diff --git a/calico/reference/resources/stagednetworkpolicy.mdx b/calico/reference/resources/stagednetworkpolicy.mdx
index d0f2e6d860..fc49c48218 100644
--- a/calico/reference/resources/stagednetworkpolicy.mdx
+++ b/calico/reference/resources/stagednetworkpolicy.mdx
@@ -18,6 +18,8 @@ import Icmp from '@site/calico/_includes/content/_icmp.mdx';
import Rule from '@site/calico/_includes/content/_rule.mdx';
+import Httpmatch from '@site/calico/_includes/content/_httpmatch.mdx';
+
A staged network policy resource (`StagedNetworkPolicy`) represents an ordered set of rules which are applied
to a collection of endpoints that match a [label selector](#selector). These rules are used to preview network behavior and do
not enforce network traffic. For enforcing network traffic, see [network policy resource](networkpolicy.mdx).
@@ -42,7 +44,7 @@ may be used to specify the resource type on the CLI:
## Sample YAML
This sample policy allows TCP traffic from `frontend` endpoints to port 6379 on
-`database` endpoints.
+`database` endpoints. The `internal-access` [tier](tier.mdx) must exist before you create the policy.
```yaml
apiVersion: projectcalico.org/v3
@@ -74,7 +76,7 @@ spec:
| Field | Description | Accepted Values | Schema | Default |
| --------- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | --------- |
-| name | The name of the network policy. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | |
+| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and at most one `.`. | string | |
| namespace | Namespace provides an additional qualification to a resource name. | | string | "default" |
### Spec
@@ -83,6 +85,7 @@ spec:
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | --------------------- | --------------------------------------------- |
| order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | |
| tier | Name of the [tier](tier.mdx) this policy belongs to. | | string | `default` |
+| stagedAction | The staged action. `Set` stages the policy as written. With `Delete`, leave every other spec field except `tier` empty. | `Set`, `Delete`, `Learn`, `Ignore` | string | `Set` |
| selector | Selects the endpoints to which this policy applies. | | [selector](#selector) | all() |
| types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* |
| ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | |
@@ -127,6 +130,10 @@ spec:
+### HTTPMatch
+
+
+
### Performance Hints
Performance hints provide a way to tell $[prodname] about the intended use of the policy so that it may
@@ -149,10 +156,11 @@ process it more efficiently. Currently only one hint is defined:
List and watch operations may specify label selectors or field selectors to filter `StagedNetworkPolicy` resources on tiers returned by the API server.
When no selector is specified, the API server returns all `StagedNetworkPolicy` resources from all tiers that the user has access to.
+When using native `projectcalico.org/v3` CRDs, tier RBAC is not enforced for list and watch: they require the `list` and `watch` verbs on `stagednetworkpolicies`, and return resources from all tiers.
##### Field selector
-When using the field selector, supported operators are `=` and `==`
+When using the field selector, supported operators include `=` and `==`
The following example shows how to retrieve all `StagedNetworkPolicy` resources in the default tier and in all namespaces:
@@ -162,7 +170,7 @@ kubectl get stagednetworkpolicy.p --field-selector spec.tier=default --all-names
##### Label selector
-When using the label selector, supported operators are `=`, `==` and `IN`.
+When using the label selector, supported operators include `=`, `==` and `in`.
