From 576664c4deca2c6f5cabbe7b116023e93ba39495 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Fri, 16 Oct 2026 08:22:52 +0100 Subject: [PATCH 1/7] Fix inaccuracies on the GlobalNetworkPolicy reference for next --- calico/_includes/content/_rule.mdx | 2 +- calico/reference/resources/globalnetworkpolicy.mdx | 14 +++++++------- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/calico/_includes/content/_rule.mdx b/calico/_includes/content/_rule.mdx index 54a04d392e..6f9aca1311 100644 --- a/calico/_includes/content/_rule.mdx +++ b/calico/_includes/content/_rule.mdx @@ -4,7 +4,7 @@ are executed in order. | Field | Description | Accepted Values | Schema | Default | | ----------- | ------------------------------------------------------------------------------------------ | ------------------------------------------------------------ | ----------------------------- | ------- | | metadata | Per-rule metadata. | | [RuleMetadata](#rulemetadata) | | -| action | Action to perform when matching this rule. | `Allow`, `Deny`, `Log`, `Pass` | string | | +| action | Action to perform when matching this rule. Required. | `Allow`, `Deny`, `Log`, `Pass` | string | | | protocol | Positive protocol match. | `TCP`, `UDP`, `ICMP`, `ICMPv6`, `SCTP`, `UDPLite`, `1`-`255` | string \| integer | | | notProtocol | Negative protocol match. | `TCP`, `UDP`, `ICMP`, `ICMPv6`, `SCTP`, `UDPLite`, `1`-`255` | string \| integer | | | icmp | ICMP match criteria. | | [ICMP](#icmp) | | diff --git a/calico/reference/resources/globalnetworkpolicy.mdx b/calico/reference/resources/globalnetworkpolicy.mdx index 260ffb1c5e..eeda2f4b82 100644 --- a/calico/reference/resources/globalnetworkpolicy.mdx +++ b/calico/reference/resources/globalnetworkpolicy.mdx @@ -71,16 +71,17 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ----- | ----------------------------------------- | --------------------------------------------------- | ------ | ------- | -| name | The name of the network policy. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | | +| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and at most one `.`. | string | | ### Spec | Field | Description | Accepted Values | Schema | Default | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | ---------------------- | --------------------------------------------- | -| order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | +| order | Controls the order of precedence within the policy's tier. $[prodname] applies the policy with the lowest value first. | | float | | +| tier | Name of the tier this policy belongs to. The tier must exist before you create the policy. | | string | `default` | | selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() | -| serviceAccountSelector | Selects the service account(s) to which this policy applies. Select all service accounts in the cluster with a specific name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() | -| namespaceSelector | Selects the namespace(s) to which this policy applies. Select a specific namespace by name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() | +| serviceAccountSelector | Selects the service account(s) to which this policy applies. Select all service accounts in the cluster with a specific name using the `projectcalico.org/name` label. | | [selector](#selectors) | | +| namespaceSelector | Selects the namespace(s) to which this policy applies. Select a specific namespace by name using the `projectcalico.org/name` label. | | [selector](#selectors) | | | types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | | ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | | | egress | Ordered list of egress rules applied by this policy. | | List of [Rule](#rule) | | @@ -101,9 +102,8 @@ spec: \*\* The `doNotTrack` and `preDNAT` and `applyOnForward` fields are meaningful only when applying policy to a [host endpoint](hostendpoint.mdx). -Only one of `doNotTrack` and `preDNAT` may be set to `true` (in a given policy). If they are both `false`, or when applying the policy to a -[workload endpoint](workloadendpoint.mdx), -the policy is enforced after connection tracking and any DNAT. +Only one of `doNotTrack` and `preDNAT` may be set to `true` (in a given policy). If they are both `false`, the policy is enforced after connection tracking and any DNAT. A policy with either of them set to `true` is not applied to +[workload endpoints](workloadendpoint.mdx). `applyOnForward` must be set to `true` if either `doNotTrack` or `preDNAT` is `true` because for a given policy, any untracked rules or rules before