diff --git a/calico/_includes/content/_rule.mdx b/calico/_includes/content/_rule.mdx index 54a04d392e..6f9aca1311 100644 --- a/calico/_includes/content/_rule.mdx +++ b/calico/_includes/content/_rule.mdx @@ -4,7 +4,7 @@ are executed in order. | Field | Description | Accepted Values | Schema | Default | | ----------- | ------------------------------------------------------------------------------------------ | ------------------------------------------------------------ | ----------------------------- | ------- | | metadata | Per-rule metadata. | | [RuleMetadata](#rulemetadata) | | -| action | Action to perform when matching this rule. | `Allow`, `Deny`, `Log`, `Pass` | string | | +| action | Action to perform when matching this rule. Required. | `Allow`, `Deny`, `Log`, `Pass` | string | | | protocol | Positive protocol match. | `TCP`, `UDP`, `ICMP`, `ICMPv6`, `SCTP`, `UDPLite`, `1`-`255` | string \| integer | | | notProtocol | Negative protocol match. | `TCP`, `UDP`, `ICMP`, `ICMPv6`, `SCTP`, `UDPLite`, `1`-`255` | string \| integer | | | icmp | ICMP match criteria. | | [ICMP](#icmp) | | diff --git a/calico/reference/resources/globalnetworkpolicy.mdx b/calico/reference/resources/globalnetworkpolicy.mdx index 260ffb1c5e..5f6386fc67 100644 --- a/calico/reference/resources/globalnetworkpolicy.mdx +++ b/calico/reference/resources/globalnetworkpolicy.mdx @@ -71,16 +71,17 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ----- | ----------------------------------------- | --------------------------------------------------- | ------ | ------- | -| name | The name of the network policy. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | | +| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and at most one `.`. | string | | ### Spec | Field | Description | Accepted Values | Schema | Default | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | ---------------------- | --------------------------------------------- | -| order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | +| order | Controls the order of precedence within the policy's tier. $[prodname] applies the policy with the lowest value first. | | float | | +| tier | Name of the tier this policy belongs to. The tier must exist before you create the policy. | | string | `default` | | selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() | -| serviceAccountSelector | Selects the service account(s) to which this policy applies. Select all service accounts in the cluster with a specific name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() | -| namespaceSelector | Selects the namespace(s) to which this policy applies. Select a specific namespace by name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() | +| serviceAccountSelector | Selects the service account(s) to which this policy applies. Select all service accounts in the cluster with a specific name using the `projectcalico.org/name` label. | | [selector](#selectors) | | +| namespaceSelector | Selects the namespace(s) to which this policy applies. Select a specific namespace by name using the `projectcalico.org/name` label. | | [selector](#selectors) | | | types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | | ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | | | egress | Ordered list of egress rules applied by this policy. | | List of [Rule](#rule) | | @@ -89,7 +90,7 @@ spec: | applyOnForward\*\* | Indicates to apply the rules in this policy on forwarded traffic as well as to locally terminated traffic. | true, false | boolean | false | | performanceHints | Contains a list of hints to Calico's policy engine to help process the policy more efficiently. Hints never change the enforcement behaviour of the policy. The available hints are described [below](#performance-hints). | `AssumeNeededOnEveryNode` | List of strings | | -\* If `types` has no value, $[prodname] defaults as follows. +\* If `types` has no value, $[prodname] defaults as follows. Leave out `ingress` or `egress` when it has no rules, because an empty list such as `ingress: []` can count as rules present. > | Ingress Rules Present | Egress Rules Present | `Types` value | > | --------------------- | -------------------- | ----------------- | @@ -101,9 +102,8 @@ spec: \*\* The `doNotTrack` and `preDNAT` and `applyOnForward` fields are meaningful only when applying policy to a [host endpoint](hostendpoint.mdx). -Only one of `doNotTrack` and `preDNAT` may be set to `true` (in a given policy). If they are both `false`, or when applying the policy to a -[workload endpoint](workloadendpoint.mdx), -the policy is enforced after connection tracking and any DNAT. +Only one of `doNotTrack` and `preDNAT` may be set to `true` (in a given policy). If they are both `false`, the policy is enforced after connection tracking and any DNAT. A policy with either of them set to `true` is not applied to +[workload endpoints](workloadendpoint.mdx). `applyOnForward` must be set to `true` if either `doNotTrack` or `preDNAT` is `true` because for a given policy, any untracked rules or rules before DNAT will diff --git a/calico_versioned_docs/version-3.31/reference/resources/globalnetworkpolicy.mdx b/calico_versioned_docs/version-3.31/reference/resources/globalnetworkpolicy.mdx index 9aeedbe893..919273482a 100644 --- a/calico_versioned_docs/version-3.31/reference/resources/globalnetworkpolicy.mdx +++ b/calico_versioned_docs/version-3.31/reference/resources/globalnetworkpolicy.mdx @@ -71,16 +71,17 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ----- | ----------------------------------------- | --------------------------------------------------- | ------ | ------- | -| name | The name of the network policy. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | | +| name | The name of the network policy. Required. A policy in a tier other than `default` must be named `.`. | Lowercase alphanumeric string with optional `-` and at most one `.`. | string | | ### Spec | Field | Description | Accepted Values | Schema | Default | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | ---------------------- | --------------------------------------------- | -| order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | +| order | Controls the order of precedence within the policy's tier. $[prodname] applies the policy with the lowest value first. | | float | | +| tier | Name of the tier this policy belongs to. The tier must exist before you create the policy. | | string | `default` | | selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() | -| serviceAccountSelector | Selects the service account(s) to which this policy applies. Select all service accounts in the cluster with a specific name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() | -| namespaceSelector | Selects the namespace(s) to which this policy applies. Select a specific namespace by name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() | +| serviceAccountSelector | Selects the service account(s) to which this policy applies. Select all service accounts in the cluster with a specific name using the `projectcalico.org/name` label. | | [selector](#selectors) | | +| namespaceSelector | Selects the namespace(s) to which this policy applies. Select a specific namespace by name using the `projectcalico.org/name` label. | | [selector](#selectors) | | | types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | | ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | | | egress | Ordered list of egress rules applied by this policy. | | List of [Rule](#rule) | | diff --git a/calico_versioned_docs/version-3.32/_includes/content/_rule.mdx b/calico_versioned_docs/version-3.32/_includes/content/_rule.mdx index 6ed49affa9..cbcf7ba2d4 100644 --- a/calico_versioned_docs/version-3.32/_includes/content/_rule.mdx +++ b/calico_versioned_docs/version-3.32/_includes/content/_rule.mdx @@ -4,7 +4,7 @@ are executed in order. | Field | Description | Accepted Values | Schema | Default | | ----------- | ------------------------------------------------------------------------------------------ | ------------------------------------------------------------ | ----------------------------- | ------- | | metadata | Per-rule metadata. | | [RuleMetadata](#rulemetadata) | | -| action | Action to perform when matching this rule. | `Allow`, `Deny`, `Log`, `Pass` | string | | +| action | Action to perform when matching this rule. Required. | `Allow`, `Deny`, `Log`, `Pass` | string | | | protocol | Positive protocol match. | `TCP`, `UDP`, `ICMP`, `ICMPv6`, `SCTP`, `UDPLite`, `1`-`255` | string \| integer | | | notProtocol | Negative protocol match. | `TCP`, `UDP`, `ICMP`, `ICMPv6`, `SCTP`, `UDPLite`, `1`-`255` | string \| integer | | | icmp | ICMP match criteria. | | [ICMP](#icmp) | | diff --git a/calico_versioned_docs/version-3.32/reference/resources/globalnetworkpolicy.mdx b/calico_versioned_docs/version-3.32/reference/resources/globalnetworkpolicy.mdx index fdd3d40ec7..f199dab529 100644 --- a/calico_versioned_docs/version-3.32/reference/resources/globalnetworkpolicy.mdx +++ b/calico_versioned_docs/version-3.32/reference/resources/globalnetworkpolicy.mdx @@ -71,16 +71,17 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ----- | ----------------------------------------- | --------------------------------------------------- | ------ | ------- | -| name | The name of the network policy. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | | +| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and at most one `.`. | string | | ### Spec | Field | Description | Accepted Values | Schema | Default | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | ---------------------- | --------------------------------------------- | -| order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | +| order | Controls the order of precedence within the policy's tier. $[prodname] applies the policy with the lowest value first. | | float | | +| tier | Name of the tier this policy belongs to. The tier must exist before you create the policy. | | string | `default` | | selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() | -| serviceAccountSelector | Selects the service account(s) to which this policy applies. Select all service accounts in the cluster with a specific name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() | -| namespaceSelector | Selects the namespace(s) to which this policy applies. Select a specific namespace by name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() | +| serviceAccountSelector | Selects the service account(s) to which this policy applies. Select all service accounts in the cluster with a specific name using the `projectcalico.org/name` label. | | [selector](#selectors) | | +| namespaceSelector | Selects the namespace(s) to which this policy applies. Select a specific namespace by name using the `projectcalico.org/name` label. | | [selector](#selectors) | | | types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | | ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | | | egress | Ordered list of egress rules applied by this policy. | | List of [Rule](#rule) | | @@ -101,9 +102,8 @@ spec: \*\* The `doNotTrack` and `preDNAT` and `applyOnForward` fields are meaningful only when applying policy to a [host endpoint](hostendpoint.mdx). -Only one of `doNotTrack` and `preDNAT` may be set to `true` (in a given policy). If they are both `false`, or when applying the policy to a -[workload endpoint](workloadendpoint.mdx), -the policy is enforced after connection