid selector | [selector](#selectors) | | | ports | Positive match on the specified ports | | list of [ports](#ports) | | | notPorts | Negative match on the specified ports | | list of [ports](#ports) | | | serviceAccounts | Match endpoints running under service accounts. If a `namespaceSelector` is also defined, the set of service accounts this applies to is limited to the service accounts in the selected namespaces. | | [ServiceAccountMatch](#serviceaccountmatch) | | @@ -40,7 +40,7 @@ $[prodname] typically drops the empty value when it stores the resource, so the rather than the selector: - `selector: !has(foo)` matches packets from/to endpoints and network sets that do not have the label "foo". -- `notSelector: has(foo)` matches packets from/to **anywhere** (including outside the cluster), **except** traffic from/to endpoints and network sets that have the label "foo". +- `notSelector: has(foo)` matches packets from/to **anywhere** (including outside the cluster), **except** traffic from/to endpoints and network sets that have the label "foo". In a `NetworkPolicy`, or in a rule that also sets `namespaceSelector`, the match is limited to in-scope endpoints and network sets, so it matches packets from/to those that do not have the label "foo". #### Selector performance in EntityRules @@ -63,7 +63,7 @@ The following perform like `has(label)`. All endpoints with the label will be s - `label starts with 's'` - `label ends with 's'` -The other operators, and in particular, `all()`, `!`, `||` and `!=` are not optimized. +The other operators, and in particular, `all()`, `!`, `||` and `!=` are not optimized. The exception is `||` where every branch requires the same label, such as `a == 'b' || a == 'c'`, which is optimized. Examples: diff --git a/calico/_includes/content/_httpmatch.mdx b/calico/_includes/content/_httpmatch.mdx index 613bb97c3d..870f67918f 100644 --- a/calico/_includes/content/_httpmatch.mdx +++ b/calico/_includes/content/_httpmatch.mdx @@ -1,4 +1,4 @@ -An HTTPMatch matches attributes of an HTTP request. The presence of an HTTPMatch clause on a Rule will cause that rule to only match HTTP traffic. Other application layer protocols will not match the rule. +An HTTPMatch matches attributes of an HTTP request. Example: @@ -17,7 +17,7 @@ http: ### HTTPPathMatch -| Syntax | Example | Description | -| ------ | ------------------- | ------------------------------------------------------------------------------- | -| exact | `exact: "/foo/bar"` | Matches the exact path as written, not including the query string or fragments. | -| prefix | `prefix: "/keys"` | Matches any path that begins with the given prefix. | +| Syntax | Example | Description | +| ------ | ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| exact | `exact: "/foo/bar"` | Matches the exact path after normalization, not including the query string or fragments. For example, normalization decodes percent-escapes, collapses repeated slashes, and resolves `.` and `..` segments. | +| prefix | `prefix: "/keys"` | Matches the given path and any path below it, at a path-segment boundary. For example, `/keys` matches `/keys/1` but not `/keystore`. | diff --git a/calico/_includes/content/_rule.mdx b/calico/_includes/content/_rule.mdx index 54a04d392e..2280a4cdca 100644 --- a/calico/_includes/content/_rule.mdx +++ b/calico/_includes/content/_rule.mdx @@ -17,7 +17,7 @@ are executed in order. After a `Log` action, processing continues with the next rule; `Allow` and `Deny` are immediate and final and no further rules are processed. -An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` will skip over the remaining policies and jump to the +An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` will skip over the remaining policies in its tier and jump to the next tier with policies that apply to the endpoint. After the last such tier, it jumps to the first [profile](../../reference/resources/profile.mdx) assigned to the endpoint, applying the policy configured in the profile; if there are no Profiles configured for the endpoint the default applied action is `Deny`. diff --git a/calico/_includes/content/_selectors.mdx b/calico/_includes/content/_selectors.mdx index 52baf960ae..ba6f21d0be 100644 --- a/calico/_includes/content/_selectors.mdx +++ b/calico/_includes/content/_selectors.mdx @@ -39,7 +39,7 @@ For example, the expression Would be "bracketed" like this: ``` -((!(has(my-label)) || ((my-label starts with 'prod') && (role in {'frontend','business'})) +((!