Skip to content

DOCS-3097: Fix inaccuracies on the StagedNetworkPolicy reference #3116

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ctauchen merged 8 commits into from
Oct 19, 2026
Merged

DOCS-3097: Fix inaccuracies on the StagedNetworkPolicy reference #3116

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
4167852
Fix inaccuracies on the StagedNetworkPolicy reference for next
ctauchen Oct 16, 2026
d7f4178
Fix inaccuracies on the StagedNetworkPolicy reference for 3.33
ctauchen Oct 16, 2026
826a166
Fix inaccuracies on the StagedNetworkPolicy reference for 3.32
ctauchen Oct 16, 2026
798ecf7
Fix inaccuracies on the StagedNetworkPolicy reference for 3.31
ctauchen Oct 16, 2026
109a534
Fix the name rule, tier RBAC, and selector operators for native v3 CR…
ctauchen Oct 19, 2026
6602366
Fix the name rule, tier RBAC, and selector operators for native v3 CR…
ctauchen Oct 19, 2026
128846f
State the name rule without naming a tool
ctauchen Oct 19, 2026
9c0d77e
Use one wording for the policy name rule
ctauchen Oct 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 12 additions & 4 deletions calico/reference/resources/stagednetworkpolicy.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,8 @@

import Rule from '@site/calico/_includes/content/_rule.mdx';

import Httpmatch from '@site/calico/_includes/content/_httpmatch.mdx';

A staged network policy resource (`StagedNetworkPolicy`) represents an ordered set of rules which are applied
to a collection of endpoints that match a [label selector](#selector). These rules are used to preview network behavior and do
not enforce network traffic. For enforcing network traffic, see [network policy resource](networkpolicy.mdx).
Expand All @@ -42,7 +44,7 @@
## Sample YAML

This sample policy allows TCP traffic from `frontend` endpoints to port 6379 on
`database` endpoints.
`database` endpoints. The `internal-access` [tier](tier.mdx) must exist before you create the policy.

```yaml
apiVersion: projectcalico.org/v3
Expand Down Expand Up @@ -74,7 +76,7 @@

| Field | Description | Accepted Values | Schema | Default |
| --------- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | --------- |
| name | The name of the network policy. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | |
| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and at most one `.`. | string | |
| namespace | Namespace provides an additional qualification to a resource name. | | string | "default" |

### Spec
Expand All @@ -83,6 +85,7 @@
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | --------------------- | --------------------------------------------- |
| order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | |
| tier | Name of the [tier](tier.mdx) this policy belongs to. | | string | `default` |
| stagedAction | The staged action. `Set` stages the policy as written. With `Delete`, leave every other spec field except `tier` empty. | `Set`, `Delete`, `Learn`, `Ignore` | string | `Set` |

Check failure on line 88 in calico/reference/resources/stagednetworkpolicy.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'stagedAction'?

Raw Output:
{"message":"[Vale.Spelling] Did you really mean 'stagedAction'?","location":{"path":"calico/reference/resources/stagednetworkpolicy.mdx","range":{"start":{"line":88,"column":3},"end":{"line":88,"column":15}}},"severity":"ERROR","code":{"value":"Vale.Spelling"}}
| selector | Selects the endpoints to which this policy applies. | | [selector](#selector) | all() |
| types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* |
| ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | |
Expand Down Expand Up @@ -127,6 +130,10 @@

<Servicematch />

### HTTPMatch

<Httpmatch />

### Performance Hints

Performance hints provide a way to tell $[prodname] about the intended use of the policy so that it may
Expand All @@ -149,10 +156,11 @@

List and watch operations may specify label selectors or field selectors to filter `StagedNetworkPolicy` resources on tiers returned by the API server.
When no selector is specified, the API server returns all `StagedNetworkPolicy` resources from all tiers that the user has access to.
When using native `projectcalico.org/v3` CRDs, tier RBAC is not enforced for list and watch: they require the `list` and `watch` verbs on `stagednetworkpolicies`, and return resources from all tiers.

##### Field selector

When using the field selector, supported operators are `=` and `==`
When using the field selector, supported operators include `=` and `==`

The following example shows how to retrieve all `StagedNetworkPolicy` resources in the default tier and in all namespaces:

Expand All @@ -162,7 +170,7 @@

##### Label selector

When using the label selector, supported operators are `=`, `==` and `IN`.
When using the label selector, supported operators include `=`, `==` and `in`.

The following example shows how to retrieve all `StagedNetworkPolicy` resources in the `default` and `net-sec` tiers and in all namespaces:

Expand Down
10 changes: 8 additions & 2 deletions calico_versioned_docs/version-3.31/reference/resources/stagednetworkpolicy.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,8 @@ import Icmp from '@site/calico_versioned_docs/version-3.31/_includes/content/_ic

import Rule from '@site/calico_versioned_docs/version-3.31/_includes/content/_rule.mdx';

import Httpmatch from '@site/calico_versioned_docs/version-3.31/_includes/content/_httpmatch.mdx';

A staged network policy resource (`StagedNetworkPolicy`) represents an ordered set of rules which are applied
to a collection of endpoints that match a [label selector](#selector). These rules are used to preview network behavior and do
not enforce network traffic. For enforcing network traffic, see [network policy resource](networkpolicy.mdx).
Expand All @@ -42,7 +44,7 @@ may be used to specify the resource type on the CLI:
## Sample YAML

This sample policy allows TCP traffic from `frontend` endpoints to port 6379 on
`database` endpoints.
`database` endpoints. The `internal-access` [tier](tier.mdx) must exist before you create the policy.

