From f86172c1da2016602cd50a971a653fddd407f437 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Thu, 15 Oct 2026 16:35:56 +0100 Subject: [PATCH 01/17] Fix inaccuracies on the OSS 3.33 NetworkPolicy reference --- .../version-3.33/_includes/content/_entityrule.mdx | 5 +++-- .../version-3.33/_includes/content/_selectors.mdx | 2 +- .../version-3.33/reference/resources/networkpolicy.mdx | 4 ++-- 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/calico_versioned_docs/version-3.33/_includes/content/_entityrule.mdx b/calico_versioned_docs/version-3.33/_includes/content/_entityrule.mdx index 6172ecc91f..d7d5307949 100644 --- a/calico_versioned_docs/version-3.33/_includes/content/_entityrule.mdx +++ b/calico_versioned_docs/version-3.33/_includes/content/_entityrule.mdx @@ -16,7 +16,7 @@ for the rule as a whole to match a packet. | notNets | Negative match on CIDRs. Match packets with IP not in any of the listed CIDRs. | List of valid IPv4 CIDRs or list of valid IPv6 CIDRs (IPv4 and IPv6 CIDRs shouldn't be mixed in one rule) | list of cidrs | | selector | Positive match on selected endpoints. If a `namespaceSelector` is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces. | Valid selector | [selector](#selectors) | | | notSelector | Negative match on selected endpoints. If a `namespaceSelector` is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces. | Valid selector | [selector](#selectors) | | -| namespaceSelector | Positive match on selected namespaces. If specified, only workload endpoints in the selected Kubernetes namespaces are matched. Matches namespaces based on the labels that have been applied to the namespaces. Defines the scope that selectors will apply to, if not defined then selectors apply to the policy's namespace for a namespaced policy, and to all namespaces and non-namespaced resources for a global policy. Match a specific namespace by name using the `kubernetes.io/metadata.name` label. Select the non-namespaced resources like GlobalNetworkSet(s), host endpoints to which this policy applies by using `global()` selector. | Valid selector | [selector](#selectors) | | +| namespaceSelector | Positive match on selected namespaces. If specified, only workload endpoints and network sets in the selected Kubernetes namespaces are matched. Matches namespaces based on the labels that have been applied to the namespaces. Defines the scope that selectors will apply to, if not defined then selectors apply to the policy's namespace for a namespaced policy, and to all namespaces and non-namespaced resources for a global policy. Match a specific namespace by name using the `kubernetes.io/metadata.name` label. Select the non-namespaced resources like GlobalNetworkSet(s), host endpoints to which this policy applies by using `global()` selector. | Valid selector | [selector](#selectors) | | | ports | Positive match on the specified ports | | list of [ports](#ports) | | | notPorts | Negative match on the specified ports | | list of [ports](#ports) | | | serviceAccounts | Match endpoints running under service accounts. If a `namespaceSelector` is also defined, the set of service accounts this applies to is limited to the service accounts in the selected namespaces. | | [ServiceAccountMatch](#serviceaccountmatch) | | @@ -41,6 +41,7 @@ rather than the selector: - `selector: !has(foo)` matches packets from/to endpoints and network sets that do not have the label "foo". - `notSelector: has(foo)` matches packets from/to **anywhere** (including outside the cluster), **except** traffic from/to endpoints and network sets that have the label "foo". + This applies in a `GlobalNetworkPolicy`. In a `NetworkPolicy` without a `namespaceSelector`, `notSelector: has(foo)` matches only packets from/to endpoints and network sets in the policy's namespace that do not have the label "foo". #### Selector performance in EntityRules @@ -63,7 +64,7 @@ The following perform like `has(label)`. All endpoints with the label will be s - `label starts with 's'` - `label ends with 's'` -The other operators, and in particular, `all()`, `!`, `||` and `!=` are not optimized. +The other operators, and in particular, `all()`, `!` and `!=`, are not optimized. `||` is optimized only when both sides require the same label, for example `a == 'b' || a == 'c'`. Examples: diff --git a/calico_versioned_docs/version-3.33/_includes/content/_selectors.mdx b/calico_versioned_docs/version-3.33/_includes/content/_selectors.mdx index 52baf960ae..8f60ebe074 100644 --- a/calico_versioned_docs/version-3.33/_includes/content/_selectors.mdx +++ b/calico_versioned_docs/version-3.33/_includes/content/_selectors.mdx @@ -39,7 +39,7 @@ For example, the expression Would be "bracketed" like this: ``` -((!(has(my-label)) || ((my-label starts with 'prod') && (role in {'frontend','business'})) +(!(has(my-label))) || ((my-label starts with 'prod') && (role in {'frontend','business'})) ``` It would match: diff --git a/calico_versioned_docs/version-3.33/reference/resources/networkpolicy.mdx b/calico_versioned_docs/version-3.33/reference/resources/networkpolicy.mdx index 8679413f54..0ef366c826 100644 --- a/calico_versioned_docs/version-3.33/reference/resources/networkpolicy.mdx +++ b/calico_versioned_docs/version-3.33/reference/resources/networkpolicy.mdx @@ -72,7 +72,7 @@ spec: | Field | Description | Accepted Values | Schema | Default | | --------- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | --------- | -| name | The name of the network policy. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | | +| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and at most one `.`. Names that start with `knp.default.` or `ossg.default.` can have more dots. | string | | | namespace | Namespace provides an additional qualification to a resource name. | | string | "default" | ### Spec @@ -81,7 +81,7 @@ spec: | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | ---------------------- | --------------------------------------------- | | order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | | selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() | -| types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | +| types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `[Ingress]`. To apply the policy to outbound traffic, set to `[Egress]`. To apply the policy to both, set to `[Ingress, Egress]`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | | ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | | | egress | Ordered list of egress rules applied by this policy. | | List of [Rule](#rule) | | | serviceAccountSelector | Selects the service account(s) to which this policy applies. Select a specific service account by name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() | From a7395f7e471f37eeefe83bbdef499c9e85692a4e Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Thu, 15 Oct 2026 16:38:32 +0100 Subject: [PATCH 02/17] Fix Pass action and HTTP path match descriptions --- .../version-3.33/_includes/content/_httpmatch.mdx | 4 ++-- .../version-3.33/_includes/content/_rule.mdx | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/calico_versioned_docs/version-3.33/_includes/content/_httpmatch.mdx b/calico_versioned_docs/version-3.33/_includes/content/_httpmatch.mdx index 613bb97c3d..379b392ef1 100644 --- a/calico_versioned_docs/version-3.33/_includes/content/_httpmatch.mdx +++ b/calico_versioned_docs/version-3.33/_includes/content/_httpmatch.mdx @@ -19,5 +19,5 @@ http: | Syntax | Example | Description | | ------ | ------------------- | ------------------------------------------------------------------------------- | -| exact | `exact: "/foo/bar"` | Matches the exact path as written, not including the query string or fragments. | -| prefix | `prefix: "/keys"` | Matches any path that begins with the given prefix. | +| exact | `exact: "/foo/bar"` | Matches the path exactly after normalization, not including the query string or fragments. Normalization decodes percent-encoding once, changes `\` to `/`, removes `;` matrix parameters, collapses repeated slashes, resolves `.` and `..` segments, and removes a trailing slash. | +| prefix | `prefix: "/keys"` | Matches any path that begins with the given prefix as whole path segments, after the same normalization as `exact`. For example, `/keys` matches `/keys` and `/keys/1`, but not `/keysafe`. | diff --git a/calico_versioned_docs/version-3.33/_includes/content/_rule.mdx b/calico_versioned_docs/version-3.33/_includes/content/_rule.mdx index 54a04d392e..8ec615d46e 100644 --- a/calico_versioned_docs/version-3.33/_includes/content/_rule.mdx +++ b/calico_versioned_docs/version-3.33/_includes/content/_rule.mdx @@ -17,7 +17,7 @@ are executed in order. After a `Log` action, processing continues with the next rule; `Allow` and `Deny` are immediate and final and no further rules are processed. -An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` will skip over the remaining policies and jump to the +An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` will skip over the remaining policies in its tier and continue with the next tier that has policies for the endpoint. After the last tier, it jumps to the first [profile](../../reference/resources/profile.mdx) assigned to the endpoint, applying the policy configured in the profile; if there are no Profiles configured for the endpoint the default applied action is `Deny`. From a6a564c88188866ca3e212c909cba44c5b9b1ad0 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Thu, 15 Oct 2026 18:54:38 +0100 Subject: [PATCH 03/17] Revert "Fix Pass action and HTTP path match descriptions" This reverts commit 62468c2b4a475e69ae1ba7d2b231a0a67ec5c77e. --- .../version-3.33/_includes/content/_httpmatch.mdx | 4 ++-- .../version-3.33/_includes/content/_rule.mdx | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/calico_versioned_docs/version-3.33/_includes/content/_httpmatch.mdx b/calico_versioned_docs/version-3.33/_includes/content/_httpmatch.mdx index 379b392ef1..613bb97c3d 100644 --- a/calico_versioned_docs/version-3.33/_includes/content/_httpmatch.mdx +++ b/calico_versioned_docs/version-3.33/_includes/content/_httpmatch.mdx @@ -19,5 +19,5 @@ http: | Syntax | Example | Description | | ------ | ------------------- | ------------------------------------------------------------------------------- | -| exact | `exact: "/foo/bar"` | Matches the path exactly after normalization, not including the query string or fragments. Normalization decodes percent-encoding once, changes `\` to `/`, removes `;` matrix parameters, collapses repeated slashes, resolves `.