Skip to content

DOCS-3087: Fix inaccuracies on the HostEndpoint reference - #3123

Merged
ctauchen merged 4 commits into
tigera:mainfrom
ctauchen:DOCS-3087-fact-check-hostendpoint
Oct 19, 2026
Merged

ctauchen merged 4 commits into
tigera:mainfrom
ctauchen:DOCS-3087-fact-check-hostendpoint

Conversation

@ctauchen

@ctauchen ctauchen commented Oct 16, 2026 •

Copy link
Copy Markdown
Collaborator

Fixes inaccuracies on the HostEndpoint reference page and the shared EndpointPort table, found and verified with the calico-fact-check skill.

  • The policy link pointed to NetworkPolicy, which has no effect on host endpoints. It now points to GlobalNetworkPolicy.
  • Default deny also lets through IP-in-IP and VXLAN traffic between nodes and WireGuard traffic, and forwarded traffic is only affected by applyOnForward policies. This applies to named and wildcard host endpoints.
  • A wildcard host endpoint does not block local workload interfaces.
  • The untracked policy limit for wildcard host endpoints applies to the iptables and nftables data planes. With eBPF the untracked policy is enforced.
  • name: lowercase only, and no underscores.
  • interfaceName can be empty when expectedIPs is set.
  • ports: the named ports belong to the host endpoint, not a workload.
  • node, and the EndpointPort name, protocol and port, are marked Required.
  • EndpointPort names do not have to be unique. Duplicates are accepted and both are programmed.

Changes next, 3.33, 3.32 and 3.31. Each fix was reproduced on a kind cluster running that tree's release: v3.33.0 for next and 3.33, v3.32.2 for 3.32, v3.31.7 for 3.31.

Not changed, for follow-up:

  • A wildcard host endpoint with no policy also blocks loopback, which can make calico-node fail its health checks. The page does not warn about this.
  • Named ports on a host endpoint only resolve against its expectedIPs.
  • EndpointPort protocol also accepts 6, 17 and 132, and the unquoted interfaceName: * in the examples may not parse as YAML.

Previous attempt: #3085.

Preview the changed page:

Next and 3.33 were verified in both API server mode and native v3 CRD mode, except the nftables case of the wildcard host endpoint fix and the WireGuard exception of the forwarded traffic fix, which were verified in API server mode only.

Copilot AI lite review requested due to automatic review settings October 16, 2026 11:56

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

The documentation updates were fully reviewed with no unresolved blocking issues.

0 open findings

What changed in this PR

Updates HostEndpoint and EndpointPort reference documentation across current, 3.33, 3.32, and 3.31.

Changes:

  • Corrects policy behavior and default-traffic descriptions.
  • Clarifies HostEndpoint field constraints and port ownership.
  • Corrects EndpointPort requirements and naming behavior.
File Description
calico/​reference/​resources/​hostendpoint.mdx Updated current HostEndpoint reference.
calico/​_includes/​content/​_endpointport.mdx Updated current EndpointPort table.
calico_versioned_docs/​version-3.33/​reference/​resources/​hostendpoint.mdx Updated 3.33 HostEndpoint reference.
calico_versioned_docs/​version-3.33/​_includes/​content/​_endpointport.mdx Updated 3.33 EndpointPort table.
calico_versioned_docs/​version-3.32/​reference/​resources/​hostendpoint.mdx Updated 3.32 HostEndpoint reference.
calico_versioned_docs/​version-3.32/​_includes/​content/​_endpointport.mdx Updated 3.32 EndpointPort table.
calico_versioned_docs/​version-3.31/​reference/​resources/​hostendpoint.mdx Updated 3.31 HostEndpoint reference.
calico_versioned_docs/​version-3.31/​_includes/​content/​_endpointport.mdx Updated 3.31 EndpointPort table.

🧠 Review effort: Lite


💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@netlify

netlify Bot commented Oct 16, 2026 •

Copy link
Copy Markdown

✅ Deploy Preview succeeded!

Built without sensitive environment variables

Name Link
🔨 Latest commit b4ac0e8
🔍 Latest deploy log https://app.netlify.com/projects/tigera/deploys/6ad2110ac8618701b97378a1
😎 Deploy Preview https://deploy-preview-3123--tigera.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
Lighthouse
Lighthouse
1 paths audited
Performance: 75 (🟢 up 2 from production)
Accessibility: 98 (no change from production)
Best Practices: 92 (no change from production)
SEO: 100 (no change from production)
PWA: -
View the detailed breakdown and full score reports
🤖 Make changes Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

@netlify

netlify Bot commented Oct 16, 2026 •

Copy link
Copy Markdown

✅ Deploy Preview for calico-docs-preview-next ready!

Name Link
🔨 Latest commit b4ac0e8
🔍 Latest deploy log https://app.netlify.com/projects/calico-docs-preview-next/deploys/6ad2110add7c860afa0f2263
😎 Deploy Preview https://deploy-preview-3123--calico-docs-preview-next.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
🤖 Make changes Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

@ctauchen

Copy link
Copy Markdown
Collaborator Author

LGTM

@ctauchen
ctauchen marked this pull request as ready for review October 19, 2026 14:11
@ctauchen
ctauchen requested a review from a team as a code owner October 19, 2026 14:11
@ctauchen
ctauchen merged commit b6f3f66 into tigera:main Oct 19, 2026
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants