From afdd1cd25398c11df723c24f07f0a2f8d4656523 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Fri, 16 Oct 2026 08:22:55 +0100 Subject: [PATCH 1/6] Fix inaccuracies on the StagedKubernetesNetworkPolicy reference for next --- .../resources/stagedkubernetesnetworkpolicy.mdx | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/calico/reference/resources/stagedkubernetesnetworkpolicy.mdx b/calico/reference/resources/stagedkubernetesnetworkpolicy.mdx index 44fcd868e8..2ee9dae9e5 100644 --- a/calico/reference/resources/stagedkubernetesnetworkpolicy.mdx +++ b/calico/reference/resources/stagedkubernetesnetworkpolicy.mdx @@ -7,8 +7,8 @@ description: Reference for the StagedKubernetesNetworkPolicy resource in Calico A staged Kubernetes network policy resource (`StagedKubernetesNetworkPolicy`) represents a staged version of [Kubernetes network policy](https://kubernetes.io/docs/concepts/services-networking/network-policies). This is used to preview network behavior before actually enforcing the network policy. Once persisted, this -will create a Kubernetes network policy backed by a $[prodname] -[network policy](networkpolicy.mdx). +is converted to a $[prodname] +[network policy](networkpolicy.mdx) that is not enforced. For `kubectl` [commands](https://kubernetes.io/docs/reference/kubectl/overview/), the following case-insensitive aliases may be used to specify the resource type on the CLI: @@ -63,3 +63,13 @@ spec: See the [Kubernetes NetworkPolicy documentation](https://v1-21.docs.kubernetes.io/docs/reference/generated/kubernetes-api/v1.21/#networkpolicyspec-v1-networking-k8s-io) for more information. + +### Spec + +| Field | Description | Accepted Values | Schema | Default | +| ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------- | --------------------------------------------- | --------- | +| stagedAction | The staged action. With `Delete`, all other spec fields must be empty, and the policy is not sent to Felix. | `Set`, `Delete`, `Learn`, `Ignore` | string | `Set` | +| podSelector | Selects the pods in the namespace to which this policy applies. An empty selector matches all pods in the namespace. | | Kubernetes `LabelSelector` | | +| ingress | List of ingress rules applied to the selected pods. | | List of Kubernetes `NetworkPolicyIngressRule` | | +| egress | List of egress rules applied to the selected pods. | | List of Kubernetes `NetworkPolicyEgressRule` | | +| policyTypes | Applies the policy to ingress traffic (`Ingress`), egress traffic (`Egress`), or both. If omitted, the staged policy applies to ingress traffic only. | `Ingress`, `Egress` | List of strings | `Ingress` | From a80723e1591cc1edeae6da2c373e09042a3ad487 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Fri, 16 Oct 2026 08:22:55 +0100 Subject: [PATCH 2/6] Fix inaccuracies on the StagedKubernetesNetworkPolicy reference for 3.33 --- .../resources/stagedkubernetesnetworkpolicy.mdx | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/calico_versioned_docs/version-3.33/reference/resources/stagedkubernetesnetworkpolicy.mdx b/calico_versioned_docs/version-3.33/reference/resources/stagedkubernetesnetworkpolicy.mdx index 44fcd868e8..2ee9dae9e5 100644 --- a/calico_versioned_docs/version-3.33/reference/resources/stagedkubernetesnetworkpolicy.mdx +++ b/calico_versioned_docs/version-3.33/reference/resources/stagedkubernetesnetworkpolicy.mdx @@ -7,8 +7,8 @@ description: Reference for the StagedKubernetesNetworkPolicy resource in Calico A staged Kubernetes network policy resource (`StagedKubernetesNetworkPolicy`) represents a staged version of [Kubernetes network policy](https://kubernetes.io/docs/concepts/services-networking/network-policies). This is used to preview network behavior before actually enforcing the network policy. Once persisted, this -will create a Kubernetes network policy backed by a $[prodname] -[network policy](networkpolicy.mdx). +is converted to a $[prodname] +[network policy](networkpolicy.mdx) that is not enforced. For `kubectl` [commands](https://kubernetes.io/docs/reference/kubectl/overview/), the following case-insensitive aliases may be used to specify the resource type on the CLI: @@ -63,3 +63,13 @@ spec: See the [Kubernetes NetworkPolicy documentation](https://v1-21.docs.kubernetes.io/docs/reference/generated/kubernetes-api/v1.21/#networkpolicyspec-v1-networking-k8s-io) for more information. + +### Spec + +| Field | Description | Accepted Values | Schema | Default | +| ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------- | --------------------------------------------- | --------- | +| stagedAction | The staged action. With `Delete`, all other spec fields must be empty, and the policy is not sent to Felix. | `Set`, `Delete`, `Learn`, `Ignore` | string | `Set` | +| podSelector | Selects the pods in the namespace to which this policy applies. An empty selector matches all pods in the namespace. | | Kubernetes `LabelSelector` | | +| ingress | List of ingress rules applied to the selected pods. | | List of Kubernetes `NetworkPolicyIngressRule` | | +| egress | List of egress rules applied to the selected pods. | | List of Kubernetes `NetworkPolicyEgressRule` | | +| policyTypes | Applies the policy to ingress traffic (`Ingress`), egress traffic (`Egress`), or both. If omitted, the staged policy applies to ingress traffic only. | `Ingress`, `Egress` | List of strings | `Ingress` | From f310755e5f0447aea9bcb321be98810e22723211 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Fri, 16 Oct 2026 08:22:55 +0100 Subject: [PATCH 3/6] Fix inaccuracies on the StagedKubernetesNetworkPolicy reference for 3.32 --- .../resources/stagedkubernetesnetworkpolicy.mdx | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/calico_versioned_docs/version-3.32/reference/resources/stagedkubernetesnetworkpolicy.mdx b/calico_versioned_docs/version-3.32/reference/resources/stagedkubernetesnetworkpolicy.mdx index 44fcd868e8..2ee9dae9e5 100644 --- a/calico_versioned_docs/version-3.32/reference/resources/stagedkubernetesnetworkpolicy.mdx +++ b/calico_versioned_docs/version-3.32/reference/resources/stagedkubernetesnetworkpolicy.mdx @@ -7,8 +7,8 @@ description: Reference for the StagedKubernetesNetworkPolicy resource in Calico A staged Kubernetes network policy resource (`StagedKubernetesNetworkPolicy`) represents a staged version of [Kubernetes network policy](https://kubernetes.io/docs/concepts/services-networking/network-policies). This is used to preview network behavior before actually enforcing the network policy. Once persisted, this -will create a Kubernetes network policy backed by a $[prodname] -[network policy](networkpolicy.mdx). +is converted to a $[prodname] +[network policy](networkpolicy.mdx) that is not enforced. For `kubectl` [commands](https://kubernetes.io/docs/reference/kubectl/overview/), the following case-insensitive aliases may be used to specify the resource type on the CLI: @@ -63,3 +63,13 @@ spec: See the [Kubernetes NetworkPolicy documentation](https://v1-21.docs.kubernetes.io/docs/reference/generated/kubernetes-api/v1.21/#networkpolicyspec-v1-networking-k8s-io) for more information. + +### Spec + +| Field | Description | Accepted Values | Schema | Default | +| ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------- | --------------------------------------------- | --------- | +| stagedAction | The staged action. With `Delete`, all other spec fields must be empty, and the policy is not sent to Felix. | `Set`, `Delete`, `Learn`, `Ignore` | string | `Set` | +| podSelector | Selects the pods in the namespace to which this policy applies. An empty selector matches all pods in the namespace. | | Kubernetes `LabelSelector` | | +| ingress | List of ingress rules applied to the selected pods. | | List of Kubernetes `NetworkPolicyIngressRule` | | +| egress | List of egress rules applied to the selected pods. | | List of Kubernetes `NetworkPolicyEgressRule` | | +| policyTypes | Applies the policy to ingress traffic (`Ingress`), egress traffic (`Egress`), or both. If omitted, the staged policy applies to ingress traffic only. | `Ingress`, `Egress` | List of strings | `Ingress` | From 4734e0d7ee99e047f26c786cfdd09dd5fc02773c Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Fri, 16 Oct 2026 08:22:55 +0100 Subject: [PATCH 4/6] Fix inaccuracies on the StagedKubernetesNetworkPolicy reference for 3.31 --- .../resources/stagedkubernetesnetworkpolicy.mdx | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/calico_versioned_docs/version-3.31/reference/resources/stagedkubernetesnetworkpolicy.mdx b/calico_versioned_docs/version-3.31/reference/resources/stagedkubernetesnetworkpolicy.mdx index 6a06d8ba48..61e38aeb21 100644 --- a/calico_versioned_docs/version-3.31/reference/resources/stagedkubernetesnetworkpolicy.mdx +++ b/calico_versioned_docs/version-3.31/reference/resources/stagedkubernetesnetworkpolicy.mdx @@ -7,8 +7,8 @@ description: API for this resource. A staged Kubernetes network policy resource (`StagedKubernetesNetworkPolicy`) represents a staged version of [Kubernetes network policy](https://kubernetes.io/docs/concepts/services-networking/network-policies). This is used to preview network behavior before actually enforcing the network policy. Once persisted, this -will create a Kubernetes network policy backed by a $[prodname] -[network policy](networkpolicy.mdx). +is converted to a $[prodname] +[network policy](networkpolicy.mdx) that is not enforced. For `kubectl` [commands](https://kubernetes.io/docs/reference/kubectl/overview/), the following case-insensitive aliases may be used to specify the resource type on the CLI: @@ -63,3 +63,13 @@ spec: See the [Kubernetes NetworkPolicy documentation](https://v1-21.docs.kubernetes.io/docs/reference/generated/kubernetes-api/v1.21/#networkpolicyspec-v1-networking-k8s-io) for more information. + +### Spec + +| Field | Description | Accepted Values | Schema | Default | +| ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------- | --------------------------------------------- | --------- | +| stagedAction | The staged action. With `Delete`, all other spec fields must be empty, and the policy is not sent to Felix. | `Set`, `Delete`, `Learn`, `Ignore` | string | `Set` | +| podSelector | Selects the pods in the namespace to which this policy applies. An empty selector matches all pods in the namespace. | | Kubernetes `LabelSelector` | | +| ingress | List of ingress rules applied to the selected pods. | | List of Kubernetes `NetworkPolicyIngressRule` | | +| egress | List of egress rules applied to the selected pods. | | List of Kubernetes `NetworkPolicyEgressRule` | | +| policyTypes | Applies the policy to ingress traffic (`Ingress`), egress traffic (`Egress`), or both. If omitted, the staged policy applies to ingress traffic only. | `Ingress`, `Egress` | List of strings | `Ingress` | From c49f8e94929ac211c2bd61345da3cbed5b103104 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Mon, 19 Oct 2026 13:59:19 +0100 Subject: [PATCH 5/6] Fix policyTypes and stagedAction for native v3 CRDs in the next StagedKubernetesNetworkPolicy reference --- calico/reference/resources/stagedkubernetesnetworkpolicy.