Staged Kubernetes network policy

A staged Kubernetes network policy resource (StagedKubernetesNetworkPolicy) represents a staged version of Kubernetes network policy. This is used to preview network behavior before actually enforcing the network policy. Once persisted, this is converted to a Calico network policy that is not enforced.

For kubectl commands, the following case-insensitive aliases may be used to specify the resource type on the CLI: stagedkubernetesnetworkpolicy.projectcalico.org, stagedkubernetesnetworkpolicies.projectcalico.org and abbreviations such as stagedkubernetesnetworkpolicy.p and stagedkubernetesnetworkpolicies.p.

Sample YAML

Below is a sample policy created from the example policy from the Kubernetes NetworkPolicy documentation. The only difference between this policy and the example Kubernetes version is that the apiVersion and kind are changed to properly specify a staged Kubernetes network policy.

apiVersion: projectcalico.org/v3
kind: StagedKubernetesNetworkPolicy
metadata:
  name: test-network-policy
  namespace: default
spec:
  podSelector:
    matchLabels:
      role: db
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - ipBlock:
            cidr: 172.17.0.0/16
            except:
              - 172.17.1.0/24
        - namespaceSelector:
            matchLabels:
              project: myproject
        - podSelector:
            matchLabels:
              role: frontend
      ports:
        - protocol: TCP
          port: 6379
  egress:
    - to:
        - ipBlock:
            cidr: 10.0.0.0/24
      ports:
        - protocol: TCP
          port: 5978

Definition

See the Kubernetes NetworkPolicy documentation for more information.

Spec

Field	Description	Accepted Values	Schema	Default
stagedAction	The staged action. With Delete, leave every other spec field empty, and the policy is not sent to Felix.	Set, Delete, Learn, Ignore	string	Set
podSelector	Selects the pods in the namespace to which this policy applies. An empty selector matches all pods in the namespace.		Kubernetes LabelSelector
ingress	List of ingress rules applied to the selected pods.		List of Kubernetes NetworkPolicyIngressRule
egress	List of egress rules applied to the selected pods.		List of Kubernetes NetworkPolicyEgressRule
policyTypes	Applies the policy to ingress traffic (Ingress), egress traffic (Egress), or both. If omitted and the policy has no egress rules, the policy applies to ingress traffic only. If the policy has egress rules, set this field: when it is omitted, clusters that use native v3 CRDs store Ingress, Egress, but clusters that use the Calico API server apply the policy to ingress traffic only.	Ingress, Egress	List of strings