DOCS-3007: Rename allow-tigera tier to calico-system in Calico Cloud docs - #2918
Open
ctauchen wants to merge 2 commits into
Open
DOCS-3007: Rename allow-tigera tier to calico-system in Calico Cloud docs#2918ctauchen wants to merge 2 commits into
ctauchen wants to merge 2 commits into
Conversation
…docs Calico Cloud 23.0.0 renames the allow-tigera tier to calico-system, but the Calico Cloud docs still described allow-tigera. The rename was written in May on docs/ce-3.23-ep2-oss-3.32-mirror-cc (b3703db) and never merged, while the Calico Enterprise half of the same work landed as 137a531. This replays the Calico Cloud commit and extends it to the released tree: - Rename network-policy/policy-tiers/allow-tigera.mdx to calico-system.mdx in the Next tree and in calico-cloud_versioned_docs/version-23-2, and update the tiered-policy / network-policy index / configure-http-proxy / recommended-metrics / operations/disconnect cross-references and both sidebars. - Redirect the published allow-tigera URL to calico-system. - Add the missed breaking change note to the 23.0.0 release notes. The original commit left the versioned trees alone, which was right before 23.0.0 shipped. Calico Cloud 23 now runs the renamed tier, so version-23-2 needs it too. Version 22-2 keeps allow-tigera because Calico Cloud 22 runs that tier. The original commit also assumed no release note was needed, because the Tigera Operator renames the tier automatically. CI-2032 shows the operator migrates its own policies but not resources that users created, so the note lists what to check before upgrading. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
✅ Deploy Preview succeeded!Built without sensitive environment variables
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for calico-docs-preview-next ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
There was a problem hiding this comment.
Pull request overview
Updates Calico Cloud documentation to reflect the Calico Cloud 23 rename of the allow-tigera policy tier to calico-system, including navigation updates, cross-reference fixes, redirects for existing URLs, and a release-notes breaking-change note for 23.0.0.
Changes:
- Renames the policy-tier doc page from
allow-tigeratocalico-systemin both Calico Cloud “next” andversion-23-2, and updates related sidebars and index cards. - Updates multiple Calico Cloud docs to reference the renamed tier in examples and explanatory text.
- Adds redirects from the old published URLs and adds a missing breaking-change note in the 23.0.0 release notes.
Reviewed changes
Copilot reviewed 18 out of 18 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| static/_redirects | Adds redirects from allow-tigera URLs to calico-system for Calico Cloud current + next. |
| sidebars-calico-cloud.js | Updates sidebar doc entry to point to calico-system page. |
| calico-cloud/operations/monitor/metrics/recommended-metrics.mdx | Updates metrics examples to use tier="calico-system". |
| calico-cloud/operations/disconnect.mdx | Updates disconnect behavior description to reference calico-system. |
| calico-cloud/network-policy/policy-tiers/tiered-policy.mdx | Updates system tier description and link to renamed tier page. |
| calico-cloud/network-policy/policy-tiers/calico-system.mdx | Adds the new Calico Cloud “next” doc page for the renamed tier. |
| calico-cloud/network-policy/policy-tiers/allow-tigera.mdx | Removes the old Calico Cloud “next” page for allow-tigera. |
| calico-cloud/network-policy/index.mdx | Updates policy docs landing page card to the renamed tier doc. |
| calico-cloud/compliance/configure-http-proxy.mdx | Updates proxy-related explanation to reference calico-system. |
| calico-cloud_versioned_sidebars/version-23-2-sidebars.json | Updates versioned sidebar doc entry to calico-system. |
| calico-cloud_versioned_docs/version-23-2/release-notes/index.mdx | Adds a breaking-change note for the tier rename in the 23.0.0 entry. |
| calico-cloud_versioned_docs/version-23-2/operations/monitor/metrics/recommended-metrics.mdx | Updates versioned metrics examples to use tier="calico-system". |
| calico-cloud_versioned_docs/version-23-2/operations/disconnect.mdx | Updates versioned disconnect behavior description to reference calico-system. |
| calico-cloud_versioned_docs/version-23-2/network-policy/policy-tiers/tiered-policy.mdx | Updates versioned system tier description and link to renamed tier page. |
| calico-cloud_versioned_docs/version-23-2/network-policy/policy-tiers/calico-system.mdx | Adds the new versioned doc page for the renamed tier. |
| calico-cloud_versioned_docs/version-23-2/network-policy/policy-tiers/allow-tigera.mdx | Removes the old versioned page for allow-tigera. |
| calico-cloud_versioned_docs/version-23-2/network-policy/index.mdx | Updates versioned policy docs landing page card to the renamed tier doc. |
| calico-cloud_versioned_docs/version-23-2/compliance/configure-http-proxy.mdx | Updates versioned proxy-related explanation to reference calico-system. |
Suppressed comments (2)
calico-cloud_versioned_docs/version-23-2/network-policy/policy-tiers/calico-system.mdx:59
- The YAML example is not valid due to inconsistent indentation under
spec/ingress(several keys are misaligned). Readers copy/pasting this will likely get YAML parsing errors.
spec:
# Place in a tier prior to calico-system.
tier: preceding-tier
# Select the same endpoint as the original policy.
calico-cloud/network-policy/policy-tiers/calico-system.mdx:59
- The YAML example is not valid due to inconsistent indentation under
spec/ingress(several keys are misaligned). Readers copy/pasting this will likely get YAML parsing errors.
spec:
# Place in a tier prior to calico-system.
tier: preceding-tier
# Select the same endpoint as the original policy.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| :::warning | ||
|
|
||
| Although it is possible to change the behavior of the `allow-tigera` using adjacent tiers, it is not a trivial task. You can break critical cluster traffic and impact the operation of $[prodname]. To prevent loss of cluster services, see [Change allow-tigera tier behavior](allow-tigera.mdx), and contact Support for help. | ||
| Although it is possible to change the behavior of the `calico-system` using adjacent tiers, it is not a trivial task. You can break critical cluster traffic and impact the operation of $[prodname]. To prevent loss of cluster services, see [Change calico-system tier behavior](calico-system.mdx), and contact Support for help. |
| :::warning | ||
|
|
||
| Although it is possible to change the behavior of the `allow-tigera` using adjacent tiers, it is not a trivial task. You can break critical cluster traffic and impact the operation of $[prodname]. To prevent loss of cluster services, see [Change allow-tigera tier behavior](allow-tigera.mdx), and contact Support for help. | ||
| Although it is possible to change the behavior of the `calico-system` using adjacent tiers, it is not a trivial task. You can break critical cluster traffic and impact the operation of $[prodname]. To prevent loss of cluster services, see [Change calico-system tier behavior](calico-system.mdx), and contact Support for help. |
| # Change calico-system tier behavior | ||
|
|
||
| :::warning | ||
| The `calico-system` tier contains policies that secure $[prodname] components and is critical to cluster integrity. It is controlled by the Tigera Operator, and policies in the tier should not be edited, and the tier should not be moved. Although you can change the behavior of calico-system using adjacent tiers, you can inadvertently break critical cluster traffic. We highly recommend that you work with Support to implement changes around `calico-system` to prevent service disruption. |
| # Change calico-system tier behavior | ||
|
|
||
| :::warning | ||
| The `calico-system` tier contains policies that secure $[prodname] components and is critical to cluster integrity. It is controlled by the Tigera Operator, and policies in the tier should not be edited, and the tier should not be moved. Although you can change the behavior of calico-system using adjacent tiers, you can inadvertently break critical cluster traffic. We highly recommend that you work with Support to implement changes around `calico-system` to prevent service disruption. |
The link check in make netlify fails on every pull request, which blocks the deploy preview for the main site. Two links are dead: - calicousers.slack.com returns 403 to the crawler on calico/reference/involved. Every other page links the same host with a trailing slash, and that form is already in the crawler skip list, so this makes the two involved pages consistent instead of adding a skip entry. - Cockroach Labs moved their docs to docs.cockroachlabs.com and dropped the stable alias, so the multi-cluster page linked from use-cases/cluster-mesh returns 404. The page still exists under a pinned version path. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 21 out of 21 changed files in this pull request and generated no new comments.