(has(my-label))) || ((my-label starts with 'prod') && (role in {'frontend','business'}))) ``` It would match: diff --git a/calico/reference/resources/networkpolicy.mdx b/calico/reference/resources/networkpolicy.mdx index b65ee62b57..19d5561688 100644 --- a/calico/reference/resources/networkpolicy.mdx +++ b/calico/reference/resources/networkpolicy.mdx @@ -72,22 +72,23 @@ spec: | Field | Description | Accepted Values | Schema | Default | | --------- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | --------- | -| name | The name of the network policy. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | | +| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and at most one `.`. | string | | | namespace | Namespace provides an additional qualification to a resource name. | | string | "default" | ### Spec | Field | Description | Accepted Values | Schema | Default | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | ---------------------- | --------------------------------------------- | -| order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | +| order | Controls the order of precedence within the policy's tier. $[prodname] applies the policy with the lowest value first. | | float | | +| tier | Name of the [tier](tier.mdx) this policy belongs to. The tier must exist before you create the policy. | | string | `default` | | selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() | -| types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | +| types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `[Ingress]`. To apply the policy to outbound traffic, set to `[Egress]`. To apply the policy to both, set to `[Ingress, Egress]`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | | ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | | | egress | Ordered list of egress rules applied by this policy. | | List of [Rule](#rule) | | | serviceAccountSelector | Selects the service account(s) to which this policy applies. Select a specific service account by name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() | | performanceHints | Contains a list of hints to Calico's policy engine to help process the policy more efficiently. Hints never change the enforcement behaviour of the policy. The available hints are described [below](#performance-hints). | `AssumeNeededOnEveryNode` | List of strings | | -\* If `types` has no value, $[prodname] defaults as follows. +\* If `types` has no value, $[prodname] defaults as follows. Leave out `ingress` or `egress` when it has no rules, because an empty list such as `ingress: []` can count as rules present. > | Ingress Rules Present | Egress Rules Present | `Types` value | > | --------------------- | -------------------- | ----------------- | diff --git a/calico_versioned_docs/version-3.31/_includes/content/_entityrule.mdx b/calico_versioned_docs/version-3.31/_includes/content/_entityrule.mdx index 6172ecc91f..40aac6f3c4 100644 --- a/calico_versioned_docs/version-3.31/_includes/content/_entityrule.mdx +++ b/calico_versioned_docs/version-3.31/_includes/content/_entityrule.mdx @@ -5,7 +5,7 @@ to match. Packets can be matched on combinations of: Kubernetes `Service`. Selectors can match [workload endpoints](../../reference/resources/workloadendpoint.mdx), [host endpoints](../../reference/resources/hostendpoint.mdx) and ([namespaced](../../reference/resources/networkset.mdx) or [global](../../reference/resources/globalnetworkset.mdx)) network sets. -- Source/destination IP address, protocol and port. +- Source/destination IP address and port. If the rule contains multiple match criteria (for example, an IP and a port) then all match criteria must match for the rule as a whole to match a packet. @@ -16,7 +16,7 @@ for the rule as a whole to match a packet. | notNets | Negative match on CIDRs. Match packets with IP not in any of the listed CIDRs. | List of valid IPv4 CIDRs or list of valid IPv6 CIDRs (IPv4 and IPv6 CIDRs shouldn't be mixed in one rule) | list of cidrs | | selector | Positive match on selected endpoints. If a `namespaceSelector` is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces. | Valid selector | [selector](#selectors) | | | notSelector | Negative match on selected endpoints. If a `namespaceSelector` is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces. | Valid selector | [selector](#selectors) | | -| namespaceSelector | Positive match on selected namespaces. If specified, only workload endpoints in the selected Kubernetes namespaces are matched. Matches namespaces based on the labels that have been applied to the namespaces. Defines the scope that selectors will apply to, if not defined then selectors apply to the policy's namespace for a namespaced policy, and to all namespaces and non-namespaced resources for