DOCS-3007: Rename allow-tigera tier to calico-system in Calico Cloud docs - #2918
Merged
Conversation
✅ Deploy Preview succeeded!Built without sensitive environment variables
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for calico-docs-preview-next ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
There was a problem hiding this comment.
Pull request overview
Updates Calico Cloud documentation to reflect the Calico Cloud 23 rename of the allow-tigera policy tier to calico-system, including navigation updates, cross-reference fixes, redirects for existing URLs, and a release-notes breaking-change note for 23.0.0.
Changes:
- Renames the policy-tier doc page from
allow-tigeratocalico-systemin both Calico Cloud “next” andversion-23-2, and updates related sidebars and index cards. - Updates multiple Calico Cloud docs to reference the renamed tier in examples and explanatory text.
- Adds redirects from the old published URLs and adds a missing breaking-change note in the 23.0.0 release notes.
Reviewed changes
Copilot reviewed 18 out of 18 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| static/_redirects | Adds redirects from allow-tigera URLs to calico-system for Calico Cloud current + next. |
| sidebars-calico-cloud.js | Updates sidebar doc entry to point to calico-system page. |
| calico-cloud/operations/monitor/metrics/recommended-metrics.mdx | Updates metrics examples to use tier="calico-system". |
| calico-cloud/operations/disconnect.mdx | Updates disconnect behavior description to reference calico-system. |
| calico-cloud/network-policy/policy-tiers/tiered-policy.mdx | Updates system tier description and link to renamed tier page. |
| calico-cloud/network-policy/policy-tiers/calico-system.mdx | Adds the new Calico Cloud “next” doc page for the renamed tier. |
| calico-cloud/network-policy/policy-tiers/allow-tigera.mdx | Removes the old Calico Cloud “next” page for allow-tigera. |
| calico-cloud/network-policy/index.mdx | Updates policy docs landing page card to the renamed tier doc. |
| calico-cloud/compliance/configure-http-proxy.mdx | Updates proxy-related explanation to reference calico-system. |
| calico-cloud_versioned_sidebars/version-23-2-sidebars.json | Updates versioned sidebar doc entry to calico-system. |
| calico-cloud_versioned_docs/version-23-2/release-notes/index.mdx | Adds a breaking-change note for the tier rename in the 23.0.0 entry. |
| calico-cloud_versioned_docs/version-23-2/operations/monitor/metrics/recommended-metrics.mdx | Updates versioned metrics examples to use tier="calico-system". |
| calico-cloud_versioned_docs/version-23-2/operations/disconnect.mdx | Updates versioned disconnect behavior description to reference calico-system. |
| calico-cloud_versioned_docs/version-23-2/network-policy/policy-tiers/tiered-policy.mdx | Updates versioned system tier description and link to renamed tier page. |
| calico-cloud_versioned_docs/version-23-2/network-policy/policy-tiers/calico-system.mdx | Adds the new versioned doc page for the renamed tier. |
| calico-cloud_versioned_docs/version-23-2/network-policy/policy-tiers/allow-tigera.mdx | Removes the old versioned page for allow-tigera. |
| calico-cloud_versioned_docs/version-23-2/network-policy/index.mdx | Updates versioned policy docs landing page card to the renamed tier doc. |
| calico-cloud_versioned_docs/version-23-2/compliance/configure-http-proxy.mdx | Updates versioned proxy-related explanation to reference calico-system. |
Suppressed comments (2)
calico-cloud_versioned_docs/version-23-2/network-policy/policy-tiers/calico-system.mdx:59
- The YAML example is not valid due to inconsistent indentation under
spec/ingress(several keys are misaligned). Readers copy/pasting this will likely get YAML parsing errors.
spec:
# Place in a tier prior to calico-system.
tier: preceding-tier
# Select the same endpoint as the original policy.
calico-cloud/network-policy/policy-tiers/calico-system.mdx:59
- The YAML example is not valid due to inconsistent indentation under
spec/ingress(several keys are misaligned). Readers copy/pasting this will likely get YAML parsing errors.