```yaml
apiVersion: projectcalico.org/v3
Expand Down Expand Up @@ -74,7 +76,7 @@ spec:

| Field | Description | Accepted Values | Schema | Default |
| --------- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | --------- |
| name | The name of the network policy. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | |
| name | The name of the network policy. Required. Must start with the tier name followed by `.`; the `default.` prefix may be omitted for policies in the `default` tier. | Lowercase alphanumeric string with optional `-` and at most one `.`. | string | |
| namespace | Namespace provides an additional qualification to a resource name. | | string | "default" |

### Spec
Expand Down Expand Up @@ -127,6 +129,10 @@ spec:

<Servicematch />

### HTTPMatch

<Httpmatch />

### Performance Hints

Performance hints provide a way to tell $[prodname] about the intended use of the policy so that it may
Expand Down
11 changes: 9 additions & 2 deletions calico_versioned_docs/version-3.32/reference/resources/stagednetworkpolicy.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,8 @@

import Rule from '@site/calico_versioned_docs/version-3.32/_includes/content/_rule.mdx';

import Httpmatch from '@site/calico_versioned_docs/version-3.32/_includes/content/_httpmatch.mdx';

A staged network policy resource (`StagedNetworkPolicy`) represents an ordered set of rules which are applied
to a collection of endpoints that match a [label selector](#selector). These rules are used to preview network behavior and do
not enforce network traffic. For enforcing network traffic, see [network policy resource](networkpolicy.mdx).
Expand All @@ -42,7 +44,7 @@
## Sample YAML

This sample policy allows TCP traffic from `frontend` endpoints to port 6379 on
`database` endpoints.
`database` endpoints. The `internal-access` [tier](tier.mdx) must exist before you create the policy.

```yaml
apiVersion: projectcalico.org/v3
Expand Down Expand Up @@ -74,7 +76,7 @@

| Field | Description | Accepted Values | Schema | Default |
| --------- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | --------- |
| name | The name of the network policy. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | |
| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and at most one `.`. | string | |
| namespace | Namespace provides an additional qualification to a resource name. | | string | "default" |

### Spec
Expand All @@ -83,6 +85,7 @@
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | --------------------- | --------------------------------------------- |
| order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | |
| tier | Name of the [tier](tier.mdx) this policy belongs to. | | string | `default` |
| stagedAction | The staged action. `Set` stages the policy as written. With `Delete`, leave every other spec field except `tier` empty. | `Set`, `Delete`, `Learn`, `Ignore` | string | `Set` |

Check failure on line 88 in calico_versioned_docs/version-3.32/reference/resources/stagednetworkpolicy.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'stagedAction'?

Raw Output:
{"message":"[Vale.Spelling] Did you really mean 'stagedAction'?","location":{"path":"calico_versioned_docs/version-3.32/reference/resources/stagednetworkpolicy.mdx","range":{"start":{"line":88,"column":3},"end":{"line":88,"column":15}}},"severity":"ERROR","code":{"value":"Vale.Spelling"}}
| selector | Selects the endpoints to which this policy applies. | | [selector](#selector) | all() |
| types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* |
| ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | |
Expand Down Expand Up @@ -127,6 +130,10 @@

<Servicematch />

### HTTPMatch

<Httpmatch />

### Performance Hints

Performance hints provide a way to tell $[prodname] about the intended use of the policy so that it may
Expand Down
16 changes: 12 additions & 4 deletions calico_versioned_docs/version-3.33/reference/resources/stagednetworkpolicy.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,8 @@

import Rule from '@site/calico_versioned_docs/version-3.33/_includes/content/_rule.mdx';

import Httpmatch from '@site/calico_versioned_docs/version-3.33/_includes/content/_httpmatch.mdx';

A staged network policy resource (`StagedNetworkPolicy`) represents an ordered set of rules which are applied
to a collection of endpoints that match a [label selector](#selector). These rules are used to preview network behavior and do
not enforce network traffic. For enforcing network traffic, see [network policy resource](networkpolicy.mdx).
Expand All @@ -42,7 +44,7 @@
## Sample YAML

This sample policy allows TCP traffic from `frontend` endpoints to port 6379 on
`database` endpoints.
`database` endpoints. The `internal-access` [tier](tier.mdx) must exist before you create the policy.