a global policy. Match a specific namespace by name using the `kubernetes.io/metadata.name` label. Select the non-namespaced resources like GlobalNetworkSet(s), host endpoints to which this policy applies by using `global()` selector. | Valid selector | [selector](#selectors) | | +| namespaceSelector | Positive match on selected namespaces. If specified, only workload endpoints and network sets in the selected Kubernetes namespaces are matched. Matches namespaces based on the labels that have been applied to the namespaces. Defines the scope that selectors will apply to, if not defined then selectors apply to the policy's namespace for a namespaced policy, and to all namespaces and non-namespaced resources for a global policy. Match a specific namespace by name using the `kubernetes.io/metadata.name` label. Select the non-namespaced resources like GlobalNetworkSet(s), host endpoints to which this policy applies by using `global()` selector. | Valid selector | [selector](#selectors) | | | ports | Positive match on the specified ports | | list of [ports](#ports) | | | notPorts | Negative match on the specified ports | | list of [ports](#ports) | | | serviceAccounts | Match endpoints running under service accounts. If a `namespaceSelector` is also defined, the set of service accounts this applies to is limited to the service accounts in the selected namespaces. | | [ServiceAccountMatch](#serviceaccountmatch) | | @@ -40,7 +40,7 @@ $[prodname] typically drops the empty value when it stores the resource, so the rather than the selector: - `selector: !has(foo)` matches packets from/to endpoints and network sets that do not have the label "foo". -- `notSelector: has(foo)` matches packets from/to **anywhere** (including outside the cluster), **except** traffic from/to endpoints and network sets that have the label "foo". +- `notSelector: has(foo)` matches packets from/to **anywhere** (including outside the cluster), **except** traffic from/to endpoints and network sets that have the label "foo". In a `NetworkPolicy`, or in a rule that also sets `namespaceSelector`, the match is limited to in-scope endpoints and network sets, so it matches packets from/to those that do not have the label "foo". #### Selector performance in EntityRules @@ -63,7 +63,7 @@ The following perform like `has(label)`. All endpoints with the label will be s - `label starts with 's'` - `label ends with 's'` -The other operators, and in particular, `all()`, `!`, `||` and `!=` are not optimized. +The other operators, and in particular, `all()`, `!`, `||` and `!=` are not optimized. The exception is `||` where every branch requires the same label, such as `a == 'b' || a == 'c'`, which is optimized. Examples: diff --git a/calico_versioned_docs/version-3.31/_includes/content/_httpmatch.mdx b/calico_versioned_docs/version-3.31/_includes/content/_httpmatch.mdx index 613bb97c3d..f852d57248 100644 --- a/calico_versioned_docs/version-3.31/_includes/content/_httpmatch.mdx +++ b/calico_versioned_docs/version-3.31/_includes/content/_httpmatch.mdx @@ -1,4 +1,4 @@ -An HTTPMatch matches attributes of an HTTP request. The presence of an HTTPMatch clause on a Rule will cause that rule to only match HTTP traffic. Other application layer protocols will not match the rule. +An HTTPMatch matches attributes of an HTTP request. Example: diff --git a/calico_versioned_docs/version-3.31/_includes/content/_rule.mdx b/calico_versioned_docs/version-3.31/_includes/content/_rule.mdx index 6f9aca1311..f32cab676c 100644 --- a/calico_versioned_docs/version-3.31/_includes/content/_rule.mdx +++ b/calico_versioned_docs/version-3.31/_includes/content/_rule.mdx @@ -17,7 +17,7 @@ are executed in order. After a `Log` action, processing continues with the next rule; `Allow` and `Deny` are immediate and final and no further rules are processed. -An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` will skip over the remaining policies and jump to the +An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` will skip over the remaining policies in its tier and jump to the next tier with policies that apply to the endpoint. After the last such tier, it jumps to the first [profile](../../reference/resources/profile.mdx) assigned to the endpoint, applying the policy configured in the profile; if there are no Profiles configured for the endpoint the default applied action is `Deny`. diff --git a/calico_versioned_docs/version-3.31/_includes/content/_selectors.mdx b/calico_versioned_docs/version-3.31/_includes/content/_selectors.mdx index 52baf960ae..ba6f21d0be 100644 --- a/calico_versioned_docs/version-3.31/_includes/content/_selectors.mdx +++ b/calico_versioned_docs/version-3.31/_includes/content/_selectors.mdx @@ -39,7 +39,7 @@ For example, the expression Would be "bracketed" like this: ``` -((!