Skip to content

DOCS-3085: Fix inaccuracies on the GlobalNetworkPolicy reference #3115

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ctauchen merged 7 commits into from
Oct 19, 2026
Merged

DOCS-3085: Fix inaccuracies on the GlobalNetworkPolicy reference #3115

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
576664c
Fix inaccuracies on the GlobalNetworkPolicy reference for next
ctauchen Oct 16, 2026
5b45c17
Fix inaccuracies on the GlobalNetworkPolicy reference for 3.33
ctauchen Oct 16, 2026
80be928
Fix inaccuracies on the GlobalNetworkPolicy reference for 3.32
ctauchen Oct 16, 2026
1d74a3e
Fix inaccuracies on the GlobalNetworkPolicy reference for 3.31
ctauchen Oct 16, 2026
c09ffdc
Fix the name rule and types default for native v3 CRDs in the next Gl…
ctauchen Oct 19, 2026
f14ba85
Fix the name rule and types default for native v3 CRDs in the 3.33 Gl…
ctauchen Oct 19, 2026
f67d823
Use one wording for the policy name rule
ctauchen Oct 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion calico/_includes/content/_rule.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ are executed in order.
| Field | Description | Accepted Values | Schema | Default |
| ----------- | ------------------------------------------------------------------------------------------ | ------------------------------------------------------------ | ----------------------------- | ------- |
| metadata | Per-rule metadata. | | [RuleMetadata](#rulemetadata) | |
| action | Action to perform when matching this rule. | `Allow`, `Deny`, `Log`, `Pass` | string | |
| action | Action to perform when matching this rule. Required. | `Allow`, `Deny`, `Log`, `Pass` | string | |
| protocol | Positive protocol match. | `TCP`, `UDP`, `ICMP`, `ICMPv6`, `SCTP`, `UDPLite`, `1`-`255` | string \| integer | |
| notProtocol | Negative protocol match. | `TCP`, `UDP`, `ICMP`, `ICMPv6`, `SCTP`, `UDPLite`, `1`-`255` | string \| integer | |
| icmp | ICMP match criteria. | | [ICMP](#icmp) | |
Expand Down
16 changes: 8 additions & 8 deletions calico/reference/resources/globalnetworkpolicy.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,16 +71,17 @@ spec:

| Field | Description | Accepted Values | Schema | Default |
| ----- | ----------------------------------------- | --------------------------------------------------- | ------ | ------- |
| name | The name of the network policy. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | |
| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and at most one `.`. | string | |

### Spec

| Field | Description | Accepted Values | Schema | Default |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | ---------------------- | --------------------------------------------- |
| order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | |
| order | Controls the order of precedence within the policy's tier. $[prodname] applies the policy with the lowest value first. | | float | |
| tier | Name of the tier this policy belongs to. The tier must exist before you create the policy. | | string | `default` |
| selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() |
| serviceAccountSelector | Selects the service account(s) to which this policy applies. Select all service accounts in the cluster with a specific name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() |
| namespaceSelector | Selects the namespace(s) to which this policy applies. Select a specific namespace by name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() |
| serviceAccountSelector | Selects the service account(s) to which this policy applies. Select all service accounts in the cluster with a specific name using the `projectcalico.org/name` label. | | [selector](#selectors) | |
| namespaceSelector | Selects the namespace(s) to which this policy applies. Select a specific namespace by name using the `projectcalico.org/name` label. | | [selector](#selectors) | |
| types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* |
| ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | |
| egress | Ordered list of egress rules applied by this policy. | | List of [Rule](#rule) | |
Expand All @@ -89,7 +90,7 @@ spec:
| applyOnForward\*\* | Indicates to apply the rules in this policy on forwarded traffic as well as to locally terminated traffic. | true, false | boolean | false |
| performanceHints | Contains a list of hints to Calico's policy engine to help process the policy more efficiently. Hints never change the enforcement behaviour of the policy. The available hints are described [below](#performance-hints). | `AssumeNeededOnEveryNode` | List of strings | |

\* If `types` has no value, $[prodname] defaults as follows.
\* If `types` has no value, $[prodname] defaults as follows. Leave out `ingress` or `egress` when it has no rules, because an empty list such as `ingress: []` can count as rules present.

> | Ingress Rules Present | Egress Rules Present | `Types` value |
> | --------------------- | -------------------- | ----------------- |
Expand All @@ -101,9 +102,8 @@ spec:
\*\* The `doNotTrack` and `preDNAT` and `applyOnForward` fields are meaningful
only when applying policy to a [host endpoint](hostendpoint.mdx).

Only one of `doNotTrack` and `preDNAT` may be set to `true` (in a given policy). If they are both `false`, or when applying the policy to a
[workload endpoint](workloadendpoint.mdx),
the policy is enforced after connection tracking and any DNAT.
Only one of `doNotTrack` and `preDNAT` may be set to `true` (in a given policy). If they are both `false`, the policy is enforced after connection tracking and any DNAT. A policy with either of them set to `true` is not applied to
[workload endpoints](workloadendpoint.mdx).

`applyOnForward` must be set to `true` if either `doNotTrack` or `preDNAT` is
`true` because for a given policy, any untracked rules or rules before DNAT will
Expand Down
9 changes: 5 additions & 4 deletions calico_versioned_docs/version-3.31/reference/resources/globalnetworkpolicy.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,16 +71,17 @@ spec:

| Field | Description | Accepted Values | Schema | Default |
| ----- | ----------------------------------------- | --------------------------------------------------- | ------ | ------- |
| name | The name of the network policy. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | |
| name | The name of the network policy. Required. A policy in a tier other than `default` must be named `<tier>.<name>`. | Lowercase alphanumeric string with optional `-` and at most one `.`. | string | |

### Spec

| Field | Description | Accepted Values | Schema | Default |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | ---------------------- | --------------------------------------------- |
| order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | |
| order | Controls the order of precedence within the policy's tier. $[prodname] applies the policy with the lowest value first. | | float | |
| tier | Name of the tier this policy belongs to. The tier must exist before you create the policy. | | string | `default` |
| selector | Selects the endpoints to which this policy applies. | | [selector](#selectors) | all() |
| serviceAccountSelector | Selects the service account(s) to which this policy applies. Select all service accounts in the cluster with a specific name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() |
| namespaceSelector | Selects the namespace(s) to which this policy applies. Select a specific namespace by name using the `projectcalico.org/name` label. | | [selector](#selectors) | all() |
| serviceAccountSelector | Selects the service account(s) to which this policy applies. Select all service accounts in the cluster with a specific name using the `projectcalico.org/name` label. | | [selector](#selectors) | |
| namespaceSelector | Selects the namespace(s) to which this policy applies. Select a specific namespace by name using the `projectcalico.org/name` label. | | [selector](#selectors) | |
| types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* |
| ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | |
| egress | Ordered list of egress rules applied by this policy. | | List of [Rule](#rule) | |
Expand Down
2 changes: 1 addition & 1 deletion calico_versioned_docs/version-3.32/_includes/content/_rule.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ are executed in order.
| Field | Description | Accepted Values | Schema | Default |
| ----------- | ------------------------------------------------------------------------------------------ | ------------------------------------------------------------ | ----------------------------- | ------- |
| metadata | Per-rule metadata. | | [RuleMetadata](#rulemetadata) | |
| action | Action to perform when matching this rule. | `Allow`, `Deny`, `Log`, `Pass` | string | |
| action | Action to perform when matching this rule. Required. | `Allow`, `Deny`, `Log`, `Pass` | string | |
| protocol | Positive protocol match. | `TCP`, `UDP`, `ICMP`, `ICMPv6`, `SCTP`, `UDPLite`, `1`-`255` | string \| integer | |
| notProtocol | Negative protocol match. | `TCP`, `UDP`, `ICMP`, `ICMPv6`, `SCTP`, `UDPLite`, `1`-`255` | string \| integer | |
| icmp | ICMP match criteria. | | [ICMP](#icmp) | |
Expand Down
Loading
Loading