` and `..` segments, and removes a trailing slash. | -| prefix | `prefix: "/keys"` | Matches any path that begins with the given prefix as whole path segments, after the same normalization as `exact`. For example, `/keys` matches `/keys` and `/keys/1`, but not `/keysafe`. | +| exact | `exact: "/foo/bar"` | Matches the exact path as written, not including the query string or fragments. | +| prefix | `prefix: "/keys"` | Matches any path that begins with the given prefix. | diff --git a/calico_versioned_docs/version-3.33/_includes/content/_rule.mdx b/calico_versioned_docs/version-3.33/_includes/content/_rule.mdx index 8ec615d46e..54a04d392e 100644 --- a/calico_versioned_docs/version-3.33/_includes/content/_rule.mdx +++ b/calico_versioned_docs/version-3.33/_includes/content/_rule.mdx @@ -17,7 +17,7 @@ are executed in order. After a `Log` action, processing continues with the next rule; `Allow` and `Deny` are immediate and final and no further rules are processed. -An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` will skip over the remaining policies in its tier and continue with the next tier that has policies for the endpoint. After the last tier, it jumps to the +An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` will skip over the remaining policies and jump to the first [profile](../../reference/resources/profile.mdx) assigned to the endpoint, applying the policy configured in the profile; if there are no Profiles configured for the endpoint the default applied action is `Deny`. From ac7c492c8077c1597e371bac0a610a03a94463f3 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Thu, 15 Oct 2026 18:54:38 +0100 Subject: [PATCH 04/17] Revert "Fix inaccuracies on the OSS 3.33 NetworkPolicy reference" This reverts commit 48bdc48b561f73b7de6d0212e71b5636a6676fdf. --- .../version-3.33/_includes/content/_entityrule.mdx | 5 ++--- .../version-3.33/_includes/content/_selectors.mdx | 2 +- .../version-3.33/reference/resources/networkpolicy.mdx | 4 ++-- 3 files changed, 5 insertions(+), 6 deletions(-) diff --git a/calico_versioned_docs/version-3.33/_includes/content/_entityrule.mdx b/calico_versioned_docs/version-3.33/_includes/content/_entityrule.mdx index d7d5307949..6172ecc91f 100644 --- a/calico_versioned_docs/version-3.33/_includes/content/_entityrule.mdx +++ b/calico_versioned_docs/version-3.33/_includes/content/_entityrule.mdx @@ -16,7 +16,7 @@ for the rule as a whole to match a packet. | notNets | Negative match on CIDRs. Match packets with IP not in any of the listed CIDRs. | List of valid IPv4 CIDRs or list of valid IPv6 CIDRs (IPv4 and IPv6 CIDRs shouldn't be mixed in one rule) | list of cidrs | | selector | Positive match on selected endpoints. If a `namespaceSelector` is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces. | Valid selector | [selector](#selectors) | | | notSelector | Negative match on selected endpoints. If a `namespaceSelector` is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces. | Valid selector | [selector](#selectors) | | -| namespaceSelector | Positive match on selected namespaces. If specified, only workload endpoints and network sets in the selected Kubernetes namespaces are matched. Matches namespaces based on the labels that have been applied to the namespaces. Defines the scope that selectors will apply to, if not defined then selectors apply to the policy's namespace for a namespaced policy, and to all namespaces and non-namespaced resources for a global policy. Match a specific namespace by name using the `kubernetes.io/metadata.name` label. Select the non-namespaced resources like GlobalNetworkSet(s), host endpoints to which this policy applies by using `global()` selector. | Valid selector | [selector](#selectors) | | +| namespaceSelector | Positive match on selected namespaces. If specified, only workload endpoints in the selected Kubernetes namespaces are matched. Matches namespaces based on the labels that have been applied to the namespaces. Defines the scope that selectors will apply to, if not defined then selectors apply to the policy's namespace for a namespaced policy, and to all namespaces and non-namespaced resources for a global policy. Match a specific namespace by name using the `kubernetes.io/metadata.name` label. Select the non-namespaced resources like GlobalNetworkSet(s), host endpoints to which this policy applies by using `global()` selector. | Valid selector | [selector](#selectors) | | | ports | Positive match on the specified ports | | list of [ports](#ports) | | | notPorts | Negative match on the specified ports | | list of [ports](#ports) | | | serviceAccounts | Match endpoints running under service accounts. If a `namespaceSelector` is also defined, the set of service accounts this applies to is limited to the service accounts in the selected namespaces. | | [ServiceAccountMatch](#serviceaccountmatch) | | @@ -41,7 +41,6 @@ rather than the selector: - `selector: !has(foo)` matches packets from/to endpoints and network sets that do not have the label "foo". - `notSelector: has(foo)` matches packets from/to **anywhere** (including outside the cluster), **except** traffic from/to endpoints and network sets that have the label "foo". - This applies in a `GlobalNetworkPolicy`. In a `NetworkPolicy` without a `namespaceSelector`, `notSelector: has(foo)` matches only packets from/to endpoints and network sets in the policy's namespace that do not have the label "foo". #### Selector performance in EntityRules @@ -64,7 +63,7 @@ The following perform like `has(label)`. All endpoints with the label will be s - `label starts with 's'` - `label ends with 's'` -The other operators, and in particular, `all()`, `!` and `!=`, are not optimized. `||` is optimized only when both sides require the same label, for example `a == 'b' || a == 'c'`. +The other operators, and in particular, `all()`, `!`, `||` and `!=` are not optimized. Examples: diff --git a/calico_versioned_docs/version-3.33/_includes/content/_selectors.mdx b/calico_versioned_docs/version-3.33/_includes/content/_selectors.mdx index 8f60ebe074..52baf960ae 100644 --- a/calico_versioned_docs/version-3.33/_includes/content/_selectors.mdx +++ b/calico_versioned_docs/version-3.33/_includes/content/_selectors.mdx @@ -39,7 +39,7 @@ For example, the expression Would be "bracketed" like this: ``` -(!(has(my-label))) || ((my-label starts with 'prod') && (role in {'frontend','business'})) +((!(has(my-label)) || ((my-label starts with 'prod') && (role in {'frontend','business'})) ``` It would match: diff --git a/calico_versioned_docs/version-3.33/reference/resources/networkpolicy.mdx b/calico_versioned_docs/version-3.33/reference/resources/networkpolicy.mdx index 0ef366c826..8679413f54 100644 --- a/calico_versioned_docs/version-3.33/reference/resources/networkpolicy.mdx +++ b/calico_versioned_docs/version-3.33/reference/resources/networkpolicy.mdx @@ -72,7 +72,7 @@ spec: | Field | Description | Accepted Values | Schema | Default | | --------- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | --------- | -| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and at most one `.`. Names that start with `knp.default.` or `ossg.default.` can have more dots. | string | | +| name | The name of the network policy. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | | | namespace | Namespace provides an additional qualification to a resource name. | | string | "default" | ### Spec @@ -81,7 +81,7 @@ spec: | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | ---------------------- | --------------------------------------------- | | order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | | selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() | -| types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `[Ingress]`. To apply the policy to outbound traffic, set to `[Egress]`. To apply the policy to both, set to `[Ingress, Egress]`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | +| types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | | ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | | | egress | Ordered list of egress rules applied by this policy. | | List of [Rule](#rule) | | | serviceAccountSelector | Selects the service account(s) to which this policy applies. Select a specific service account by name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() | From 1ab775d8cf8497c4430f4ee712db717df763f121 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Thu, 15 Oct 2026 18:54:49 +0100 Subject: [PATCH 05/17] Fix inaccuracies on the next NetworkPolicy reference --- calico/_includes/content/_entityrule.mdx | 8 ++++---- calico/_includes/content/_httpmatch.mdx | 6 +++--- calico/_includes/content/_rule.mdx | 2 +- calico/_includes/content/_selectors.mdx | 2 +- calico/reference/resources/networkpolicy.mdx | 5 +++-- 5 files changed, 12 insertions(+), 11 deletions(-) diff --git a/calico/_includes/content/_entityrule.mdx b/calico/_includes/content/_entityrule.mdx index 6172ecc91f..40aac6f3c4 100644 --- a/calico/_includes/content/_entityrule.mdx +++ b/calico/_includes/content/_entityrule.mdx @@ -5,7 +5,7 @@ to match. Packets can be matched on combinations of: Kubernetes `Service`. Selectors can match [workload endpoints](../../reference/resources/workloadendpoint.mdx), [host endpoints](../../reference/resources/hostendpoint.mdx) and ([namespaced](../../reference/resources/networkset.mdx) or [global](../../reference/resources/globalnetworkset.mdx)) network sets. -- Source/destination IP address, protocol and port. +- Source/destination IP address and port. If the rule contains multiple match criteria (for example, an IP and a port) then all match criteria must match for the rule as a whole to match a packet. @@ -16,7 +16,7 @@ for the rule as a whole to match a packet. | notNets | Negative match on CIDRs. Match packets with IP not in any of the listed CIDRs. | List of valid IPv4 CIDRs or list of valid IPv6 CIDRs (IPv4 and IPv6 CIDRs shouldn't be mixed in one rule) | list of cidrs | | selector | Positive match on selected endpoints. If a `namespaceSelector` is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces. | Valid selector | [selector](#selectors) | | | notSelector | Negative match on selected endpoints. If a `namespaceSelector` is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces. | Valid selector | [selector](#selectors) | | -| namespaceSelector | Positive match on selected namespaces. If specified, only workload endpoints in the selected Kubernetes namespaces are matched. Matches namespaces based on the labels that have been applied to the namespaces. Defines the scope that selectors will apply to, if not defined then selectors apply to the policy's namespace for a namespaced policy, and to all namespaces and non-namespaced resources for a global policy. Match a specific namespace by name using the `kubernetes.io/metadata.name` label. Select the non-namespaced resources like GlobalNetworkSet(s), host endpoints to which this policy applies by using `global()` selector. | Valid selector | [selector](#selectors) | | +| namespaceSelector | Positive match on selected namespaces. If specified, only workload endpoints and network sets in the selected Kubernetes namespaces are matched. Matches namespaces based on the labels that have been applied to the namespaces. Defines the scope that selectors will apply to, if not defined then selectors apply to the policy's namespace for a namespaced policy, and to all namespaces and non-namespaced resources for a global policy. Match a specific namespace by name using the `kubernetes.io/metadata.name` label. Select the non-namespaced resources like GlobalNetworkSet(s), host endpoints to which this policy applies by using `global()` selector. | Valid selector | [selector](#selectors) | | | ports | Positive match on the specified ports | | list of [ports](#ports) | | | notPorts | Negative match on the specified ports | | list of [ports](#ports) | | | serviceAccounts | Match endpoints running under service accounts. If a `namespaceSelector` is also defined, the set of service accounts this applies to is limited to the service accounts in the selected namespaces. | | [ServiceAccountMatch](#serviceaccountmatch) | | @@ -40,7 +40,7 @@ $[prodname] typically drops the empty value when it stores the resource, so the rather than the selector: - `selector: !has(foo)` matches packets from/to endpoints and network sets that do not have the label "foo". -- `notSelector: has(foo)` matches packets from/to **anywhere** (including outside the cluster), **except** traffic from/to endpoints and network sets that have the label "foo". +- `notSelector: has(foo)` matches packets from/to **anywhere** (including outside the cluster), **except** traffic from/to endpoints and network sets that have the label "foo". In a `NetworkPolicy`, or in a rule that also sets `namespaceSelector`, the match is limited to in-scope endpoints and network sets, so it matches packets from/to those that do not have the label "foo". #### Selector performance in EntityRules @@ -63,7 +63,7 @@ The following perform like `has(label)`. All endpoints with the label will be s - `label starts with 's'` - `label ends with 's'` -The other operators, and in particular, `all()`, `!`, `||` and `!=` are not optimized. +The other operators, and in particular, `all()`, `!`, `||` and `!=` are not optimized. The exception is `||` where every branch requires the same label, such as `a == 'b' || a == 'c'`, which is optimized. Examples: diff --git a/calico/_includes/content/_httpmatch.mdx b/calico/_includes/content/_httpmatch.mdx index 613bb97c3d..a10cb22dcd 100644 --- a/calico/_includes/content/_httpmatch.mdx +++ b/calico/_includes/content/_httpmatch.mdx @@ -1,4 +1,4 @@ -An HTTPMatch matches attributes of an HTTP request. The presence of an HTTPMatch clause on a Rule will cause that rule to only match HTTP traffic. Other application layer protocols will not match the rule. +An HTTPMatch matches attributes of an HTTP request. Example: @@ -19,5 +19,5 @@ http: | Syntax | Example | Description | | ------ | ------------------- | ------------------------------------------------------------------------------- | -| exact | `exact: "/foo/bar"` | Matches the exact path as written, not including the query string or fragments. | -| prefix | `prefix: "/keys"` | Matches any path that begins with the given prefix. | +| exact | `exact: "/foo/bar"` | Matches the exact path after normalization, not including the query string or fragments. For example, normalization decodes percent-escapes, collapses repeated slashes, and resolves `.` and `..` segments. | +| prefix | `prefix: "/keys"` | Matches the given path and any path below it, at a path-segment boundary. For example, `/keys` matches `/keys/1` but not `/keystore`. | diff --git a/calico/_includes/content/_rule.mdx b/calico/_includes/content/_rule.mdx index 54a04d392e..2280a4cdca 100644 --- a/calico/_includes/content/_rule.mdx +++ b/calico/_includes/content/_rule.mdx @@ -17,7 +17,7 @@ are executed in order. After a `Log` action, processing continues with the next rule; `Allow` and `Deny` are immediate and final and no further rules are processed. -An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` will skip over the remaining policies and jump to the +An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` will skip over the remaining policies in its tier and jump to the next tier with policies that apply to the endpoint. After the last such tier, it jumps to the first [profile](../../reference/resources/profile.mdx) assigned to the endpoint, applying the policy configured in the profile; if there are no Profiles configured for the endpoint the default applied action is `Deny`. diff --git a/calico/_includes/content/_selectors.mdx b/calico/_includes/content/_selectors.mdx index 52baf960ae..ba6f21d0be 100644 --- a/calico/_includes/content/_selectors.mdx +++ b/calico/_includes/content/_selectors.mdx @@ -39,7 +39,7 @@ For example, the expression Would be "bracketed" like this: ``` -((!(has(my-label)) || ((my-label starts with 'prod') && (role in {'frontend','business'})) +((!(has(my-label))) || ((my-label starts with 'prod') && (role in {'frontend','business'}))) ``` It would match: diff --git a/calico/reference/resources/networkpolicy.mdx b/calico/reference/resources/networkpolicy.mdx index b65ee62b57..ebfb886a84 100644 --- a/calico/reference/resources/networkpolicy.mdx +++ b/calico/reference/resources/networkpolicy.mdx @@ -72,7 +72,7 @@ spec: | Field | Description | Accepted Values | Schema | Default | | --------- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | --------- | -| name | The name of the network policy. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | | +| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and at most one `.`. Names that start with `knp.default.` or `ossg.default.` can have more dots. | string | | | namespace | Namespace provides an additional qualification to a resource name. | | string | "default" | ### Spec @@ -80,8 +80,9 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | ---------------------- | --------------------------------------------- | | order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | +| tier | Name of the [tier](tier.mdx) this policy belongs to. | | string | `default` | | selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() | -| types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | +| types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `[Ingress]`. To apply the policy to outbound traffic, set to `[Egress]`. To apply the policy to both, set to `[Ingress, Egress]`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | | ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | | | egress | Ordered list of egress rules applied by this policy. | | List of [Rule](#rule) | | | serviceAccountSelector | Selects the service account(s) to which this policy applies. Select a specific service account by name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() | From d3c22bb3666b5602d5087f7b6e82ded25ce8cb84 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Thu, 15 Oct 2026 18:54:49 +0100 Subject: [PATCH 06/17] Fix inaccuracies on the 3.33 NetworkPolicy reference --- .../version-3.33/_includes/content/_entityrule.mdx | 8 ++++---- .../version-3.33/_includes/content/_httpmatch.mdx | 6 +++--- .../version-3.33/_includes/content/_rule.mdx | 2 +- .../version-3.33/_includes/content/_selectors.mdx | 2 +- .../version-3.33/reference/resources/networkpolicy.mdx | 5 +++-- 5 files changed, 12 insertions(+), 11 deletions(-) diff --git a/calico_versioned_docs/version-3.33/_includes/content/_entityrule.mdx b/calico_versioned_docs/version-3.33/_includes/content/_entityrule.mdx index 6172ecc91f..40aac6f3c4 100644 --- a/calico_versioned_docs/version-3.33/_includes/content/_entityrule.mdx +++ b/calico_versioned_docs/version-3.33/_includes/content/_entityrule.mdx @@ -5,7 +5,7 @@ to match. Packets can be matched on combinations of: Kubernetes `Service`. Selectors can match [workload endpoints](../../reference/resources/workloadendpoint.mdx), [host endpoints](../../reference/resources/hostendpoint.mdx) and ([namespaced](../../reference/resources/networkset.mdx) or [global](../../reference/resources/globalnetworkset.mdx)) network sets. -- Source/destination IP address, protocol and port. +- Source/destination IP address and port. If the rule contains multiple match criteria (for example, an IP and a port) then all match criteria must match for the rule as a whole to match a packet. @@ -16,7 +16,7 @@ for the rule as a whole to match a packet. | notNets | Negative match on CIDRs. Match packets with IP not in any of the listed CIDRs. | List of valid IPv4 CIDRs or list of valid IPv6 CIDRs (IPv4 and IPv6 CIDRs shouldn't be mixed in one rule) | list of cidrs | | selector | Positive match on selected endpoints. If a `namespaceSelector` is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces. | Valid selector | [selector](#selectors) | | | notSelector | Negative match on selected endpoints. If a `namespaceSelector` is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces. | Valid selector | [selector](#selectors) | | -| namespaceSelector | Positive match on selected namespaces. If specified, only workload endpoints in the selected Kubernetes namespaces are matched. Matches namespaces based on the labels that have been applied to the namespaces. Defines the scope that selectors will apply to, if not defined then selectors apply to the policy's namespace for a namespaced policy, and to all namespaces and non-namespaced resources for a global policy. Match a specific namespace by name using the `kubernetes.io/metadata.name` label. Select the non-namespaced resources like GlobalNetworkSet(s), host endpoints to which this policy applies by using `global()` selector. | Valid selector | [selector](#selectors) | | +| namespaceSelector | Positive match on selected namespaces. If specified, only workload endpoints and network sets in the selected Kubernetes namespaces are matched. Matches namespaces based on the labels that have been applied to the namespaces. Defines the scope that selectors will apply to, if not defined then selectors apply to the policy's namespace for a namespaced policy, and to all namespaces and non-namespaced resources for a global policy. Match a specific namespace by name using the `kubernetes.io/metadata.name` label. Select the non-namespaced resources like GlobalNetworkSet(s), host endpoints to which this policy applies by using `global()` selector. | Valid selector | [selector](#selectors) | | | ports | Positive match on the specified ports | | list of [ports](#ports) | | | notPorts | Negative match on the specified ports | | list of [ports](#ports) | | | serviceAccounts | Match endpoints running under service accounts. If a `namespaceSelector` is also defined, the set of service accounts this applies to is limited to the service accounts in the selected namespaces. | | [ServiceAccountMatch](#serviceaccountmatch) | | @@ -40,7 +40,7 @@ $[prodname] typically drops the empty value when it stores the resource, so the rather than the selector: - `selector: !has(foo)` matches packets from/to endpoints and network sets that do not have the label "foo". -- `notSelector: has(foo)` matches packets from/to **anywhere** (including outside the cluster), **except** traffic from/to endpoints and network sets that have the label "foo". +- `notSelector: has(foo)` matches packets from/to **anywhere** (including outside the cluster), **except** traffic from/to endpoints and network sets that have the label "foo". In a `NetworkPolicy`, or in a rule that also sets `namespaceSelector`, the match is limited to in-scope endpoints and network sets, so it matches packets from/to those that do not have the label "foo". #### Selector performance in EntityRules @@ -63,7 +63,7 @@ The following perform like `has(label)`. All endpoints with the label will be s - `label starts with 's'` - `label ends with 's'` -The other operators, and in particular, `all()`, `!`, `||` and `!=` are not optimized. +The other operators, and in particular, `all()`, `!`, `||` and `!=` are not optimized. The exception is `||` where every branch requires the same label, such as `a == 'b' || a == 'c'`, which is optimized. Examples: diff --git a/calico_versioned_docs/version-3.33/_includes/content/_httpmatch.mdx b/calico_versioned_docs/version-3.33/_includes/content/_httpmatch.mdx index 613bb97c3d..a10cb22dcd 100644 --- a/calico_versioned_docs/version-3.33/_includes/content/_httpmatch.mdx +++ b/calico_versioned_docs/version-3.33/_includes/content/_httpmatch.mdx @@ -1,4 +1,4 @@ -An HTTPMatch matches attributes of an HTTP request. The presence of an HTTPMatch clause on a Rule will cause that rule to only match HTTP traffic. Other application layer protocols will not match the rule. +An HTTPMatch matches attributes of an HTTP request. Example: @@ -19,5 +19,5 @@ http: | Syntax | Example | Description | | ------ | ------------------- | ------------------------------------------------------------------------------- | -| exact | `exact: "/foo/bar"` | Matches the exact path as written, not including the query string or fragments. | -| prefix | `prefix: "/keys"` | Matches any path that begins with the given prefix. | +| exact | `exact: "/foo/bar"` | Matches the exact path after normalization, not including the query string or fragments. For example, normalization decodes percent-escapes, collapses repeated slashes, and resolves `.` and `..` segments. | +| prefix | `prefix: "/keys"` | Matches the given path and any path below it, at a path-segment boundary. For example, `/keys` matches `/keys/1` but not `/keystore`. | diff --git a/calico_versioned_docs/version-3.33/_includes/content/_rule.mdx b/calico_versioned_docs/version-3.33/_includes/content/_rule.mdx index 54a04d392e..2280a4cdca 100644 --- a/calico_versioned_docs/version-3.33/_includes/content/_rule.mdx +++ b/calico_versioned_docs/version-3.33/_includes/content/_rule.mdx @@ -17,7 +17,7 @@ are executed in order. After a `Log` action, processing continues with the next rule; `Allow` and `Deny` are immediate and final and no further rules are processed. -An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` will skip over the remaining policies and jump to the +An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` will skip over the remaining policies in its tier and jump to the next tier with policies that apply to the endpoint. After the last such tier, it jumps to the first [profile](../../reference/resources/profile.mdx) assigned to the endpoint, applying the policy configured in the profile; if there are no Profiles configured for the endpoint the default applied action is `Deny`. diff --git a/calico_versioned_docs/version-3.33/_includes/content/_selectors.mdx b/calico_versioned_docs/version-3.33/_includes/content/_selectors.mdx index 52baf960ae..ba6f21d0be 100644 --- a/calico_versioned_docs/version-3.33/_includes/content/_selectors.mdx +++ b/calico_versioned_docs/version-3.33/_includes/content/_selectors.mdx @@ -39,7 +39,7 @@ For example, the expression Would be "bracketed" like this: ``` -((!(has(my-label)) || ((my-label starts with 'prod') && (role in {'frontend','business'})) +((!(has(my-label))) || ((my-label starts with 'prod') && (role in {'frontend','business'}))) ``` It would match: diff --git a/calico_versioned_docs/version-3.33/reference/resources/networkpolicy.mdx b/calico_versioned_docs/version-3.33/reference/resources/networkpolicy.mdx index 8679413f54..f49ac13f5a 100644 --- a/calico_versioned_docs/version-3.33/reference/resources/networkpolicy.mdx +++ b/calico_versioned_docs/version-3.33/reference/resources/networkpolicy.mdx @@ -72,7 +72,7 @@ spec: | Field | Description | Accepted Values | Schema | Default | | --------- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | --------- | -| name | The name of the network policy. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | | +| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and at most one `.`. Names that start with `knp.default.` or `ossg.default.` can have more dots. | string | | | namespace | Namespace provides an additional qualification to a resource name. | | string | "default" | ### Spec @@ -80,8 +80,9 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | ---------------------- | --------------------------------------------- | | order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | +| tier | Name of the [tier](tier.mdx) this policy belongs to. | | string | `default` | | selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() | -| types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | +| types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `[Ingress]`. To apply the policy to outbound traffic, set to `[Egress]`. To apply the policy to both, set to `[Ingress, Egress]`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | | ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | | | egress | Ordered list of egress rules applied by this policy. | | List of [Rule](#rule) | | | serviceAccountSelector | Selects the service account(s) to which this policy applies. Select a specific service account by name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() | From de5076c6d68a6b936ab01f09300ae1018e076a6c Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Thu, 15 Oct 2026 18:54:49 +0100 Subject: [PATCH 07/17] Fix inaccuracies on the 3.32 NetworkPolicy reference --- .../version-3.32/_includes/content/_entityrule.mdx | 8 ++++---- .../version-3.32/_includes/content/_httpmatch.mdx | 6 +++--- .../version-3.32/_includes/content/_rule.mdx | 2 +- .../version-3.32/_includes/content/_selectors.mdx | 2 +- .../version-3.32/reference/resources/networkpolicy.mdx | 5 +++-- 5 files changed, 12 insertions(+), 11 deletions(-) diff --git a/calico_versioned_docs/version-3.32/_includes/content/_entityrule.mdx b/calico_versioned_docs/version-3.32/_includes/content/_entityrule.mdx index 6172ecc91f..40aac6f3c4 100644 --- a/calico_versioned_docs/version-3.32/_includes/content/_entityrule.mdx +++ b/calico_versioned_docs/version-3.32/_includes/content/_entityrule.mdx @@ -5,7 +5,7 @@ to match. Packets can be matched on combinations of: Kubernetes `Service`. Selectors can match [workload endpoints](../../reference/resources/workloadendpoint.mdx), [host endpoints](../../reference/resources/hostendpoint.mdx) and ([namespaced](../../reference/resources/networkset.mdx) or [global](../../reference/resources/globalnetworkset.mdx)) network sets. -- Source/destination IP address, protocol and port. +- Source/destination IP address and port. If the rule contains multiple match criteria (for example, an IP and a port) then all match criteria must match for the rule as a whole to match a packet. @@ -16,7 +16,7 @@ for the rule as a whole to match a packet. | notNets | Negative match on CIDRs. Match packets with IP not in any of the listed CIDRs. | List of valid IPv4 CIDRs or list of valid IPv6 CIDRs (IPv4 and IPv6 CIDRs shouldn't be mixed in one rule) | list of cidrs | | selector | Positive match on selected endpoints. If a `namespaceSelector` is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces. | Valid selector | [selector](#selectors) | | | notSelector | Negative match on selected endpoints. If a `namespaceSelector` is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces. | Valid selector | [selector](#selectors) | | -| namespaceSelector | Positive match on selected namespaces. If specified, only workload endpoints in the selected Kubernetes namespaces are matched. Matches namespaces based on the labels that have been applied to the namespaces. Defines the scope that selectors will apply to, if not defined then selectors apply to the policy's namespace for a