DNAT will From 5b45c17910f9fb9ceba2d5162de60bb580f0a849 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Fri, 16 Oct 2026 08:22:52 +0100 Subject: [PATCH 2/7] Fix inaccuracies on the GlobalNetworkPolicy reference for 3.33 --- .../version-3.33/_includes/content/_rule.mdx | 2 +- .../reference/resources/globalnetworkpolicy.mdx | 14 +++++++------- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/calico_versioned_docs/version-3.33/_includes/content/_rule.mdx b/calico_versioned_docs/version-3.33/_includes/content/_rule.mdx index 54a04d392e..6f9aca1311 100644 --- a/calico_versioned_docs/version-3.33/_includes/content/_rule.mdx +++ b/calico_versioned_docs/version-3.33/_includes/content/_rule.mdx @@ -4,7 +4,7 @@ are executed in order. | Field | Description | Accepted Values | Schema | Default | | ----------- | ------------------------------------------------------------------------------------------ | ------------------------------------------------------------ | ----------------------------- | ------- | | metadata | Per-rule metadata. | | [RuleMetadata](#rulemetadata) | | -| action | Action to perform when matching this rule. | `Allow`, `Deny`, `Log`, `Pass` | string | | +| action | Action to perform when matching this rule. Required. | `Allow`, `Deny`, `Log`, `Pass` | string | | | protocol | Positive protocol match. | `TCP`, `UDP`, `ICMP`, `ICMPv6`, `SCTP`, `UDPLite`, `1`-`255` | string \| integer | | | notProtocol | Negative protocol match. | `TCP`, `UDP`, `ICMP`, `ICMPv6`, `SCTP`, `UDPLite`, `1`-`255` | string \| integer | | | icmp | ICMP match criteria. | | [ICMP](#icmp) | | diff --git a/calico_versioned_docs/version-3.33/reference/resources/globalnetworkpolicy.mdx b/calico_versioned_docs/version-3.33/reference/resources/globalnetworkpolicy.mdx index 1813eae42b..3fc06720e4 100644 --- a/calico_versioned_docs/version-3.33/reference/resources/globalnetworkpolicy.mdx +++ b/calico_versioned_docs/version-3.33/reference/resources/globalnetworkpolicy.mdx @@ -71,16 +71,17 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ----- | ----------------------------------------- | --------------------------------------------------- | ------ | ------- | -| name | The name of the network policy. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | | +| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and at most one `.`. | string | | ### Spec | Field | Description | Accepted Values | Schema | Default | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | ---------------------- | --------------------------------------------- | -| order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | +| order | Controls the order of precedence within the policy's tier. $[prodname] applies the policy with the lowest value first. | | float | | +| tier | Name of the tier this policy belongs to. The tier must exist before you create the policy. | | string | `default` | | selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() | -| serviceAccountSelector | Selects the service account(s) to which this policy applies. Select all service accounts in the cluster with a specific name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() | -| namespaceSelector | Selects the namespace(s) to which this policy applies. Select a specific namespace by name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() | +| serviceAccountSelector | Selects the service account(s) to which this policy applies. Select all service accounts in the cluster with a specific name using the `projectcalico.org/name` label. | | [selector](#selectors) | | +| namespaceSelector | Selects the namespace(s) to which this policy applies. Select a specific namespace by name using the `projectcalico.org/name` label. | | [selector](#selectors) | | | types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | | ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | | | egress | Ordered list of egress rules applied by this policy. | | List of [Rule](#rule) | | @@ -101,9 +102,8 @@ spec: \*\* The `doNotTrack` and `preDNAT` and `applyOnForward` fields are meaningful only when applying policy to a [host endpoint](hostendpoint.mdx). -Only one of `doNotTrack` and `preDNAT` may be set to `true` (in a given policy). If they are both `false`, or when applying the policy to a -[workload endpoint](workloadendpoint.mdx), -the policy is enforced after connection tracking and any DNAT. +Only one of `doNotTrack` and `preDNAT` may be set to `true` (in a given policy). If they are both `false`, the policy is enforced after connection tracking and any DNAT. A policy with