From 24c44e4a3d84b57103029c7f771a76d00f4dc39b Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Fri, 9 Oct 2026 16:56:37 +0100 Subject: [PATCH] Port selector guidance to CE and CC entity rule include --- calico-cloud/_includes/content/_entityrule.mdx | 11 +++++++++++ .../version-23-2/_includes/content/_entityrule.mdx | 11 +++++++++++ calico-enterprise/_includes/content/_entityrule.mdx | 11 +++++++++++ .../version-3.21-2/_includes/content/_entityrule.mdx | 11 +++++++++++ .../version-3.22-2/_includes/content/_entityrule.mdx | 11 +++++++++++ .../version-3.23-2/_includes/content/_entityrule.mdx | 11 +++++++++++ .../version-3.24-2/_includes/content/_entityrule.mdx | 11 +++++++++++ 7 files changed, 77 insertions(+) diff --git a/calico-cloud/_includes/content/_entityrule.mdx b/calico-cloud/_includes/content/_entityrule.mdx index 0fbe49cffa..92aa3c4769 100644 --- a/calico-cloud/_includes/content/_entityrule.mdx +++ b/calico-cloud/_includes/content/_entityrule.mdx @@ -31,6 +31,10 @@ You cannot mix IPv4 and IPv6 CIDRs in a single rule using `nets` or `notNets`. I ::: +When using selectors in network policy, remember that selectors only match (known) resources, but _rules_ match packets. +A rule with a selector `all()` won't match "all packets", it will match "packets from all in-scope endpoints and network sets". +To match all packets, do not include a selector in the rule at all. + #### Empty match fields An empty value in a match field is treated as if the field were not set at all, not as an empty set that matches nothing. @@ -39,6 +43,13 @@ It leaves the rule unconstrained by IP address, so the rule matches any source o The same is true of `notNets`, `ports`, and `notPorts`, and of an empty string in `selector`, `notSelector`, and `namespaceSelector`. $[prodname] typically drops the empty value when it stores the resource, so the field is absent when you read the policy back. +#### Understanding `notSelector` + +`notSelector` is somewhat subtle because the `not` in `notSelector` negates the packet match rather than the selector: + +- `selector: !has(foo)` matches packets from/to endpoints and network sets that do not have the label "foo". +- `notSelector: has(foo)` matches packets from/to **anywhere** (including outside the cluster), **except** traffic from/to endpoints and network sets that have the label "foo". + #### Selector performance in EntityRules When rendering policy into the data plane, $[prodname] must identify the endpoints that match the selectors diff --git a/calico-cloud_versioned_docs/version-23-2/_includes/content/_entityrule.mdx b/calico-cloud_versioned_docs/version-23-2/_includes/content/_entityrule.mdx index e53333187d..7592d12f87 100644 --- a/calico-cloud_versioned_docs/version-23-2/_includes/content/_entityrule.mdx +++ b/calico-cloud_versioned_docs/version-23-2/_includes/content/_entityrule.mdx @@ -31,6 +31,10 @@ You cannot mix IPv4 and IPv6 CIDRs in a single rule using `nets` or `notNets`. I ::: +When using selectors in network policy, remember that selectors only match (known) resources, but _rules_ match packets. +A rule with a selector `all()` won't match "all packets", it will match "packets from all in-scope endpoints and network sets". +To match all packets, do not include a selector in the rule at all. + #### Empty match fields An empty value in a match field is treated as if the field were not set at all, not as an empty set that matches nothing. @@ -39,6 +43,13 @@ It leaves the rule unconstrained by IP address, so the rule matches any source o The same is true of `notNets`, `ports`, and `notPorts`, and of an empty string in `selector`, `notSelector`, and `namespaceSelector`. $[prodname] typically drops the empty value when it stores the resource, so the field is absent when you read the policy back. +#### Understanding `notSelector` + +`notSelector` is somewhat subtle because the `not` in `notSelector` negates the packet match rather than the selector: + +- `selector: !has(foo)` matches packets from/to endpoints and network sets that do not have the label "foo". +- `notSelector: has(foo)` matches packets from/to **anywhere** (including outside the cluster), **except** traffic from/to endpoints and network sets that have the label "foo". + #### Selector performance in EntityRules When rendering policy into the data plane, $[prodname] must identify the endpoints that match the selectors diff --git a/calico-enterprise/_includes/content/_entityrule.mdx b/calico-enterprise/_includes/content/_entityrule.mdx index 5f75b684fb..dea06fbda9 100644 --- a/calico-enterprise/_includes/content/_entityrule.mdx +++ b/calico-enterprise/_includes/content/_entityrule.mdx @@ -31,6 +31,10 @@ You cannot mix IPv4 and IPv6 CIDRs in a single rule using `nets` or `notNets`. I ::: +When using selectors in network policy, remember that selectors only match (known) resources, but _rules_ match packets. +A rule with a selector `all()` won't match "all packets", it will match "packets from all in-scope endpoints and network sets". +To match all packets, do not include a selector in the rule at all. + #### Empty match fields An empty value in a match field is treated as if the field were not set at all, not as an empty set that matches nothing. @@ -39,6 +43,13 @@ It leaves the rule unconstrained by IP address, so the rule matches any source o The same is true of `notNets`, `ports`, and `notPorts`, and of an empty string in `selector`, `notSelector`, and `namespaceSelector`. $[prodname] typically drops the empty value when it stores the resource, so the field is absent when you read the policy back. +#### Understanding `notSelector` + +`notSelector` is somewhat subtle because the `not` in `notSelector` negates the packet match rather than the selector: + +- `selector: !has(foo)` matches packets from/to endpoints and network sets that do not have the label "foo". +- `notSelector: has(foo)` matches packets from/to **anywhere** (including outside the cluster), **except** traffic from/to endpoints and network sets that have the label "foo". + #### Selector performance in EntityRules When rendering policy into the data plane, $[prodname] must identify the endpoints that match the selectors diff --git a/calico-enterprise_versioned_docs/version-3.21-2/_includes/content/_entityrule.mdx b/calico-enterprise_versioned_docs/version-3.21-2/_includes/content/_entityrule.mdx index b0046b81b0..337fe24f92 100644 --- a/calico-enterprise_versioned_docs/version-3.21-2/_includes/content/_entityrule.mdx +++ b/calico-enterprise_versioned_docs/version-3.21-2/_includes/content/_entityrule.mdx @@ -31,6 +31,10 @@ You cannot mix IPv4 and IPv6 CIDRs in a single rule using `nets` or `notNets`. I ::: +When using selectors in network policy, remember that selectors only match (known) resources, but _rules_ match packets. +A rule with a selector `all()` won't match "all packets", it will match "packets from all in-scope endpoints and network sets". +To match all packets, do not include a selector in the rule at all. + #### Empty match fields An empty value in a match field is treated as if the field were not set at all, not as an empty set that matches nothing. @@ -39,6 +43,13 @@ It leaves the rule unconstrained by IP address, so the rule matches any source o The same is true of `notNets`, `ports`, and `notPorts`, and of an empty string in `selector`, `notSelector`, and `namespaceSelector`. $[prodname] typically drops the empty value when it stores the resource, so the field is absent when you read the policy back. +#### Understanding `notSelector` + +`notSelector` is somewhat subtle because the `not` in `notSelector` negates the packet match rather than the selector: + +- `selector: !has(foo)` matches packets from/to endpoints and network sets that do not have the label "foo". +- `notSelector: has(foo)` matches packets from/to **anywhere** (including outside the cluster), **except** traffic from/to endpoints and network sets that have the label "foo". + #### Selector performance in EntityRules When rendering policy into the data plane, $[prodname] must identify the endpoints that match the selectors diff --git a/calico-enterprise_versioned_docs/version-3.22-2/_includes/content/_entityrule.mdx b/calico-enterprise_versioned_docs/version-3.22-2/_includes/content/_entityrule.mdx index cec9b09c54..e22a496b41 100644 --- a/calico-enterprise_versioned_docs/version-3.22-2/_includes/content/_entityrule.mdx +++ b/calico-enterprise_versioned_docs/version-3.22-2/_includes/content/_entityrule.mdx @@ -31,6 +31,10 @@ You cannot mix IPv4 and IPv6 CIDRs in a single rule using `nets` or `notNets`. I ::: +When using selectors in network policy, remember that selectors only match (known) resources, but _rules_ match packets. +A rule with a selector `all()` won't match "all packets", it will match "packets from all in-scope endpoints and network sets". +To match all packets, do not include a selector in the rule at all. + #### Empty match fields An empty value in a match field is treated as if the field were not set at all, not as an empty set that matches nothing. @@ -39,6 +43,13 @@ It leaves the rule unconstrained by IP address, so the rule matches any source o The same is true of `notNets`, `ports`, and `notPorts`, and of an empty string in `selector`, `notSelector`, and `namespaceSelector`. $[prodname] typically drops the empty value when it stores the resource, so the field is absent when you read the policy back. +#### Understanding `notSelector` + +`notSelector` is somewhat subtle because the `not` in `notSelector` negates the packet match rather than the selector: + +- `selector: !has(foo)` matches packets from/to endpoints and network sets that do not have the label "foo". +- `notSelector: has(foo)` matches packets from/to **anywhere** (including outside the cluster), **except** traffic from/to endpoints and network sets that have the label "foo". + #### Selector performance in EntityRules When rendering policy into the data plane, $[prodname] must identify the endpoints that match the selectors diff --git a/calico-enterprise_versioned_docs/version-3.23-2/_includes/content/_entityrule.mdx b/calico-enterprise_versioned_docs/version-3.23-2/_includes/content/_entityrule.mdx index fa8681bc04..3edb0ad1d6 100644 --- a/calico-enterprise_versioned_docs/version-3.23-2/_includes/content/_entityrule.mdx +++ b/calico-enterprise_versioned_docs/version-3.23-2/_includes/content/_entityrule.mdx @@ -31,6 +31,10 @@ You cannot mix IPv4 and IPv6 CIDRs in a single rule using `nets` or `notNets`. I ::: +When using selectors in network policy, remember that selectors only match (known) resources, but _rules_ match packets. +A rule with a selector `all()` won't match "all packets", it will match "packets from all in-scope endpoints and network sets". +To match all packets, do not include a selector in the rule at all. + #### Empty match fields An empty value in a match field is treated as if the field were not set at all, not as an empty set that matches nothing. @@ -39,6 +43,13 @@ It leaves the rule unconstrained by IP address, so the rule matches any source o The same is true of `notNets`, `ports`, and `notPorts`, and of an empty string in `selector`, `notSelector`, and `namespaceSelector`. $[prodname] typically drops the empty value when it stores the resource, so the field is absent when you read the policy back. +#### Understanding `notSelector` + +`notSelector` is somewhat subtle because the `not` in `notSelector` negates the packet match rather than the selector: + +- `selector: !has(foo)` matches packets from/to endpoints and network sets that do not have the label "foo". +- `notSelector: has(foo)` matches packets from/to **anywhere** (including outside the cluster), **except** traffic from/to endpoints and network sets that have the label "foo". + #### Selector performance in EntityRules When rendering policy into the data plane, $[prodname] must identify the endpoints that match the selectors diff --git a/calico-enterprise_versioned_docs/version-3.24-2/_includes/content/_entityrule.mdx b/calico-enterprise_versioned_docs/version-3.24-2/_includes/content/_entityrule.mdx index 8d2d218212..8ef6979c7a 100644 --- a/calico-enterprise_versioned_docs/version-3.24-2/_includes/content/_entityrule.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-2/_includes/content/_entityrule.mdx @@ -31,6 +31,10 @@ You cannot mix IPv4 and IPv6 CIDRs in a single rule using `nets` or `notNets`. I ::: +When using selectors in network policy, remember that selectors only match (known) resources, but _rules_ match packets. +A rule with a selector `all()` won't match "all packets", it will match "packets from all in-scope endpoints and network sets". +To match all packets, do not include a selector in the rule at all. + #### Empty match fields An empty value in a match field is treated as if the field were not set at all, not as an empty set that matches nothing. @@ -39,6 +43,13 @@ It leaves the rule unconstrained by IP address, so the rule matches any source o The same is true of `notNets`, `ports`, and `notPorts`, and of an empty string in `selector`, `notSelector`, and `namespaceSelector`. $[prodname] typically drops the empty value when it stores the resource, so the field is absent when you read the policy back. +#### Understanding `notSelector` + +`notSelector` is somewhat subtle because the `not` in `notSelector` negates the packet match rather than the selector: + +- `selector: !has(foo)` matches packets from/to endpoints and network sets that do not have the label "foo". +- `notSelector: has(foo)` matches packets from/to **anywhere** (including outside the cluster), **except** traffic from/to endpoints and network sets that have the label "foo". + #### Selector performance in EntityRules When rendering policy into the data plane, $[prodname] must identify the endpoints that match the selectors