From f0d3e1873382247348b1d43d773401ac8e204106 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Fri, 16 Oct 2026 12:56:13 +0100 Subject: [PATCH 1/4] Fix tier order default and built-in tier text (next) --- calico/reference/resources/tier.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/calico/reference/resources/tier.mdx b/calico/reference/resources/tier.mdx index 6864bea45b..4c77b6dc6c 100644 --- a/calico/reference/resources/tier.mdx +++ b/calico/reference/resources/tier.mdx @@ -56,7 +56,7 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ------------- | ------------------------------------------------------------------------------------------------------------------------------------ | --------------- | ------ | --------------------- | -| order | (Optional) Indicates priority of this Tier, with lower order taking precedence. No value indicates highest order (lowest precedence) | | float | `nil` (highest order) | +| order | (Optional) Indicates priority of this Tier, with lower order taking precedence. No value is treated as order `1000000`, the order of the `default` Tier | | float | `1000000` | | defaultAction | (Optional) Indicates the default action, when this Tier applies to an endpoint, but takes no action on the packet | `Deny`, `Pass` | string | `Deny` | -All Policies created by $[prodname] orchestrator integrations are created in the default (last) Tier. +All Policies created by $[prodname] orchestrator integrations are created in the `default` Tier (order `1000000`), except Kubernetes ClusterNetworkPolicies, which are created in the `kube-admin` (order `1000`) and `kube-baseline` (order `10000000`) Tiers. If you install $[prodname] with the operator and the `projectcalico.org/v3` API is available (through the $[prodname] API server or v3 CRDs), the operator also creates a `calico-system` Tier (order `100`) for the policies it installs to allow $[prodname] component traffic. From cb436d5b9a39462da22d4f6cfc229e2b1768997f Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Fri, 16 Oct 2026 12:56:13 +0100 Subject: [PATCH 2/4] Fix tier order default and built-in tier text (3.33) --- .../version-3.33/reference/resources/tier.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/calico_versioned_docs/version-3.33/reference/resources/tier.mdx b/calico_versioned_docs/version-3.33/reference/resources/tier.mdx index 6864bea45b..4c77b6dc6c 100644 --- a/calico_versioned_docs/version-3.33/reference/resources/tier.mdx +++ b/calico_versioned_docs/version-3.33/reference/resources/tier.mdx @@ -56,7 +56,7 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ------------- | ------------------------------------------------------------------------------------------------------------------------------------ | --------------- | ------ | --------------------- | -| order | (Optional) Indicates priority of this Tier, with lower order taking precedence. No value indicates highest order (lowest precedence) | | float | `nil` (highest order) | +| order | (Optional) Indicates priority of this Tier, with lower order taking precedence. No value is treated as order `1000000`, the order of the `default` Tier | | float | `1000000` | | defaultAction | (Optional) Indicates the default action, when this Tier applies to an endpoint, but takes no action on the packet | `Deny`, `Pass` | string | `Deny` | -All Policies created by $[prodname] orchestrator integrations are created in the default (last) Tier. +All Policies created by $[prodname] orchestrator integrations are created in the `default` Tier (order `1000000`), except Kubernetes ClusterNetworkPolicies, which are created in the `kube-admin` (order `1000`) and `kube-baseline` (order `10000000`) Tiers. If you install $[prodname] with the operator and the `projectcalico.org/v3` API is available (through the $[prodname] API server or v3 CRDs), the operator also creates a `calico-system` Tier (order `100`) for the policies it installs to allow $[prodname] component traffic. From 35aafcf8a716fe1c272a63044912ec9b63c31229 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Fri, 16 Oct 2026 12:56:13 +0100 Subject: [PATCH 3/4] Fix tier order default and built-in tier text (3.32) --- .../version-3.32/reference/resources/tier.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/calico_versioned_docs/version-3.32/reference/resources/tier.mdx b/calico_versioned_docs/version-3.32/reference/resources/tier.mdx index 6864bea45b..4c77b6dc6c 100644 --- a/calico_versioned_docs/version-3.32/reference/resources/tier.mdx +++ b/calico_versioned_docs/version-3.32/reference/resources/tier.mdx @@ -56,7 +56,7 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ------------- | ------------------------------------------------------------------------------------------------------------------------------------ | --------------- | ------ | --------------------- | -| order | (Optional) Indicates priority of this Tier, with lower order taking precedence. No value indicates highest order (lowest precedence) | | float | `nil` (highest order) | +| order | (Optional) Indicates priority of this Tier, with lower order taking precedence. No value is treated as order `1000000`, the order of the `default` Tier | | float | `1000000` | | defaultAction | (Optional) Indicates the default action, when this Tier applies to an endpoint, but takes no action on the packet | `Deny`, `Pass` | string | `Deny` | -All Policies created by $[prodname] orchestrator integrations are created in the default (last) Tier. +All Policies created by $[prodname] orchestrator integrations are created in the `default` Tier (order `1000000`), except Kubernetes ClusterNetworkPolicies, which are created in the `kube-admin` (order `1000`) and `kube-baseline` (order `10000000`) Tiers. If you install $[prodname] with the operator and the `projectcalico.org/v3` API is available (through the $[prodname] API server or v3 CRDs), the operator also creates a `calico-system` Tier (order `100`) for the policies it installs to allow $[prodname] component traffic. From 3248a932b063fa6cb6cf42bbdb1b75d571890c4a Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Fri, 16 Oct 2026 12:56:13 +0100 Subject: [PATCH 4/4] Fix tier order default and built-in tier text (3.31) --- .../version-3.31/reference/resources/tier.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/calico_versioned_docs/version-3.31/reference/resources/tier.mdx b/calico_versioned_docs/version-3.31/reference/resources/tier.mdx index 8d27bf5411..885318f2ea 100644 --- a/calico_versioned_docs/version-3.31/reference/resources/tier.mdx +++ b/calico_versioned_docs/version-3.31/reference/resources/tier.mdx @@ -56,7 +56,7 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ------------- | ------------------------------------------------------------------------------------------------------------------------------------ | --------------- | ------ | --------------------- | -| order | (Optional) Indicates priority of this Tier, with lower order taking precedence. No value indicates highest order (lowest precedence) | | float | `nil` (highest order) | +| order | (Optional) Indicates priority of this Tier, with lower order taking precedence. No value is treated as order `1000000`, the order of the `default` Tier | | float | `1000000` | | defaultAction | (Optional) Indicates the default action, when this Tier applies to an endpoint, but takes no action on the packet | `Deny`, `Pass` | string | `Deny` | -All Policies created by $[prodname] orchestrator integrations are created in the default (last) Tier. +All Policies created by $[prodname] orchestrator integrations are created in the `default` Tier (order `1000000`), except Kubernetes AdminNetworkPolicies and BaselineAdminNetworkPolicies, which are created in the `adminnetworkpolicy` (order `1000`) and `baselineadminnetworkpolicy` (order `10000000`) Tiers.