either of them set to `true` is not applied to +[workload endpoints](workloadendpoint.mdx). `applyOnForward` must be set to `true` if either `doNotTrack` or `preDNAT` is `true` because for a given policy, any untracked rules or rules before DNAT will From 80be9281ef2d228e0b5f7fc7b91024fee6c57024 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Fri, 16 Oct 2026 08:22:53 +0100 Subject: [PATCH 3/7] Fix inaccuracies on the GlobalNetworkPolicy reference for 3.32 --- .../version-3.32/_includes/content/_rule.mdx | 2 +- .../reference/resources/globalnetworkpolicy.mdx | 14 +++++++------- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/calico_versioned_docs/version-3.32/_includes/content/_rule.mdx b/calico_versioned_docs/version-3.32/_includes/content/_rule.mdx index 6ed49affa9..cbcf7ba2d4 100644 --- a/calico_versioned_docs/version-3.32/_includes/content/_rule.mdx +++ b/calico_versioned_docs/version-3.32/_includes/content/_rule.mdx @@ -4,7 +4,7 @@ are executed in order. | Field | Description | Accepted Values | Schema | Default | | ----------- | ------------------------------------------------------------------------------------------ | ------------------------------------------------------------ | ----------------------------- | ------- | | metadata | Per-rule metadata. | | [RuleMetadata](#rulemetadata) | | -| action | Action to perform when matching this rule. | `Allow`, `Deny`, `Log`, `Pass` | string | | +| action | Action to perform when matching this rule. Required. | `Allow`, `Deny`, `Log`, `Pass` | string | | | protocol | Positive protocol match. | `TCP`, `UDP`, `ICMP`, `ICMPv6`, `SCTP`, `UDPLite`, `1`-`255` | string \| integer | | | notProtocol | Negative protocol match. | `TCP`, `UDP`, `ICMP`, `ICMPv6`, `SCTP`, `UDPLite`, `1`-`255` | string \| integer | | | icmp | ICMP match criteria. | | [ICMP](#icmp) | | diff --git a/calico_versioned_docs/version-3.32/reference/resources/globalnetworkpolicy.mdx b/calico_versioned_docs/version-3.32/reference/resources/globalnetworkpolicy.mdx index fdd3d40ec7..f199dab529 100644 --- a/calico_versioned_docs/version-3.32/reference/resources/globalnetworkpolicy.mdx +++ b/calico_versioned_docs/version-3.32/reference/resources/globalnetworkpolicy.mdx @@ -71,16 +71,17 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ----- | ----------------------------------------- | --------------------------------------------------- | ------ | ------- | -| name | The name of the network policy. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | | +| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and at most one `.`. | string | | ### Spec | Field | Description | Accepted Values | Schema | Default | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | ---------------------- | --------------------------------------------- | -| order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | +| order | Controls the order of precedence within the policy's tier. $[prodname] applies the policy with the lowest value first. | | float | | +| tier | Name of the tier this policy belongs to. The tier must exist before you create the policy. | | string | `default` | | selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() | -| serviceAccountSelector | Selects the service account(s) to which this policy applies. Select all service accounts in the cluster with a specific name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() | -| namespaceSelector | Selects the namespace(s) to which this policy applies. Select a specific namespace by name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() | +| serviceAccountSelector | Selects the service account(s) to which this policy applies. Select all service accounts in the cluster with a specific name using the `projectcalico.org/name` label. | | [selector](#selectors) | | +| namespaceSelector | Selects the namespace(s) to which this policy applies. Select a specific namespace by name using the `projectcalico.org/name` label. | | [selector](#selectors) | | | types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | | ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | | | egress | Ordered list of egress rules applied by this policy. | | List of [Rule](#rule) | | @@ -101,9 +102,8 @@ spec: \*\* The `doNotTrack` and `preDNAT` and `applyOnForward` fields are meaningful only when applying policy to a [host endpoint](hostendpoint.mdx). -Only one of `doNotTrack` and `preDNAT` may be set to `true` (in a given policy). If they are both `false`, or when applying the policy to a -[workload endpoint](workloadendpoint.mdx), -the policy