tracking and any DNAT. +Only one of `doNotTrack` and `preDNAT` may be set to `true` (in a given policy). If they are both `false`, the policy is enforced after connection tracking and any DNAT. A policy with either of them set to `true` is not applied to +[workload endpoints](workloadendpoint.mdx). `applyOnForward` must be set to `true` if either `doNotTrack` or `preDNAT` is `true` because for a given policy, any untracked rules or rules before DNAT will diff --git a/calico_versioned_docs/version-3.33/_includes/content/_rule.mdx b/calico_versioned_docs/version-3.33/_includes/content/_rule.mdx index 54a04d392e..6f9aca1311 100644 --- a/calico_versioned_docs/version-3.33/_includes/content/_rule.mdx +++ b/calico_versioned_docs/version-3.33/_includes/content/_rule.mdx @@ -4,7 +4,7 @@ are executed in order. | Field | Description | Accepted Values | Schema | Default | | ----------- | ------------------------------------------------------------------------------------------ | ------------------------------------------------------------ | ----------------------------- | ------- | | metadata | Per-rule metadata. | | [RuleMetadata](#rulemetadata) | | -| action | Action to perform when matching this rule. | `Allow`, `Deny`, `Log`, `Pass` | string | | +| action | Action to perform when matching this rule. Required. | `Allow`, `Deny`, `Log`, `Pass` | string | | | protocol | Positive protocol match. | `TCP`, `UDP`, `ICMP`, `ICMPv6`, `SCTP`, `UDPLite`, `1`-`255` | string \| integer | | | notProtocol | Negative protocol match. | `TCP`, `UDP`, `ICMP`, `ICMPv6`, `SCTP`, `UDPLite`, `1`-`255` | string \| integer | | | icmp | ICMP match criteria. | | [ICMP](#icmp) | | diff --git a/calico_versioned_docs/version-3.33/reference/resources/globalnetworkpolicy.mdx b/calico_versioned_docs/version-3.33/reference/resources/globalnetworkpolicy.mdx index 1813eae42b..e60567e65c 100644 --- a/calico_versioned_docs/version-3.33/reference/resources/globalnetworkpolicy.mdx +++ b/calico_versioned_docs/version-3.33/reference/resources/globalnetworkpolicy.mdx @@ -71,16 +71,17 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ----- | ----------------------------------------- | --------------------------------------------------- | ------ | ------- | -| name | The name of the network policy. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | | +| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and at most one `.`. | string | | ### Spec | Field | Description | Accepted Values | Schema | Default | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | ---------------------- | --------------------------------------------- | -| order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | +| order | Controls the order of precedence within the policy's tier. $[prodname] applies the policy with the lowest value first. | | float | | +| tier | Name of the tier this policy belongs to. The tier must exist before you create the policy. | | string | `default` | | selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() | -| serviceAccountSelector | Selects the service account(s) to which this policy applies. Select all service accounts in the cluster with a specific name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() | -| namespaceSelector | Selects the namespace(s) to which this policy applies. Select a specific namespace by name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() | +| serviceAccountSelector | Selects the service account(s) to which this policy applies. Select all service accounts in the cluster with a specific name using the `projectcalico.org/name` label. | | [selector](#selectors) | | +| namespaceSelector | Selects the namespace(s) to which this policy applies. Select a specific namespace by name using the `projectcalico.org/name` label. | | [selector](#selectors) | | | types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | | ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | | | egress | Ordered list of egress rules applied by this policy. | | List of [Rule](#rule) | | @@ -89,7 +90,7 @@ spec: | applyOnForward\*\* | Indicates to apply the rules in this policy on forwarded traffic as well as to locally terminated traffic. | true, false | boolean | false | | performanceHints | Contains a list of hints to Calico's policy engine to help process the policy more efficiently. Hints never change the enforcement behaviour of the policy. The available hints are described [below](#performance-hints). | `AssumeNeededOnEveryNode` | List of strings | | -\* If `types` has no value, $[prodname] defaults as follows. +\* If `types` has no value, $[prodname] defaults as follows. Leave out `ingress` or `egress` when it has no rules, because an empty list such as `ingress: []` can count as rules present. > | Ingress Rules Present | Egress Rules Present | `Types` value | > | --------------------- | -------------------- | ----------------- | @@ -101,9 +102,8 @@ spec: \*\* The `doNotTrack` and `preDNAT` and `applyOnForward` fields are meaningful only when applying policy to a [host endpoint](hostendpoint.mdx). -Only one of `doNotTrack` and `preDNAT` may be set to `true` (in a given policy). If they are both `false`, or when applying the policy to a -[workload endpoint](workloadendpoint.mdx), -the policy is enforced after connection tracking and any DNAT. +Only one of `doNotTrack` and `preDNAT` may be set to `true` (in a given policy). If they are both `false`, the policy is enforced after connection tracking and any DNAT. A policy with either of them set to `true` is not applied to +[workload endpoints](workloadendpoint.mdx). `applyOnForward` must be set to `true` if either `doNotTrack` or `preDNAT` is `true` because for a given policy, any untracked rules or rules before DNAT will