The following example shows how to retrieve all `StagedNetworkPolicy` resources in the `default` and `net-sec` tiers and in all namespaces:
diff --git a/calico_versioned_docs/version-3.31/reference/resources/stagednetworkpolicy.mdx b/calico_versioned_docs/version-3.31/reference/resources/stagednetworkpolicy.mdx
index bda071a127..04891c08ab 100644
--- a/calico_versioned_docs/version-3.31/reference/resources/stagednetworkpolicy.mdx
+++ b/calico_versioned_docs/version-3.31/reference/resources/stagednetworkpolicy.mdx
@@ -18,6 +18,8 @@ import Icmp from '@site/calico_versioned_docs/version-3.31/_includes/content/_ic
import Rule from '@site/calico_versioned_docs/version-3.31/_includes/content/_rule.mdx';
+import Httpmatch from '@site/calico_versioned_docs/version-3.31/_includes/content/_httpmatch.mdx';
+
A staged network policy resource (`StagedNetworkPolicy`) represents an ordered set of rules which are applied
to a collection of endpoints that match a [label selector](#selector). These rules are used to preview network behavior and do
not enforce network traffic. For enforcing network traffic, see [network policy resource](networkpolicy.mdx).
@@ -42,7 +44,7 @@ may be used to specify the resource type on the CLI:
## Sample YAML
This sample policy allows TCP traffic from `frontend` endpoints to port 6379 on
-`database` endpoints.
+`database` endpoints. The `internal-access` [tier](tier.mdx) must exist before you create the policy.
```yaml
apiVersion: projectcalico.org/v3
@@ -74,7 +76,7 @@ spec:
| Field | Description | Accepted Values | Schema | Default |
| --------- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | --------- |
-| name | The name of the network policy. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | |
+| name | The name of the network policy. Required. Must start with the tier name followed by `.`; the `default.` prefix may be omitted for policies in the `default` tier. | Lowercase alphanumeric string with optional `-` and at most one `.`. | string | |
| namespace | Namespace provides an additional qualification to a resource name. | | string | "default" |
### Spec
@@ -127,6 +129,10 @@ spec:
+### HTTPMatch
+
+
+
### Performance Hints
Performance hints provide a way to tell $[prodname] about the intended use of the policy so that it may
diff --git a/calico_versioned_docs/version-3.32/reference/resources/stagednetworkpolicy.mdx b/calico_versioned_docs/version-3.32/reference/resources/stagednetworkpolicy.mdx
index 418b49be86..7021457266 100644
--- a/calico_versioned_docs/version-3.32/reference/resources/stagednetworkpolicy.mdx
+++ b/calico_versioned_docs/version-3.32/reference/resources/stagednetworkpolicy.mdx
@@ -18,6 +18,8 @@ import Icmp from '@site/calico_versioned_docs/version-3.32/_includes/content/_ic
import Rule from '@site/calico_versioned_docs/version-3.32/_includes/content/_rule.mdx';
+import Httpmatch from '@site/calico_versioned_docs/version-3.32/_includes/content/_httpmatch.mdx';
+
A staged network policy resource (`StagedNetworkPolicy`) represents an ordered set of rules which are applied
to a collection of endpoints that match a [label selector](#selector). These rules are used to preview network behavior and do
not enforce network traffic. For enforcing network traffic, see [network policy resource](networkpolicy.mdx).
@@ -42,7 +44,7 @@ may be used to specify the resource type on the CLI:
## Sample YAML
This sample policy allows TCP traffic from `frontend` endpoints to port 6379 on
-`database` endpoints.
+`database` endpoints. The `internal-access` [tier](tier.mdx) must exist before you create the policy.