namespaced policy, and to all namespaces and non-namespaced resources for a global policy. Match a specific namespace by name using the `kubernetes.io/metadata.name` label. Select the non-namespaced resources like GlobalNetworkSet(s), host endpoints to which this policy applies by using `global()` selector. | Valid selector | [selector](#selectors) | | +| namespaceSelector | Positive match on selected namespaces. If specified, only workload endpoints and network sets in the selected Kubernetes namespaces are matched. Matches namespaces based on the labels that have been applied to the namespaces. Defines the scope that selectors will apply to, if not defined then selectors apply to the policy's namespace for a namespaced policy, and to all namespaces and non-namespaced resources for a global policy. Match a specific namespace by name using the `kubernetes.io/metadata.name` label. Select the non-namespaced resources like GlobalNetworkSet(s), host endpoints to which this policy applies by using `global()` selector. | Valid selector | [selector](#selectors) | | | ports | Positive match on the specified ports | | list of [ports](#ports) | | | notPorts | Negative match on the specified ports | | list of [ports](#ports) | | | serviceAccounts | Match endpoints running under service accounts. If a `namespaceSelector` is also defined, the set of service accounts this applies to is limited to the service accounts in the selected namespaces. | | [ServiceAccountMatch](#serviceaccountmatch) | | @@ -40,7 +40,7 @@ $[prodname] typically drops the empty value when it stores the resource, so the rather than the selector: - `selector: !has(foo)` matches packets from/to endpoints and network sets that do not have the label "foo". -- `notSelector: has(foo)` matches packets from/to **anywhere** (including outside the cluster), **except** traffic from/to endpoints and network sets that have the label "foo". +- `notSelector: has(foo)` matches packets from/to **anywhere** (including outside the cluster), **except** traffic from/to endpoints and network sets that have the label "foo". In a `NetworkPolicy`, or in a rule that also sets `namespaceSelector`, the match is limited to in-scope endpoints and network sets, so it matches packets from/to those that do not have the label "foo". #### Selector performance in EntityRules @@ -63,7 +63,7 @@ The following perform like `has(label)`. All endpoints with the label will be s - `label starts with 's'` - `label ends with 's'` -The other operators, and in particular, `all()`, `!`, `||` and `!=` are not optimized. +The other operators, and in particular, `all()`, `!`, `||` and `!=` are not optimized. The exception is `||` where every branch requires the same label, such as `a == 'b' || a == 'c'`, which is optimized. Examples: diff --git a/calico_versioned_docs/version-3.32/_includes/content/_httpmatch.mdx b/calico_versioned_docs/version-3.32/_includes/content/_httpmatch.mdx index 613bb97c3d..a10cb22dcd 100644 --- a/calico_versioned_docs/version-3.32/_includes/content/_httpmatch.mdx +++ b/calico_versioned_docs/version-3.32/_includes/content/_httpmatch.mdx @@ -1,4 +1,4 @@ -An HTTPMatch matches attributes of an HTTP request. The presence of an HTTPMatch clause on a Rule will cause that rule to only match HTTP traffic. Other application layer protocols will not match the rule. +An HTTPMatch matches attributes of an HTTP request. Example: @@ -19,5 +19,5 @@ http: | Syntax | Example | Description | | ------ | ------------------- | ------------------------------------------------------------------------------- | -| exact | `exact: "/foo/bar"` | Matches the exact path as written, not including the query string or fragments. | -| prefix | `prefix: "/keys"` | Matches any path that begins with the given prefix. | +| exact | `exact: "/foo/bar"` | Matches the exact path after normalization, not including the query string or fragments. For example, normalization decodes percent-escapes, collapses repeated slashes, and resolves `.` and `..` segments. | +| prefix | `prefix: "/keys"` | Matches the given path and any path below it, at a path-segment boundary. For example, `/keys` matches `/keys/1` but not `/keystore`. | diff --git a/calico_versioned_docs/version-3.32/_includes/content/_rule.mdx b/calico_versioned_docs/version-3.32/_includes/content/_rule.mdx index 6ed49affa9..6432760601 100644 --- a/calico_versioned_docs/version-3.32/_includes/content/_rule.mdx +++ b/calico_versioned_docs/version-3.32/_includes/content/_rule.mdx @@ -17,7 +17,7 @@ are executed in order. After a `Log` action, processing continues with the next rule; `Allow` and `Deny` are immediate and final and no further rules are processed. -An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` will skip over the remaining policies and jump to the +An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` will skip over the remaining policies in its tier and jump to the next tier with policies that apply to the endpoint. After the last such tier, it jumps to the first [profile](../../reference/resources/profile.mdx) assigned to the endpoint, applying the policy configured in the profile; if there are no Profiles configured for the endpoint the default applied action is `Deny`. diff --git a/calico_versioned_docs/version-3.32/_includes/content/_selectors.mdx b/calico_versioned_docs/version-3.32/_includes/content/_selectors.mdx index 52baf960ae..ba6f21d0be 100644 --- a/calico_versioned_docs/version-3.32/_includes/content/_selectors.mdx +++ b/calico_versioned_docs/version-3.32/_includes/content/_selectors.mdx @@ -39,7 +39,7 @@ For example, the expression Would be "bracketed" like this: ``` -((!(has(my-label)) || ((my-label starts with 'prod') && (role in {'frontend','business'})) +((!(has(my-label))) || ((my-label starts with 'prod') && (role in {'frontend','business'}))) ``` It would match: diff --git a/calico_versioned_docs/version-3.32/reference/resources/networkpolicy.mdx b/calico_versioned_docs/version-3.32/reference/resources/networkpolicy.mdx index 3da3ca0d7f..0d30d99c8d 100644 --- a/calico_versioned_docs/version-3.32/reference/resources/networkpolicy.mdx +++ b/calico_versioned_docs/version-3.32/reference/resources/networkpolicy.mdx @@ -72,7 +72,7 @@ spec: | Field | Description | Accepted Values | Schema | Default | | --------- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | --------- | -| name | The name of the network policy. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | | +| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and at most one `.`. Names that start with `knp.default.` or `ossg.default.` can have more dots. | string | | | namespace | Namespace provides an additional qualification to a resource name. | | string | "default" | ### Spec @@ -80,8 +80,9 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | ---------------------- | --------------------------------------------- | | order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | +| tier | Name of the [tier](tier.mdx) this policy belongs to. | | string | `default` | | selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() | -| types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | +| types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `[Ingress]`. To apply the policy to outbound traffic, set to `[Egress]`. To apply the policy to both, set to `[Ingress, Egress]`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | | ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | | | egress | Ordered list of egress rules applied by this policy. | | List of [Rule](#rule) | | | serviceAccountSelector | Selects the service account(s) to which this policy applies. Select a specific service account by name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() | From 54e88a192a61fd7b71ea7a2b2f3d0a87a7792ebc Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Thu, 15 Oct 2026 18:54:49 +0100 Subject: [PATCH 08/17] Fix inaccuracies on the 3.31 NetworkPolicy reference --- .../version-3.31/_includes/content/_entityrule.mdx | 8 ++++---- .../version-3.31/_includes/content/_httpmatch.mdx | 6 +++--- .../version-3.31/_includes/content/_rule.mdx | 2 +- .../version-3.31/_includes/content/_selectors.mdx | 2 +- .../version-3.31/reference/resources/networkpolicy.mdx | 3 ++- 5 files changed, 11 insertions(+), 10 deletions(-) diff --git a/calico_versioned_docs/version-3.31/_includes/content/_entityrule.mdx b/calico_versioned_docs/version-3.31/_includes/content/_entityrule.mdx index 6172ecc91f..40aac6f3c4 100644 --- a/calico_versioned_docs/version-3.31/_includes/content/_entityrule.mdx +++ b/calico_versioned_docs/version-3.31/_includes/content/_entityrule.mdx @@ -5,7 +5,7 @@ to match. Packets can be matched on combinations of: Kubernetes `Service`. Selectors can match [workload endpoints](../../reference/resources/workloadendpoint.mdx), [host endpoints](../../reference/resources/hostendpoint.mdx) and ([namespaced](../../reference/resources/networkset.mdx) or [global](../../reference/resources/globalnetworkset.mdx)) network sets. -- Source/destination IP address, protocol and port. +- Source/destination IP address and port. If the rule contains multiple match criteria (for example, an IP and a port) then all match criteria must match for the rule as a whole to match a packet. @@ -16,7 +16,7 @@ for the rule as a whole to match a packet. | notNets | Negative match on CIDRs. Match packets with IP not in any of the listed CIDRs. | List of valid IPv4 CIDRs or list of valid IPv6 CIDRs (IPv4 and IPv6 CIDRs shouldn't be mixed in one rule) | list of cidrs | | selector | Positive match on selected endpoints. If a `namespaceSelector` is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces. | Valid selector | [selector](#selectors) | | | notSelector | Negative match on selected endpoints. If a `namespaceSelector` is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces. | Valid selector | [selector](#selectors) | | -| namespaceSelector | Positive match on selected namespaces. If specified, only workload endpoints in the selected Kubernetes namespaces are matched. Matches namespaces based on the labels that have been applied to the namespaces. Defines the scope that selectors will apply to, if not defined then selectors apply to the policy's namespace for a namespaced policy, and to all namespaces and non-namespaced resources for a global policy. Match a specific namespace by name using the `kubernetes.io/metadata.name` label. Select the non-namespaced resources like GlobalNetworkSet(s), host endpoints to which this policy applies by using `global()` selector. | Valid selector | [selector](#selectors) | | +| namespaceSelector | Positive match on selected namespaces. If specified, only workload endpoints and network sets in the selected Kubernetes namespaces are matched. Matches namespaces based on the labels that have been applied to the namespaces. Defines the scope that selectors will apply to, if not defined then selectors apply to the policy's namespace for a namespaced policy, and to all namespaces and non-namespaced resources for a global policy. Match a specific namespace by name using the `kubernetes.io/metadata.name` label. Select the non-namespaced resources like GlobalNetworkSet(s), host endpoints to which this policy applies by using `global()` selector. | Valid selector | [selector](#selectors) | | | ports | Positive match on the specified ports | | list of [ports](#ports) | | | notPorts | Negative match on the specified ports | | list of [ports](#ports) | | | serviceAccounts | Match endpoints running under service accounts. If a `namespaceSelector` is also defined, the set of service accounts this applies to is limited to the service accounts in the selected namespaces. | | [ServiceAccountMatch](#serviceaccountmatch) | | @@ -40,7 +40,7 @@ $[prodname] typically drops the empty value when it stores the resource, so the rather than the selector: - `selector: !has(foo)` matches packets from/to endpoints and network sets that do not have the label "foo". -- `notSelector: has(foo)` matches packets from/to **anywhere** (including outside the cluster), **except** traffic from/to endpoints and network sets that have the label "foo". +- `notSelector: has(foo)` matches packets from/to **anywhere** (including outside the cluster), **except** traffic from/to endpoints and network sets that have the label "foo". In a `NetworkPolicy`, or in a rule that also sets `namespaceSelector`, the match is limited to in-scope endpoints and network sets, so it matches packets from/to those that do not have the label "foo". #### Selector performance in EntityRules @@ -63,7 +63,7 @@ The following perform like `has(label)`. All endpoints with the label will be s - `label starts with 's'` - `label ends with 's'` -The other operators, and in particular, `all()`, `!`, `||` and `!=` are not optimized. +The other operators, and in particular, `all()`, `!`, `||` and `!=` are not optimized. The exception is `||` where every branch requires the same label, such as `a == 'b' || a == 'c'`, which is optimized. Examples: diff --git a/calico_versioned_docs/version-3.31/_includes/content/_httpmatch.mdx b/calico_versioned_docs/version-3.31/_includes/content/_httpmatch.mdx index 613bb97c3d..a10cb22dcd 100644 --- a/calico_versioned_docs/version-3.31/_includes/content/_httpmatch.mdx +++ b/calico_versioned_docs/version-3.31/_includes/content/_httpmatch.mdx @@ -1,4 +1,4 @@ -An HTTPMatch matches attributes of an HTTP request. The presence of an HTTPMatch clause on a Rule will cause that rule to only match HTTP traffic. Other application layer protocols will not match the rule. +An HTTPMatch matches attributes of an HTTP request. Example: @@ -19,5 +19,5 @@ http: | Syntax | Example | Description | | ------ | ------------------- | ------------------------------------------------------------------------------- | -| exact | `exact: "/foo/bar"` | Matches the exact path as written, not including the query string or fragments. | -| prefix | `prefix: "/keys"` | Matches any path that begins with the given prefix. | +| exact | `exact: "/foo/bar"` | Matches the exact path after normalization, not including the query string or fragments. For example, normalization decodes percent-escapes, collapses repeated slashes, and resolves `.` and `..` segments. | +| prefix | `prefix: "/keys"` | Matches the given path and any path below it, at a path-segment boundary. For example, `/keys` matches `/keys/1` but not `/keystore`. | diff --git a/calico_versioned_docs/version-3.31/_includes/content/_rule.mdx b/calico_versioned_docs/version-3.31/_includes/content/_rule.mdx index 6f9aca1311..f32cab676c 100644 --- a/calico_versioned_docs/version-3.31/_includes/content/_rule.mdx +++ b/calico_versioned_docs/version-3.31/_includes/content/_rule.mdx @@ -17,7 +17,7 @@ are executed in order. After a `Log` action, processing continues with the next rule; `Allow` and `Deny` are immediate and final and no further rules are processed. -An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` will skip over the remaining policies and jump to the +An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` will skip over the remaining policies in its tier and jump to the next tier with policies that apply to the endpoint. After the last such tier, it jumps to the first [profile](../../reference/resources/profile.mdx) assigned to the endpoint, applying the policy configured in the profile; if there are no Profiles configured for the endpoint the default applied action is `Deny`. diff --git a/calico_versioned_docs/version-3.31/_includes/content/_selectors.mdx b/calico_versioned_docs/version-3.31/_includes/content/_selectors.mdx index 52baf960ae..ba6f21d0be 100644 --- a/calico_versioned_docs/version-3.31/_includes/content/_selectors.mdx +++ b/calico_versioned_docs/version-3.31/_includes/content/_selectors.mdx @@ -39,7 +39,7 @@ For example, the expression Would be "bracketed" like this: ``` -((!(has(my-label)) || ((my-label starts with 'prod') && (role in {'frontend','business'})) +((!(has(my-label))) || ((my-label starts with 'prod') && (role in {'frontend','business'}))) ``` It would match: diff --git a/calico_versioned_docs/version-3.31/reference/resources/networkpolicy.mdx b/calico_versioned_docs/version-3.31/reference/resources/networkpolicy.mdx index 68ba747077..5a9e9dfe70 100644 --- a/calico_versioned_docs/version-3.31/reference/resources/networkpolicy.mdx +++ b/calico_versioned_docs/version-3.31/reference/resources/networkpolicy.mdx @@ -80,8 +80,9 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | ---------------------- | --------------------------------------------- | | order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | +| tier | Name of the [tier](tier.mdx) this policy belongs to. | | string | `default` | | selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() | -| types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | +| types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `[Ingress]`. To apply the policy to outbound traffic, set to `[Egress]`. To apply the policy to both, set to `[Ingress, Egress]`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | | ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | | | egress | Ordered list of egress rules applied by this policy. | | List of [Rule](#rule) | | | serviceAccountSelector | Selects the service account(s) to which this policy applies. Select a specific service account by name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() | From 199e77ace83ca7b52d26bc967fea7eedf80b147d Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Thu, 15 Oct 2026 19:04:23 +0100 Subject: [PATCH 09/17] Remove unverified HTTP path match changes --- calico/_includes/content/_httpmatch.mdx | 4 ++-- .../version-3.31/_includes/content/_httpmatch.mdx | 4 ++-- .../version-3.32/_includes/content/_httpmatch.mdx | 4 ++-- .../version-3.33/_includes/content/_httpmatch.mdx | 4 ++-- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/calico/_includes/content/_httpmatch.mdx b/calico/_includes/content/_httpmatch.mdx index a10cb22dcd..f852d57248 100644 --- a/calico/_includes/content/_httpmatch.mdx +++ b/calico/_includes/content/_httpmatch.mdx @@ -19,5 +19,5 @@ http: | Syntax | Example | Description | | ------ | ------------------- | ------------------------------------------------------------------------------- | -| exact | `exact: "/foo/bar"` | Matches the exact path after normalization, not including the query string or fragments. For example, normalization decodes percent-escapes, collapses repeated slashes, and resolves `.` and `..` segments. | -| prefix | `prefix: "/keys"` | Matches the given path and any path below it, at a path-segment boundary. For example, `/keys` matches `/keys/1` but not `/keystore`. | +| exact | `exact: "/foo/bar"` | Matches the exact path as written, not including the query string or fragments. | +| prefix | `prefix: "/keys"` | Matches any path that begins with the given prefix. | diff --git a/calico_versioned_docs/version-3.31/_includes/content/_httpmatch.mdx b/calico_versioned_docs/version-3.31/_includes/content/_httpmatch.mdx index a10cb22dcd..f852d57248 100644 --- a/calico_versioned_docs/version-3.31/_includes/content/_httpmatch.mdx +++ b/calico_versioned_docs/version-3.31/_includes/content/_httpmatch.mdx @@ -19,5 +19,5 @@ http: | Syntax | Example | Description | | ------ | ------------------- | ------------------------------------------------------------------------------- | -| exact | `exact: "/foo/bar"` | Matches the exact path after normalization, not including the query string or fragments. For example, normalization decodes percent-escapes, collapses repeated slashes, and resolves `.` and `..` segments. | -| prefix | `prefix: "/keys"` | Matches the given path and any path below it, at a path-segment boundary. For example, `/keys` matches `/keys/1` but not `/keystore`. | +| exact | `exact: "/foo/bar"` | Matches the exact path as written, not including the query string or fragments. | +| prefix | `prefix: "/keys"` | Matches any path that begins with the given prefix. | diff --git a/calico_versioned_docs/version-3.32/_includes/content/_httpmatch.mdx b/calico_versioned_docs/version-3.32/_includes/content/_httpmatch.mdx index a10cb22dcd..f852d57248 100644 --- a/calico_versioned_docs/version-3.32/_includes/content/_httpmatch.mdx +++ b/calico_versioned_docs/version-3.32/_includes/content/_httpmatch.mdx @@ -19,5 +19,5 @@ http: | Syntax | Example | Description | | ------ | ------------------- | ------------------------------------------------------------------------------- | -| exact | `exact: "/foo/bar"` | Matches the exact path after normalization, not including the query string or fragments. For example, normalization decodes percent-escapes, collapses repeated slashes, and resolves `.