(has(my-label)) || ((my-label starts with 'prod') && (role in {'frontend','business'})) +((!(has(my-label))) || ((my-label starts with 'prod') && (role in {'frontend','business'}))) ``` It would match: diff --git a/calico_versioned_docs/version-3.31/reference/resources/networkpolicy.mdx b/calico_versioned_docs/version-3.31/reference/resources/networkpolicy.mdx index 68ba747077..b6a013666b 100644 --- a/calico_versioned_docs/version-3.31/reference/resources/networkpolicy.mdx +++ b/calico_versioned_docs/version-3.31/reference/resources/networkpolicy.mdx @@ -72,16 +72,17 @@ spec: | Field | Description | Accepted Values | Schema | Default | | --------- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | --------- | -| name | The name of the network policy. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | | +| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and at most one `.`. | string | | | namespace | Namespace provides an additional qualification to a resource name. | | string | "default" | ### Spec | Field | Description | Accepted Values | Schema | Default | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | ---------------------- | --------------------------------------------- | -| order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | +| order | Controls the order of precedence within the policy's tier. $[prodname] applies the policy with the lowest value first. | | float | | +| tier | Name of the [tier](tier.mdx) this policy belongs to. The tier must exist before you create the policy. If the tier isn't `default`, the policy name must have the form `.`. | | string | `default` | | selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() | -| types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | +| types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `[Ingress]`. To apply the policy to outbound traffic, set to `[Egress]`. To apply the policy to both, set to `[Ingress, Egress]`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | | ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | | | egress | Ordered list of egress rules applied by this policy. | | List of [Rule](#rule) | | | serviceAccountSelector | Selects the service account(s) to which this policy applies. Select a specific service account by name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() | diff --git a/calico_versioned_docs/version-3.32/_includes/content/_entityrule.mdx b/calico_versioned_docs/version-3.32/_includes/content/_entityrule.mdx index 6172ecc91f..40aac6f3c4 100644 --- a/calico_versioned_docs/version-3.32/_includes/content/_entityrule.mdx +++ b/calico_versioned_docs/version-3.32/_includes/content/_entityrule.mdx @@ -5,7 +5,7 @@ to match. Packets can be matched on combinations of: Kubernetes `Service`. Selectors can match [workload endpoints](../../reference/resources/workloadendpoint.mdx), [host endpoints](../../reference/resources/hostendpoint.mdx) and ([namespaced](../../reference/resources/networkset.mdx) or [global](../../reference/resources/globalnetworkset.mdx)) network sets. -- Source/destination IP address, protocol and port. +- Source/destination IP address and port. If the rule contains multiple match criteria (for example, an IP and a port) then all match criteria must match for the rule as a whole to match a packet. @@ -16,7 +16,7 @@ for the rule as a whole to match a packet. | notNets | Negative match on CIDRs. Match packets with IP not in any of the listed CIDRs. | List of valid IPv4 CIDRs or list of valid IPv6 CIDRs (IPv4 and IPv6 CIDRs shouldn't be mixed in one rule) | list of cidrs | | selector | Positive match on selected endpoints. If a `namespaceSelector` is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces. | Valid selector | [selector](#selectors) | | | notSelector | Negative match on selected endpoints. If a `namespaceSelector` is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces. | Valid selector | [selector](#selectors) | | -| namespaceSelector | Positive match on selected namespaces. If specified, only workload endpoints in the selected Kubernetes namespaces are matched. Matches namespaces based on the labels that have been applied to the namespaces. Defines the scope that selectors will apply to, if not defined then selectors apply to the policy's namespace for a namespaced policy, and to all namespaces and non-namespaced resources for a global policy. Match a specific namespace by name using the `kubernetes.io/metadata.name` label. Select the non-namespaced resources like GlobalNetworkSet(s), host endpoints to which this policy applies by using `global()` selector. | Valid selector | [selector](#selectors) | | +| namespaceSelector | Positive match on selected namespaces. If specified, only workload endpoints and network sets in the selected Kubernetes namespaces are matched. Matches namespaces based on the labels that have been applied to the namespaces. Defines the scope that selectors will apply to, if not defined then selectors apply to the policy's namespace for a namespaced policy, and to all namespaces and non-namespaced resources for a global policy. Match a specific namespace by name using the `kubernetes.io/metadata.name` label. Select the non-namespaced resources like GlobalNetworkSet(s), host endpoints to which this policy applies by using `global()` selector. | Valid selector | [selector](#selectors) | | | ports | Positive match on the specified ports | | list of [ports](#ports) | | | notPorts | Negative match on the specified ports | | list of [ports](#ports) | | | serviceAccounts | Match endpoints running under service accounts. If a `namespaceSelector` is also defined, the set of service accounts this applies to is limited to the service accounts in the selected namespaces. | | [ServiceAccountMatch](#serviceaccountmatch) | | @@ -40,7 +40,7 @@ $[prodname] typically drops the empty value when it stores the resource, so the rather than the selector: - `selector: !has(foo)` matches packets from/to endpoints and network sets that do not have the label "foo". -- `notSelector: has(foo)` matches packets from/to **anywhere** (including outside the cluster), **except** traffic from/to endpoints and network sets that have the label "foo". +- `notSelector: has(foo)` matches packets from/to **anywhere** (including outside the cluster), **except** traffic from/to endpoints and network sets that have the label "foo". In a `NetworkPolicy`, or in a rule that also sets `namespaceSelector`, the match is limited to in-scope endpoints and network sets, so it matches packets from/to those that do not have the label "foo". #### Selector performance in EntityRules @@ -63,7 +63,7 @@ The following perform like `has(label)`. All endpoints with the label will be s - `label starts with 's'` - `label ends with 's'` -The other operators, and in particular, `all()`, `!`, `||` and `!=` are not optimized. +The other operators, and in particular, `all()`, `!`, `||` and `!=` are not optimized. The exception is `||` where every branch requires the same label, such as `a == 'b' || a == 'c'`, which is optimized. Examples: diff --git a/calico_versioned_docs/version-3.32/_includes/content/_httpmatch.mdx b/calico_versioned_docs/version-3.32/_includes/content/_httpmatch.mdx index 613bb97c3d..870f67918f 100644 --- a/calico_versioned_docs/version-3.32/_includes/content/_httpmatch.mdx +++ b/calico_versioned_docs/version-3.32/_includes/content/_httpmatch.mdx @@ -1,4 +1,4 @@ -An HTTPMatch matches attributes of an HTTP request. The presence of an HTTPMatch clause on a Rule will cause that rule to only match HTTP traffic. Other application layer protocols will not match the rule. +An HTTPMatch matches attributes of an HTTP request. Example: @@ -17,7 +17,7 @@ http: ### HTTPPathMatch -| Syntax | Example | Description | -| ------ | ------------------- | ------------------------------------------------------------------------------- | -| exact | `exact: "/foo/bar"` | Matches the exact path as written, not including the query string or fragments. | -| prefix | `prefix: "/keys"` | Matches any path that begins with the given prefix. | +| Syntax | Example | Description | +| ------ | ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| exact | `exact: "/foo/bar"` | Matches the exact path after normalization, not including the query string or fragments. For example, normalization decodes percent-escapes, collapses repeated slashes, and resolves `.` and `..` segments. | +| prefix | `prefix: "/keys"` | Matches the given path and any path below it, at a path-segment boundary. For example, `/keys` matches `/keys/1` but not `/keystore`. | diff --git a/calico_versioned_docs/version-3.32/_includes/content/_rule.mdx b/calico_versioned_docs/version-3.32/_includes/content/_rule.mdx index 6ed49affa9..6432760601 100644 --- a/calico_versioned_docs/version-3.32/_includes/content/_rule.mdx +++ b/calico_versioned_docs/version-3.32/_includes/content/_rule.mdx @@ -17,7 +17,7 @@ are executed in order. After a `Log` action, processing continues with the next rule; `Allow` and `Deny` are immediate and final and no further rules are processed. -An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` will skip over the remaining policies and jump to the +An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` will skip over the remaining policies in its tier and jump to the next tier with policies that apply to the endpoint. After the last such tier, it jumps to the first [profile](../../reference/resources/profile.mdx) assigned to the endpoint, applying the policy configured in the profile; if there are no Profiles configured for the endpoint the default applied action is `Deny`. diff --git a/calico_versioned_docs/version-3.32/_includes/content/_selectors.mdx b/calico_versioned_docs/version-3.32/_includes/content/_selectors.mdx index 52baf960ae..ba6f21d0be 100644 --- a/calico_versioned_docs/version-3.32/_includes/content/_selectors.mdx +++ b/calico_versioned_docs/version-3.32/_includes/content/_selectors.mdx @@ -39,7 +39,7 @@ For example, the expression Would be "bracketed" like this: ``` -((!(has(my-label)) || ((my-label starts with 'prod') && (role in {'frontend','business'})) +((!(has(my-label))) || ((my-label starts with 'prod') && (role in {'frontend','business'}))) ``` It would match: diff --git a/calico_versioned_docs/version-3.32/reference/resources/networkpolicy.mdx b/calico_versioned_docs/version-3.32/reference/resources/networkpolicy.mdx index 3da3ca0d7f..d1ef22e68f 100644 --- a/calico_versioned_docs/version-3.32/reference/resources/networkpolicy.mdx +++ b/calico_versioned_docs/version-3.32/reference/resources/networkpolicy.mdx @@ -72,16 +72,17 @@ spec: | Field | Description | Accepted Values | Schema | Default | | --------- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | --------- | -| name | The name of the network policy. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | | +| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and at most one `.`. | string | | | namespace | Namespace provides an additional qualification to a resource name. | | string | "default" | ### Spec | Field | Description | Accepted Values | Schema | Default | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | ---------------------- | --------------------------------------------- | -| order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | +| order | Controls the order of precedence within the policy's tier. $[prodname] applies the policy with the lowest value first. | | float | | +| tier | Name of the [tier](tier.mdx) this policy belongs to. The tier must exist before you create the policy. | | string | `default` | | selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() | -| types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | +| types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `[Ingress]`. To apply the policy to outbound traffic, set to `[Egress]`. To apply the policy to both, set to `[Ingress, Egress]`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | | ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | | | egress | Ordered list of egress rules applied by this policy. | | List of [Rule](#rule) | | | serviceAccountSelector | Selects the service account(s) to which this policy applies. Select a specific service account by name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() | diff --git a/calico_versioned_docs/version-3.33/_includes/content/_entityrule.mdx b/calico_versioned_docs/version-3.33/_includes/content/_entityrule.mdx index 6172ecc91f..40aac6f3c4 100644 --- a/calico_versioned_docs/version-3.33/_includes/content/_entityrule.mdx +++ b/calico_versioned_docs/version-3.33/_includes/content/_entityrule.mdx @@ -5,7 +5,7 @@ to match. Packets can be matched on combinations of: Kubernetes `Service`. Selectors can match [workload endpoints](../../reference/resources/workloadendpoint.mdx), [host endpoints](../../reference/resources/hostendpoint.mdx) and ([namespaced](../../reference/resources/networkset.mdx) or [global](../../reference/resources/globalnetworkset.mdx)) network sets. -- Source/destination IP address, protocol and port. +- Source/destination IP address and port. If the rule contains multiple match criteria (for example, an IP and a port) then all match criteria must match for the rule as a whole to match a packet. @@ -16,7 +16,7 @@ for the rule as a whole to match a packet. | notNets | Negative match on CIDRs. Match packets with IP not in any of the listed CIDRs. | List of valid IPv4 CIDRs or list of valid IPv6 CIDRs (IPv4 and IPv6 CIDRs shouldn't be mixed in one rule) | list of cidrs | | selector | Positive match on selected endpoints. If a `namespaceSelector` is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces. | Valid selector | [selector](#selectors) | | | notSelector | Negative match on selected endpoints. If a `namespaceSelector` is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces. | Valid selector | [selector](#selectors) | | -| namespaceSelector | Positive match on selected namespaces. If specified, only workload endpoints in the selected Kubernetes namespaces are matched. Matches namespaces based on the labels that have been applied to the namespaces. Defines the scope that selectors will apply to, if not defined then selectors apply to the policy's namespace for a namespaced policy, and to all namespaces and non-namespaced resources for a global policy. Match a specific namespace by name using the `kubernetes.io/metadata.name` label. Select the non-namespaced resources like GlobalNetworkSet(s), host endpoints to which this policy applies by using `global()` selector. | Valid selector | [selector](#selectors) | | +| namespaceSelector | Positive match on selected namespaces. If specified, only workload endpoints and network sets in the selected Kubernetes namespaces are matched. Matches namespaces based on the labels that have been applied to the namespaces. Defines the scope that selectors will apply to, if not defined then selectors apply to the policy's namespace for a namespaced policy, and to all namespaces and non-namespaced resources for a global policy. Match a specific namespace by name using the `kubernetes.io/metadata.name` label. Select the non-namespaced resources like GlobalNetworkSet(s), host endpoints to which this policy applies by using `global()` selector. | Valid selector | [selector](#selectors) | | | ports | Positive match on the specified ports | | list of [ports](#ports) | | | notPorts | Negative match on the specified ports | | list of [ports](#ports) | | | serviceAccounts | Match endpoints running under service accounts. If a `namespaceSelector` is also defined, the set of service accounts this applies to is limited to the service accounts in the selected namespaces. | | [ServiceAccountMatch](#serviceaccountmatch) | | @@ -40,7 +40,7 @@ $[prodname] typically drops the empty value when it stores the resource, so the rather than the selector: - `selector: !has(foo)` matches packets from/to endpoints and network sets that do not have the label "foo". -- `notSelector: has(foo)` matches packets from/to **anywhere** (including outside the cluster), **except** traffic from/to endpoints and network sets that have the label "foo". +- `notSelector: has(foo)` matches packets from/to **anywhere** (including outside the cluster), **except** traffic from/to endpoints and network sets that have the label "foo". In a `NetworkPolicy`, or in a rule that also sets `namespaceSelector`, the match is limited to in-scope endpoints and network sets, so it matches packets from/to those that do not have the label "foo". #### Selector performance in EntityRules @@ -63,7 +63,7 @@ The following perform like `has(label)`. All endpoints with the label will be s - `label starts with 's'` - `label ends with 's'` -The other operators, and in particular, `all()`, `!`, `||` and `!=` are not optimized. +The other operators, and in particular, `all()`, `!`, `||` and `!=` are not optimized. The exception is `||` where every branch requires the same label, such as `a == 'b' || a == 'c'`, which is optimized. Examples: diff --git a/calico_versioned_docs/version-3.33/_includes/content/_httpmatch.mdx b/calico_versioned_docs/version-3.33/_includes/content/_httpmatch.mdx index 613bb97c3d..870f67918f 100644 --- a/calico_versioned_docs/version-3.33/_includes/content/_httpmatch.mdx +++ b/calico_versioned_docs/version-3.33/_includes/content/_httpmatch.mdx @@ -1,4 +1,4 @@ -An HTTPMatch matches attributes of an HTTP request. The presence of an HTTPMatch clause on a Rule will cause that rule to only match HTTP traffic. Other application layer protocols will not match the rule. +An HTTPMatch matches attributes of an HTTP request. Example: @@ -17,7 +17,7 @@ http: ### HTTPPathMatch -| Syntax | Example | Description | -| ------ | ------------------- | ------------------------------------------------------------------------------- | -| exact | `exact: "/foo/bar"` | Matches the exact path as written, not including the query string or fragments. | -| prefix | `prefix: "/keys"` | Matches any path that begins with the given prefix. | +| Syntax | Example | Description | +| ------ | ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| exact | `exact: "/foo/bar"` | Matches the exact path after normalization, not including the query string or fragments. For example, normalization decodes percent-escapes, collapses repeated slashes, and resolves `.` and `..` segments. | +| prefix | `prefix: "/keys"` | Matches the given path and any path below it, at a path-segment boundary. For example, `/keys` matches `/keys/1` but not `/keystore`. | diff --git a/calico_versioned_docs/version-3.33/_includes/content/_rule.mdx b/calico_versioned_docs/version-3.33/_includes/content/_rule.mdx index 54a04d392e..2280a4cdca 100644 --- a/calico_versioned_docs/version-3.33/_includes/content/_rule.mdx +++ b/calico_versioned_docs/version-3.33/_includes/content/_rule.mdx @@ -17,7 +17,7 @@ are executed in order. After a `Log` action, processing continues with the next rule; `Allow` and `Deny` are immediate and final and no further rules are processed. -An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` will skip over the remaining policies and jump to the +An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` will skip over the remaining policies in its tier and jump to the next tier with policies that apply to the endpoint. After the last such tier, it jumps to the first [profile](../../reference/resources/profile.mdx) assigned to the endpoint, applying the policy configured in the profile; if there are no Profiles configured for the endpoint the default applied action is `Deny`. diff --git a/calico_versioned_docs/version-3.33/_includes/content/_selectors.mdx b/calico_versioned_docs/version-3.33/_includes/content/_selectors.mdx index 52baf960ae..ba6f21d0be 100644 --- a/calico_versioned_docs/version-3.33/_includes/content/_selectors.mdx +++ b/calico_versioned_docs/version-3.33/_includes/content/_selectors.mdx @@ -39,7 +39,7 @@ For example, the expression Would be "bracketed" like this: ``` -((!(has(my-label)) || ((my-label starts with 'prod') && (role in {'frontend','business'})) +((!(has(my-label))) || ((my-label starts with 'prod') && (role in {'frontend','business'}))) ``` It would match: diff --git a/calico_versioned_docs/version-3.33/reference/resources/networkpolicy.mdx b/calico_versioned_docs/version-3.33/reference/resources/networkpolicy.mdx index 8679413f54..08b2324c01 100644 --- a/calico_versioned_docs/version-3.33/reference/resources/networkpolicy.mdx +++ b/calico_versioned_docs/version-3.33/reference/resources/networkpolicy.mdx @@ -72,22 +72,23 @@ spec: | Field | Description | Accepted Values | Schema | Default | | --------- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | --------- | -| name | The name of the network policy. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | | +| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and at most one `.`. | string | | | namespace | Namespace provides an additional qualification to a resource name. | | string | "default" | ### Spec | Field | Description | Accepted Values | Schema | Default | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | ---------------------- | --------------------------------------------- | -| order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | +| order | Controls the order of precedence within the policy's tier. $[prodname] applies the policy with the lowest value first. | | float | | +| tier | Name of the [tier](tier.mdx) this policy belongs to. The tier must exist before you create the policy. | | string | `default` | | selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() | -| types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | +| types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `[Ingress]`. To apply the policy to outbound traffic, set to `[Egress]`. To apply the policy to both, set to `[Ingress, Egress]`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | | ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | | | egress | Ordered list of egress rules applied by this policy. | | List of [Rule](#rule) | | | serviceAccountSelector | Selects the service account(s) to which this policy applies. Select a specific service account by name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() | | performanceHints | Contains a list of hints to Calico's policy engine to help process the policy more efficiently. Hints never change the enforcement behaviour of the policy. The available hints are described [below](#performance-hints). | `AssumeNeededOnEveryNode` | List of strings | | -\* If `types` has no value, $[prodname] defaults as follows. +\* If `types` has no value, $[prodname] defaults as follows. Leave out `ingress` or `egress` when it has no rules, because an empty list such as `ingress: []` can count as rules present. > | Ingress Rules Present | Egress Rules Present | `Types` value | > | --------------------- | -------------------- | ----------------- |