[ctauchen]

Fixes statements on the StagedGlobalNetworkPolicy reference that a test cluster showed to be wrong.

Jira: https://tigera.atlassian.net/browse/DOCS-3095

• The sample policy fails unless its internal-access tier exists. The page now says so.
• The name rule allowed _ and uppercase. The validator rejects both and allows at most one ..
• The page said a doNotTrack or preDNAT policy is enforced after conntrack on workload endpoints. Such a policy is not applied to workload endpoints at all.
• The Spec table had no stagedAction field. It now lists the values and the Delete constraint.
• The Rule table links to an HTTPMatch section that this page did not have. The page now imports and renders it.
• The shared EntityRule partial said an unset namespaceSelector limits rule selectors to the policy's namespace. That holds only for namespaced policies; global policies get no namespace limit. This also fixes the other policy pages.
• 3.31 only: the shared Rule table now marks action as required. The other trees get this fix from DOCS-3085: Fix inaccuracies on the GlobalNetworkPolicy reference #3115.

Changes next, 3.33 and 3.32, reproduced on v3.33.0 and v3.32.2, and 3.31, reproduced on v3.31.7.

• In next and 3.33, the name rule now says to use at most one ., because calicoctl rejects more. With native v3 CRDs, kubectl accepts names with more dots.
• In next and 3.33, the stagedAction row says to leave other fields empty with Delete, because only calicoctl enforces it.
• In next and 3.33, the page says that with native v3 CRDs, tier RBAC is not applied to list and watch.
• In next and 3.33, the selector operator lists are no longer exhaustive, and the label selector uses lowercase in. Upper-case IN fails to parse.

Next and 3.33 were verified in both API server mode and native v3 CRD mode.

Not changed:

• In 3.33 and 3.32, with native v3 CRDs instead of the aggregated API server, list and watch are not filtered by tier RBAC. The source shows this, but the lab runs the aggregated API server, so it could not be reproduced.
• The namespaceSelector and serviceAccountSelector rows list all() as the default. DOCS-3085: Fix inaccuracies on the GlobalNetworkPolicy reference #3115 showed on a cluster that an explicit all() is not the same as omitting the field, and the same conversion runs here. This page was not retested.
• The page links to #selectors, but its heading is Selector, so those links are dead. The same is true on the StagedNetworkPolicy page.
• For engineering: with native v3 CRDs, kubectl writes skip Calico's own validation (the webhook only enforces tiered RBAC on writes), and tier RBAC is not applied to list and watch. calicoctl still validates.

Preview:

• Next: https://deploy-preview-3118--calico-docs-preview-next.netlify.app/calico/next/reference/resources/stagedglobalnetworkpolicy/
• 3.33: https://deploy-preview-3118--tigera.netlify.app/calico/latest/reference/resources/stagedglobalnetworkpolicy
• 3.32: https://deploy-preview-3118--tigera.netlify.app/calico/3.32/reference/resources/stagedglobalnetworkpolicy
• 3.31: https://deploy-preview-3118--tigera.netlify.app/calico/3.31/reference/resources/stagedglobalnetworkpolicy

[netlify]

✅ Deploy Preview for calico-docs-preview-next ready!

Name	Link
🔨 Latest commit	30f19ea
🔍 Latest deploy log	https://app.netlify.com/projects/calico-docs-preview-next/deploys/6ad6143d03957482d14a03e9
😎 Deploy Preview	https://deploy-preview-3118--calico-docs-preview-next.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[netlify]

✅ Deploy Preview succeeded!

Built without sensitive environment variables

Name	Link
🔨 Latest commit	30f19ea
🔍 Latest deploy log	https://app.netlify.com/projects/tigera/deploys/6ad6143d9c530c183515928a
😎 Deploy Preview	https://deploy-preview-3118--tigera.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	1 paths audited Performance: 95 (🟢 up 22 from production) Accessibility: 98 (no change from production) Best Practices: 92 (no change from production) SEO: 100 (no change from production) PWA: - View the detailed breakdown and full score reports
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[Copilot]

🟢 Approval recommended

The remaining finding is a non-blocking documentation nit.

1 open finding

• Document tier-dependent GlobalNetworkPolicy naming constraints · New

What changed in this PR

Updates StagedGlobalNetworkPolicy documentation across current and Calico versions 3.31–3.33 to reflect validated behavior.

Changes:

• Corrects naming, tier, endpoint, and selector documentation.
• Adds stagedAction and HTTPMatch details.
• Marks 3.31 rule actions as required.

File	Summary
calico/​reference/​resources/​stagedglobalnetworkpolicy.mdx	Updates current reference.
calico/​_includes/​content/​_entityrule.mdx	Clarifies global selector scope.
calico_versioned_docs/​version-3.33/​reference/​resources/​stagedglobalnetworkpolicy.mdx	Updates 3.33 reference.
calico_versioned_docs/​version-3.33/​_includes/​content/​_entityrule.mdx	Clarifies 3.33 selector scope.
calico_versioned_docs/​version-3.32/​reference/​resources/​stagedglobalnetworkpolicy.mdx	Updates 3.32 reference.
calico_versioned_docs/​version-3.32/​_includes/​content/​_entityrule.mdx	Clarifies 3.32 selector scope.
calico_versioned_docs/​version-3.31/​reference/​resources/​stagedglobalnetworkpolicy.mdx	Updates 3.31 reference.
calico_versioned_docs/​version-3.31/​_includes/​content/​_rule.mdx	Marks rule actions as required.
calico_versioned_docs/​version-3.31/​_includes/​content/​_entityrule.mdx	Clarifies 3.31 selector scope.

🧠 Review effort: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.