Suppressed comments (4)
calico-cloud/network-policy/policy-tiers/calico-system.mdx:42
- Grammar: “an
calico-systempolicy” should be “acalico-systempolicy”.
Let's say an `calico-system` policy allows ingress traffic from a $[prodname] component that you do not use, and you want to tighten enforcement to not allow this traffic.
calico-cloud_versioned_docs/version-23-2/network-policy/policy-tiers/calico-system.mdx:42
- Grammar: “an
calico-systempolicy” should be “acalico-systempolicy”.
Let's say an `calico-system` policy allows ingress traffic from a $[prodname] component that you do not use, and you want to tighten enforcement to not allow this traffic.
calico-cloud/network-policy/policy-tiers/calico-system.mdx:38
- Grammar: “must create policy” is missing an article; use “must create a policy …” for correct sentence structure.
This issue also appears on line 42 of the same file.
If you want to change the way traffic is enforced by the `calico-system` tier, you must create policy in an adjacent tier to meet your needs. For example, if a policy in the `calico-system` tier allows or denies traffic, and you want to change how that traffic is enforced, you can create a policy in a tier before `calico-system` that selects the same traffic to make your desired changes. Similarly, if a policy in the `calico-system` tier passes or does not select traffic that you want to enforce, you can create a policy in a tier after `calico-system` to select this traffic to meet the desired behavior.
calico-cloud_versioned_docs/version-23-2/network-policy/policy-tiers/calico-system.mdx:38
- Grammar: “must create policy” is missing an article; use “must create a policy …” for correct sentence structure.
This issue also appears on line 42 of the same file.
If you want to change the way traffic is enforced by the `calico-system` tier, you must create policy in an adjacent tier to meet your needs. For example, if a policy in the `calico-system` tier allows or denies traffic, and you want to change how that traffic is enforced, you can create a policy in a tier before `calico-system` that selects the same traffic to make your desired changes. Similarly, if a policy in the `calico-system` tier passes or does not select traffic that you want to enforce, you can create a policy in a tier after `calico-system` to select this traffic to meet the desired behavior.
This was referenced Aug 14, 2026
ctauchen
pushed a commit
that referenced
this pull request
Aug 14, 2026
Erik Stidham's wording from ctauchen#16, rebased onto main. The note now calls the tier rename a potential breaking change, since it only breaks clusters that depend on allow-tigera. It also says what a user has to do rather than only what to review: network policies in allow-tigera must be removed before the upgrade starts, or the install blocks until they are, and calico-system keeps the same order as allow-tigera. It closes with the recommendation to keep user policies out of the Calico Cloud tier. The original commit was written against the DOCS-3007 branch, where the policy-tiers page is already renamed to calico-system. On main that page is still allow-tigera, so the link points there. It moves with the rename when #2918 merges. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Calico Cloud 23.0.0 renames the allow-tigera tier to calico-system, but the Calico Cloud docs still described allow-tigera, and the 23.0.0 release notes never flagged the rename as a breaking change.
The rename was written in May on docs/ce-3.23-ep2-oss-3.32-mirror-cc (b3703db) and never merged. The Calico Enterprise half of the same work landed as 137a531, so Calico Enterprise renamed its pages while Calico Cloud did not. This replays the Calico Cloud commit and extends it to the released tree.
Changes:
The original commit left the versioned trees alone, which was right before 23.0.0 shipped. Calico Cloud 23 now runs the renamed tier, so version-23-2 needs it too. Version 22-2 keeps allow-tigera because Calico Cloud 22 runs that tier.
The original commit also assumed no release note was needed, because the Tigera Operator renames the tier automatically. CI-2032 shows the operator migrates its own policies but not resources that users created, so the note lists what to check before upgrading.
Out of scope:
Reviewers, once the deploy preview builds, please check these pages:
CI-2032: https://tigera.atlassian.net/browse/CI-2032