` and `..` segments. | -| prefix | `prefix: "/keys"` | Matches the given path and any path below it, at a path-segment boundary. For example, `/keys` matches `/keys/1` but not `/keystore`. | +| exact | `exact: "/foo/bar"` | Matches the exact path as written, not including the query string or fragments. | +| prefix | `prefix: "/keys"` | Matches any path that begins with the given prefix. | diff --git a/calico_versioned_docs/version-3.33/_includes/content/_httpmatch.mdx b/calico_versioned_docs/version-3.33/_includes/content/_httpmatch.mdx index a10cb22dcd..f852d57248 100644 --- a/calico_versioned_docs/version-3.33/_includes/content/_httpmatch.mdx +++ b/calico_versioned_docs/version-3.33/_includes/content/_httpmatch.mdx @@ -19,5 +19,5 @@ http: | Syntax | Example | Description | | ------ | ------------------- | ------------------------------------------------------------------------------- | -| exact | `exact: "/foo/bar"` | Matches the exact path after normalization, not including the query string or fragments. For example, normalization decodes percent-escapes, collapses repeated slashes, and resolves `.` and `..` segments. | -| prefix | `prefix: "/keys"` | Matches the given path and any path below it, at a path-segment boundary. For example, `/keys` matches `/keys/1` but not `/keystore`. | +| exact | `exact: "/foo/bar"` | Matches the exact path as written, not including the query string or fragments. | +| prefix | `prefix: "/keys"` | Matches any path that begins with the given prefix. | From 5c42391e58308a19f8db8a007ddaee63164cd484 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Thu, 15 Oct 2026 20:08:29 +0100 Subject: [PATCH 10/17] Add tier details and scope order to the tier in the next NetworkPolicy reference --- calico/reference/resources/networkpolicy.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/calico/reference/resources/networkpolicy.mdx b/calico/reference/resources/networkpolicy.mdx index ebfb886a84..3a3496b28b 100644 --- a/calico/reference/resources/networkpolicy.mdx +++ b/calico/reference/resources/networkpolicy.mdx @@ -79,8 +79,8 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | ---------------------- | --------------------------------------------- | -| order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | -| tier | Name of the [tier](tier.mdx) this policy belongs to. | | string | `default` | +| order | Controls the order of precedence within the policy's tier. $[prodname] applies the policy with the lowest value first. | | float | | +| tier | Name of the [tier](tier.mdx) this policy belongs to. The tier must exist before you create the policy. | | string | `default` | | selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() | | types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `[Ingress]`. To apply the policy to outbound traffic, set to `[Egress]`. To apply the policy to both, set to `[Ingress, Egress]`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | | ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | | From 1edb4aa6ad9ba075f08c72fab51a49151a35b2e7 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Thu, 15 Oct 2026 20:08:30 +0100 Subject: [PATCH 11/17] Add tier details and scope order to the tier in the 3.33 NetworkPolicy reference --- .../version-3.33/reference/resources/networkpolicy.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/calico_versioned_docs/version-3.33/reference/resources/networkpolicy.mdx b/calico_versioned_docs/version-3.33/reference/resources/networkpolicy.mdx index f49ac13f5a..52c41b6ebc 100644 --- a/calico_versioned_docs/version-3.33/reference/resources/networkpolicy.mdx +++ b/calico_versioned_docs/version-3.33/reference/resources/networkpolicy.mdx @@ -79,8 +79,8 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | ---------------------- | --------------------------------------------- | -| order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | -| tier | Name of the [tier](tier.mdx) this policy belongs to. | | string | `default` | +| order | Controls the order of precedence within the policy's tier. $[prodname] applies the policy with the lowest value first. | | float | | +| tier | Name of the [tier](tier.mdx) this policy belongs to. The tier must exist before you create the policy. | | string | `default` | | selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() | | types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `[Ingress]`. To apply the policy to outbound traffic, set to `[Egress]`. To apply the policy to both, set to `[Ingress, Egress]`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | | ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | | From 2194c4496008a60e8c20f4b9ccc18f55def81e70 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Thu, 15 Oct 2026 20:08:30 +0100 Subject: [PATCH 12/17] Add tier details and scope order to the tier in the 3.32 NetworkPolicy reference --- .../version-3.32/reference/resources/networkpolicy.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/calico_versioned_docs/version-3.32/reference/resources/networkpolicy.mdx b/calico_versioned_docs/version-3.32/reference/resources/networkpolicy.mdx index 0d30d99c8d..045e0198de 100644 --- a/calico_versioned_docs/version-3.32/reference/resources/networkpolicy.mdx +++ b/calico_versioned_docs/version-3.32/reference/resources/networkpolicy.mdx @@ -79,8 +79,8 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | ---------------------- | --------------------------------------------- | -| order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | -| tier | Name of the [tier](tier.mdx) this policy belongs to. | | string | `default` | +| order | Controls the order of precedence within the policy's tier. $[prodname] applies the policy with the lowest value first. | | float | | +| tier | Name of the [tier](tier.mdx) this policy belongs to. The tier must exist before you create the policy. | | string | `default` | | selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() | | types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `[Ingress]`. To apply the policy to outbound traffic, set to `[Egress]`. To apply the policy to both, set to `[Ingress, Egress]`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | | ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | | From 4e381a384709afe5f5a855bc1008cff3f2d94f88 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Thu, 15 Oct 2026 20:08:30 +0100 Subject: [PATCH 13/17] Add tier details and scope order to the tier in the 3.31 NetworkPolicy reference --- .../version-3.31/reference/resources/networkpolicy.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/calico_versioned_docs/version-3.31/reference/resources/networkpolicy.mdx b/calico_versioned_docs/version-3.31/reference/resources/networkpolicy.mdx index 5a9e9dfe70..e8d4e5a732 100644 --- a/calico_versioned_docs/version-3.31/reference/resources/networkpolicy.mdx +++ b/calico_versioned_docs/version-3.31/reference/resources/networkpolicy.mdx @@ -79,8 +79,8 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | ---------------------- | --------------------------------------------- | -| order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | -| tier | Name of the [tier](tier.mdx) this policy belongs to. | | string | `default` | +| order | Controls the order of precedence within the policy's tier. $[prodname] applies the policy with the lowest value first. | | float | | +| tier | Name of the [tier](tier.mdx) this policy belongs to. The tier must exist before you create the policy. If the tier isn't `default`, the policy name must have the form `.`. | | string | `default` | | selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() | | types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `[Ingress]`. To apply the policy to outbound traffic, set to `[Egress]`. To apply the policy to both, set to `[Ingress, Egress]`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | | ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | | From 82d5ef2fa996cc9d908312e606cfa3598b3f7097 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Mon, 19 Oct 2026 13:59:18 +0100 Subject: [PATCH 14/17] Fix the name rule and types default for native v3 CRDs in the next NetworkPolicy reference --- calico/reference/resources/networkpolicy.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/calico/reference/resources/networkpolicy.mdx b/calico/reference/resources/networkpolicy.mdx index 3a3496b28b..c9eb94ffaa 100644 --- a/calico/reference/resources/networkpolicy.mdx +++ b/calico/reference/resources/networkpolicy.mdx @@ -72,7 +72,7 @@ spec: | Field | Description | Accepted Values | Schema | Default | | --------- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | --------- | -| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and at most one `.`. Names that start with `knp.default.` or `ossg.default.` can have more dots. | string | | +| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-`. Use at most one `.`, because calicoctl rejects names with more. Names that start with `ossg.default.` can have more dots. | string | | | namespace | Namespace provides an additional qualification to a resource name. | | string | "default" | ### Spec @@ -88,7 +88,7 @@ spec: | serviceAccountSelector | Selects the service account(s) to which this policy applies. Select a specific service account by name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() | | performanceHints | Contains a list of hints to Calico's policy engine to help process the policy more efficiently. Hints never change the enforcement behaviour of the policy. The available hints are described [below](#performance-hints). | `AssumeNeededOnEveryNode` | List of strings | | -\* If `types` has no value, $[prodname] defaults as follows. +\* If `types` has no value, $[prodname] defaults as follows. Leave out `ingress` or `egress` when it has no rules, because an empty list such as `ingress: []` can count as rules present. > | Ingress Rules Present | Egress Rules Present | `Types` value | > | --------------------- | -------------------- | ----------------- | From b64245e5567c03da5342335aaba1bb35216fe9ea Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Mon, 19 Oct 2026 13:59:19 +0100 Subject: [PATCH 15/17] Fix the name rule and types default for native v3 CRDs in the 3.33 NetworkPolicy reference --- .../version-3.33/reference/resources/networkpolicy.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/calico_versioned_docs/version-3.33/reference/resources/networkpolicy.mdx b/calico_versioned_docs/version-3.33/reference/resources/networkpolicy.mdx index 52c41b6ebc..2d0544b136 100644 --- a/calico_versioned_docs/version-3.33/reference/resources/networkpolicy.mdx +++ b/calico_versioned_docs/version-3.33/reference/resources/networkpolicy.mdx @@ -72,7 +72,7 @@ spec: | Field | Description | Accepted Values | Schema | Default | | --------- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | --------- | -| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and at most one `.`. Names that start with `knp.default.` or `ossg.default.` can have more dots. | string | | +| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-`. Use at most one `.`, because calicoctl rejects names with more. Names that start with `ossg.default.` can have more dots. | string | | | namespace | Namespace provides an additional qualification to a resource name. | | string | "default" | ### Spec @@ -88,7 +88,7 @@ spec: | serviceAccountSelector | Selects the service account(s) to which this policy applies. Select a specific service account by name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() | | performanceHints | Contains a list of hints to Calico's policy engine to help process the policy more efficiently. Hints never change the enforcement behaviour of the policy. The available hints are described [below](#performance-hints). | `AssumeNeededOnEveryNode` | List of strings | | -\* If `types` has no value, $[prodname] defaults as follows. +\* If `types` has no value, $[prodname] defaults as follows. Leave out `ingress` or `egress` when it has no rules, because an empty list such as `ingress: []` can count as rules present. > | Ingress Rules Present | Egress Rules Present | `Types` value | > | --------------------- | -------------------- | ----------------- | From 82c5e1fe4744434fd02062d6e27f3bdac9029c3a Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Mon, 19 Oct 2026 16:55:03 +0100 Subject: [PATCH 16/17] Fix HTTPMatch exact and prefix path matching descriptions The exact match compares the path after normalization, not the path as written. The prefix match works on whole path segments, so /keys does not match /keystore. Reproduced on kind with Istio and Dikastes on v3.33.0 and v3.32.2, with Envoy path normalization on and off. --- calico/_includes/content/_httpmatch.mdx | 8 ++++---- .../version-3.32/_includes/content/_httpmatch.mdx | 8 ++++---- .../version-3.33/_includes/content/_httpmatch.mdx | 8 ++++---- 3 files changed, 12 insertions(+), 12 deletions(-) diff --git a/calico/_includes/content/_httpmatch.mdx b/calico/_includes/content/_httpmatch.mdx index f852d57248..870f67918f 100644 --- a/calico/_includes/content/_httpmatch.mdx +++ b/calico/_includes/content/_httpmatch.mdx @@ -17,7 +17,7 @@ http: ### HTTPPathMatch -| Syntax | Example | Description | -| ------ | ------------------- | ------------------------------------------------------------------------------- | -| exact | `exact: "/foo/bar"` | Matches the exact path as written, not including the query string or fragments. | -| prefix | `prefix: "/keys"` | Matches any path that begins with the given prefix. | +| Syntax | Example | Description | +| ------ | ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| exact | `exact: "/foo/bar"` | Matches the exact path after normalization, not including the query string or fragments. For example, normalization decodes percent-escapes, collapses repeated slashes, and resolves `.` and `..` segments. | +| prefix | `prefix: "/keys"` | Matches the given path and any path below it, at a path-segment boundary. For example, `/keys` matches `/keys/1` but not `/keystore`. | diff --git a/calico_versioned_docs/version-3.32/_includes/content/_httpmatch.mdx b/calico_versioned_docs/version-3.32/_includes/content/_httpmatch.mdx index f852d57248..870f67918f 100644 --- a/calico_versioned_docs/version-3.32/_includes/content/_httpmatch.mdx +++ b/calico_versioned_docs/version-3.32/_includes/content/_httpmatch.mdx @@ -17,7 +17,7 @@ http: ### HTTPPathMatch -| Syntax | Example | Description | -| ------ | ------------------- | ------------------------------------------------------------------------------- | -| exact | `exact: "/foo/bar"` | Matches the exact path as written, not including the query string or fragments. | -| prefix | `prefix: "/keys"` | Matches any path that begins with the given prefix. | +| Syntax | Example | Description | +| ------ | ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| exact | `exact: "/foo/bar"` | Matches the exact path after normalization, not including the query string or fragments. For example, normalization decodes percent-escapes, collapses repeated slashes, and resolves `.` and `..` segments. | +| prefix | `prefix: "/keys"` | Matches the given path and any path below it, at a path-segment boundary. For example, `/keys` matches `/keys/1` but not `/keystore`. | diff --git a/calico_versioned_docs/version-3.33/_includes/content/_httpmatch.mdx b/calico_versioned_docs/version-3.33/_includes/content/_httpmatch.mdx index f852d57248..870f67918f 100644 --- a/calico_versioned_docs/version-3.33/_includes/content/_httpmatch.mdx +++ b/calico_versioned_docs/version-3.33/_includes/content/_httpmatch.mdx @@ -17,7 +17,7 @@ http: ### HTTPPathMatch -| Syntax | Example | Description | -| ------ | ------------------- | ------------------------------------------------------------------------------- | -| exact | `exact: "/foo/bar"` | Matches the exact path as written, not including the query string or fragments. | -| prefix | `prefix: "/keys"` | Matches any path that begins with the given prefix. | +| Syntax | Example | Description | +| ------ | ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| exact | `exact: "/foo/bar"` | Matches the exact path after normalization, not including the query string or fragments. For example, normalization decodes percent-escapes, collapses repeated slashes, and resolves `.` and `..` segments. | +| prefix | `prefix: "/keys"` | Matches the given path and any path below it, at a path-segment boundary. For example, `/keys` matches `/keys/1` but not `/keystore`. | From f4704b8ca14fbca9bb51caeb331a768b47ff9db1 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Mon, 19 Oct 2026 17:06:27 +0100 Subject: [PATCH 17/17] Use one wording for the policy name rule Every version says the name is lowercase alphanumeric with optional hyphens and at most one period. --- calico/reference/resources/networkpolicy.mdx | 2 +- .../version-3.31/reference/resources/networkpolicy.mdx | 2 +- .../version-3.32/reference/resources/networkpolicy.mdx | 2 +- .../version-3.33/reference/resources/networkpolicy.mdx | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/calico/reference/resources/networkpolicy.mdx b/calico/reference/resources/networkpolicy.mdx index c9eb94ffaa..19d5561688 100644 --- a/calico/reference/resources/networkpolicy.mdx +++ b/calico/reference/resources/networkpolicy.mdx @@ -72,7 +72,7 @@ spec: | Field | Description | Accepted Values | Schema | Default | | --------- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | --------- | -| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-`. Use at most one `.`, because calicoctl rejects names with more. Names that start with `ossg.default.` can have more dots. | string | | +| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and at most one `.`. | string | | | namespace | Namespace provides an additional qualification to a resource name. | | string | "default" | ### Spec diff --git a/calico_versioned_docs/version-3.31/reference/resources/networkpolicy.mdx b/calico_versioned_docs/version-3.31/reference/resources/networkpolicy.mdx index e8d4e5a732..b6a013666b 100644 --- a/calico_versioned_docs/version-3.31/reference/resources/networkpolicy.mdx +++ b/calico_versioned_docs/version-3.31/reference/resources/networkpolicy.mdx @@ -72,7 +72,7 @@ spec: | Field | Description | Accepted Values | Schema | Default | | --------- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | --------- | -| name | The name of the network policy. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | | +| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and at most one `.`. | string | | | namespace | Namespace provides an additional qualification to a resource name. | | string | "default" | ### Spec diff --git a/calico_versioned_docs/version-3.32/reference/resources/networkpolicy.mdx b/calico_versioned_docs/version-3.32/reference/resources/networkpolicy.mdx index 045e0198de..d1ef22e68f 100644 --- a/calico_versioned_docs/version-3.32/reference/resources/networkpolicy.mdx +++ b/calico_versioned_docs/version-3.32/reference/resources/networkpolicy.mdx @@ -72,7 +72,7 @@ spec: | Field | Description | Accepted Values | Schema | Default | | --------- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | --------- | -| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and at most one `.`. Names that start with `knp.default.` or `ossg.default.` can have more dots. | string | | +| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and at most one `.`. | string | | | namespace | Namespace provides an additional qualification to a resource name. | | string | "default" | ### Spec diff --git a/calico_versioned_docs/version-3.33/reference/resources/networkpolicy.mdx b/calico_versioned_docs/version-3.33/reference/resources/networkpolicy.mdx index 2d0544b136..08b2324c01 100644 --- a/calico_versioned_docs/version-3.33/reference/resources/networkpolicy.mdx +++ b/calico_versioned_docs/version-3.33/reference/resources/networkpolicy.mdx @@ -72,7 +72,7 @@ spec: | Field | Description | Accepted Values | Schema | Default | | --------- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | --------- | -| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-`. Use at most one `.`, because calicoctl rejects names with more. Names that start with `ossg.default.` can have more dots. | string | | +| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and at most one `.`. | string | | | namespace | Namespace provides an additional qualification to a resource name. | | string | "default" | ### Spec