1"use strict";(self.webpackChunktigera_docs=self.webpackChunktigera_docs||[]).push([["514"],{50254:function(e,t,o){o.r(t),o.d(t,{frontMatter:()=>c,toc:()=>a,default:()=>p,metadata:()=>n,assets:()=>l,contentTitle:()=>i});var n=JSON.parse('{"id":"reference/host-endpoints/selector","title":"Selector-based policies","description":"Apply ordered policies to endpoints that match specific label selectors.","source":"@site/calico_versioned_docs/version-3.28/reference/host-endpoints/selector.mdx","sourceDirName":"reference/host-endpoints","slug":"/reference/host-endpoints/selector","permalink":"/calico/3.28/reference/host-endpoints/selector","draft":false,"unlisted":false,"editUrl":"https://github.com/tigera/docs/edit/main/calico_versioned_docs/version-3.28/reference/host-endpoints/selector.mdx","tags":[],"version":"3.28","frontMatter":{"description":"Apply ordered policies to endpoints that match specific label selectors."},"sidebar":"calicoSidebar","previous":{"title":"Creating host endpoint objects","permalink":"/calico/3.28/reference/host-endpoints/objects"},"next":{"title":"Failsafe rules","permalink":"/calico/3.28/reference/host-endpoints/failsafe"}}'),s=o(37937),r=o(17869);let c={description:"Apply ordered policies to endpoints that match specific label selectors."},i="Selector-based policies",l={},a=[];function d(e){let t={code:"code",h1:"h1",header:"header",p:"p",pre:"pre",...(0,r.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.header,{children:(0,s.jsx)(t.h1,{id:"selector-based-policies",children:"Selector-based policies"})}),"\n",(0,s.jsx)(t.p,{children:"We recommend using selector-based security policy with\nhost endpoints. This allows ordered policy to be applied to\nendpoints that match particular label selectors."}),"\n",(0,s.jsx)(t.p,{children:"For example, you could add a second policy for webserver access:"}),"\n",(0,s.jsx)(t.pre,{children:(0,s.jsx)(t.code,{className:"language-bash",children:'cat <<EOF | dist/calicoctl create -f -\n- apiVersion: projectcalico.org/v3\n kind: GlobalNetworkPolicy\n metadata:\n name: webserver\n spec:\n selector: "role==\\"webserver\\""\n order: 100\n ingress:\n - action: Allow\n protocol: TCP\n destination:\n ports: [80]\n egress:\n - action: Allow\nEOF\n'})})]})}function p(e={}){let{wrapper:t}={...(0,r.R)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},17869:function(e,t,o){o.d(t,{R:()=>c,x:()=>i});var n=o(82645);let s={},r=n.createContext(s);function c(e){let t=n.useContext(r);return n.useMemo(function(){return"function"==typeof e?e(t):{...t,...e}},[t,e])}function i(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:c(e.components),n.createElement(r.Provider,{value:t},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.