Calico NetworkPolicy API

openapi: 3.1.0
info:
  title: Project Calico API (projectcalico.org/v3) BGPConfiguration NetworkPolicy API
  version: 3.0.0
  description: 'Calico exposes its custom resources through the Kubernetes API server

    under the `projectcalico.org/v3` API group. Authentication and transport

    follow standard Kubernetes conventions (bearer token or client cert) and

    requests are made against the cluster''s kube-apiserver. This document

    covers the most commonly used resources: NetworkPolicy, GlobalNetworkPolicy,

    BGPPeer, BGPConfiguration, IPPool, HostEndpoint, and Profile. Cluster-scoped

    resources do not appear under a `/namespaces/{namespace}/` segment.

    '
  contact:
    name: Project Calico / Tigera
    url: https://docs.tigera.io/calico/latest/reference/
servers:
- url: https://{kube_apiserver_host}/apis/projectcalico.org/v3
  description: Calico API group on the Kubernetes API server
  variables:
    kube_apiserver_host:
      default: kubernetes.default.svc
      description: Kubernetes API server host
security:
- BearerAuth: []
tags:
- name: NetworkPolicy
paths:
  /namespaces/{namespace}/networkpolicies:
    parameters:
    - $ref: '#/components/parameters/Namespace'
    get:
      tags:
      - NetworkPolicy
      summary: List NetworkPolicy in namespace
      operationId: listNamespacedNetworkPolicy
      parameters:
      - $ref: '#/components/parameters/LabelSelector'
      - $ref: '#/components/parameters/FieldSelector'
      responses:
        '200':
          description: NetworkPolicy list.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NetworkPolicyList'
        '401':
          $ref: '#/components/responses/Unauthorized'
    post:
      tags:
      - NetworkPolicy
      summary: Create NetworkPolicy
      operationId: createNamespacedNetworkPolicy
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/NetworkPolicy'
      responses:
        '201':
          description: Created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NetworkPolicy'
        '409':
          $ref: '#/components/responses/Conflict'
  /namespaces/{namespace}/networkpolicies/{name}:
    parameters:
    - $ref: '#/components/parameters/Namespace'
    - $ref: '#/components/parameters/Name'
    get:
      tags:
      - NetworkPolicy
      summary: Read NetworkPolicy
      operationId: readNamespacedNetworkPolicy
      responses:
        '200':
          description: NetworkPolicy.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NetworkPolicy'
        '404':
          $ref: '#/components/responses/NotFound'
    put:
      tags:
      - NetworkPolicy
      summary: Replace NetworkPolicy
      operationId: replaceNamespacedNetworkPolicy
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/NetworkPolicy'
      responses:
        '200':
          description: Updated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NetworkPolicy'
    delete:
      tags:
      - NetworkPolicy
      summary: Delete NetworkPolicy
      operationId: deleteNamespacedNetworkPolicy
      responses:
        '200':
          description: Deleted.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Status'
components:
  schemas:
    Rule:
      type: object
      required:
      - action
      properties:
        action:
          type: string
          enum:
          - Allow
          - Deny
          - Log
          - Pass
        protocol:
          type: string
        notProtocol:
          type: string
        icmp:
          type: object
          properties:
            type:
              type: integer
            code:
              type: integer
        ipVersion:
          type: integer
          enum:
          - 4
          - 6
        source:
          $ref: '#/components/schemas/EntityRule'
        destination:
          $ref: '#/components/schemas/EntityRule'
        http:
          type: object
          properties:
            methods:
              type: array
              items:
                type: string
            paths:
              type: array
              items:
                type: object
                additionalProperties: true
        metadata:
          type: object
          properties:
            annotations:
              type: object
              additionalProperties:
                type: string
    ObjectMeta:
      type: object
      properties:
        name:
          type: string
        namespace:
          type: string
        resourceVersion:
          type: string
        uid:
          type: string
        creationTimestamp:
          type: string
          format: date-time
        labels:
          type: object
          additionalProperties:
            type: string
        annotations:
          type: object
          additionalProperties:
            type: string
    EntityRule:
      type: object
      properties:
        nets:
          type: array
          items:
            type: string
        notNets:
          type: array
          items:
            type: string
        selector:
          type: string
        notSelector:
          type: string
        namespaceSelector:
          type: string
        ports:
          type: array
          items:
            oneOf:
            - type: integer
            - type: string
        notPorts:
          type: array
          items:
            oneOf:
            - type: integer
            - type: string
        serviceAccounts:
          type: object
          properties:
            names:
              type: array
              items:
                type: string
            selector:
              type: string
    NetworkPolicy:
      type: object
      required:
      - apiVersion
      - kind
      - metadata
      - spec
      properties:
        apiVersion:
          type: string
          const: projectcalico.org/v3
        kind:
          type: string
          const: NetworkPolicy
        metadata:
          $ref: '#/components/schemas/ObjectMeta'
        spec:
          $ref: '#/components/schemas/NetworkPolicySpec'
    NetworkPolicySpec:
      type: object
      properties:
        order:
          type: number
        tier:
          type: string
        selector:
          type: string
        serviceAccountSelector:
          type: string
        types:
          type: array
          items:
            type: string
            enum:
            - Ingress
            - Egress
        ingress:
          type: array
          items:
            $ref: '#/components/schemas/Rule'
        egress:
          type: array
          items:
            $ref: '#/components/schemas/Rule'
    NetworkPolicyList:
      type: object
      properties:
        apiVersion:
          type: string
        kind:
          type: string
          const: NetworkPolicyList
        items:
          type: array
          items:
            $ref: '#/components/schemas/NetworkPolicy'
    Status:
      type: object
      properties:
        kind:
          type: string
          default: Status
        apiVersion:
          type: string
        status:
          type: string
        message:
          type: string
        reason:
          type: string
        code:
          type: integer
  parameters:
    Name:
      name: name
      in: path
      required: true
      schema:
        type: string
    Namespace:
      name: namespace
      in: path
      required: true
      schema:
        type: string
    LabelSelector:
      name: labelSelector
      in: query
      schema:
        type: string
    FieldSelector:
      name: fieldSelector
      in: query
      schema:
        type: string
  responses:
    Unauthorized:
      description: Unauthorized.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Status'
    NotFound:
      description: Resource not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Status'
    Conflict:
      description: Conflict (already exists).
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Status'
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Kubernetes service account bearer token.