Repository navigation
DOCS-3085: Fix inaccuracies on the GlobalNetworkPolicy reference - #3115
Merged
ctauchen merged 7 commits intoOct 19, 2026
Merged
Conversation
✅ Deploy Preview for calico-docs-preview-next ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview succeeded!Built without sensitive environment variables
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
No unresolved review issues were identified.
0 open findings
What changed in this PR
Updates GlobalNetworkPolicy documentation to match validated behavior across current and Calico 3.31–3.33 references.
Changes:
- Corrects naming, tier ordering, selector defaults, and endpoint enforcement details.
- Marks
actionas required in shared rule tables.
| File | Description |
|---|---|
calico/reference/resources/globalnetworkpolicy.mdx |
Updates the current GlobalNetworkPolicy reference. |
calico/_includes/content/_rule.mdx |
Marks rule actions as required. |
calico_versioned_docs/version-3.33/reference/resources/globalnetworkpolicy.mdx |
Updates the 3.33 reference. |
calico_versioned_docs/version-3.33/_includes/content/_rule.mdx |
Marks action as required. |
calico_versioned_docs/version-3.32/reference/resources/globalnetworkpolicy.mdx |
Updates the 3.32 reference. |
calico_versioned_docs/version-3.32/_includes/content/_rule.mdx |
Marks action as required. |
calico_versioned_docs/version-3.31/reference/resources/globalnetworkpolicy.mdx |
Updates 3.31 naming and tier documentation. |
🧠 Review effort: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
…obalNetworkPolicy reference
…obalNetworkPolicy reference
Every version says the name is lowercase alphanumeric with optional hyphens and at most one period.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes statements on the GlobalNetworkPolicy reference that a test cluster showed to be wrong.
Jira: https://tigera.atlassian.net/browse/DOCS-3085
_and uppercase. The validator rejects both and allows at most one..tierfield. It now liststier, andorderis said to apply within the policy's tier.namespaceSelectorandserviceAccountSelectorlistedall()as the default. An explicitall()excludes host endpoints, so it is not the same as omitting the field.doNotTrackorpreDNATpolicy is enforced after conntrack on workload endpoints. Such a policy is not applied to workload endpoints at all.actionas required. This also fixes the NetworkPolicy and staged policy pages.defaulttier must be named<tier>.<name>.Changes next, 3.33 and 3.32, reproduced on v3.33.0 and v3.32.2, and 3.31, reproduced on v3.31.7.
., because calicoctl rejects more. With native v3 CRDs, kubectl accepts names with more dots.typesfootnote says to leave out an emptyingressoregresslist. With native v3 CRDs, kubectl countsingress: []as rules present, which can deny all ingress.Next and 3.33 were verified in both API server mode and native v3 CRD mode.
Not changed:
doNotTrackandactionfixes were not verified on a 3.31 cluster, so they are left out of that tree. The 3.31 Rule table fix is in DOCS-3095: Fix inaccuracies on the StagedGlobalNetworkPolicy reference #3118 instead.defaulttier must start withdefault.. The page does not say so. Worth a follow-up.Preview: