Skip to content

DOCS-3087: Fix inaccuracies on the HostEndpoint reference #3123

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ctauchen merged 4 commits into from
Oct 19, 2026
Merged

DOCS-3087: Fix inaccuracies on the HostEndpoint reference #3123

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
cbc8512
Fix HostEndpoint default deny, wildcard, and field text (next)
ctauchen Oct 16, 2026
77b14a8
Fix HostEndpoint default deny, wildcard, and field text (3.33)
ctauchen Oct 16, 2026
5fcfaea
Fix HostEndpoint default deny, wildcard, and field text (3.32)
ctauchen Oct 16, 2026
b4ac0e8
Fix HostEndpoint default deny, wildcard, and field text (3.31)
ctauchen Oct 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions calico/_includes/content/_endpointport.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,9 @@ be referenced as a named port in [policy rules](../../reference/resources/networ

| Field | Description | Accepted Values | Schema | Default |
| -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------- | ------ | ------- |
| name | The name to attach to this port, allowing it to be referred to in [policy rules](../../reference/resources/networkpolicy.mdx#entityrule). Names must be unique within an endpoint. | | string | |
| protocol | The protocol of this named port. | `TCP`, `UDP`, `SCTP` | string | |
| port | The workload port number. | `1`-`65535` | int | |
| name | The name to attach to this port, allowing it to be referred to in [policy rules](../../reference/resources/networkpolicy.mdx#entityrule). Required. | | string | |
| protocol | The protocol of this named port. Required. | `TCP`, `UDP`, `SCTP` | string | |
| port | The port number. Required. | `1`-`65535` | int | |

:::note

Expand Down
16 changes: 8 additions & 8 deletions calico/reference/resources/hostendpoint.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,21 +20,21 @@

Each host endpoint may include a set of labels and list of profiles that $[prodname]
will use to apply
[policy](networkpolicy.mdx)
[policy](globalnetworkpolicy.mdx)
to the interface.

**Default behavior of external traffic to/from host**

If a host endpoint is created and network policy is not in place, the $[prodname] default is to deny traffic to/from that endpoint (except for traffic allowed by failsafe rules).
If a host endpoint is created and network policy is not in place, the $[prodname] default is to deny traffic to/from that endpoint (except for traffic allowed by failsafe rules, IP-in-IP or VXLAN traffic between $[prodname] nodes, and WireGuard traffic). Traffic forwarded through the endpoint is not denied by default; only policies with `applyOnForward: true` apply to it.
For a named host endpoint (i.e. a host endpoint representing a specific interface), $[prodname] blocks traffic only to/from the interface specified in the host endpoint. Traffic to/from other interfaces is ignored.

:::note

Host endpoints with `interfaceName: *` do not support [untracked policy](../../network-policy/extreme-traffic/high-connection-workloads.mdx).
With the iptables and nftables data planes, host endpoints with `interfaceName: *` do not support [untracked policy](../../network-policy/extreme-traffic/high-connection-workloads.mdx).

:::

For a wildcard host endpoint (i.e. a host endpoint representing all of a host's interfaces), $[prodname] blocks traffic to/from _all_ interfaces on the host (except for traffic allowed by failsafe rules).
For a wildcard host endpoint (i.e. a host endpoint representing all of a host's interfaces), $[prodname] blocks traffic to/from _all_ interfaces on the host except local workload interfaces (and except for traffic allowed by failsafe rules, IP-in-IP or VXLAN traffic between $[prodname] nodes, and WireGuard traffic). Traffic forwarded through the host is not denied by default; only policies with `applyOnForward: true` apply to it.

However, profiles can be used in conjunction with host endpoints to modify default behavior of external traffic to/from the host in the absence of network policy.
$[prodname] provides a default profile resource named `projectcalico-default-allow` that consists of allow-all ingress and egress rules.
Expand Down Expand Up @@ -91,18 +91,18 @@

| Field | Description | Accepted Values | Schema |
| ------ | ------------------------------------------ | --------------------------------------------------- | ------ |
| name | The name of this hostEndpoint. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string |
| name | The name of this hostEndpoint. Required. | Lowercase alphanumeric string with optional `.` or `-`. | string |
| labels | A set of labels to apply to this endpoint. | | map |

### Spec

| Field | Description | Accepted Values | Schema | Default |
| ------------- | -------------------------------------------------------------------------- | -------------------------- | -------------------------------------- | ------- |
| node | The name of the node where this HostEndpoint resides. | | string |
| interfaceName | Either `*` or the name of the specific interface on which to apply policy. | | string |
| node | The name of the node where this HostEndpoint resides. Required. | | string |
| interfaceName | Either `*`, the name of the specific interface on which to apply policy, or empty (to match the interface by `expectedIPs`). | | string |

Check failure on line 102 in calico/reference/resources/hostendpoint.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'interfaceName'?

Raw Output:
{"message":"[Vale.Spelling] Did you really mean 'interfaceName'?","location":{"path":"calico/reference/resources/hostendpoint.mdx","range":{"start":{"line":102,"column":3},"end":{"line":102,"column":16}}},"severity":"ERROR","code":{"value":"Vale.Spelling"}}
| expectedIPs | The expected IP addresses associated with the interface. | Valid IPv4 or IPv6 address | list |
| profiles | The list of profiles to apply to the endpoint. | | list |
| ports | List of named ports that this workload exposes. | | List of [EndpointPorts](#endpointport) |
| ports | List of named ports on this host endpoint. | | List of [EndpointPorts](#endpointport) |

### EndpointPort

Expand Down
6 changes: 3 additions & 3 deletions calico_versioned_docs/version-3.31/_includes/content/_endpointport.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,9 @@ be referenced as a named port in [policy rules](../../reference/resources/networ

| Field | Description | Accepted Values | Schema | Default |
| -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------- | ------ | ------- |
| name | The name to attach to this port, allowing it to be referred to in [policy rules](../../reference/resources/networkpolicy.mdx#entityrule). Names must be unique within an endpoint. | | string | |
| protocol | The protocol of this named port. | `TCP`, `UDP`, `SCTP` | string | |
| port | The workload port number. | `1`-`65535` | int | |
| name | The name to attach to this port, allowing it to be referred to in [policy rules](../../reference/resources/networkpolicy.mdx#entityrule). Required. | | string | |
| protocol | The protocol of this named port. Required. | `TCP`, `UDP`, `SCTP` | string | |
| port | The port number. Required. | `1`-`65535` | int | |

:::note

Expand Down
16 changes: 8 additions & 8 deletions calico_versioned_docs/version-3.31/reference/resources/hostendpoint.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,21 +20,21 @@

Each host endpoint may include a set of labels and list of profiles that $[prodname]
will use to apply
[policy](networkpolicy.mdx)
[policy](globalnetworkpolicy.mdx)
to the interface.

**Default behavior of external traffic to/from host**

If a host endpoint is created and network policy is not in place, the $[prodname] default is to deny traffic to/from that endpoint (except for traffic allowed by failsafe rules).
If a host endpoint is created and network policy is not in place, the $[prodname] default is to deny traffic to/from that endpoint (except for traffic allowed by failsafe rules, IP-in-IP or VXLAN traffic between $[prodname] nodes, and WireGuard traffic). Traffic forwarded through the endpoint is not denied by default; only policies with `applyOnForward: true` apply to it.
For a named host endpoint (i.e. a host endpoint representing a specific interface), $[prodname] blocks traffic only to/from the interface specified in the host endpoint. Traffic to/from other interfaces is ignored.

:::note

Host endpoints with `interfaceName: *` do not support [untracked policy](../../network-policy/extreme-traffic/high-connection-workloads.mdx).
With the iptables and nftables data planes, host endpoints with `interfaceName: *` do not support [untracked policy](../../network-policy/extreme-traffic/high-connection-workloads.mdx).

:::

For a wildcard host endpoint (i.e. a host endpoint representing all of a host's interfaces), $[prodname] blocks traffic to/from _all_ interfaces on the host (except for traffic allowed by failsafe rules).
For a wildcard host endpoint (i.e. a host endpoint representing all of a host's interfaces), $[prodname] blocks traffic to/from _all_ interfaces on the host except local workload interfaces (and except for traffic allowed by failsafe rules, IP-in-IP or VXLAN traffic between $[prodname] nodes, and WireGuard traffic). Traffic forwarded through the host is not denied by default; only policies with `applyOnForward: true` apply to it.

However, profiles can be used in conjunction with host endpoints to modify default behavior of external traffic to/from the host in the absence of network policy.
$[prodname] provides a default profile resource named `projectcalico-default-allow` that consists of allow-all ingress and egress rules.
Expand Down Expand Up @@ -91,18 +91,18 @@

| Field | Description | Accepted Values | Schema |
| ------ | ------------------------------------------ | --------------------------------------------------- | ------ |
| name | The name of this hostEndpoint. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string |
| name | The name of this hostEndpoint. Required. | Lowercase alphanumeric string with optional `.` or `-`. | string |
| labels | A set of labels to apply to this endpoint. | | map |

### Spec

| Field | Description | Accepted Values | Schema | Default |
| ------------- | -------------------------------------------------------------------------- | -------------------------- | -------------------------------------- | ------- |
| node | The name of the node where this HostEndpoint resides. | | string |
| interfaceName | Either `*` or the name of the specific interface on which to apply policy. | | string |
| node | The name of the node where this HostEndpoint resides. Required. | | string |
| interfaceName | Either `*`, the name of the specific interface on which to apply policy, or empty (to match the interface by `expectedIPs`). | | string |

Check failure on line 102 in calico_versioned_docs/version-3.31/reference/resources/hostendpoint.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'interfaceName'?

Raw Output:
{"message":"[Vale.Spelling] Did you really mean 'interfaceName'?","location":{"path":"calico_versioned_docs/version-3.31/reference/resources/hostendpoint.mdx","range":{"start":{"line":102,"column":3},"end":{"line":102,"column":16}}},"severity":"ERROR","code":{"value":"Vale.Spelling"}}
| expectedIPs | The expected IP addresses associated with the interface. | Valid IPv4 or IPv6 address | list |
| profiles | The list of profiles to apply to the endpoint. | | list |
| ports | List of named ports that this workload exposes. | | List of [EndpointPorts](#endpointport) |
| ports | List of named ports on this host endpoint. | | List of [EndpointPorts](#endpointport) |

### EndpointPort

Expand Down
6 changes: 3 additions & 3 deletions calico_versioned_docs/version-3.32/_includes/content/_endpointport.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,9 @@ be referenced as a named port in [policy rules](../../reference/resources/networ

| Field | Description | Accepted Values | Schema | Default |
| -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------- | ------ | ------- |
| name | The name to attach to this port, allowing it to be referred to in [policy rules](../../reference/resources/networkpolicy.mdx#entityrule). Names must be unique within an endpoint. | | string | |
| protocol | The protocol of this named port. | `TCP`, `UDP`, `SCTP` | string | |
| port | The workload port number. | `1`-`65535` | int | |
| name | The name to attach to this port, allowing it to be referred to in [policy rules](../../reference/resources/networkpolicy.mdx#entityrule). Required. | | string | |
| protocol | The protocol of this named port. Required. | `TCP`, `UDP`, `SCTP` | string | |
| port | The port number. Required. | `1`-`65535` | int | |

:::note

Expand Down
16 changes: 8 additions & 8 deletions calico_versioned_docs/version-3.32/reference/resources/hostendpoint.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,21 +20,21 @@

Each host endpoint may include a set of labels and list of profiles that $[prodname]
will use to apply
[policy](networkpolicy.mdx)
[policy](globalnetworkpolicy.mdx)
to the interface.

**Default behavior of external traffic to/from host**

If a host endpoint is created and network policy is not in place, the $[prodname] default is to deny traffic to/from that endpoint (except for traffic allowed by failsafe rules).
If a host endpoint is created and network policy is not in place, the $[prodname] default is to deny traffic to/from that endpoint (except for traffic allowed by failsafe rules, IP-in-IP or VXLAN traffic between $[prodname] nodes, and WireGuard traffic). Traffic forwarded through the endpoint is not denied by default; only policies with `applyOnForward: true` apply to it.
For a named host endpoint (i.e. a host endpoint representing a specific interface), $[prodname] blocks traffic only to/from the interface specified in the host endpoint. Traffic to/from other interfaces is ignored.

:::note

Host endpoints with `interfaceName: *` do not support [untracked policy](../../network-policy/extreme-traffic/high-connection-workloads.mdx).
With the iptables and nftables data planes, host endpoints with `interfaceName: *` do not support [untracked policy](../../network-policy/extreme-traffic/high-connection-workloads.mdx).

:::

For a wildcard host endpoint (i.e. a host endpoint representing all of a host's interfaces), $[prodname] blocks traffic to/from _all_ interfaces on the host (except for traffic allowed by failsafe rules).
For a wildcard host endpoint (i.e. a host endpoint representing all of a host's interfaces), $[prodname] blocks traffic to/from _all_ interfaces on the host except local workload interfaces (and except for traffic allowed by failsafe rules, IP-in-IP or VXLAN traffic between $[prodname] nodes, and WireGuard traffic). Traffic forwarded through the host is not denied by default; only policies with `applyOnForward: true` apply to it.

However, profiles can be used in conjunction with host endpoints to modify default behavior of external traffic to/from the host in the absence of network policy.
$[prodname] provides a default profile resource named `projectcalico-default-allow` that consists of allow-all ingress and egress rules.
Expand Down Expand Up @@ -91,18 +91,18 @@

| Field | Description | Accepted Values | Schema |
| ------ | ------------------------------------------ | --------------------------------------------------- | ------ |
| name | The name of this hostEndpoint. Required. | Alphanumeric string with optional `.`, `_`, or `-`. | string |
| name | The name of this hostEndpoint. Required. | Lowercase alphanumeric string with optional `.` or `-`. | string |
| labels | A set of labels to apply to this endpoint. | | map |

### Spec

| Field | Description | Accepted Values | Schema | Default |
| ------------- | -------------------------------------------------------------------------- | -------------------------- | -------------------------------------- | ------- |
| node | The name of the node where this HostEndpoint resides. | | string |
| interfaceName | Either `*` or the name of the specific interface on which to apply policy. | | string |
| node | The name of the node where this HostEndpoint resides. Required. | | string |
| interfaceName | Either `*`, the name of the specific interface on which to apply policy, or empty (to match the interface by `expectedIPs`). | | string |

Check failure on line 102 in calico_versioned_docs/version-3.32/reference/resources/hostendpoint.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'interfaceName'?

Raw Output:
{"message":"[Vale.Spelling] Did you really mean 'interfaceName'?","location":{"path":"calico_versioned_docs/version-3.32/reference/resources/hostendpoint.mdx","range":{"start":{"line":102,"column":3},"end":{"line":102,"column":16}}},"severity":"ERROR","code":{"value":"Vale.Spelling"}}
| expectedIPs | The expected IP addresses associated with the interface. | Valid IPv4 or IPv6 address | list |
| profiles | The list of profiles to apply to the endpoint. | | list |
| ports | List of named ports that this workload exposes. | | List of [EndpointPorts](#endpointport) |
| ports | List of named ports on this host endpoint. | | List of [EndpointPorts](#endpointport) |

### EndpointPort

Expand Down
Loading
Loading