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/calico/reference/resources/stagedkubernetesnetworkpolicy.mdx b/calico/reference/resources/stagedkubernetesnetworkpolicy.mdx index 2ee9dae9e5..fb25dd8dad 100644 --- a/calico/reference/resources/stagedkubernetesnetworkpolicy.mdx +++ b/calico/reference/resources/stagedkubernetesnetworkpolicy.mdx @@ -68,8 +68,8 @@ for more information. | Field | Description | Accepted Values | Schema | Default | | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------- | --------------------------------------------- | --------- | -| stagedAction | The staged action. With `Delete`, all other spec fields must be empty, and the policy is not sent to Felix. | `Set`, `Delete`, `Learn`, `Ignore` | string | `Set` | +| stagedAction | The staged action. With `Delete`, leave every other spec field empty, and the policy is not sent to Felix. | `Set`, `Delete`, `Learn`, `Ignore` | string | `Set` | | podSelector | Selects the pods in the namespace to which this policy applies. An empty selector matches all pods in the namespace. | | Kubernetes `LabelSelector` | | | ingress | List of ingress rules applied to the selected pods. | | List of Kubernetes `NetworkPolicyIngressRule` | | | egress | List of egress rules applied to the selected pods. | | List of Kubernetes `NetworkPolicyEgressRule` | | -| policyTypes | Applies the policy to ingress traffic (`Ingress`), egress traffic (`Egress`), or both. If omitted, the staged policy applies to ingress traffic only. | `Ingress`, `Egress` | List of strings | `Ingress` | +| policyTypes | Applies the policy to ingress traffic (`Ingress`), egress traffic (`Egress`), or both. If omitted and the policy has no egress rules, the policy applies to ingress traffic only. If the policy has egress rules, set this field: when it is omitted, clusters that use native v3 CRDs store `Ingress, Egress`, but clusters that use the $[prodname] API server apply the policy to ingress traffic only. | `Ingress`, `Egress` | List of strings | | From e11d0f2cfe6cdf4fb32604b8256b850dd85636a9 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Mon, 19 Oct 2026 13:59:19 +0100 Subject: [PATCH 6/6] Fix policyTypes and stagedAction for native v3 CRDs in the 3.33 StagedKubernetesNetworkPolicy reference --- .../reference/resources/stagedkubernetesnetworkpolicy.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/calico_versioned_docs/version-3.33/reference/resources/stagedkubernetesnetworkpolicy.mdx b/calico_versioned_docs/version-3.33/reference/resources/stagedkubernetesnetworkpolicy.mdx index 2ee9dae9e5..fb25dd8dad 100644 --- a/calico_versioned_docs/version-3.33/reference/resources/stagedkubernetesnetworkpolicy.mdx +++ b/calico_versioned_docs/version-3.33/reference/resources/stagedkubernetesnetworkpolicy.mdx @@ -68,8 +68,8 @@ for more information. | Field | Description | Accepted Values | Schema | Default | | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------- | --------------------------------------------- | --------- | -| stagedAction | The staged action. With `Delete`, all other spec fields must be empty, and the policy is not sent to Felix. | `Set`, `Delete`, `Learn`, `Ignore` | string | `Set` | +| stagedAction | The staged action. With `Delete`, leave every other spec field empty, and the policy is not sent to Felix. | `Set`, `Delete`, `Learn`, `Ignore` | string | `Set` | | podSelector | Selects the pods in the namespace to which this policy applies. An empty selector matches all pods in the namespace. | | Kubernetes `LabelSelector` | | | ingress | List of ingress rules applied to the selected pods. | | List of Kubernetes `NetworkPolicyIngressRule` | | | egress | List of egress rules applied to the selected pods. | | List of Kubernetes `NetworkPolicyEgressRule` | | -| policyTypes | Applies the policy to ingress traffic (`Ingress`), egress traffic (`Egress`), or both. If omitted, the staged policy applies to ingress traffic only. | `Ingress`, `Egress` | List of strings | `Ingress` | +| policyTypes | Applies the policy to ingress traffic (`Ingress`), egress traffic (`Egress`), or both. If omitted and the policy has no egress rules, the policy applies to ingress traffic only. If the policy has egress rules, set this field: when it is omitted, clusters that use native v3 CRDs store `Ingress, Egress`, but clusters that use the $[prodname] API server apply the policy to ingress traffic only. | `Ingress`, `Egress` | List of strings | |