From dbc3f1def5d568147ae2fbf7759128b7281eba76 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Tue, 20 Oct 2026 07:55:30 +0100 Subject: [PATCH 1/4] Fix inaccuracies on the BGPFilter reference for next Correct statements on the BGPFilter page that a kind cluster running the release showed to be wrong. --- calico/reference/resources/bgpfilter.mdx | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/calico/reference/resources/bgpfilter.mdx b/calico/reference/resources/bgpfilter.mdx index 66d22fa311..58190ed937 100644 --- a/calico/reference/resources/bgpfilter.mdx +++ b/calico/reference/resources/bgpfilter.mdx @@ -11,7 +11,8 @@ specified by a [BGP peer resource](bgppeer.mdx) (`BGPPeer`). The BGPFilter rules are applied sequentially: the `action` for the **first** rule that matches is executed immediately. If an address does not match any explicit BGP filter rule, -the default action is `Accept`. +it is accepted on import. On export, it is advertised only if +Calico would advertise it to that peer without the filter. In order for a BGPFilter to be used in a BGP peering, its `name` must be added to `filters` of the corresponding BGPPeer resource. @@ -61,7 +62,7 @@ spec: | Field | Description | Accepted Values | Schema | | ----- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | -| `name` | Unique name to describe this resource instance. Must be specified. | Alphanumeric string with optional `.`, `_`, or `-`. | string | +| `name` | Unique name to describe this resource instance. Must be specified. | Lowercase alphanumeric string with optional `.` or `-`. | string | ### Spec @@ -84,7 +85,8 @@ spec: | `peerType` | Only apply this rule to routes from/to the specified BGP peer type. If empty, the rule applies to all peers. | `eBGP`, `iBGP` | string | | | `priority` | Only apply this rule to routes with the given priority (metric). Uses the same units as the `...RoutePriority` fields in FelixConfiguration. | 1-2147483646 | integer | | | `communities` | Only apply this rule to routes carrying the specified BGP community. | See [BGP Filter Community Match](#bgp-filter-community-match). | object | | -| `action` | Action to be taken for this rule | `Accept` or `Reject` | string | | +| `asPathPrefix` | Only apply this rule to routes whose AS path begins with the specified sequence of AS numbers. | A list of valid AS numbers. | list of integer | | +| `action` | Action to be taken for this rule. Required.| `Accept` or `Reject` | string | | | `operations` | Ordered list of route modifications to apply when the rule matches. Only valid when action is `Accept`. Maximum 10 operations. | See [BGP Filter Operation](#bgp-filter-operation). | list | | ### BGP Filter Rule v6 @@ -106,14 +108,14 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ------ | --------------------------------------------- | ------------------------------------------------------------------- | ------ | ------- | -| `min` | Smallest matched mask size (0 by default) | Valid integers between 0 and ipv4/6 max (32, 128) | int | | -| `max` | Largest matched mask size (32/128 by default) | Valid integers between 1 and ipv4/6 max (32, 128) | int | | +| `min` | Smallest matched mask size (the CIDR's mask size by default) | Valid integers between 0 and ipv4/6 max (32, 128) | int | | +| `max` | Largest matched mask size (32/128 by default) | Valid integers between 0 and ipv4/6 max (32, 128) | int | | ### BGP Filter Community Match | Field | Description | Accepted Values | Schema | | ------ | ---------------------------------------------------------------------------------------------------- | ------------------------------------------------------------ | -------------- | -| `values` | List of BGP community values to match against. The route must carry at least one of these communities. | Standard (`aa:nn`) or large (`aa:nn:mm`) community values. | list of string | +| `values` | List of BGP community values to match against. Required. Must contain exactly one value, which the route must carry. | Standard (`aa:nn`) or large (`aa:nn:mm`) community values. | list of string | ### BGP Filter Operation @@ -129,16 +131,16 @@ Each operation is an object with exactly one of the following fields set: | Field | Description | Accepted Values | Schema | | ----- | ---------------------------- | ---------------------------------------------------------- | ------ | -| `value` | BGP community value to add. | Standard (`aa:nn`) or large (`aa:nn:mm`) community value. | string | +| `value` | BGP community value to add. Required. | Standard (`aa:nn`) or large (`aa:nn:mm`) community value. | string | ### BGP Filter Prepend AS Path | Field | Description | Accepted Values | Schema | | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------- | ---------------- | -| `prefix` | Sequence of AS numbers to prepend to the route's AS path. The resulting path starts with these AS numbers in the order listed (e.g., `[65000, 65001]` produces `65000 65001 `). | A list of 1-10 valid AS numbers. | list of integer | +| `prefix` | Sequence of AS numbers to prepend to the route's AS path. Required. The resulting path starts with these AS numbers in the order listed (e.g., `[65000, 65001]` produces `65000 65001 `). | A list of 1-10 valid AS numbers. | list of integer | ### BGP Filter Set Priority | Field | Description | Accepted Values | Schema | | ----- | ---------------------------------------------------------------------------------------------------------- | --------------- | ------- | -| `value` | The priority (metric) value to set on the route. Uses the same units as FelixConfiguration RoutePriority fields. | 1-2147483646 | integer | +| `value` | The priority (metric) value to set on the route. Required. Uses the same units as FelixConfiguration RoutePriority fields. | 1-2147483646 | integer | From e29d40f9e2c55a8c3cde469fa18c718b56edf007 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Tue, 20 Oct 2026 07:55:31 +0100 Subject: [PATCH 2/4] Fix inaccuracies on the BGPFilter reference for 3.33 Correct statements on the BGPFilter page that a kind cluster running the release showed to be wrong. --- .../reference/resources/bgpfilter.mdx | 20 ++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/calico_versioned_docs/version-3.33/reference/resources/bgpfilter.mdx b/calico_versioned_docs/version-3.33/reference/resources/bgpfilter.mdx index 66d22fa311..58190ed937 100644 --- a/calico_versioned_docs/version-3.33/reference/resources/bgpfilter.mdx +++ b/calico_versioned_docs/version-3.33/reference/resources/bgpfilter.mdx @@ -11,7 +11,8 @@ specified by a [BGP peer resource](bgppeer.mdx) (`BGPPeer`). The BGPFilter rules are applied sequentially: the `action` for the **first** rule that matches is executed immediately. If an address does not match any explicit BGP filter rule, -the default action is `Accept`. +it is accepted on import. On export, it is advertised only if +Calico would advertise it to that peer without the filter. In order for a BGPFilter to be used in a BGP peering, its `name` must be added to `filters` of the corresponding BGPPeer resource. @@ -61,7 +62,7 @@ spec: | Field | Description | Accepted Values | Schema | | ----- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | -| `name` | Unique name to describe this resource instance. Must be specified. | Alphanumeric string with optional `.`, `_`, or `-`. | string | +| `name` | Unique name to describe this resource instance. Must be specified. | Lowercase alphanumeric string with optional `.` or `-`. | string | ### Spec @@ -84,7 +85,8 @@ spec: | `peerType` | Only apply this rule to routes from/to the specified BGP peer type. If empty, the rule applies to all peers. | `eBGP`, `iBGP` | string | | | `priority` | Only apply this rule to routes with the given priority (metric). Uses the same units as the `...RoutePriority` fields in FelixConfiguration. | 1-2147483646 | integer | | | `communities` | Only apply this rule to routes carrying the specified BGP community. | See [BGP Filter Community Match](#bgp-filter-community-match). | object | | -| `action` | Action to be taken for this rule | `Accept` or `Reject` | string | | +| `asPathPrefix` | Only apply this rule to routes whose AS path begins with the specified sequence of AS numbers. | A list of valid AS numbers. | list of integer | | +| `action` | Action to be taken for this rule. Required.| `Accept` or `Reject` | string | | | `operations` | Ordered list of route modifications to apply when the rule matches. Only valid when action is `Accept`. Maximum 10 operations. | See [BGP Filter Operation](#bgp-filter-operation). | list | | ### BGP Filter Rule v6 @@ -106,14 +108,14 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ------ | --------------------------------------------- | ------------------------------------------------------------------- | ------ | ------- | -| `min` | Smallest matched mask size (0 by default) | Valid integers between 0 and ipv4/6 max (32, 128) | int | | -| `max` | Largest matched mask size (32/128 by default) | Valid integers between 1 and ipv4/6 max (32, 128) | int | | +| `min` | Smallest matched mask size (the CIDR's mask size by default) | Valid integers between 0 and ipv4/6 max (32, 128) | int | | +| `max` | Largest matched mask size (32/128 by default) | Valid integers between 0 and ipv4/6 max (32, 128) | int | | ### BGP Filter Community Match | Field | Description | Accepted Values | Schema | | ------ | ---------------------------------------------------------------------------------------------------- | ------------------------------------------------------------ | -------------- | -| `values` | List of BGP community values to match against. The route must carry at least one of these communities. | Standard (`aa:nn`) or large (`aa:nn:mm`) community values. | list of string | +| `values` | List of BGP community values to match against. Required. Must contain exactly one value, which the route must carry. | Standard (`aa:nn`) or large (`aa:nn:mm`) community values. | list of string | ### BGP Filter Operation @@ -129,16 +131,16 @@ Each operation is an object with exactly one of the following fields set: | Field | Description | Accepted Values | Schema | | ----- | ---------------------------- | ---------------------------------------------------------- | ------ | -| `value` | BGP