is enforced after connection tracking and any DNAT. +Only one of `doNotTrack` and `preDNAT` may be set to `true` (in a given policy). If they are both `false`, the policy is enforced after connection tracking and any DNAT. A policy with either of them set to `true` is not applied to +[workload endpoints](workloadendpoint.mdx). `applyOnForward` must be set to `true` if either `doNotTrack` or `preDNAT` is `true` because for a given policy, any untracked rules or rules before DNAT will From 1d74a3e7cd037eaa89ecaa9037c51eaf00a618d3 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Fri, 16 Oct 2026 08:22:53 +0100 Subject: [PATCH 4/7] Fix inaccuracies on the GlobalNetworkPolicy reference for 3.31 --- .../reference/resources/globalnetworkpolicy.mdx | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/calico_versioned_docs/version-3.31/reference/resources/globalnetworkpolicy.mdx b/calico_versioned_docs/version-3.31/reference/resources/globalnetworkpolicy.mdx index 9aeedbe893..919273482a 100644 --- a/calico_versioned_docs/version-3.31/reference/resources/globalnetworkpolicy.mdx +++ b/calico_versioned_docs/version-3.31/reference/resources/globalnetworkpolicy.mdx @@ -71,16 +71,17 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ----- | ----------------------------------------- | --------------------------------------------------- | ------ | ------- | -| name | The name of the network policy. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | | +| name | The name of the network policy. Required. A policy in a tier other than `default` must be named `.`. | Lowercase alphanumeric string with optional `-` and at most one `.`. | string | | ### Spec | Field | Description | Accepted Values | Schema | Default | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | ---------------------- | --------------------------------------------- | -| order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | +| order | Controls the order of precedence within the policy's tier. $[prodname] applies the policy with the lowest value first. | | float | | +| tier | Name of the tier this policy belongs to. The tier must exist before you create the policy. | | string | `default` | | selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() | -| serviceAccountSelector | Selects the service account(s) to which this policy applies. Select all service accounts in the cluster with a specific name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() | -| namespaceSelector | Selects the namespace(s) to which this policy applies. Select a specific namespace by name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() | +| serviceAccountSelector | Selects the service account(s) to which this policy applies. Select all service accounts in the cluster with a specific name using the `projectcalico.org/name` label. | | [selector](#selectors) | | +| namespaceSelector | Selects the namespace(s) to which this policy applies. Select a specific namespace by name using the `projectcalico.org/name` label. | | [selector](#selectors) | | | types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | | ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | | | egress | Ordered list of egress rules applied by this policy. | | List of [Rule](#rule) | | From c09ffdcf261c47639ad908a00fb5921110387a34 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Mon, 19 Oct 2026 13:59:18 +0100 Subject: [PATCH 5/7] Fix the name rule and types default for native v3 CRDs in the next GlobalNetworkPolicy reference --- calico/reference/resources/globalnetworkpolicy.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/calico/reference/resources/globalnetworkpolicy.mdx b/calico/reference/resources/globalnetworkpolicy.mdx index eeda2f4b82..6cdf777d9a 100644 --- a/calico/reference/resources/globalnetworkpolicy.mdx +++ b/calico/reference/resources/globalnetworkpolicy.mdx @@ -71,7 +71,7 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ----- | ----------------------------------------- | --------------------------------------------------- | ------ | ------- | -| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and at most one `.`. | string | | +| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-`. Use at most one `.