spec:
# Place in a tier prior to calico-system.
tier: preceding-tier
# Select the same endpoint as the original policy.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| :::warning | ||
|
|
||
| Although it is possible to change the behavior of the `allow-tigera` using adjacent tiers, it is not a trivial task. You can break critical cluster traffic and impact the operation of $[prodname]. To prevent loss of cluster services, see [Change allow-tigera tier behavior](allow-tigera.mdx), and contact Support for help. | ||
| Although it is possible to change the behavior of the `calico-system` using adjacent tiers, it is not a trivial task. You can break critical cluster traffic and impact the operation of $[prodname]. To prevent loss of cluster services, see [Change calico-system tier behavior](calico-system.mdx), and contact Support for help. |
| :::warning | ||
|
|
||
| Although it is possible to change the behavior of the `allow-tigera` using adjacent tiers, it is not a trivial task. You can break critical cluster traffic and impact the operation of $[prodname]. To prevent loss of cluster services, see [Change allow-tigera tier behavior](allow-tigera.mdx), and contact Support for help. | ||
| Although it is possible to change the behavior of the `calico-system` using adjacent tiers, it is not a trivial task. You can break critical cluster traffic and impact the operation of $[prodname]. To prevent loss of cluster services, see [Change calico-system tier behavior](calico-system.mdx), and contact Support for help. |
| # Change calico-system tier behavior | ||
|
|
||
| :::warning | ||
| The `calico-system` tier contains policies that secure $[prodname] components and is critical to cluster integrity. It is controlled by the Tigera Operator, and policies in the tier should not be edited, and the tier should not be moved. Although you can change the behavior of calico-system using adjacent tiers, you can inadvertently break critical cluster traffic. We highly recommend that you work with Support to implement changes around `calico-system` to prevent service disruption. |
| # Change calico-system tier behavior | ||
|
|
||
| :::warning | ||
| The `calico-system` tier contains policies that secure $[prodname] components and is critical to cluster integrity. It is controlled by the Tigera Operator, and policies in the tier should not be edited, and the tier should not be moved. Although you can change the behavior of calico-system using adjacent tiers, you can inadvertently break critical cluster traffic. We highly recommend that you work with Support to implement changes around `calico-system` to prevent service disruption. |
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 21 out of 21 changed files in this pull request and generated no new comments.
Suppressed comments (4)
calico-cloud/network-policy/policy-tiers/calico-system.mdx:42
- Grammar: “an
calico-systempolicy” should be “acalico-systempolicy”.
Let's say an `calico-system` policy allows ingress traffic from a $[prodname] component that you do not use, and you want to tighten enforcement to not allow this traffic.
calico-cloud_versioned_docs/version-23-2/network-policy/policy-tiers/calico-system.mdx:42
- Grammar: “an
calico-systempolicy” should be “acalico-systempolicy”.
Let's say an `calico-system` policy allows ingress traffic from a $[prodname] component that you do not use, and you want to tighten enforcement to not allow this traffic.
calico-cloud/network-policy/policy-tiers/calico-system.mdx:38
- Grammar: “must create policy” is missing an article; use “must create a policy …” for correct sentence structure.
This issue also appears on line 42 of the same file.
If you want to change the way traffic is enforced by the `calico-system` tier, you must create policy in an adjacent tier to meet your needs. For example, if a policy in the `calico-system` tier allows or denies traffic, and you want to change how that traffic is enforced, you can create a policy in a tier before `calico-system` that selects the same traffic to make your desired changes. Similarly, if a policy in the `calico-system` tier passes or does not select traffic that you want to enforce, you can create a policy in a tier after `calico-system` to select this traffic to meet the desired behavior.
calico-cloud_versioned_docs/version-23-2/network-policy/policy-tiers/calico-system.mdx:38
- Grammar: “must create policy” is missing an article; use “must create a policy …” for correct sentence structure.
This issue also appears on line 42 of the same file.
If you want to change the way traffic is enforced by the `calico-system` tier, you must create policy in an adjacent tier to meet your needs. For example, if a policy in the `calico-system` tier allows or denies traffic, and you want to change how that traffic is enforced, you can create a policy in a tier before `calico-system` that selects the same traffic to make your desired changes. Similarly, if a policy in the `calico-system` tier passes or does not select traffic that you want to enforce, you can create a policy in a tier after `calico-system` to select this traffic to meet the desired behavior.
This was referenced Aug 14, 2026
ctauchen
pushed a commit
that referenced
this pull request
Aug 14, 2026
Erik Stidham's wording from ctauchen#16, rebased onto main. The note now calls the tier rename a potential breaking change, since it only breaks clusters that depend on allow-tigera. It also says what a user has to do rather than only what to review: network policies in allow-tigera must be removed before the upgrade starts, or the install blocks until they are, and calico-system keeps the same order as allow-tigera. It closes with the recommendation to keep user policies out of the Calico Cloud tier. The original commit was written against the DOCS-3007 branch, where the policy-tiers page is already renamed to calico-system. On main that page is still allow-tigera, so the link points there. It moves with the rename when #2918 merges. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 18 out of 18 changed files in this pull request and generated no new comments.
Suppressed comments (4)
calico-cloud/network-policy/policy-tiers/calico-system.mdx:67
- The YAML example’s indentation makes
action: Denyappear nested undersource:rather than a sibling field in the ingress rule item, which will be invalid/misleading when copied. Re-indent the rule entries soactionandsourceare at the same level under each list item.
- source:
selector: k8s-app == 'tigera-dpi'
namespaceSelector: name == 'tigera-dpi'
# Enact different behavior (originally: Allow)
action: Deny
calico-cloud_versioned_docs/version-23-2/network-policy/policy-tiers/calico-system.mdx:67
- The YAML example’s indentation makes
action: Denyappear nested undersource:rather than a sibling field in the ingress rule item, which will be invalid/misleading when copied. Re-indent the rule entries soactionandsourceare at the same level under each list item.
- source:
selector: k8s-app == 'tigera-dpi'
namespaceSelector: name == 'tigera-dpi'
# Enact different behavior (originally: Allow)
action: Deny
calico-cloud/network-policy/policy-tiers/calico-system.mdx:42
- Minor grammar issues: “create policy” should be “create a policy”, and “an
calico-systempolicy” should be “acalico-systempolicy” (since it’s pronounced with a hard ‘c’).
This issue also appears on line 63 of the same file.
If you want to change the way traffic is enforced by the `calico-system` tier, you must create policy in an adjacent tier to meet your needs. For example, if a policy in the `calico-system` tier allows or denies traffic, and you want to change how that traffic is enforced, you can create a policy in a tier before `calico-system` that selects the same traffic to make your desired changes. Similarly, if a policy in the `calico-system` tier passes or does not select traffic that you want to enforce, you can create a policy in a tier after `calico-system` to select this traffic to meet the desired behavior.
### Example: use preceding tier to tighten security
Let's say an `calico-system` policy allows ingress traffic from a $[prodname] component that you do not use, and you want to tighten enforcement to not allow this traffic.
calico-cloud_versioned_docs/version-23-2/network-policy/policy-tiers/calico-system.mdx:42
- Minor grammar issues: “create policy” should be “create a policy”, and “an
calico-systempolicy” should be “acalico-systempolicy” (since it’s pronounced with a hard ‘c’).
This issue also appears on line 63 of the same file.
If you want to change the way traffic is enforced by the `calico-system` tier, you must create policy in an adjacent tier to meet your needs. For example, if a policy in the `calico-system` tier allows or denies traffic, and you want to change how that traffic is enforced, you can create a policy in a tier before `calico-system` that selects the same traffic to make your desired changes. Similarly, if a policy in the `calico-system` tier passes or does not select traffic that you want to enforce, you can create a policy in a tier after `calico-system` to select this traffic to meet the desired behavior.
### Example: use preceding tier to tighten security
Let's say an `calico-system` policy allows ingress traffic from a $[prodname] component that you do not use, and you want to tighten enforcement to not allow this traffic.
…docs Calico Cloud 23 renames the allow-tigera tier to calico-system, but the Calico Cloud docs still described allow-tigera and the release notes never flagged the rename as a breaking change. The rename was written in May on docs/ce-3.23-ep2-oss-3.32-mirror-cc (b3703db) and never merged, while the Calico Enterprise half of the same work landed as 137a531. This replays the Calico Cloud commit and extends it to the released tree: - Rename network-policy/policy-tiers/allow-tigera.mdx to calico-system.mdx in the Next tree and in calico-cloud_versioned_docs/version-23-2, and update the tiered-policy / network-policy index / configure-http-proxy / recommended-metrics / operations/disconnect cross-references and both sidebars. - Redirect the published allow-tigera URL to calico-system, for Calico Cloud and for the Calico Enterprise versions that already renamed the page. /calico-enterprise/latest and /calico-enterprise/3.24 have returned 404 since the Calico Enterprise rename shipped, and the /security/allow-tigera rule pointed straight into that 404. - Add the missed breaking change note to the release notes, under both 23.0.0 and 23.0.1. The note appears under both versions because 23.0.0 is delisted. Anyone following the documented upgrade path goes to 23.0.1, so a note filed only under 23.0.0 would never be read by the people it is written for. The note also covers policy names. A policy name is prefixed with the name of its tier, so renaming the tier renames every policy in it, which affects RBAC resourceNames, manifests, and any query keyed on a policy name. The original commit left the versioned trees alone, which was right before 23.0.0 shipped. Calico Cloud 23 now runs the renamed tier, so version-23-2 needs it too. Version 22-2 is not built, so it is left untouched. Also fix two artifacts of the original mechanical substitution, in Calico Cloud and in the already-merged Calico Enterprise copies so the two stay in sync: "an calico-system" should be "a calico-system", and "the calico-system using adjacent tiers" was missing the noun. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 24 out of 24 changed files in this pull request and generated no new comments.
Suppressed comments (4)
calico-cloud/network-policy/policy-tiers/calico-system.mdx:54
- The YAML example’s lead-in comment mentions
calico-system.es-gateway-access, but the manifest being shown setsmetadata.name: preceding-tier.es-gateway-access. Clarify which policy each name refers to so readers don’t assume the example policy name iscalico-system.es-gateway-access.
# calico-system.es-gateway-access allows ingress from deep packet inspection, a feature not utilized for the purpose of this example.
# This policy tightens the scope of allowed ingress to es-gateway without modifying the calico-system policy directly.
apiVersion: projectcalico.org/v3
kind: NetworkPolicy
metadata:
name: preceding-tier.es-gateway-access
namespace: tigera-elasticsearch
calico-cloud_versioned_docs/version-23-2/network-policy/policy-tiers/calico-system.mdx:54
- The YAML example’s lead-in comment mentions
calico-system.es-gateway-access, but the manifest being shown setsmetadata.name: preceding-tier.es-gateway-access. Clarify which policy each name refers to so readers don’t assume the example policy name iscalico-system.es-gateway-access.
# calico-system.es-gateway-access allows ingress from deep packet inspection, a feature not utilized for the purpose of this example.
# This policy tightens the scope of allowed ingress to es-gateway without modifying the calico-system policy directly.
apiVersion: projectcalico.org/v3
kind: NetworkPolicy
metadata:
name: preceding-tier.es-gateway-access
namespace: tigera-elasticsearch
calico-cloud/network-policy/policy-tiers/calico-system.mdx:39
- Grammar: “you must create policy” is missing an article (for example, “you must create a policy”), which makes the sentence read incorrectly.
This issue also appears on line 47 of the same file.
### Change behavior of calico-system
If you want to change the way traffic is enforced by the `calico-system` tier, you must create policy in an adjacent tier to meet your needs. For example, if a policy in the `calico-system` tier allows or denies traffic, and you want to change how that traffic is enforced, you can create a policy in a tier before `calico-system` that selects the same traffic to make your desired changes. Similarly, if a policy in the `calico-system` tier passes or does not select traffic that you want to enforce, you can create a policy in a tier after `calico-system` to select this traffic to meet the desired behavior.
calico-cloud_versioned_docs/version-23-2/network-policy/policy-tiers/calico-system.mdx:39
- Grammar: “you must create policy” is missing an article (for example, “you must create a policy”), which makes the sentence read incorrectly.
This issue also appears on line 47 of the same file.
### Change behavior of calico-system
If you want to change the way traffic is enforced by the `calico-system` tier, you must create policy in an adjacent tier to meet your needs. For example, if a policy in the `calico-system` tier allows or denies traffic, and you want to change how that traffic is enforced, you can create a policy in a tier before `calico-system` that selects the same traffic to make your desired changes. Similarly, if a policy in the `calico-system` tier passes or does not select traffic that you want to enforce, you can create a policy in a tier after `calico-system` to select this traffic to meet the desired behavior.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Calico Cloud 23 renames the allow-tigera tier to calico-system, but the Calico Cloud docs still described allow-tigera, and the release notes never flagged the rename as a breaking change.
The rename was written in May on docs/ce-3.23-ep2-oss-3.32-mirror-cc (b3703db) and never merged. The Calico Enterprise half of the same work landed as 137a531, so Calico Enterprise renamed its pages while Calico Cloud did not. This replays the Calico Cloud commit and extends it to the released tree.
Changes:
The note appears under both 23.0.0 and 23.0.1 because 23.0.0 is delisted. Anyone following the documented upgrade path goes to 23.0.1, so a note filed only under 23.0.0 would never reach the people it is written for.
The note also covers policy names. A policy name is prefixed with the name of its tier, so renaming the tier renames every policy in it. That affects RBAC resourceNames, manifests and automation, and any dashboard or query keyed on a policy name.
The Calico Enterprise redirects are included because that rename already shipped and left live 404s: /calico-enterprise/latest/network-policy/policy-tiers/allow-tigera and the 3.24 equivalent both return 404 today, and the existing /security/allow-tigera rule redirected straight into that 404.
The original commit left the versioned trees alone, which was right before 23.0.0 shipped. Calico Cloud 23 now runs the renamed tier, so version-23-2 needs it too. Version 22-2 is left untouched; it is not in onlyIncludeVersions, so it is not built or published.
Out of scope: Calico Enterprise has no release note for this rename either. That is tracked separately.
Verified locally against the production build command: yarn build succeeds, and the make netlify link check passes with 5023 requests and no dead links. The redirects cannot be exercised by a local build, so reviewers please check them on the deploy preview.
Reviewers, please check these pages:
CI-2032: https://tigera.atlassian.net/browse/CI-2032
DOCS-3007: https://tigera.atlassian.net/browse/DOCS-3007