https://archive-ce-3-17.netlify.app/assets/js/9d19a44f.c75da7a8.js

1"use strict";(self.webpackChunktigera_docs=self.webpackChunktigera_docs||[]).push([["4606"],{36502:function(e,n,t){t.d(n,{ZP:function(){return c},d$:function(){return i}});var s=t(85893),r=t(50065);let i=[];function d(e){let n={code:"code",li:"li",p:"p",strong:"strong",ul:"ul",...(0,r.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsxs)(n.p,{children:["When a configured domain name has no wildcard (",(0,s.jsx)(n.code,{children:"*"}),"), it matches exactly that domain name. For example:"]}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.code,{children:"microsoft.com"})}),"\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.code,{children:"tigera.io"})}),"\n"]}),"\n",(0,s.jsx)(n.p,{children:"With a single asterisk in any part of the domain name, it matches 1 or more path components at that position. For example:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.code,{children:"*.google.com"})," matches ",(0,s.jsx)(n.code,{children:"www.google.com"})," and ",(0,s.jsx)(n.code,{children:"www.ipv6.google.com"}),", but not ",(0,s.jsx)(n.code,{children:"google.com"})]}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.code,{children:"www.*.com"})," matches ",(0,s.jsx)(n.code,{children:"www.sun.com"})," and ",(0,s.jsx)(n.code,{children:"www.apple.com"}),", but not ",(0,s.jsx)(n.code,{children:"www.com"})]}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.code,{children:"update.*.mycompany.com"})," matches ",(0,s.jsx)(n.code,{children:"update.tools.mycompany.com"}),", ",(0,s.jsx)(n.code,{children:"update.secure.suite.mycompany.com"}),", and so on"]}),"\n"]}),"\n",(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.strong,{children:"Not"})," supported are:"]}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["Multiple wildcards in the same domain, for example: ",(0,s.jsx)(n.code,{children:"*.*.mycompany.com"})]}),"\n",(0,s.jsxs)(n.li,{children:["Asterisks that are not the entire component, for example: ",(0,s.jsx)(n.code,{children:"www.g*.com"})]}),"\n",(0,s.jsx)(n.li,{children:"More general wildcards, such as regular expressions"}),"\n"]})]})}function c(e={}){let{wrapper:n}={...(0,r.a)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},57350:function(e,n,t){t.d(n,{ZP:function(){return l},d$:function(){return d}});var s=t(85893),r=t(50065),i=t(36502);let d=[{value:"Exact and wildcard domain names",id:"exact-and-wildcard-domain-names",level:3},...i.d$];function c(e){let n={a:"a",admonition:"admonition",br:"br",code:"code",h3:"h3",p:"p",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,r.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(n.p,{children:"Entity rules specify the attributes of the source or destination of a packet that must match for the rule as a whole\nto match. Packets are matched on their IPs and ports. If the rule contains multiple match criteria (for example, an\nIP and a port) then all match criteria must match for the rule as a whole to match."}),"\n",(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.a,{href:"#selector",children:"Selectors"})," offer a powerful way to select the source or destination to match based on labels.",(0,s.jsx)(n.br,{}),"\n","Selectors can match ",(0,s.jsx)(n.a,{href:"/calico-enterprise/3.17/reference/resources/workloadendpoint",children:"workload endpoints"}),", host endpoint and\n(",(0,s.jsx)(n.a,{href:"/calico-enterprise/3.17/reference/resources/networkset",children:"namespaced"})," or\n",(0,s.jsx)(n.a,{href:"/calico-enterprise/3.17/reference/resources/globalnetworkset",children:"global"}),") network sets."]}),"\n",(0,s.jsxs)(n.table,{children:[(0,s.jsx)(n.thead,{children:(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.th,{children:"Field"}),(0,s.jsx)(n.th,{children:"Description"}),(0,s.jsx)(n.th,{children:"Accepted Values"}),(0,s.jsx)(n.th,{children:"Schema"}),(0,s.jsx)(n.th,{children:"Default"})]})}),(0,s.jsxs)(n.tbody,{children:[(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"nets"}),(0,s.jsx)(n.td,{children:"Match packets with IP in any of the listed CIDRs."}),(0,s.jsx)(n.td,{children:"List of valid IPv4 CIDRs or list of valid IPv6 CIDRs (IPv4 and IPv6 CIDRs shouldn't be mixed in one rule)"}),(0,s.jsx)(n.td,{children:"list of cidrs"}),(0,s.jsx)(n.td,{})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"notNets"}),(0,s.jsx)(n.td,{children:"Negative match on CIDRs. Match packets with IP not in any of the listed CIDRs."}),(0,s.jsx)(n.td,{children:"List of valid IPv4 CIDRs or list of valid IPv6 CIDRs (IPv4 and IPv6 CIDRs shouldn't be mixed in one rule)"}),(0,s.jsx)(n.td,{children:"list of cidrs"}),(0,s.jsx)(n.td,{})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"selector"}),(0,s.jsxs)(n.td,{children:["Positive match on selected endpoints. If a ",(0,s.jsx)(n.code,{children:"namespaceSelector"})," is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces."]}),(0,s.jsx)(n.td,{children:"Valid selector"}),(0,s.jsx)(n.td,{children:(0,s.jsx)(n.a,{href:"#selector",children:"selector"})}),(0,s.jsx)(n.td,{})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"notSelector"}),(0,s.jsxs)(n.td,{children:["Negative match on selected endpoints. If a ",(0,s.jsx)(n.code,{children:"namespaceSelector"})," is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces."]}),(0,s.jsx)(n.td,{children:"Valid selector"}),(0,s.jsx)(n.td,{children:(0,s.jsx)(n.a,{href:"#selector",children:"selector"})}),(0,s.jsx)(n.td,{})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"namespaceSelector"}),(0,s.jsxs)(n.td,{children:["Positive match on selected namespaces. If specified, only workload endpoints in the selected Kubernetes namespaces are matched. Matches namespaces based on the labels that have been applied to the namespaces. Defines the scope that selectors will apply to, if not defined then selectors apply to the NetworkPolicy's namespace. Match a specific namespace by name using the ",(0,s.jsx)(n.code,{children:"projectcalico.org/name"})," label. Select the non-namespaced resources like GlobalNetworkSet(s), host endpoints to which this policy applies by using ",(0,s.jsx)(n.code,{children:"global()"})," selector."]}),(0,s.jsx)(n.td,{children:"Valid selector"}),(0,s.jsx)(n.td,{children:(0,s.jsx)(n.a,{href:"#selector",children:"selector"})}),(0,s.jsx)(n.td,{})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"ports"}),(0,s.jsx)(n.td,{children:"Positive match on the specified ports"}),(0,s.jsx)(n.td,{}),(0,s.jsxs)(n.td,{children:["list of ",(0,s.jsx)(n.a,{href:"#ports",children:"ports"})]}),(0,s.jsx)(n.td,{})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"domains"}),(0,s.jsxs)(n.td,{children:["Positive match on ",(0,s.jsx)(n.a,{href:"#exact-and-wildcard-domain-names",children:"domain names"}),"."]}),(0,s.jsxs)(n.td,{children:["List of ",(0,s.jsx)(n.a,{href:"#exact-and-wildcard-domain-names",children:"exact or wildcard domain names"})]}),(0,s.jsx)(n.td,{children:"list of strings"}),(0,s.jsx)(n.td,{})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"notPorts"}),(0,s.jsx)(n.td,{children:"Negative match on the specified ports"}),(0,s.jsx)(n.td,{}),(0,s.jsxs)(n.td,{children:["list of ",(0,s.jsx)(n.a,{href:"#ports",children:"ports"})]}),(0,s.jsx)(n.td,{})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"serviceAccounts"}),(0,s.jsxs)(n.td,{children:["Match endpoints running under service accounts. If a ",(0,s.jsx)(n.code,{children:"namespaceSelector"})," is also defined, the set of service accounts this applies to is limited to the service accounts in the selected namespaces."]}),(0,s.jsx)(n.td,{}),(0,s.jsx)(n.td,{children:(0,s.jsx)(n.a,{href:"#serviceaccountmatch",children:"ServiceAccountMatch"})}),(0,s.jsx)(n.td,{})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"services"}),(0,s.jsx)(n.td,{children:"Match the specified service(s). If specified on egress rule destinations, no other selection criteria can be set. If specified on ingress rule sources, only positive or negative matches on ports can be specified."}),(0,s.jsx)(n.td,{}),(0,s.jsx)(n.td,{children:(0,s.jsx)(n.a,{href:"#servicematch",children:"ServiceMatch"})}),(0,s.jsx)(n.td,{})]})]})]}),"\n",(0,s.jsx)(n.admonition,{type:"note",children:(0,s.jsxs)(n.p,{children:["You cannot mix IPv4 and IPv6 CIDRs in a single rule using ",(0,s.jsx)(n.code,{children:"nets"})," or ",(0,s.jsx)(n.code,{children:"notNets"}),". If you need to match both, create 2 rules."]})}),"\n",(0,s.jsx)(n.h3,{id:"exact-and-wildcard-domain-names",children:"Exact and wildcard domain names"}),"\n",(0,s.jsxs)(n.p,{children:["The ",(0,s.jsx)(n.code,{children:"domains"})," field is only valid for egress Allow rules. It restricts the\nrule to apply only to traffic to one of the specified domains. If this field is specified, the\nparent ",(0,s.jsx)(n.a,{href:"#rule",children:"Rule"}),"'s ",(0,s.jsx)(n.code,{children:"action"})," must be ",(0,s.jsx)(n.code,{children:"Allow"}),", and ",(0,s.jsx)(n.code,{children:"nets"})," and ",(0,s.jsx)(n.code,{children:"selector"})," must both be left empty."]}),"\n",(0,s.jsx)(i.ZP,{}),"\n",(0,s.jsx)(n.admonition,{type:"note",children:(0,s.jsx)(n.p,{children:"Calico Enterprise implements policy for domain names by learning the\ncorresponding IPs from DNS, then programming rules to allow those IPs. This means that\nif multiple domain names A, B and C all map to the same IP, and there is domain-based\npolicy to allow A, traffic to B and C will be allowed as well."})})]})}function l(e={}){let{wrapper:n}={...(0,r.a)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(c,{...e})}):c(e)}},38065:function(e,n,t){t.d(n,{ZP:function(){return c},d$:function(){return i}});var s=t(85893),r=t(50065);let i=[];function d(e){let n={table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,r.a)(),...e.components};return(0,s.jsxs)(n.table,{children:[(0,s.jsx)(n.thead,{children:(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.th,{children:"Field"}),(0,s.jsx)(n.th,{children:"Description"}),(0,s.jsx)(n.th,{children:"Accepted Values"}),(0,s.jsx)(n.th,{children:"Schema"}),(0,s.jsx)(n.th,{children:"Default"})]})}),(0,s.jsxs)(n.tbody,{children:[(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"type"}),(0,s.jsx)(n.td,{children:"Match on ICMP type."}),(0,s.jsx)(n.td,{children:"Can be integer 0-254"}),(0,s.jsx)(n.td,{children:"integer"}),(0,s.jsx)(n.td,{})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"code"}),(0,s.jsx)(n.td,{children:"Match on ICMP code."}),(0,s.jsx)(n.td,{children:"Can be integer 0-255"}),(0,s.jsx)(n.td,{children:"integer"}),(0,s.jsx)(n.td,{})]})]})]})}function c(e={}){let{wrapper:n}={...(0,r.a)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},12925:function(e,n,t){t.d(n,{ZP:function(){return c},d$:function(){return i}});var s=t(85893),r=t(50065);let i=[{value:"Named ports",id:"named-ports",level:4}];function d(e){let n={admonition:"admonition",code:"code",h4:"h4",p:"p",pre:"pre",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,r.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(n.p,{children:"Calico Enterprise supports the following syntaxes for expressing ports."}),"\n",(0,s.jsxs)(n.table,{children:[(0,s.jsx)(n.thead,{children:(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.th,{children:"Syntax"}),(0,s.jsx)(n.th,{children:"Example"}),(0,s.jsx)(n.th,{children:"Description"})]})}),(0,s.jsxs)(n.tbody,{children:[(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"int"}),(0,s.jsx)(n.td,{children:"80"}),(0,s.jsx)(n.td,{children:"The exact (numeric) port specified"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"start:end"}),(0,s.jsx)(n.td,{children:"6040:6050"}),(0,s.jsx)(n.td,{children:"All (numeric) ports within the range start \u2264 x \u2264 end"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"string"}),(0,s.jsx)(n.td,{children:"named-port"}),(0,s.jsx)(n.td,{children:"A named port, as defined in the ports list of one or more endpoints"})]})]})]}),"\n",(0,s.jsx)(n.p,{children:"An individual numeric port may be specified as a YAML/JSON integer. A port range or\nnamed port must be represented as a string. For example, this would be a valid list of ports:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-yaml",children:"ports: [8080, '1234:5678', 'named-port']\n"})}),"\n",(0,s.jsx)(n.h4,{id:"named-ports",children:"Named ports"}),"\n",(0,s.jsxs)(n.p,{children:["Using a named port in an ",(0,s.jsx)(n.code,{children:"EntityRule"}),", instead of a numeric port, gives a layer of indirection,\nallowing for the named port to map to different numeric values for each endpoint."]}),"\n",(0,s.jsxs)(n.p,{children:["For example, suppose you have multiple HTTP servers running as workloads; some exposing their HTTP\nport on port 80 and others on port 8080. In each workload, you could create a named port called\n",(0,s.jsx)(n.code,{children:"http-port"})," that maps to the correct local port. Then, in a rule, you could refer to the name\n",(0,s.jsx)(n.code,{children:"http-port"})," instead of writing a different rule for each type of server."]}),"\n",(0,s.jsx)(n.admonition,{type:"note",children:(0,s.jsx)(n.p,{children:"Since each named port may refer to many endpoints (and Calico Enterprise has to expand a named port into\na set of endpoint/port combinations), using a named port is considerably more expensive in terms\nof CPU than using a simple numeric port. We recommend that they are used sparingly, only where\nthe extra indirection is required."})})]})}function c(e={}){let{wrapper:n}={...(0,r.a)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}}

1,48128:function(e,n,t){t.d(n,{ZP:function(){return c},d$:function(){return i}});var s=t(85893),r=t(50065);let i=[{value:"RuleMetadata",id:"rulemetadata",level:3}];function d(e){let n={a:"a",code:"code",h3:"h3",p:"p",pre:"pre",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,r.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(n.p,{children:"A single rule matches a set of packets and applies some action to them. When multiple rules are specified, they\nare executed in order."}),"\n",(0,s.jsxs)(n.table,{children:[(0,s.jsx)(n.thead,{children:(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.th,{children:"Field"}),(0,s.jsx)(n.th,{children:"Description"}),(0,s.jsx)(n.th,{children:"Accepted Values"}),(0,s.jsx)(n.th,{children:"Schema"}),(0,s.jsx)(n.th,{children:"Default"})]})}),(0,s.jsxs)(n.tbody,{children:[(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"metadata"}),(0,s.jsx)(n.td,{children:"Per-rule metadata."}),(0,s.jsx)(n.td,{}),(0,s.jsx)(n.td,{children:(0,s.jsx)(n.a,{href:"#rulemetadata",children:"RuleMetadata"})}),(0,s.jsx)(n.td,{})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"action"}),(0,s.jsx)(n.td,{children:"Action to perform when matching this rule."}),(0,s.jsxs)(n.td,{children:[(0,s.jsx)(n.code,{children:"Allow"}),", ",(0,s.jsx)(n.code,{children:"Deny"}),", ",(0,s.jsx)(n.code,{children:"Log"}),", ",(0,s.jsx)(n.code,{children:"Pass"})]}),(0,s.jsx)(n.td,{children:"string"}),(0,s.jsx)(n.td,{})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"protocol"}),(0,s.jsx)(n.td,{children:"Positive protocol match."}),(0,s.jsxs)(n.td,{children:[(0,s.jsx)(n.code,{children:"TCP"}),", ",(0,s.jsx)(n.code,{children:"UDP"}),", ",(0,s.jsx)(n.code,{children:"ICMP"}),", ",(0,s.jsx)(n.code,{children:"ICMPv6"}),", ",(0,s.jsx)(n.code,{children:"SCTP"}),", ",(0,s.jsx)(n.code,{children:"UDPLite"}),", ",(0,s.jsx)(n.code,{children:"1"}),"-",(0,s.jsx)(n.code,{children:"255"})]}),(0,s.jsx)(n.td,{children:"string | integer"}),(0,s.jsx)(n.td,{})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"notProtocol"}),(0,s.jsx)(n.td,{children:"Negative protocol match."}),(0,s.jsxs)(n.td,{children:[(0,s.jsx)(n.code,{children:"TCP"}),", ",(0,s.jsx)(n.code,{children:"UDP"}),", ",(0,s.jsx)(n.code,{children:"ICMP"}),", ",(0,s.jsx)(n.code,{children:"ICMPv6"}),", ",(0,s.jsx)(n.code,{children:"SCTP"}),", ",(0,s.jsx)(n.code,{children:"UDPLite"}),", ",(0,s.jsx)(n.code,{children:"1"}),"-",(0,s.jsx)(n.code,{children:"255"})]}),(0,s.jsx)(n.td,{children:"string | integer"}),(0,s.jsx)(n.td,{})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"icmp"}),(0,s.jsx)(n.td,{children:"ICMP match criteria."}),(0,s.jsx)(n.td,{}),(0,s.jsx)(n.td,{children:(0,s.jsx)(n.a,{href:"#icmp",children:"ICMP"})}),(0,s.jsx)(n.td,{})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"notICMP"}),(0,s.jsx)(n.td,{children:"Negative match on ICMP."}),(0,s.jsx)(n.td,{}),(0,s.jsx)(n.td,{children:(0,s.jsx)(n.a,{href:"#icmp",children:"ICMP"})}),(0,s.jsx)(n.td,{})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"ipVersion"}),(0,s.jsx)(n.td,{children:"Positive IP version match."}),(0,s.jsxs)(n.td,{children:[(0,s.jsx)(n.code,{children:"4"}),", ",(0,s.jsx)(n.code,{children:"6"})]}),(0,s.jsx)(n.td,{children:"integer"}),(0,s.jsx)(n.td,{})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"source"}),(0,s.jsx)(n.td,{children:"Source match parameters."}),(0,s.jsx)(n.td,{}),(0,s.jsx)(n.td,{children:(0,s.jsx)(n.a,{href:"#entityrule",children:"EntityRule"})}),(0,s.jsx)(n.td,{})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"destination"}),(0,s.jsx)(n.td,{children:"Destination match parameters."}),(0,s.jsx)(n.td,{}),(0,s.jsx)(n.td,{children:(0,s.jsx)(n.a,{href:"#entityrule",children:"EntityRule"})}),(0,s.jsx)(n.td,{})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"http"}),(0,s.jsx)(n.td,{children:"Match HTTP request parameters. Application layer policy must be enabled to use this field."}),(0,s.jsx)(n.td,{}),(0,s.jsx)(n.td,{children:(0,s.jsx)(n.a,{href:"#httpmatch",children:"HTTPMatch"})}),(0,s.jsx)(n.td,{})]})]})]}),"\n",(0,s.jsxs)(n.p,{children:["After a ",(0,s.jsx)(n.code,{children:"Log"})," action, processing continues with the next rule; ",(0,s.jsx)(n.code,{children:"Allow"})," and ",(0,s.jsx)(n.code,{children:"Deny"}

1)," are immediate\nand final and no further rules are processed."]}),"\n",(0,s.jsxs)(n.p,{children:["An ",(0,s.jsx)(n.code,{children:"action"})," of ",(0,s.jsx)(n.code,{children:"Pass"})," in a ",(0,s.jsx)(n.code,{children:"NetworkPolicy"})," or ",(0,s.jsx)(n.code,{children:"GlobalNetworkPolicy"})," will skip over the remaining policies and jump to the\nfirst ",(0,s.jsx)(n.a,{href:"/calico-enterprise/3.17/reference/resources/profile",children:"profile"})," assigned to the endpoint, applying the policy configured in the\nprofile; if there are no Profiles configured for the endpoint the default applied action is ",(0,s.jsx)(n.code,{children:"Deny"}),"."]}),"\n",(0,s.jsx)(n.h3,{id:"rulemetadata",children:"RuleMetadata"}),"\n",(0,s.jsx)(n.p,{children:"Metadata associated with a specific rule (rather than the policy as a whole). The contents of the metadata does not affect how a rule is interpreted or enforced; it is\nsimply a way to store additional information for use by operators or applications that interact with Calico Enterprise."}),"\n",(0,s.jsxs)(n.table,{children:[(0,s.jsx)(n.thead,{children:(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.th,{children:"Field"}),(0,s.jsx)(n.th,{children:"Description"}),(0,s.jsx)(n.th,{children:"Schema"}),(0,s.jsx)(n.th,{children:"Default"})]})}),(0,s.jsx)(n.tbody,{children:(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"annotations"}),(0,s.jsx)(n.td,{children:"Arbitrary non-identifying metadata."}),(0,s.jsx)(n.td,{children:"map of string to string"}),(0,s.jsx)(n.td,{})]})})]}),"\n",(0,s.jsx)(n.p,{children:"Example:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-yaml",children:"metadata:\n  annotations:\n    app: database\n    owner: devops\n"})}),"\n",(0,s.jsxs)(n.p,{children:["Annotations follow the\n",(0,s.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/#syntax-and-character-set",children:"same rules as Kubernetes for valid syntax and character set"}),"."]}),"\n",(0,s.jsxs)(n.p,{children:["On Linux with the iptables data plane, rule annotations are rendered as comments in the form ",(0,s.jsx)(n.code,{children:'-m comment --comment "<key>=<value>"'})," on the iptables rule(s) that correspond\nto the Calico Enterprise rule."]})]})}function c(e={}){let{wrapper:n}={...(0,r.a)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},46950:function(e,n,t){t.d(n,{ZP:function(){return c},d$:function(){return i}});var s=t(85893),r=t(50065);let i=[];function d(e){let n={code:"code",em:"em",li:"li",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,r.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(n.p,{children:"A label selector is an expression which either matches or does not match a resource based on its labels."}),"\n",(0,s.jsx)(n.p,{children:"Calico Enterprise label selectors support a number of operators, which can be combined into larger expressions\nusing the boolean operators and parentheses."}),"\n",(0,s.jsxs)(n.table,{children:[(0,s.jsx)(n.thead,{children:(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.th,{children:"Expression"}),(0,s.jsx)(n.th,{children:"Meaning"})]})}),(0,s.jsxs)(n.tbody,{children:[(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.strong,{children:"Logical operators"})}),(0,s.jsx)(n.td,{})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"( <expression> )"})}),(0,s.jsxs)(n.td,{children:["Matches if and only if ",(0,s.jsx)(n.code,{children:"<expression>"})," matches. (Parentheses are used for grouping expressions.)"]})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"! <expression>"})}),(0,s.jsxs)(n.td,{children:["Matches if and only if ",(0,s.jsx)(n.code,{children:"<expression>"})," does not match. ",(0,s.jsx)(n.strong,{children:"Tip:"})," ",(0,s.jsx)(n.code,{children:"!"