community value to add. | Standard (`aa:nn`) or large (`aa:nn:mm`) community value. | string | +| `value` | BGP community value to add. Required. | Standard (`aa:nn`) or large (`aa:nn:mm`) community value. | string | ### BGP Filter Prepend AS Path | Field | Description | Accepted Values | Schema | | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------- | ---------------- | -| `prefix` | Sequence of AS numbers to prepend to the route's AS path. The resulting path starts with these AS numbers in the order listed (e.g., `[65000, 65001]` produces `65000 65001 `). | A list of 1-10 valid AS numbers. | list of integer | +| `prefix` | Sequence of AS numbers to prepend to the route's AS path. Required. The resulting path starts with these AS numbers in the order listed (e.g., `[65000, 65001]` produces `65000 65001 `). | A list of 1-10 valid AS numbers. | list of integer | ### BGP Filter Set Priority | Field | Description | Accepted Values | Schema | | ----- | ---------------------------------------------------------------------------------------------------------- | --------------- | ------- | -| `value` | The priority (metric) value to set on the route. Uses the same units as FelixConfiguration RoutePriority fields. | 1-2147483646 | integer | +| `value` | The priority (metric) value to set on the route. Required. Uses the same units as FelixConfiguration RoutePriority fields. | 1-2147483646 | integer | From 64d689bf0c4829c0485e1c666c3b8e745bea9b8e Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Tue, 20 Oct 2026 07:55:31 +0100 Subject: [PATCH 3/4] Fix inaccuracies on the BGPFilter reference for 3.32 Correct statements on the BGPFilter page that a kind cluster running the release showed to be wrong. --- .../reference/resources/bgpfilter.mdx | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/calico_versioned_docs/version-3.32/reference/resources/bgpfilter.mdx b/calico_versioned_docs/version-3.32/reference/resources/bgpfilter.mdx index 66d22fa311..97f673e5df 100644 --- a/calico_versioned_docs/version-3.32/reference/resources/bgpfilter.mdx +++ b/calico_versioned_docs/version-3.32/reference/resources/bgpfilter.mdx @@ -11,7 +11,8 @@ specified by a [BGP peer resource](bgppeer.mdx) (`BGPPeer`). The BGPFilter rules are applied sequentially: the `action` for the **first** rule that matches is executed immediately. If an address does not match any explicit BGP filter rule, -the default action is `Accept`. +it is accepted on import. On export, it is advertised only if +Calico would advertise it to that peer without the filter. In order for a BGPFilter to be used in a BGP peering, its `name` must be added to `filters` of the corresponding BGPPeer resource. @@ -61,7 +62,7 @@ spec: | Field | Description | Accepted Values | Schema | | ----- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | -| `name` | Unique name to describe this resource instance. Must be specified. | Alphanumeric string with optional `.`, `_`, or `-`. | string | +| `name` | Unique name to describe this resource instance. Must be specified. | Lowercase alphanumeric string with optional `.` or `-`. | string | ### Spec @@ -106,14 +107,14 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ------ | --------------------------------------------- | ------------------------------------------------------------------- | ------ | ------- | -| `min` | Smallest matched mask size (0 by default) | Valid integers between 0 and ipv4/6 max (32, 128) | int | | -| `max` | Largest matched mask size (32/128 by default) | Valid integers between 1 and ipv4/6 max (32, 128) | int | | +| `min` | Smallest matched mask size (the CIDR's mask size by default) | Valid integers between 0 and ipv4/6 max (32, 128) | int | | +| `max` | Largest matched mask size (32/128 by default) | Valid integers between 0 and ipv4/6 max (32, 128) | int | | ### BGP Filter Community Match | Field | Description | Accepted Values | Schema | | ------ | ---------------------------------------------------------------------------------------------------- | ------------------------------------------------------------ | -------------- | -| `values` | List of BGP community values to match against. The route must carry at least one of these communities. | Standard (`aa:nn`) or large (`aa:nn:mm`) community values. | list of string | +| `values` | List of BGP community values to match against. Required. Must contain exactly one value, which the route must carry. | Standard (`aa:nn`) or large (`aa:nn:mm`) community values. | list of string | ### BGP Filter Operation @@ -129,16 +130,16 @@ Each operation is an object with exactly one of the following fields set: | Field | Description | Accepted Values | Schema | | ----- | ---------------------------- | ---------------------------------------------------------- | ------ | -| `value` | BGP community value to add. | Standard (`aa:nn`) or large (`aa:nn:mm`) community value. | string | +| `value` | BGP community value to add. Required. | Standard (`aa:nn`) or large (`aa:nn:mm`) community value. | string | ### BGP Filter Prepend AS Path | Field | Description | Accepted Values | Schema | | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------- | ---------------- | -| `prefix` | Sequence of AS numbers to prepend to the route's AS path. The resulting path starts with these AS numbers in the order listed (e.g., `[65000, 65001]` produces `65000 65001 `). | A list of 1-10 valid AS numbers. | list of integer | +| `prefix` | Sequence of AS numbers to prepend to the route's AS path. Required. The resulting path starts with these AS numbers in the order listed (e.g., `[65000, 65001]` produces `65000 65001 `). | A list of 1-10 valid AS numbers. | list of integer | ### BGP Filter Set Priority | Field | Description | Accepted Values | Schema | | ----- | ---------------------------------------------------------------------------------------------------------- | --------------- | ------- | -| `value` | The priority (metric) value to set on the route. Uses the same units as FelixConfiguration RoutePriority fields. | 1-2147483646 | integer | +| `value` | The priority (metric) value to set on the route. Required. Uses the same units as FelixConfiguration RoutePriority fields. | 1-2147483646 | integer | From dd582531ba7c99d1f6a73484ee04ec31cf3e92a5 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Tue, 20 Oct 2026 07:55:31 +0100 Subject: [PATCH 4/4] Fix inaccuracies on the BGPFilter reference for 3.31 Correct statements on the BGPFilter page that a kind cluster running the release showed to be wrong. --- .../reference/resources/bgpfilter.mdx | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/calico_versioned_docs/version-3.31/reference/resources/bgpfilter.mdx b/calico_versioned_docs/version-3.31/reference/resources/bgpfilter.mdx index 37f537a31d..0b07fb2665 100644 --- a/calico_versioned_docs/version-3.31/reference/resources/bgpfilter.mdx +++ b/calico_versioned_docs/version-3.31/reference/resources/bgpfilter.mdx @@ -11,7 +11,8 @@ specified by a [BGP peer resource](bgppeer.mdx) (`BGPPeer`). The BGPFilter rules are applied sequentially: the `action` for the **first** rule that matches is executed immediately. If an address does not match any explicit BGP filter rule, -the default action is `Accept`. +it is accepted on import. On export, it is advertised only if +Calico would advertise it to that peer without the filter. In order for a BGPFilter to be used in a BGP peering, its `name` must be added to `filters` of the corresponding BGPPeer resource. @@ -61,7 +62,7 @@ spec: | Field | Description | Accepted Values | Schema | | ----- | ------------------------------------------------------------------ | --------------------------------------------------- | ------ | -| name | Unique name to describe this resource instance. Must be specified. | Alphanumeric string with optional `.`, `_`, or `-`. | string | +| name | Unique name to describe this resource instance. Must be specified. | Lowercase alphanumeric string with optional `.` or `-`. | string | ### Spec @@ -76,12 +77,12 @@ spec: | Field | Description | Accepted Values | Schema | Default | | ------------- | ------------------------------------------ | ------------------------------------------------------------------- | ------ | ------- | -| cidr | IPv6 range | A valid IPv6 CIDR | string | | +| cidr | IPv4 range | A valid IPv4 CIDR | string | | | prefixLength | [PrefixLength](#bgp-filter-prefix-length) | Valid integers between 0 and ipv4/6 max (32, 128) | | | | matchOperator | Method by which to match candidate routes | `In`, `NotIn`, `Equal`, `NotEqual` | string | | | source | Indicator of the source of route | `RemotePeers` means any route learned from other BGP peers | string | | | interface | String to match interface names | A valid pattern to match interfaces. "*" can be used as a wildcard. | string | | -| action | Action to be taken for this rule | `Accept` or `Reject` | string | | +| action | Action to be taken for this rule. Required.| `Accept` or `Reject` | string | | ### BGP Filter Rule v6 @@ -92,11 +93,11 @@ spec: | matchOperator | Method by which to match candidate routes | `In`, `NotIn`, `Equal`, `NotEqual` | string | | | source | Indicator of the source of route | `RemotePeers` means any route learned from other BGP peers | string | | | interface | String to match interface names | A valid pattern to match interfaces. "*" can be used as a wildcard. | string | | -| action | Action to be taken for this rule | `Accept` or `Reject` | string | | +| action | Action to be taken for this rule. Required.| `Accept` or `Reject` | string | | ### BGP Filter Prefix Length | Field | Description | Accepted Values | Schema | Default | | ------ | --------------------------------------------- | ------------------------------------------------------------------- | ------ | ------- | -| min | Smallest matched mask size (0 by default) | Valid integers between 0 and ipv4/6 max (32, 128) | int | | -| max | Largest matched mask size (32/128 by default) | Valid integers between 1 and ipv4/6 max (32, 128) | int | | +| min | Smallest matched mask size (the CIDR's mask size by default) | Valid integers between 0 and ipv4/6 max (32, 128) | int | | +| max | Largest matched mask size (32/128 by default) | Valid integers between 0 and ipv4/6 max (32, 128) | int | |