```yaml
apiVersion: projectcalico.org/v3
Expand Down Expand Up @@ -74,7 +76,7 @@

| Field | Description | Accepted Values | Schema | Default |
| --------- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | --------- |
| name | The name of the network policy. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | |
| name | The name of the network policy. Required. | Lowercase alphanumeric string with optional `-` and at most one `.`. | string | |
| namespace | Namespace provides an additional qualification to a resource name. | | string | "default" |

### Spec
Expand All @@ -83,6 +85,7 @@
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------- | --------------------- | --------------------------------------------- |
| order | Controls the order of precedence. $[prodname] applies the policy with the lowest value first. | | float | |
| tier | Name of the [tier](tier.mdx) this policy belongs to. | | string | `default` |
| stagedAction | The staged action. `Set` stages the policy as written. With `Delete`, leave every other spec field except `tier` empty. | `Set`, `Delete`, `Learn`, `Ignore` | string | `Set` |

Check failure on line 88 in calico_versioned_docs/version-3.33/reference/resources/stagednetworkpolicy.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'stagedAction'?

Raw Output:
{"message":"[Vale.Spelling] Did you really mean 'stagedAction'?","location":{"path":"calico_versioned_docs/version-3.33/reference/resources/stagednetworkpolicy.mdx","range":{"start":{"line":88,"column":3},"end":{"line":88,"column":15}}},"severity":"ERROR","code":{"value":"Vale.Spelling"}}
| selector | Selects the endpoints to which this policy applies. | | [selector](#selector) | all() |
| types | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress` | List of strings | Depends on presence of ingress/egress rules\* |
| ingress | Ordered list of ingress rules applied by policy. | | List of [Rule](#rule) | |
Expand Down Expand Up @@ -127,6 +130,10 @@

<Servicematch />

### HTTPMatch

<Httpmatch />

### Performance Hints

Performance hints provide a way to tell $[prodname] about the intended use of the policy so that it may
Expand All @@ -149,10 +156,11 @@

List and watch operations may specify label selectors or field selectors to filter `StagedNetworkPolicy` resources on tiers returned by the API server.
When no selector is specified, the API server returns all `StagedNetworkPolicy` resources from all tiers that the user has access to.
When using native `projectcalico.org/v3` CRDs, tier RBAC is not enforced for list and watch: they require the `list` and `watch` verbs on `stagednetworkpolicies`, and return resources from all tiers.

##### Field selector

When using the field selector, supported operators are `=` and `==`
When using the field selector, supported operators include `=` and `==`

The following example shows how to retrieve all `StagedNetworkPolicy` resources in the default tier and in all namespaces:

Expand All @@ -162,7 +170,7 @@

##### Label selector

When using the label selector, supported operators are `=`, `==` and `IN`.
When using the label selector, supported operators include `=`, `==` and `in`.

The following example shows how to retrieve all `StagedNetworkPolicy` resources in the `default` and `net-sec` tiers and in all namespaces:

Expand Down
Loading