})," is a special character at the start of a YAML string, if you need to use ",(0,s.jsx)(n.code,{children:"!"})," at the start of a YAML string, enclose the string in quotes."]})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"<expression 1> && <expression 2>"})}),(0,s.jsxs)(n.td,{children:['"And": matches if and only if both ',(0,s.jsx)(n.code,{children:"<expression 1>"}),", and, ",(0,s.jsx)(n.code,{children:"<expression 2>"})," matches"]})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)("code",{children:"<expression 1> || <expression 2>"})}),(0,s.jsxs)(n.td,{children:['"Or": matches if and only if either ',(0,s.jsx)(n.code,{children:"<expression 1>"}),", or, ",(0,s.jsx)(n.code,{children:"<expression 2>"})," matches."]})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.strong,{children:"Match operators"})}),(0,s.jsx)(n.td,{})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"all()"})}),(0,s.jsxs)(n.td,{children:["Match all in-scope resources. To match ",(0,s.jsx)(n.em,{children:"no"})," resources, combine this operator with ",(0,s.jsx)(n.code,{children:"!"})," to form ",(0,s.jsx)(n.code,{children:"!all()"}),"."]})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"global()"})}),(0,s.jsxs)(n.td,{children:["Match all non-namespaced resources. Useful in a ",(0,s.jsx)(n.code,{children:"namespaceSelector"})," to select global resources such as global network sets."]})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"k == 'v'"})}),(0,s.jsx)(n.td,{children:"Matches resources with the label 'k' and value 'v'."})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"k != 'v'"})}),(0,s.jsxs)(n.td,{children:["Matches resources without label 'k' or with label 'k' and value ",(0,s.jsx)(n.em,{children:"not"})," equal to ",(0,s.jsx)(n.code,{children:"v"})]})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"has(k)"})}),(0,s.jsxs)(n.td,{children:["Matches resources with label 'k', independent of value. To match pods that do not have label ",(0,s.jsx)(n.code,{children:"k"}),", combine this operator with ",(0,s.jsx)(n.code,{children:"!"})," to form ",(0,s.jsx)(n.code,{children:"!has(k)"})]})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"k in { 'v1', 'v2' }"})}),(0,s.jsx)(n.td,{children:"Matches resources with label 'k' and value in the given set"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"k not in { 'v1', 'v2' }"})}),(0,s.jsxs)(n.td,{children:["Matches resources without label 'k' or with label 'k' and value ",(0,s.jsx)(n.em,{children:"not"})," in the given set"]})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"k contains 's'"})}),(0,s.jsx)(n.td,{children:"Matches resources with label 'k' and value containing the substring 's'"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"k starts with 's'"})}),(0,s.jsx)(n.td,{children:"Matches resources with label 'k' and value starting with the substring 's'"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"k ends with 's'"})}),(0,s.jsx)(n.td,{children:"Matches resources with label 'k' and value ending with the substring 's'"})]})]})]}),"\n",(0,s.jsx)(n.p,{children:"Operators have the following precedence:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.strong,{children:"Highe

1st"}),": all the match operators"]}),"\n",(0,s.jsxs)(n.li,{children:["Parentheses ",(0,s.jsx)(n.code,{children:"( ... )"})]}),"\n",(0,s.jsxs)(n.li,{children:["Negation with ",(0,s.jsx)(n.code,{children:"!"})]}),"\n",(0,s.jsxs)(n.li,{children:["Conjunction with ",(0,s.jsx)(n.code,{children:"&&"})]}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.strong,{children:"Lowest"}),": Disjunction with ",(0,s.jsx)(n.code,{children:"||"})]}),"\n"]}),"\n",(0,s.jsx)(n.p,{children:"For example, the expression"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"! has(my-label) || my-label starts with 'prod' && role in {'frontend','business'}\n"})}),"\n",(0,s.jsx)(n.p,{children:'Would be "bracketed" like this:'}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"((!(has(my-label)) || ((my-label starts with 'prod') && (role in {'frontend','business'}))\n"})}),"\n",(0,s.jsx)(n.p,{children:"It would match:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:'Any resource that did not have label "my-label".'}),"\n",(0,s.jsxs)(n.li,{children:["Any resource that both:","\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["Has a value for ",(0,s.jsx)(n.code,{children:"my-label"}),' that starts with "prod", and,']}),"\n",(0,s.jsx)(n.li,{children:'Has a role label with value either "frontend", or "business".'}),"\n"]}),"\n"]}),"\n"]})]})}function c(e={}){let{wrapper:n}={...(0,r.a)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},63728:function(e,n,t){t.d(n,{ZP:function(){return c},d$:function(){return i}});var s=t(85893),r=t(50065);let i=[];function d(e){let n={a:"a",p:"p",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,r.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(n.p,{children:"A ServiceAccountMatch matches service accounts in an EntityRule."}),"\n",(0,s.jsxs)(n.table,{children:[(0,s.jsx)(n.thead,{children:(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.th,{children:"Field"}),(0,s.jsx)(n.th,{children:"Description"}),(0,s.jsx)(n.th,{children:"Schema"})]})}),(0,s.jsxs)(n.tbody,{children:[(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"names"}),(0,s.jsx)(n.td,{children:"Match service accounts by name"}),(0,s.jsx)(n.td,{children:"list of strings"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"selector"}),(0,s.jsx)(n.td,{children:"Match service accounts by label"}),(0,s.jsx)(n.td,{children:(0,s.jsx)(n.a,{href:"#selector",children:"selector"})})]})]})]})]})}function c(e={}){let{wrapper:n}={...(0,r.a)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},73192:function(e,n,t){t.d(n,{ZP:function(){return c},d$:function(){return i}});var s=t(85893),r=t(50065);let i=[];function d(e){let n={p:"p",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,r.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(n.p,{children:"A ServiceMatch matches a service in an EntityRule."}),"\n",(0,s.jsxs)(n.table,{children:[(0,s.jsx)(n.thead,{children:(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.th,{children:"Field"}),(0,s.jsx)(n.th,{children:"Description"}),(0,s.jsx)(n.th,{children:"Schema"})]})}),(0,s.jsxs)(n.tbody,{children:[(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"name"}),(0,s.jsx)(n.td,{children:"The service's name."}),(0,s.jsx)(n.td,{children:"string"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"namespace"}),(0,s.jsx)(n.td,{children:"The service's namespace."}),(0,s.jsx)(n.td,{children:"string"})]})]})]})]})}function c(e={}){let{wrapper:n}={...(0,r.a)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},34633:function(e,n,t){t.r(n),t.d(n,{default:()=>h,frontMatter:()=>d,metadata:()=>s,assets:()=>l,toc:()=>o,contentTitle:()=>c});var s=JSON.parse('{"id":"reference/resources/policyrecommendations","title":"Policy recommendation scope","description":"API for this Calico Enterprise resource.","source":"@site/calico-enterprise_versioned_docs/version-3.17/reference/resources/policyrecommendations.mdx","sourceDirName":"reference/resources","slug":"/reference/resources/policyrecommendations","permalink":"/calico-enterprise/3.17/reference/resources/policyrecommendations","draft":false,"unlisted":false,"editUrl":"https://github.com/tigera/docs/edit/main/calico-enterprise_versioned_docs/version-3.17/reference/resources/policyrecommendations.mdx","tags":[],"version":"3.17","frontMatter":{"description":"API for this Calico Enterprise resource."},"sidebar":"calicoEnterpriseSidebar","previous":{"title":"Packet capture","permalink":"/calico-enterprise/3.17/reference/resources/packetcapture"},"next":{"title":"Profile","permalink":"/calico-enterprise/3.17/reference/resources/profile"}}'),r=t("85893"),i=t("50065");t("73192"),t("63728"),t("12925"),t("46950"),t("57350"),t("38065"),t("48128");let d={description:"API for this Calico Enterprise resource."},c="Policy recommendation scope",l={},o=[{value:"Definition",id:"definition",level:2},{value:"Metadata",id:"metadata",level:3},{value:"Spec",id:"spec",level:3},{value:"NamespaceSpec",id:"namespacespec",level:4}];function a(e){let n={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",h4:"h4",header:"header",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,i.a)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(n.header,{children:(0,r.jsx)(n.h1,{id:"policy-recommendation-scope",children:"Policy recommendation scope"})}),"\n","\n","\n","\n","\n","\n","\n","\n",(0,r.jsxs)(n.p,{children:["The policy recommendation scope is a collection of configuration options to control ",(0,r.jsx)(n.a,{href:"/calico-enterprise/3.17/network-policy/recommendations/policy-recommendations",children:"policy recommendation"})," in the web console."]}),"\n",(0,r.jsx)(n.p,{children:"To apply changes to this resource, use the following format:"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{children:'$ kubectl patch policyrecommendationscope default -p \'{"spec":{"<parameter>":"<value>"}}\'\n'})}),"\n",(0,r.jsx)(n.p,{children:(0,r.jsx)(n.strong,{children:"Example"})}),"\n",(0,r.jsx)(n.p,{children:(0,r.jsx)(n.code,{children:'$ kubectl patch policyrecommendationscope default -p \'{"spec":{"interval":"5m"}}\''})}),"\n",(0,r.jsx)(n.h2,{id:"definition",children:"Definition"}),"\n",(0,r.jsx)(n.h3,{id:""}),"\n",(0,r.jsx)(n.h3,{id:"metadata",children:"Metadata"}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Field"}),(0,r.jsx)(n.th,{children:"Description"}),(0,r.jsx)(n.th,{children:"Accepted Values"}),(0,r.jsx)(n.th,{children:"Schema"}),(0,r.jsx)(n.th,{children:"Default"})]})}),(0,r.jsx)(n.tbody,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:"name"}),(0,r.jsx)(n.td,{children:"The name of the policy recommendation scope."}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"default"})}),(0,r.jsx)(n.td,{children:"string"}),(0,r.jsx)(n.td,{})]})})]}),"\n",(0,r.jsx)(n.h3,{id:"spec",children:"Spec"}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Field"}),(0,r.jsx)(n.th,{children:"Description"}),(0,r.jsx)(n.th,{children:"Accepted Values"}),(0,r.jsx)(n.th,{children:"Schema"}),(0,r.jsx)(n.th,{children:"Default"})]})}),(0,r.jsxs)(n.tbody,{children:[(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:"Interval"}),(0,r.jsx)(n.td,{children:"The frequency to create and refine policy recommendations."}),(0,r.jsx)(n.td,{}),(0,r.jsx)(n.td,{}),(0,r.jsx)(n.td,{children:"2.5m (minutes)"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:"InitialLookback"}),(0,r.jsx)(n.td,{children:"Start time to look at flow logs when first creating a policy recommendation."}),(0,r.jsx)(n.td,{}),(0,r.jsx)(n.td,{}),(0,r.jsx)(n.td,{children:"24h (hours)"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:"StabilizationPeriod"}),(0,r.jsx)(n.td,{children:"Time that a recommended policy should remain unchanged so it is stable and ready to be enforced."}),(0,r.jsx)(n.td,{}),(0,r.jsx)(n.td,{}),(0,r.jsx)(n.td,{children:"10m (minutes)"})]})]})]}),"\n",(0,r.jsx)(n.h4,{id:"namespacespec",children:"NamespaceSpec"}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Field"}),(0,r.jsx)(n.th,{children:"Description"}),(0,r.jsx)(n.th,{children:"Accepted Values"}),(0,r.jsx)(n.th,{children:"Schema"}),(0,r.jsx)(n.th,{children:"Default"})]})}),(0,r.jsxs)(n.tbody,{children:[(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:"recStatus"}),(0,r.jsx)(n.td,{children:"Defines the policy recommendation engine status."}),(0,r.jsx)(n.td,{children:"Enabled/Disabled"}),(0,r.jsx)(n.td,{}),(0,r.jsx)(n.td,{children:"Disabled"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:"selector"}),(0,r.jsx)(n.td,{children:"Selects the namespaces for generating recommendations."}),(0,r.jsx)(n.td,{}),(0,r.jsx)(n.td,{}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"!(projectcalico.org/name starts with ''tigera-'') && !(projectcalico.org/name starts with ''calico-'') && !(projectcalico.org/name starts with ''kube-'')"})})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:"intraNamespacePassThroughTraffic"}),(0,r.jsx)(n.td,{children:"When true, sets all intra-namespace traffic to Pass"}),(0,r.jsx)(n.td,{children:"true/false"}),(0,r.jsx)(n.td,{}),(0,r.jsx)(n.td,{children:"false"})]})]})]})]})}function h(e={}){let{wrapper:n}={...(0,i.a)(),...e.components};return n?(0,r.jsx)(n,{...e,children:(0,r.jsx)(a,{...e})}):a(e)}},50065:function(e,n,t){t.d(n,{Z:function(){return c},a:function(){return d}});var s=t(67294);let r={},i=s.createContext(r);function d(e){let n=s.useContext(i);return s.useMemo(function(){return"function"==typeof e?e(n):{...n,...e}},[n,e])}function c(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:d(e.components),s.createElement(i.Provider,{value:n},e.children)}}}]);