`, because calicoctl rejects names with more. | string | | ### Spec @@ -90,7 +90,7 @@ spec: | applyOnForward\*\* | Indicates to apply the rules in this policy on forwarded traffic as well as to locally terminated traffic. | true, false | boolean | false | | performanceHints | Contains a list of hints to Calico's policy engine to help process the policy more efficiently. Hints never change the enforcement behaviour of the policy. The available hints are described [below](#performance-hints). | `AssumeNeededOnEveryNode` | List of strings | | -\* If `types` has no value, $[prodname] defaults as follows. +\* If `types` has no value, $[prodname] defaults as follows. Leave out `ingress` or `egress` when it has no rules, because an empty list such as `ingress: []` can count as rules present. > | Ingress Rules Present | Egress Rules Present | `Types` value | > | --------------------- | -------------------- | ----------------- | From f14ba85b2c9593aa142aaedb164bbff0fb16dfec Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Mon, 19 Oct 2026 13:59:19 +0100 Subject: [PATCH 6/7] Fix the name rule and types default for native v3 CRDs in the 3.33 GlobalNetworkPolicy reference --- .../version-3.33/reference/resources/globalnetworkpolicy.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/calico_versioned_docs/version-3.33/reference/resources/globalnetworkpolicy.mdx b/calico_versioned_docs/version-3.33/reference/resources/globalnetworkpolicy.mdx index 3fc06720e4..12fb2ae75d 100644 --- a/calico_versioned_docs/version-3.33/reference/resources/globalnetworkpolicy.mdx +++ b/calico_versioned_docs/version-3.33/reference/resources/globalnetworkpolicy.mdx @@ -71,7 +71,7 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ----- | ----------------------------------------- | --------------------------------------------------- | ------ | ------- | -| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and at most one `.`. | string | | +| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-`. Use at most one `.`, because calicoctl rejects names with more. | string | | ### Spec @@ -90,7 +90,7 @@ spec: | applyOnForward\*\* | Indicates to apply the rules in this policy on forwarded traffic as well as to locally terminated traffic. | true, false | boolean | false | | performanceHints | Contains a list of hints to Calico's policy engine to help process the policy more efficiently. Hints never change the enforcement behaviour of the policy. The available hints are described [below](#performance-hints). | `AssumeNeededOnEveryNode` | List of strings | | -\* If `types` has no value, $[prodname] defaults as follows. +\* If `types` has no value, $[prodname] defaults as follows. Leave out `ingress` or `egress` when it has no rules, because an empty list such as `ingress: []` can count as rules present. > | Ingress Rules Present | Egress Rules Present | `Types` value | > | --------------------- | -------------------- | ----------------- | From f67d823be34e27800594fa89718acaded927e726 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Mon, 19 Oct 2026 17:06:30 +0100 Subject: [PATCH 7/7] Use one wording for the policy name rule Every version says the name is lowercase alphanumeric with optional hyphens and at most one period. --- calico/reference/resources/globalnetworkpolicy.mdx | 2 +- .../version-3.33/reference/resources/globalnetworkpolicy.mdx | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/calico/reference/resources/globalnetworkpolicy.mdx b/calico/reference/resources/globalnetworkpolicy.mdx index 6cdf777d9a..5f6386fc67 100644 --- a/calico/reference/resources/globalnetworkpolicy.mdx +++ b/calico/reference/resources/globalnetworkpolicy.mdx @@ -71,7 +71,7 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ----- | ----------------------------------------- | --------------------------------------------------- | ------ | ------- | -| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-`. Use at most one `.`, because calicoctl rejects names with more. | string | | +| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and at most one `.`. | string | | ### Spec diff --git a/calico_versioned_docs/version-3.33/reference/resources/globalnetworkpolicy.mdx b/calico_versioned_docs/version-3.33/reference/resources/globalnetworkpolicy.mdx index 12fb2ae75d..e60567e65c 100644 --- a/calico_versioned_docs/version-3.33/reference/resources/globalnetworkpolicy.mdx +++ b/calico_versioned_docs/version-3.33/reference/resources/globalnetworkpolicy.mdx @@ -71,7 +71,7 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ----- | ----------------------------------------- | --------------------------------------------------- | ------ | ------- | -| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-`. Use at most one `.`, because calicoctl rejects names with more. | string | | +| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and at most one `.`. | string | | ### Spec