From 41678528d4a939a4c008242d033f5f459b9dfba8 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Fri, 16 Oct 2026 08:22:54 +0100 Subject: [PATCH 1/8] Fix inaccuracies on the StagedNetworkPolicy reference for next --- calico/reference/resources/stagednetworkpolicy.mdx | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/calico/reference/resources/stagednetworkpolicy.mdx b/calico/reference/resources/stagednetworkpolicy.mdx index d0f2e6d860..0fb46fa6f4 100644 --- a/calico/reference/resources/stagednetworkpolicy.mdx +++ b/calico/reference/resources/stagednetworkpolicy.mdx @@ -18,6 +18,8 @@ import Icmp from '@site/calico/_includes/content/_icmp.mdx'; import Rule from '@site/calico/_includes/content/_rule.mdx'; +import Httpmatch from '@site/calico/_includes/content/_httpmatch.mdx'; + A staged network policy resource (`StagedNetworkPolicy`) represents an ordered set of rules which are applied to a collection of endpoints that match a [label selector](#selector). These rules are used to preview network behavior and do not enforce network traffic. For enforcing network traffic, see [network policy resource](networkpolicy.mdx). @@ -42,7 +44,7 @@ may be used to specify the resource type on the CLI: ## Sample YAML This sample policy allows TCP traffic from `frontend` endpoints to port 6379 on -`database` endpoints. +`database` endpoints. The `internal-access` [tier](tier.mdx) must exist before you create the policy. ```yaml apiVersion: projectcalico.org/v3 @@ -74,7 +76,7 @@ spec: | Field | Description | Accepted Values | Schema | Default | | --------- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | --------- | -| name | The name of the network policy. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | | +| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and `.`. | string | | | namespace | Namespace provides an additional qualification to a resource name. | | string | "default" | ### Spec @@ -83,6 +85,7 @@ spec: | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | --------------------- | --------------------------------------------- | | order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | | tier | Name of the [tier](tier.mdx) this policy belongs to. | | string | `default` | +| stagedAction | The staged action. `Set` stages the policy as written. With `Delete`, leave every other spec field except `tier` empty. | `Set`, `Delete`, `Learn`, `Ignore` | string | `Set` | | selector | Selects the endpoints to which this policy applies. | | [selector](#selector) | all() | | types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | | ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | | @@ -127,6 +130,10 @@ spec: +### HTTPMatch + + + ### Performance Hints Performance hints provide a way to tell $[prodname] about the intended use of the policy so that it may From d7f417855408c1ae95861d138f05b558d2615b83 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Fri, 16 Oct 2026 08:22:54 +0100 Subject: [PATCH 2/8] Fix inaccuracies on the StagedNetworkPolicy reference for 3.33 --- .../reference/resources/stagednetworkpolicy.mdx | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/calico_versioned_docs/version-3.33/reference/resources/stagednetworkpolicy.mdx b/calico_versioned_docs/version-3.33/reference/resources/stagednetworkpolicy.mdx index ea48502546..c0163b0720 100644 --- a/calico_versioned_docs/version-3.33/reference/resources/stagednetworkpolicy.mdx +++ b/calico_versioned_docs/version-3.33/reference/resources/stagednetworkpolicy.mdx @@ -18,6 +18,8 @@ import Icmp from '@site/calico_versioned_docs/version-3.33/_includes/content/_ic import Rule from '@site/calico_versioned_docs/version-3.33/_includes/content/_rule.mdx'; +import Httpmatch from '@site/calico_versioned_docs/version-3.33/_includes/content/_httpmatch.mdx'; + A staged network policy resource (`StagedNetworkPolicy`) represents an ordered set of rules which are applied to a collection of endpoints that match a [label selector](#selector). These rules are used to preview network behavior and do not enforce network traffic. For enforcing network traffic, see [network policy resource](networkpolicy.mdx). @@ -42,7 +44,7 @@ may be used to specify the resource type on the CLI: ## Sample YAML This sample policy allows TCP traffic from `frontend` endpoints to port 6379 on -`database` endpoints. +`database` endpoints. The `internal-access` [tier](tier.mdx) must exist before you create the policy. ```yaml apiVersion: projectcalico.org/v3 @@ -74,7 +76,7 @@ spec: | Field | Description | Accepted Values | Schema | Default | | --------- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | --------- | -| name | The name of the network policy. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | | +| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and `.`. | string | | | namespace | Namespace provides an additional qualification to a resource name. | | string | "default" | ### Spec @@ -83,6 +85,7 @@ spec: | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | --------------------- | --------------------------------------------- | | order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | | tier | Name of the [tier](tier.mdx) this policy belongs to. | | string | `default` | +| stagedAction | The staged action. `Set` stages the policy as written. With `Delete`, leave every other spec field except `tier` empty. | `Set`, `Delete`, `Learn`, `Ignore` | string | `Set` | | selector | Selects the endpoints to which this policy applies. | | [selector](#selector) | all() | | types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | | ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | | @@ -127,6 +130,10 @@ spec: +### HTTPMatch + + + ### Performance Hints Performance hints provide a way to tell $[prodname] about the intended use of the policy so that it may From 826a16637b64636413ce0bb9f6d5effdfc563de2 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Fri, 16 Oct 2026 08:22:54 +0100 Subject: [PATCH 3/8] Fix inaccuracies on the StagedNetworkPolicy reference for 3.32 --- .../reference/resources/stagednetworkpolicy.mdx | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/calico_versioned_docs/version-3.32/reference/resources/stagednetworkpolicy.mdx b/calico_versioned_docs/version-3.32/reference/resources/stagednetworkpolicy.mdx index 418b49be86..dabdd1ed49 100644 --- a/calico_versioned_docs/version-3.32/reference/resources/stagednetworkpolicy.mdx +++ b/calico_versioned_docs/version-3.32/reference/resources/stagednetworkpolicy.mdx @@ -18,6 +18,8 @@ import Icmp from '@site/calico_versioned_docs/version-3.32/_includes/content/_ic import Rule from '@site/calico_versioned_docs/version-3.32/_includes/content/_rule.mdx'; +import Httpmatch from '@site/calico_versioned_docs/version-3.32/_includes/content/_httpmatch.mdx'; + A staged network policy resource (`StagedNetworkPolicy`) represents an ordered set of rules which are applied to a collection of endpoints that match a [label selector](#selector). These rules are used to preview network behavior and do not enforce network traffic. For enforcing network traffic, see [network policy resource](networkpolicy.mdx). @@ -42,7 +44,7 @@ may be used to specify the resource type on the CLI: ## Sample YAML This sample policy allows TCP traffic from `frontend` endpoints to port 6379 on -`database` endpoints. +`database` endpoints. The `internal-access` [tier](tier.mdx) must exist before you create the policy. ```yaml apiVersion: projectcalico.org/v3 @@ -74,7 +76,7 @@ spec: | Field | Description | Accepted Values | Schema | Default | | --------- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | --------- | -| name | The name of the network policy. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | | +| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-`, and at most one `.`. | string | | | namespace | Namespace provides an additional qualification to a resource name. | | string | "default" | ### Spec @@ -83,6 +85,7 @@ spec: | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | --------------------- | --------------------------------------------- | | order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | | | tier | Name of the [tier](tier.mdx) this policy belongs to. | | string | `default` | +| stagedAction | The staged action. `Set` stages the policy as written. With `Delete`, leave every other spec field except `tier` empty. | `Set`, `Delete`, `Learn`, `Ignore` | string | `Set` | | selector | Selects the endpoints to which this policy applies. | | [selector](#selector) | all() | | types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* | | ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | | @@ -127,6 +130,10 @@ spec: +### HTTPMatch + + + ### Performance Hints Performance hints provide a way to tell $[prodname] about the intended use of the policy so that it may From 798ecf79516b8a5edde825c62e0dcabf24338f14 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Fri, 16 Oct 2026 08:22:54 +0100 Subject: [PATCH 4/8] Fix inaccuracies on the StagedNetworkPolicy reference for 3.31 --- .../reference/resources/stagednetworkpolicy.mdx | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/calico_versioned_docs/version-3.31/reference/resources/stagednetworkpolicy.mdx b/calico_versioned_docs/version-3.31/reference/resources/stagednetworkpolicy.mdx index bda071a127..6a8d11a8c1 100644 --- a/calico_versioned_docs/version-3.31/reference/resources/stagednetworkpolicy.mdx +++ b/calico_versioned_docs/version-3.31/reference/resources/stagednetworkpolicy.mdx @@ -18,6 +18,8 @@ import Icmp from '@site/calico_versioned_docs/version-3.31/_includes/content/_ic import Rule from '@site/calico_versioned_docs/version-3.31/_includes/content/_rule.mdx'; +import Httpmatch from '@site/calico_versioned_docs/version-3.31/_includes/content/_httpmatch.mdx'; + A staged network policy resource (`StagedNetworkPolicy`) represents an ordered set of rules which are applied to a collection of endpoints that match a [label selector](#selector). These rules are used to preview network behavior and do not enforce network traffic. For enforcing network traffic, see [network policy resource](networkpolicy.mdx). @@ -42,7 +44,7 @@ may be used to specify the resource type on the CLI: ## Sample YAML This sample policy allows TCP traffic from `frontend` endpoints to port 6379 on -`database` endpoints. +`database` endpoints. The `internal-access` [tier](tier.mdx) must exist before you create the policy. ```yaml apiVersion: projectcalico.org/v3 @@ -74,7 +76,7 @@ spec: | Field | Description | Accepted Values | Schema | Default | | --------- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | --------- | -| name | The name of the network policy. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | | +| name | The name of the network policy. Required. Must start with the tier name followed by `.`; the `default.` prefix may be omitted for policies in the `default` tier. | Lowercase alphanumeric string with optional `-` and `.`. | string | | | namespace | Namespace provides an additional qualification to a resource name. | | string | "default" | ### Spec @@ -127,6 +129,10 @@ spec: +### HTTPMatch + + + ### Performance Hints Performance hints provide a way to tell $[prodname] about the intended use of the policy so that it may From 109a5342394afc177379d96ba8282e2d2bf7eb0e Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Mon, 19 Oct 2026 13:59:18 +0100 Subject: [PATCH 5/8] Fix the name rule, tier RBAC, and selector operators for native v3 CRDs in the next StagedNetworkPolicy reference --- calico/reference/resources/stagednetworkpolicy.mdx | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/calico/reference/resources/stagednetworkpolicy.mdx b/calico/reference/resources/stagednetworkpolicy.mdx index 0fb46fa6f4..be1feb4b82 100644 --- a/calico/reference/resources/stagednetworkpolicy.mdx +++ b/calico/reference/resources/stagednetworkpolicy.mdx @@ -76,7 +76,7 @@ spec: | Field | Description | Accepted Values | Schema | Default | | --------- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | --------- | -| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and `.`. | string | | +| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-`. Use at most one `.`, because calicoctl rejects names with more. Names that start with `ossg.default.` can have more dots. | string | | | namespace | Namespace provides an additional qualification to a resource name. | | string | "default" | ### Spec @@ -156,10 +156,11 @@ process it more efficiently. Currently only one hint is defined: List and watch operations may specify label selectors or field selectors to filter `StagedNetworkPolicy` resources on tiers returned by the API server. When no selector is specified, the API server returns all `StagedNetworkPolicy` resources from all tiers that the user has access to. +When using native `projectcalico.org/v3` CRDs, tier RBAC is not enforced for list and watch: they require the `list` and `watch` verbs on `stagednetworkpolicies`, and return resources from all tiers. ##### Field selector -When using the field selector, supported operators are `=` and `==` +When using the field selector, supported operators include `=` and `==` The following example shows how to retrieve all `StagedNetworkPolicy` resources in the default tier and in all namespaces: @@ -169,7 +170,7 @@ kubectl get stagednetworkpolicy.p --field-selector spec.tier=default --all-names ##### Label selector -When using the label selector, supported operators are `=`, `==` and `IN`. +When using the label selector, supported operators include `=`, `==` and `in`. The following example shows how to retrieve all `StagedNetworkPolicy` resources in the `default` and `net-sec` tiers and in all namespaces: From 6602366258b15ae94eae4635e165f30cf3031f70 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Mon, 19 Oct 2026 13:59:19 +0100 Subject: [PATCH 6/8] Fix the name rule, tier RBAC, and selector operators for native v3 CRDs in the 3.33 StagedNetworkPolicy reference --- .../reference/resources/stagednetworkpolicy.mdx | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/calico_versioned_docs/version-3.33/reference/resources/stagednetworkpolicy.mdx b/calico_versioned_docs/version-3.33/reference/resources/stagednetworkpolicy.mdx index c0163b0720..593e1323ab 100644 --- a/calico_versioned_docs/version-3.33/reference/resources/stagednetworkpolicy.mdx +++ b/calico_versioned_docs/version-3.33/reference/resources/stagednetworkpolicy.mdx @@ -76,7 +76,7 @@ spec: | Field | Description | Accepted Values | Schema | Default | | --------- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | --------- | -| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and `.`. | string | | +| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-`. Use at most one `.`, because calicoctl rejects names with more. Names that start with `ossg.default.` can have more dots. | string | | | namespace | Namespace provides an additional qualification to a resource name. | | string | "default" | ### Spec @@ -156,10 +156,11 @@ process it more efficiently. Currently only one hint is defined: List and watch operations may specify label selectors or field selectors to filter `StagedNetworkPolicy` resources on tiers returned by the API server. When no selector is specified, the API server returns all `StagedNetworkPolicy` resources from all tiers that the user has access to. +When using native `projectcalico.org/v3` CRDs, tier RBAC is not enforced for list and watch: they require the `list` and `watch` verbs on `stagednetworkpolicies`, and return resources from all tiers. ##### Field selector -When using the field selector, supported operators are `=` and `==` +When using the field selector, supported operators include `=` and `==` The following example shows how to retrieve all `StagedNetworkPolicy` resources in the default tier and in all namespaces: @@ -169,7 +170,7 @@ kubectl get stagednetworkpolicy.p --field-selector spec.tier=default --all-names ##### Label selector -When using the label selector, supported operators are `=`, `==` and `IN`. +When using the label selector, supported operators include `=`, `==` and `in`. The following example shows how to retrieve all `StagedNetworkPolicy` resources in the `default` and `net-sec` tiers and in all namespaces: From 128846f145134b3716640fbbc73fe62be0dc8be3 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Mon, 19 Oct 2026 16:57:58 +0100 Subject: [PATCH 7/8] State the name rule without naming a tool The one-period limit comes from the Calico validator, which runs in calicoctl and in the Calico API server. Write it as a plain rule, as the 3.32 page does. --- calico/reference/resources/stagednetworkpolicy.mdx | 2 +- .../version-3.33/reference/resources/stagednetworkpolicy.mdx | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/calico/reference/resources/stagednetworkpolicy.mdx b/calico/reference/resources/stagednetworkpolicy.mdx index be1feb4b82..f338afb932 100644 --- a/calico/reference/resources/stagednetworkpolicy.mdx +++ b/calico/reference/resources/stagednetworkpolicy.mdx @@ -76,7 +76,7 @@ spec: | Field | Description | Accepted Values | Schema | Default | | --------- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | --------- | -| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-`. Use at most one `.`, because calicoctl rejects names with more. Names that start with `ossg.default.` can have more dots. | string | | +| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-`, and at most one `.`. | string | | | namespace | Namespace provides an additional qualification to a resource name. | | string | "default" | ### Spec diff --git a/calico_versioned_docs/version-3.33/reference/resources/stagednetworkpolicy.mdx b/calico_versioned_docs/version-3.33/reference/resources/stagednetworkpolicy.mdx index 593e1323ab..0b0f95b62e 100644 --- a/calico_versioned_docs/version-3.33/reference/resources/stagednetworkpolicy.mdx +++ b/calico_versioned_docs/version-3.33/reference/resources/stagednetworkpolicy.mdx @@ -76,7 +76,7 @@ spec: | Field | Description | Accepted Values | Schema | Default | | --------- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | --------- | -| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-`. Use at most one `.`, because calicoctl rejects names with more. Names that start with `ossg.default.` can have more dots. | string | | +| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-`, and at most one `.`. | string | | | namespace | Namespace provides an additional qualification to a resource name. | | string | "default" | ### Spec From 9c0d77e79500f89c0ab2b5a040c3d60ad84f5299 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Mon, 19 Oct 2026 17:06:32 +0100 Subject: [PATCH 8/8] Use one wording for the policy name rule Every version says the name is lowercase alphanumeric with optional hyphens and at most one period. --- calico/reference/resources/stagednetworkpolicy.mdx | 2 +- .../version-3.31/reference/resources/stagednetworkpolicy.mdx | 2 +- .../version-3.32/reference/resources/stagednetworkpolicy.mdx | 2 +- .../version-3.33/reference/resources/stagednetworkpolicy.mdx | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/calico/reference/resources/stagednetworkpolicy.mdx b/calico/reference/resources/stagednetworkpolicy.mdx index f338afb932..fc49c48218 100644 --- a/calico/reference/resources/stagednetworkpolicy.mdx +++ b/calico/reference/resources/stagednetworkpolicy.mdx @@ -76,7 +76,7 @@ spec: | Field | Description | Accepted Values | Schema | Default | | --------- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | --------- | -| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-`, and at most one `.`. | string | | +| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and at most one `.`. | string | | | namespace | Namespace provides an additional qualification to a resource name. | | string | "default" | ### Spec diff --git a/calico_versioned_docs/version-3.31/reference/resources/stagednetworkpolicy.mdx b/calico_versioned_docs/version-3.31/reference/resources/stagednetworkpolicy.mdx index 6a8d11a8c1..04891c08ab 100644 --- a/calico_versioned_docs/version-3.31/reference/resources/stagednetworkpolicy.mdx +++ b/calico_versioned_docs/version-3.31/reference/resources/stagednetworkpolicy.mdx @@ -76,7 +76,7 @@ spec: | Field | Description | Accepted Values | Schema | Default | | --------- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | --------- | -| name | The name of the network policy. Required. Must start with the tier name followed by `.`; the `default.` prefix may be omitted for policies in the `default` tier. | Lowercase alphanumeric string with optional `-` and `.`. | string | | +| name | The name of the network policy. Required. Must start with the tier name followed by `.`; the `default.` prefix may be omitted for policies in the `default` tier. | Lowercase alphanumeric string with optional `-` and at most one `.`. | string | | | namespace | Namespace provides an additional qualification to a resource name. | | string | "default" | ### Spec diff --git a/calico_versioned_docs/version-3.32/reference/resources/stagednetworkpolicy.mdx b/calico_versioned_docs/version-3.32/reference/resources/stagednetworkpolicy.mdx index dabdd1ed49..7021457266 100644 --- a/calico_versioned_docs/version-3.32/reference/resources/stagednetworkpolicy.mdx +++ b/calico_versioned_docs/version-3.32/reference/resources/stagednetworkpolicy.mdx @@ -76,7 +76,7 @@ spec: | Field | Description | Accepted Values | Schema | Default | | --------- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | --------- | -| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-`, and at most one `.`. | string | | +| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and at most one `.`. | string | | | namespace | Namespace provides an additional qualification to a resource name. | | string | "default" | ### Spec diff --git a/calico_versioned_docs/version-3.33/reference/resources/stagednetworkpolicy.mdx b/calico_versioned_docs/version-3.33/reference/resources/stagednetworkpolicy.mdx index 0b0f95b62e..94ed915db8 100644 --- a/calico_versioned_docs/version-3.33/reference/resources/stagednetworkpolicy.mdx +++ b/calico_versioned_docs/version-3.33/reference/resources/stagednetworkpolicy.mdx @@ -76,7 +76,7 @@ spec: | Field | Description | Accepted Values | Schema | Default | | --------- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | --------- | -| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-`, and at most one `.`. | string | | +| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and at most one `.`. | string | | | namespace | Namespace provides an additional qualification to a resource name. | | string | "default" | ### Spec