```yaml
apiVersion: projectcalico.org/v3
@@ -74,7 +76,7 @@ spec:
| Field | Description | Accepted Values | Schema | Default |
| --------- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | --------- |
-| name | The name of the network policy. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | |
+| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and at most one `.`. | string | |
| namespace | Namespace provides an additional qualification to a resource name. | | string | "default" |
### Spec
@@ -83,6 +85,7 @@ spec:
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | --------------------- | --------------------------------------------- |
| order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | |
| tier | Name of the [tier](tier.mdx) this policy belongs to. | | string | `default` |
+| stagedAction | The staged action. `Set` stages the policy as written. With `Delete`, leave every other spec field except `tier` empty. | `Set`, `Delete`, `Learn`, `Ignore` | string | `Set` |
| selector | Selects the endpoints to which this policy applies. | | [selector](#selector) | all() |
| types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* |
| ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | |
@@ -127,6 +130,10 @@ spec:
+### HTTPMatch
+
+
+
### Performance Hints
Performance hints provide a way to tell $[prodname] about the intended use of the policy so that it may
diff --git a/calico_versioned_docs/version-3.33/reference/resources/stagednetworkpolicy.mdx b/calico_versioned_docs/version-3.33/reference/resources/stagednetworkpolicy.mdx
index ea48502546..94ed915db8 100644
--- a/calico_versioned_docs/version-3.33/reference/resources/stagednetworkpolicy.mdx
+++ b/calico_versioned_docs/version-3.33/reference/resources/stagednetworkpolicy.mdx
@@ -18,6 +18,8 @@ import Icmp from '@site/calico_versioned_docs/version-3.33/_includes/content/_ic
import Rule from '@site/calico_versioned_docs/version-3.33/_includes/content/_rule.mdx';
+import Httpmatch from '@site/calico_versioned_docs/version-3.33/_includes/content/_httpmatch.mdx';
+
A staged network policy resource (`StagedNetworkPolicy`) represents an ordered set of rules which are applied
to a collection of endpoints that match a [label selector](#selector). These rules are used to preview network behavior and do
not enforce network traffic. For enforcing network traffic, see [network policy resource](networkpolicy.mdx).
@@ -42,7 +44,7 @@ may be used to specify the resource type on the CLI:
## Sample YAML
This sample policy allows TCP traffic from `frontend` endpoints to port 6379 on
-`database` endpoints.
+`database` endpoints. The `internal-access` [tier](tier.mdx) must exist before you create the policy.
```yaml
apiVersion: projectcalico.org/v3
@@ -74,7 +76,7 @@ spec:
| Field | Description | Accepted Values | Schema | Default |
| --------- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | --------- |
-| name | The name of the network policy. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | |
+| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and at most one `.`. | string | |
| namespace | Namespace provides an additional qualification to a resource name. | | string | "default" |
### Spec
@@ -83,6 +85,7 @@ spec:
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | --------------------- | --------------------------------------------- |
| order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | |
| tier | Name of the [tier](tier.mdx) this policy belongs to. | | string | `default` |
+| stagedAction | The staged action. `Set` stages the policy as written. With `Delete`, leave every other spec field except `tier` empty. | `Set`, `Delete`, `Learn`, `Ignore` | string | `Set` |
| selector | Selects the endpoints to which this policy applies. | | [selector](#selector) | all() |
| types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* |
| ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | |
@@ -127,6 +130,10 @@ spec:
+### HTTPMatch
+
+
+
### Performance Hints
Performance hints provide a way to tell $[prodname] about the intended use of the policy so that it may
@@ -149,10 +156,11 @@ process it more efficiently. Currently only one hint is defined:
List and watch operations may specify label selectors or field selectors to filter `StagedNetworkPolicy` resources on tiers returned by the API server.
When no selector is specified, the API server returns all `StagedNetworkPolicy` resources from all tiers that the user has access to.
+When using native `projectcalico.org/v3` CRDs, tier RBAC is not enforced for list and watch: they require the `list` and `watch` verbs on `stagednetworkpolicies`, and return resources from all tiers.
##### Field selector
-When using the field selector, supported operators are `=` and `==`
+When using the field selector, supported operators include `=` and `==`
The following example shows how to retrieve all `StagedNetworkPolicy` resources in the default tier and in all namespaces:
@@ -162,7 +170,7 @@ kubectl get stagednetworkpolicy.p --field-selector spec.tier=default --all-names
##### Label selector
-When using the label selector, supported operators are `=`, `==` and `IN`.
+When using the label selector, supported operators include `=`, `==` and `in`.
The following example shows how to retrieve all `StagedNetworkPolicy` resources in the `default` and `net-sec` tiers and in all namespaces: