From cbc8512c05a19664e308fb65b10b29e6914172cf Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Fri, 16 Oct 2026 12:56:16 +0100 Subject: [PATCH 1/4] Fix HostEndpoint default deny, wildcard, and field text (next) --- calico/_includes/content/_endpointport.mdx | 6 +++--- calico/reference/resources/hostendpoint.mdx | 16 ++++++++-------- 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/calico/_includes/content/_endpointport.mdx b/calico/_includes/content/_endpointport.mdx index 05dde33612..cc49ff48a7 100644 --- a/calico/_includes/content/_endpointport.mdx +++ b/calico/_includes/content/_endpointport.mdx @@ -3,9 +3,9 @@ be referenced as a named port in [policy rules](../../reference/resources/networ | Field | Description | Accepted Values | Schema | Default | | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------- | ------ | ------- | -| name | The name to attach to this port, allowing it to be referred to in [policy rules](../../reference/resources/networkpolicy.mdx#entityrule). Names must be unique within an endpoint. | | string | | -| protocol | The protocol of this named port. | `TCP`, `UDP`, `SCTP` | string | | -| port | The workload port number. | `1`-`65535` | int | | +| name | The name to attach to this port, allowing it to be referred to in [policy rules](../../reference/resources/networkpolicy.mdx#entityrule). Required. | | string | | +| protocol | The protocol of this named port. Required. | `TCP`, `UDP`, `SCTP` | string | | +| port | The port number. Required. | `1`-`65535` | int | | :::note diff --git a/calico/reference/resources/hostendpoint.mdx b/calico/reference/resources/hostendpoint.mdx index bd0601ee79..cdd9d90818 100644 --- a/calico/reference/resources/hostendpoint.mdx +++ b/calico/reference/resources/hostendpoint.mdx @@ -20,21 +20,21 @@ interfaces. Each host endpoint may include a set of labels and list of profiles that $[prodname] will use to apply -[policy](networkpolicy.mdx) +[policy](globalnetworkpolicy.mdx) to the interface. **Default behavior of external traffic to/from host** -If a host endpoint is created and network policy is not in place, the $[prodname] default is to deny traffic to/from that endpoint (except for traffic allowed by failsafe rules). +If a host endpoint is created and network policy is not in place, the $[prodname] default is to deny traffic to/from that endpoint (except for traffic allowed by failsafe rules, IP-in-IP or VXLAN traffic between $[prodname] nodes, and WireGuard traffic). Traffic forwarded through the endpoint is not denied by default; only policies with `applyOnForward: true` apply to it. For a named host endpoint (i.e. a host endpoint representing a specific interface), $[prodname] blocks traffic only to/from the interface specified in the host endpoint. Traffic to/from other interfaces is ignored. :::note -Host endpoints with `interfaceName: *` do not support [untracked policy](../../network-policy/extreme-traffic/high-connection-workloads.mdx). +With the iptables and nftables data planes, host endpoints with `interfaceName: *` do not support [untracked policy](../../network-policy/extreme-traffic/high-connection-workloads.mdx). ::: -For a wildcard host endpoint (i.e. a host endpoint representing all of a host's interfaces), $[prodname] blocks traffic to/from _all_ interfaces on the host (except for traffic allowed by failsafe rules). +For a wildcard host endpoint (i.e. a host endpoint representing all of a host's interfaces), $[prodname] blocks traffic to/from _all_ interfaces on the host except local workload interfaces (and except for traffic allowed by failsafe rules, IP-in-IP or VXLAN traffic between $[prodname] nodes, and WireGuard traffic). Traffic forwarded through the host is not denied by default; only policies with `applyOnForward: true` apply to it. However, profiles can be used in conjunction with host endpoints to modify default behavior of external traffic to/from the host in the absence of network policy. $[prodname] provides a default profile resource named `projectcalico-default-allow` that consists of allow-all ingress and egress rules. @@ -91,18 +91,18 @@ spec: | Field | Description | Accepted Values | Schema | | ------ | ------------------------------------------ | --------------------------------------------------- | ------ | -| name | The name of this hostEndpoint. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | +| name | The name of this hostEndpoint. Required. | Lowercase alphanumeric string with optional `.` or `-`. | string | | labels | A set of labels to apply to this endpoint. | | map | ### Spec | Field | Description | Accepted Values | Schema | Default | | ------------- | -------------------------------------------------------------------------- | -------------------------- | -------------------------------------- | ------- | -| node | The name of the node where this HostEndpoint resides. | | string | -| interfaceName | Either `*` or the name of the specific interface on which to apply policy. | | string | +| node | The name of the node where this HostEndpoint resides. Required. | | string | +| interfaceName | Either `*`, the name of the specific interface on which to apply policy, or empty (to match the interface by `expectedIPs`). | | string | | expectedIPs | The expected IP addresses associated with the interface. | Valid IPv4 or IPv6 address | list | | profiles | The list of profiles to apply to the endpoint. | | list | -| ports | List of named ports that this workload exposes. | | List of [EndpointPorts](#endpointport) | +| ports | List of named ports on this host endpoint. | | List of [EndpointPorts](#endpointport) | ### EndpointPort From 77b14a875b813f42d6df4b5efa8237e95a33a314 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Fri, 16 Oct 2026 12:56:16 +0100 Subject: [PATCH 2/4] Fix HostEndpoint default deny, wildcard, and field text (3.33) --- .../_includes/content/_endpointport.mdx | 6 +++--- .../reference/resources/hostendpoint.mdx | 16 ++++++++-------- 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/calico_versioned_docs/version-3.33/_includes/content/_endpointport.mdx b/calico_versioned_docs/version-3.33/_includes/content/_endpointport.mdx index 05dde33612..cc49ff48a7 100644 --- a/calico_versioned_docs/version-3.33/_includes/content/_endpointport.mdx +++ b/calico_versioned_docs/version-3.33/_includes/content/_endpointport.mdx @@ -3,9 +3,9 @@ be referenced as a named port in [policy rules](../../reference/resources/networ | Field | Description | Accepted Values | Schema | Default | | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------- | ------ | ------- | -| name | The name to attach to this port, allowing it to be referred to in [policy rules](../../reference/resources/networkpolicy.mdx#entityrule). Names must be unique within an endpoint. | | string | | -| protocol | The protocol of this named port. | `TCP`, `UDP`, `SCTP` | string | | -| port | The workload port number. | `1`-`65535` | int | | +| name | The name to attach to this port, allowing it to be referred to in [policy rules](../../reference/resources/networkpolicy.mdx#entityrule). Required. | | string | | +| protocol | The protocol of this named port. Required. | `TCP`, `UDP`, `SCTP` | string | | +| port | The port number. Required. | `1`-`65535` | int | | :::note diff --git a/calico_versioned_docs/version-3.33/reference/resources/hostendpoint.mdx b/calico_versioned_docs/version-3.33/reference/resources/hostendpoint.mdx index 6ffc8aa7d1..45fdb8272c 100644 --- a/calico_versioned_docs/version-3.33/reference/resources/hostendpoint.mdx +++ b/calico_versioned_docs/version-3.33/reference/resources/hostendpoint.mdx @@ -20,21 +20,21 @@ interfaces. Each host endpoint may include a set of labels and list of profiles that $[prodname] will use to apply -[policy](networkpolicy.mdx) +[policy](globalnetworkpolicy.mdx) to the interface. **Default behavior of external traffic to/from host** -If a host endpoint is created and network policy is not in place, the $[prodname] default is to deny traffic to/from that endpoint (except for traffic allowed by failsafe rules). +If a host endpoint is created and network policy is not in place, the $[prodname] default is to deny traffic to/from that endpoint (except for traffic allowed by failsafe rules, IP-in-IP or VXLAN traffic between $[prodname] nodes, and WireGuard traffic). Traffic forwarded through the endpoint is not denied by default; only policies with `applyOnForward: true` apply to it. For a named host endpoint (i.e. a host endpoint representing a specific interface), $[prodname] blocks traffic only to/from the interface specified in the host endpoint. Traffic to/from other interfaces is ignored. :::note -Host endpoints with `interfaceName: *` do not support [untracked policy](../../network-policy/extreme-traffic/high-connection-workloads.mdx). +With the iptables and nftables data planes, host endpoints with `interfaceName: *` do not support [untracked policy](../../network-policy/extreme-traffic/high-connection-workloads.mdx). ::: -For a wildcard host endpoint (i.e. a host endpoint representing all of a host's interfaces), $[prodname] blocks traffic to/from _all_ interfaces on the host (except for traffic allowed by failsafe rules). +For a wildcard host endpoint (i.e. a host endpoint representing all of a host's interfaces), $[prodname] blocks traffic to/from _all_ interfaces on the host except local workload interfaces (and except for traffic allowed by failsafe rules, IP-in-IP or VXLAN traffic between $[prodname] nodes, and WireGuard traffic). Traffic forwarded through the host is not denied by default; only policies with `applyOnForward: true` apply to it. However, profiles can be used in conjunction with host endpoints to modify default behavior of external traffic to/from the host in the absence of network policy. $[prodname] provides a default profile resource named `projectcalico-default-allow` that consists of allow-all ingress and egress rules. @@ -91,18 +91,18 @@ spec: | Field | Description | Accepted Values | Schema | | ------ | ------------------------------------------ | --------------------------------------------------- | ------ | -| name | The name of this hostEndpoint. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | +| name | The name of this hostEndpoint. Required. | Lowercase alphanumeric string with optional `.` or `-`. | string | | labels | A set of labels to apply to this endpoint. | | map | ### Spec | Field | Description | Accepted Values | Schema | Default | | ------------- | -------------------------------------------------------------------------- | -------------------------- | -------------------------------------- | ------- | -| node | The name of the node where this HostEndpoint resides. | | string | -| interfaceName | Either `*` or the name of the specific interface on which to apply policy. | | string | +| node | The name of the node where this HostEndpoint resides. Required. | | string | +| interfaceName | Either `*`, the name of the specific interface on which to apply policy, or empty (to match the interface by `expectedIPs`). | | string | | expectedIPs | The expected IP addresses associated with the interface. | Valid IPv4 or IPv6 address | list | | profiles | The list of profiles to apply to the endpoint. | | list | -| ports | List of named ports that this workload exposes. | | List of [EndpointPorts](#endpointport) | +| ports | List of named ports on this host endpoint. | | List of [EndpointPorts](#endpointport) | ### EndpointPort From 5fcfaea7229a8dd241ebe234e3b0a829e42cf673 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Fri, 16 Oct 2026 12:56:16 +0100 Subject: [PATCH 3/4] Fix HostEndpoint default deny, wildcard, and field text (3.32) --- .../_includes/content/_endpointport.mdx | 6 +++--- .../reference/resources/hostendpoint.mdx | 16 ++++++++-------- 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/calico_versioned_docs/version-3.32/_includes/content/_endpointport.mdx b/calico_versioned_docs/version-3.32/_includes/content/_endpointport.mdx index 05dde33612..cc49ff48a7 100644 --- a/calico_versioned_docs/version-3.32/_includes/content/_endpointport.mdx +++ b/calico_versioned_docs/version-3.32/_includes/content/_endpointport.mdx @@ -3,9 +3,9 @@ be referenced as a named port in [policy rules](../../reference/resources/networ | Field | Description | Accepted Values | Schema | Default | | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------- | ------ | ------- | -| name | The name to attach to this port, allowing it to be referred to in [policy rules](../../reference/resources/networkpolicy.mdx#entityrule). Names must be unique within an endpoint. | | string | | -| protocol | The protocol of this named port. | `TCP`, `UDP`, `SCTP` | string | | -| port | The workload port number. | `1`-`65535` | int | | +| name | The name to attach to this port, allowing it to be referred to in [policy rules](../../reference/resources/networkpolicy.mdx#entityrule). Required. | | string | | +| protocol | The protocol of this named port. Required. | `TCP`, `UDP`, `SCTP` | string | | +| port | The port number. Required. | `1`-`65535` | int | | :::note diff --git a/calico_versioned_docs/version-3.32/reference/resources/hostendpoint.mdx b/calico_versioned_docs/version-3.32/reference/resources/hostendpoint.mdx index 25cc5e0477..9aff7920d3 100644 --- a/calico_versioned_docs/version-3.32/reference/resources/hostendpoint.mdx +++ b/calico_versioned_docs/version-3.32/reference/resources/hostendpoint.mdx @@ -20,21 +20,21 @@ interfaces. Each host endpoint may include a set of labels and list of profiles that $[prodname] will use to apply -[policy](networkpolicy.mdx) +[policy](globalnetworkpolicy.mdx) to the interface. **Default behavior of external traffic to/from host** -If a host endpoint is created and network policy is not in place, the $[prodname] default is to deny traffic to/from that endpoint (except for traffic allowed by failsafe rules). +If a host endpoint is created and network policy is not in place, the $[prodname] default is to deny traffic to/from that endpoint (except for traffic allowed by failsafe rules, IP-in-IP or VXLAN traffic between $[prodname] nodes, and WireGuard traffic). Traffic forwarded through the endpoint is not denied by default; only policies with `applyOnForward: true` apply to it. For a named host endpoint (i.e. a host endpoint representing a specific interface), $[prodname] blocks traffic only to/from the interface specified in the host endpoint. Traffic to/from other interfaces is ignored. :::note -Host endpoints with `interfaceName: *` do not support [untracked policy](../../network-policy/extreme-traffic/high-connection-workloads.mdx). +With the iptables and nftables data planes, host endpoints with `interfaceName: *` do not support [untracked policy](../../network-policy/extreme-traffic/high-connection-workloads.mdx). ::: -For a wildcard host endpoint (i.e. a host endpoint representing all of a host's interfaces), $[prodname] blocks traffic to/from _all_ interfaces on the host (except for traffic allowed by failsafe rules). +For a wildcard host endpoint (i.e. a host endpoint representing all of a host's interfaces), $[prodname] blocks traffic to/from _all_ interfaces on the host except local workload interfaces (and except for traffic allowed by failsafe rules, IP-in-IP or VXLAN traffic between $[prodname] nodes, and WireGuard traffic). Traffic forwarded through the host is not denied by default; only policies with `applyOnForward: true` apply to it. However, profiles can be used in conjunction with host endpoints to modify default behavior of external traffic to/from the host in the absence of network policy. $[prodname] provides a default profile resource named `projectcalico-default-allow` that consists of allow-all ingress and egress rules. @@ -91,18 +91,18 @@ spec: | Field | Description | Accepted Values | Schema | | ------ | ------------------------------------------ | --------------------------------------------------- | ------ | -| name | The name of this hostEndpoint. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | +| name | The name of this hostEndpoint. Required. | Lowercase alphanumeric string with optional `.` or `-`. | string | | labels | A set of labels to apply to this endpoint. | | map | ### Spec | Field | Description | Accepted Values | Schema | Default | | ------------- | -------------------------------------------------------------------------- | -------------------------- | -------------------------------------- | ------- | -| node | The name of the node where this HostEndpoint resides. | | string | -| interfaceName | Either `*` or the name of the specific interface on which to apply policy. | | string | +| node | The name of the node where this HostEndpoint resides. Required. | | string | +| interfaceName | Either `*`, the name of the specific interface on which to apply policy, or empty (to match the interface by `expectedIPs`). | | string | | expectedIPs | The expected IP addresses associated with the interface. | Valid IPv4 or IPv6 address | list | | profiles | The list of profiles to apply to the endpoint. | | list | -| ports | List of named ports that this workload exposes. | | List of [EndpointPorts](#endpointport) | +| ports | List of named ports on this host endpoint. | | List of [EndpointPorts](#endpointport) | ### EndpointPort From b4ac0e81ef27a5b9f382ee3ebb10152360460352 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Fri, 16 Oct 2026 12:56:16 +0100 Subject: [PATCH 4/4] Fix HostEndpoint default deny, wildcard, and field text (3.31) --- .../_includes/content/_endpointport.mdx | 6 +++--- .../reference/resources/hostendpoint.mdx | 16 ++++++++-------- 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/calico_versioned_docs/version-3.31/_includes/content/_endpointport.mdx b/calico_versioned_docs/version-3.31/_includes/content/_endpointport.mdx index 05dde33612..cc49ff48a7 100644 --- a/calico_versioned_docs/version-3.31/_includes/content/_endpointport.mdx +++ b/calico_versioned_docs/version-3.31/_includes/content/_endpointport.mdx @@ -3,9 +3,9 @@ be referenced as a named port in [policy rules](../../reference/resources/networ | Field | Description | Accepted Values | Schema | Default | | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------- | ------ | ------- | -| name | The name to attach to this port, allowing it to be referred to in [policy rules](../../reference/resources/networkpolicy.mdx#entityrule). Names must be unique within an endpoint. | | string | | -| protocol | The protocol of this named port. | `TCP`, `UDP`, `SCTP` | string | | -| port | The workload port number. | `1`-`65535` | int | | +| name | The name to attach to this port, allowing it to be referred to in [policy rules](../../reference/resources/networkpolicy.mdx#entityrule). Required. | | string | | +| protocol | The protocol of this named port. Required. | `TCP`, `UDP`, `SCTP` | string | | +| port | The port number. Required. | `1`-`65535` | int | | :::note diff --git a/calico_versioned_docs/version-3.31/reference/resources/hostendpoint.mdx b/calico_versioned_docs/version-3.31/reference/resources/hostendpoint.mdx index 23793521f2..05761165dc 100644 --- a/calico_versioned_docs/version-3.31/reference/resources/hostendpoint.mdx +++ b/calico_versioned_docs/version-3.31/reference/resources/hostendpoint.mdx @@ -20,21 +20,21 @@ interfaces. Each host endpoint may include a set of labels and list of profiles that $[prodname] will use to apply -[policy](networkpolicy.mdx) +[policy](globalnetworkpolicy.mdx) to the interface. **Default behavior of external traffic to/from host** -If a host endpoint is created and network policy is not in place, the $[prodname] default is to deny traffic to/from that endpoint (except for traffic allowed by failsafe rules). +If a host endpoint is created and network policy is not in place, the $[prodname] default is to deny traffic to/from that endpoint (except for traffic allowed by failsafe rules, IP-in-IP or VXLAN traffic between $[prodname] nodes, and WireGuard traffic). Traffic forwarded through the endpoint is not denied by default; only policies with `applyOnForward: true` apply to it. For a named host endpoint (i.e. a host endpoint representing a specific interface), $[prodname] blocks traffic only to/from the interface specified in the host endpoint. Traffic to/from other interfaces is ignored. :::note -Host endpoints with `interfaceName: *` do not support [untracked policy](../../network-policy/extreme-traffic/high-connection-workloads.mdx). +With the iptables and nftables data planes, host endpoints with `interfaceName: *` do not support [untracked policy](../../network-policy/extreme-traffic/high-connection-workloads.mdx). ::: -For a wildcard host endpoint (i.e. a host endpoint representing all of a host's interfaces), $[prodname] blocks traffic to/from _all_ interfaces on the host (except for traffic allowed by failsafe rules). +For a wildcard host endpoint (i.e. a host endpoint representing all of a host's interfaces), $[prodname] blocks traffic to/from _all_ interfaces on the host except local workload interfaces (and except for traffic allowed by failsafe rules, IP-in-IP or VXLAN traffic between $[prodname] nodes, and WireGuard traffic). Traffic forwarded through the host is not denied by default; only policies with `applyOnForward: true` apply to it. However, profiles can be used in conjunction with host endpoints to modify default behavior of external traffic to/from the host in the absence of network policy. $[prodname] provides a default profile resource named `projectcalico-default-allow` that consists of allow-all ingress and egress rules. @@ -91,18 +91,18 @@ spec: | Field | Description | Accepted Values | Schema | | ------ | ------------------------------------------ | --------------------------------------------------- | ------ | -| name | The name of this hostEndpoint. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string | +| name | The name of this hostEndpoint. Required. | Lowercase alphanumeric string with optional `.` or `-`. | string | | labels | A set of labels to apply to this endpoint. | | map | ### Spec | Field | Description | Accepted Values | Schema | Default | | ------------- | -------------------------------------------------------------------------- | -------------------------- | -------------------------------------- | ------- | -| node | The name of the node where this HostEndpoint resides. | | string | -| interfaceName | Either `*` or the name of the specific interface on which to apply policy. | | string | +| node | The name of the node where this HostEndpoint resides. Required. | | string | +| interfaceName | Either `*`, the name of the specific interface on which to apply policy, or empty (to match the interface by `expectedIPs`). | | string | | expectedIPs | The expected IP addresses associated with the interface. | Valid IPv4 or IPv6 address | list | | profiles | The list of profiles to apply to the endpoint. | | list | -| ports | List of named ports that this workload exposes. | | List of [EndpointPorts](#endpointport) | +| ports | List of named ports on this host endpoint. | | List of [EndpointPorts](#endpointport) | ### EndpointPort