Document boot-time network protection for non-cluster hosts - #2904
Conversation
✅ Deploy Preview for calico-docs-preview-next ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview succeeded!Built without sensitive environment variables
To edit notification comments on pull requests, go to your Netlify project configuration. |
There was a problem hiding this comment.
Pull request overview
Adds Calico Enterprise documentation for the new non-cluster host boot-time network protection behavior (deny-by-default ruleset applied during early boot until policy is first enforced), and updates related non-cluster host docs to reference it and reflect the current certificate-renewal command.
Changes:
- Add a new “Boot-time network protection” page under Install on non-cluster hosts, covering behavior, verification, configuration, opt-out, and recovery.
- Update non-cluster host troubleshooting guidance with two new reboot-related symptoms tied to boot-time protection.
- Correct the certificate renewal troubleshooting entry to reference the
calico component node noncluster-host-initsubcommand.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| sidebars-calico-enterprise.js | Adds the new boot protection page to the Calico Enterprise non-cluster hosts sidebar. |
| calico-enterprise/getting-started/bare-metal/troubleshoot.mdx | Updates cert-renewal wording and adds troubleshooting sections for boot-time protection symptoms and recovery links. |
| calico-enterprise/getting-started/bare-metal/boot-protection.mdx | New doc page describing boot-time protection behavior, verification, configuration, opt-out, and recovery paths. |
| calico-enterprise/getting-started/bare-metal/about.mdx | Adds an install-step note and additional-resources link pointing to the new boot-time protection page. |
74f5c82 to
06bd3ef
Compare
|
|
||
| :::note | ||
|
|
||
| After you upgrade the `calico-node` package on an existing host, protection starts at the next restart of `calico-node.service`, not only at the next reboot. |
There was a problem hiding this comment.
Is this note needed? This is slightly confusing because earlier in the docs it says that
Protection covers boot only.
If the agent restarts without a reboot, its rules stay in the kernel and keep enforcing, so there is no gap to cover.
There was a problem hiding this comment.
Agreed — removed. The section already says protection is on by default with nothing to enable, and the upgrade timing detail belongs in the release notes.
alexh-tigera
left a comment
alexh-tigera
left a comment
There was a problem hiding this comment.
Other than a minor nitpick, LGTM
5fe32ac to
304aa36
Compare
Add a page for the non-cluster host boot-time network protection landing in Calico Enterprise v3.24.0-3.0 (EV-6755): what the boot ruleset allows (a fixed list, not read from configuration), how to check it, how to opt out, and how to recover a locked-down or stalled host. The feature is on by default wherever calico-node.service is enabled, so the install page gets a note at the enable step and the troubleshooting page gets the two symptoms an operator is most likely to hit. Also correct the certificate renewal entry: calico-noncluster-host-init is now the "calico component node noncluster-host-init" subcommand rather than a standalone binary. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
304aa36 to
df1d25f
Compare
|
This change is targeting Calico Enterprise v3.24 EP3 release. |
Add a page for the non-cluster host boot-time network protection landing in Calico Enterprise v3.24.0-3.0 (EV-6755): what the boot ruleset allows, how to check it, how to change the allowed ports, how to opt out, and how to recover a locked-down or stalled host.
The feature is on by default wherever calico-node.service is enabled, so the install page gets a note at the enable step and the troubleshooting page gets the two symptoms an operator is most likely to hit.
Also correct the certificate renewal entry: calico-noncluster-host-init is now the "calico component node noncluster-host-init" subcommand rather than a standalone binary.
Product Version(s):
Calico Enterprise v3.24 EP3.
Issue:
Link to docs preview:
SME review:
DOCS review:
Additional information:
Merge checklist: