Skip to content

DOCS-3077: Fix inaccuracies on the NetworkPolicy reference #3114

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ctauchen merged 17 commits into from
Oct 19, 2026
Merged

DOCS-3077: Fix inaccuracies on the NetworkPolicy reference #3114

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
f86172c
Fix inaccuracies on the OSS 3.33 NetworkPolicy reference
ctauchen Oct 15, 2026
a7395f7
Fix Pass action and HTTP path match descriptions
ctauchen Oct 15, 2026
a6a564c
Revert "Fix Pass action and HTTP path match descriptions"
ctauchen Oct 15, 2026
ac7c492
Revert "Fix inaccuracies on the OSS 3.33 NetworkPolicy reference"
ctauchen Oct 15, 2026
1ab775d
Fix inaccuracies on the next NetworkPolicy reference
ctauchen Oct 15, 2026
d3c22bb
Fix inaccuracies on the 3.33 NetworkPolicy reference
ctauchen Oct 15, 2026
de5076c
Fix inaccuracies on the 3.32 NetworkPolicy reference
ctauchen Oct 15, 2026
54e88a1
Fix inaccuracies on the 3.31 NetworkPolicy reference
ctauchen Oct 15, 2026
199e77a
Remove unverified HTTP path match changes
ctauchen Oct 15, 2026
5c42391
Add tier details and scope order to the tier in the next NetworkPolic…
ctauchen Oct 15, 2026
1edb4aa
Add tier details and scope order to the tier in the 3.33 NetworkPolic…
ctauchen Oct 15, 2026
2194c44
Add tier details and scope order to the tier in the 3.32 NetworkPolic…
ctauchen Oct 15, 2026
4e381a3
Add tier details and scope order to the tier in the 3.31 NetworkPolic…
ctauchen Oct 15, 2026
82d5ef2
Fix the name rule and types default for native v3 CRDs in the next Ne…
ctauchen Oct 19, 2026
b64245e
Fix the name rule and types default for native v3 CRDs in the 3.33 Ne…
ctauchen Oct 19, 2026
82c5e1f
Fix HTTPMatch exact and prefix path matching descriptions
ctauchen Oct 19, 2026
f4704b8
Use one wording for the policy name rule
ctauchen Oct 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions calico/_includes/content/_entityrule.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ to match. Packets can be matched on combinations of:
Kubernetes `Service`. Selectors can match [workload endpoints](../../reference/resources/workloadendpoint.mdx),
[host endpoints](../../reference/resources/hostendpoint.mdx) and ([namespaced](../../reference/resources/networkset.mdx) or
[global](../../reference/resources/globalnetworkset.mdx)) network sets.
- Source/destination IP address, protocol and port.
- Source/destination IP address and port.

If the rule contains multiple match criteria (for example, an IP and a port) then all match criteria must match
for the rule as a whole to match a packet.
Expand All @@ -16,7 +16,7 @@ for the rule as a whole to match a packet.
| notNets | Negative match on CIDRs. Match packets with IP not in any of the listed CIDRs. | List of valid IPv4 CIDRs or list of valid IPv6 CIDRs (IPv4 and IPv6 CIDRs shouldn't be mixed in one rule) | list of cidrs |
| selector | Positive match on selected endpoints. If a `namespaceSelector` is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces. | Valid selector | [selector](#selectors) | |
| notSelector | Negative match on selected endpoints. If a `namespaceSelector` is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces. | Valid selector | [selector](#selectors) | |
| namespaceSelector | Positive match on selected namespaces. If specified, only workload endpoints in the selected Kubernetes namespaces are matched. Matches namespaces based on the labels that have been applied to the namespaces. Defines the scope that selectors will apply to, if not defined then selectors apply to the policy's namespace for a namespaced policy, and to all namespaces and non-namespaced resources for a global policy. Match a specific namespace by name using the `kubernetes.io/metadata.name` label. Select the non-namespaced resources like GlobalNetworkSet(s), host endpoints to which this policy applies by using `global()` selector. | Valid selector | [selector](#selectors) | |
| namespaceSelector | Positive match on selected namespaces. If specified, only workload endpoints and network sets in the selected Kubernetes namespaces are matched. Matches namespaces based on the labels that have been applied to the namespaces. Defines the scope that selectors will apply to, if not defined then selectors apply to the policy's namespace for a namespaced policy, and to all namespaces and non-namespaced resources for a global policy. Match a specific namespace by name using the `kubernetes.io/metadata.name` label. Select the non-namespaced resources like GlobalNetworkSet(s), host endpoints to which this policy applies by using `global()` selector. | Valid selector | [selector](#selectors) | |
| ports | Positive match on the specified ports | | list of [ports](#ports) | |
| notPorts | Negative match on the specified ports | | list of [ports](#ports) | |
| serviceAccounts | Match endpoints running under service accounts. If a `namespaceSelector` is also defined, the set of service accounts this applies to is limited to the service accounts in the selected namespaces. | | [ServiceAccountMatch](#serviceaccountmatch) | |
Expand All @@ -40,7 +40,7 @@ $[prodname] typically drops the empty value when it stores the resource, so the
rather than the selector:

- `selector: !has(foo)` matches packets from/to endpoints and network sets that do not have the label "foo".
- `notSelector: has(foo)` matches packets from/to **anywhere** (including outside the cluster), **except** traffic from/to endpoints and network sets that have the label "foo".
- `notSelector: has(foo)` matches packets from/to **anywhere** (including outside the cluster), **except** traffic from/to endpoints and network sets that have the label "foo". In a `NetworkPolicy`, or in a rule that also sets `namespaceSelector`, the match is limited to in-scope endpoints and network sets, so it matches packets from/to those that do not have the label "foo".

#### Selector performance in EntityRules

Expand All @@ -63,7 +63,7 @@ The following perform like `has(label)`. All endpoints with the label will be s
- `label starts with 's'`
- `label ends with 's'`

The other operators, and in particular, `all()`, `!`, `||` and `!=` are not optimized.
The other operators, and in particular, `all()`, `!`, `||` and `!=` are not optimized. The exception is `||` where every branch requires the same label, such as `a == 'b' || a == 'c'`, which is optimized.

Examples:

Expand Down
10 changes: 5 additions & 5 deletions calico/_includes/content/_httpmatch.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
An HTTPMatch matches attributes of an HTTP request. The presence of an HTTPMatch clause on a Rule will cause that rule to only match HTTP traffic. Other application layer protocols will not match the rule.
An HTTPMatch matches attributes of an HTTP request.

Example:

Expand All @@ -17,7 +17,7 @@ http:

### HTTPPathMatch

| Syntax | Example | Description |
| ------ | ------------------- | ------------------------------------------------------------------------------- |
| exact | `exact: "/foo/bar"` | Matches the exact path as written, not including the query string or fragments. |
| prefix | `prefix: "/keys"` | Matches any path that begins with the given prefix. |
| Syntax | Example | Description |
| ------ | ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| exact | `exact: "/foo/bar"` | Matches the exact path after normalization, not including the query string or fragments. For example, normalization decodes percent-escapes, collapses repeated slashes, and resolves `.` and `..` segments. |
| prefix | `prefix: "/keys"` | Matches the given path and any path below it, at a path-segment boundary. For example, `/keys` matches `/keys/1` but not `/keystore`. |
2 changes: 1 addition & 1 deletion calico/_includes/content/_rule.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ are executed in order.
After a `Log` action, processing continues with the next rule; `Allow` and `Deny` are immediate
and final and no further rules are processed.

An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` will skip over the remaining policies and jump to the
An `action` of `Pass` in a `NetworkPolicy` or `GlobalNetworkPolicy` will skip over the remaining policies in its tier and jump to the next tier with policies that apply to the endpoint. After the last such tier, it jumps to the
first [profile](../../reference/resources/profile.mdx) assigned to the endpoint, applying the policy configured in the
profile; if there are no Profiles configured for the endpoint the default applied action is `Deny`.

Expand Down
2 changes: 1 addition & 1 deletion calico/_includes/content/_selectors.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ For example, the expression
Would be "bracketed" like this:

```
((!(has(my-label)) || ((my-label starts with 'prod') && (role in {'frontend','business'}))
((!(has(my-label))) || ((my-label starts with 'prod') && (role in {'frontend','business'})))
```

It would match:
Expand Down
9 changes: 5 additions & 4 deletions calico/reference/resources/networkpolicy.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,22 +72,23 @@ spec:

| Field | Description | Accepted Values | Schema | Default |
| --------- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | --------- |
| name | The name of the network policy. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | |
| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and at most one `.`. | string | |
| namespace | Namespace provides an additional qualification to a resource name. | | string | "default" |

### Spec

| Field | Description | Accepted Values | Schema | Default |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | ---------------------- | --------------------------------------------- |
| order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | |
| order | Controls the order of precedence within the policy's tier. $[prodname] applies the policy with the lowest value first. | | float | |
| tier | Name of the [tier](tier.mdx) this policy belongs to. The tier must exist before you create the policy. | | string | `default` |
| selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() |
| types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* |
| types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `[Ingress]`. To apply the policy to outbound traffic, set to `[Egress]`. To apply the policy to both, set to `[Ingress, Egress]`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* |
| ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | |
| egress | Ordered list of egress rules applied by this policy. | | List of [Rule](#rule) | |
| serviceAccountSelector | Selects the service account(s) to which this policy applies. Select a specific service account by name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() |
| performanceHints | Contains a list of hints to Calico's policy engine to help process the policy more efficiently. Hints never change the enforcement behaviour of the policy. The available hints are described [below](#performance-hints). | `AssumeNeededOnEveryNode` | List of strings | |

\* If `types` has no value, $[prodname] defaults as follows.
\* If `types` has no value, $[prodname] defaults as follows. Leave out `ingress` or `egress` when it has no rules, because an empty list such as `ingress: []` can count as rules present.

> | Ingress Rules Present | Egress Rules Present | `Types` value |
> | --------------------- | -------------------- | ----------------- |
Expand Down
Loading
Loading