apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: networkpolicies.crd.projectcalico.org
spec:
  group: crd.projectcalico.org
  names:
    kind: NetworkPolicy
    listKind: NetworkPolicyList
    plural: networkpolicies
    singular: networkpolicy
  scope: Namespaced
  versions:
    - name: v1
      schema:
        openAPIV3Schema:
          properties:
            apiVersion:
              description:
                "APIVersion defines the versioned schema of this representation
                of an object. Servers should convert recognized schemas to the latest
                internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources"
              type: string
            kind:
              description:
                "Kind is a string value representing the REST resource this
                object represents. Servers may infer this from the endpoint the client
                submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
              type: string
            metadata:
              type: object
            spec:
              properties:
                egress:
                  description:
                    The ordered set of egress rules.  Each rule contains
                    a set of packet match criteria and a corresponding action to apply.
                  items:
                    description:
                      "A Rule encapsulates a set of match criteria and an
                      action.  Both selector-based security Policy and security Profiles
                      reference rules - separated out as a list of rules for both ingress
                      and egress packet matching. \n Each positive match criteria has
                      a negated version, prefixed with \"Not\". All the match criteria
                      within a rule must be satisfied for a packet to match. A single
                      rule can contain the positive and negative version of a match
                      and both must be satisfied for the rule to match."
                    properties:
                      action:
                        type: string
                      destination:
                        description:
                          Destination contains the match criteria that apply
                          to destination entity.
                        properties:
                          namespaceSelector:
                            description:
                              "NamespaceSelector is an optional field that
                              contains a selector expression. Only traffic that originates
                              from (or terminates at) endpoints within the selected
                              namespaces will be matched. When both NamespaceSelector
                              and another selector are defined on the same rule, then
                              only workload endpoints that are matched by both selectors
                              will be selected by the rule. \n For NetworkPolicy, an
                              empty NamespaceSelector implies that the Selector is limited
                              to selecting only workload endpoints in the same namespace
                              as the NetworkPolicy. \n For NetworkPolicy, `global()`
                              NamespaceSelector implies that the Selector is limited
                              to selecting only GlobalNetworkSet or HostEndpoint. \n
                              For GlobalNetworkPolicy, an empty NamespaceSelector implies
                              the Selector applies to workload endpoints across all
                              namespaces."
                            type: string
                          nets:
                            description:
                              Nets is an optional field that restricts the
                              rule to only apply to traffic that originates from (or
                              terminates at) IP addresses in any of the given subnets.
                            items:
                              type: string
                            type: array
                          notNets:
                            description:
                              NotNets is the negated version of the Nets
                              field.
                            items:
                              type: string
                            type: array
                          notPorts:
                            description:
                              NotPorts is the negated version of the Ports
                              field. Since only some protocols have ports, if any ports
                              are specified it requires the Protocol match in the Rule
                              to be set to "TCP" or "UDP".
                            items:
                              anyOf:
                                - type: integer
                                - type: string
                              pattern: ^.*
                              x-kubernetes-int-or-string: true
                            type: array
                          notSelector:
                            description:
                              NotSelector is the negated version of the Selector
                              field.  See Selector field for subtleties with negated
                              selectors.
                            type: string
                          ports:
                            description:
                              "Ports is an optional field that restricts
                              the rule to only apply to traffic that has a source (destination)
                              port that matches one of these ranges/values. This value
                              is a list of integers or strings that represent ranges
                              of ports. \n Since only some protocols have ports, if
                              any ports are specified it requires the Protocol match
                              in the Rule to be set to \"TCP\" or \"UDP\"."
                            items:
                              anyOf:
                                - type: integer
                                - type: string
                              pattern: ^.*
                              x-kubernetes-int-or-string: true
                            type: array
                          selector:
                            description:
                              "Selector is an optional field that contains
                              a selector expression (see Policy for sample syntax).
                              \ Only traffic that originates from (terminates at) endpoints
                              matching the selector will be matched. \n Note that: in
                              addition to the negated version of the Selector (see NotSelector
                              below), the selector expression syntax itself supports
                              negation.  The two types of negation are subtly different.
                              One negates the set of matched endpoints, the other negates
                              the whole match: \n \tSelector = \"!has(my_label)\" matches
                              packets that are from other Calico-controlled \tendpoints
                              that do not have the label \"my_label\". \n \tNotSelector
                              = \"has(my_label)\" matches packets that are not from
                              Calico-controlled \tendpoints that do have the label \"my_label\".
                              \n The effect is that the latter will accept packets from
                              non-Calico sources whereas the former is limited to packets
                              from Calico-controlled endpoints."
                            type: string
                          serviceAccounts:
                            description:
                              ServiceAccounts is an optional field that restricts
                              the rule to only apply to traffic that originates from
                              (or terminates at) a pod running as a matching service
                              account.
                            properties:
                              names:
                                description:
                                  Names is an optional field that restricts
                                  the rule to only apply to traffic that originates
                                  from (or terminates at) a pod running as a service
                                  account whose name is in the list.
                                items:
                                  type: string
                                type: array
                              selector:
                                description:
                                  Selector is an optional field that restricts
                                  the rule to only apply to traffic that originates
                                  from (or terminates at) a pod running as a service
                                  account that matches the given label selector. If
                                  both Names and Selector are specified then they are
                                  AND'ed.
                                type: string
                            type: object
                          services:
                            description:
                              "Services is an optional field that contains
                              options for matching Kubernetes Services. If specified,
                              only traffic that originates from or terminates at endpoints
                              within the selected service(s) will be matched, and only
                              to/from each endpoint's port. \n Services cannot be specified
                              on the same rule as Selector, NotSelector, NamespaceSelector,
                              Nets, NotNets or ServiceAccounts. \n Ports and NotPorts
                              can only be specified with Services on ingress rules."
                            properties:
                              name:
                                description:
                                  Name specifies the name of a Kubernetes
                                  Service to match.
                                type: string
                              namespace:
                                description:
                                  Namespace specifies the namespace of the
                                  given Service. If left empty, the rule will match
                                  within this policy's namespace.
                                type: string
                            type: object
                        type: object
                      http:
                        description:
                          HTTP contains match criteria that apply to HTTP
                          requests.
                        properties:
                          methods:
                            description:
                              Methods is an optional field that restricts
                              the rule to apply only to HTTP requests that use one of
                              the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
                              methods are OR'd together.
                            items:
                              type: string
                            type: array
                          paths:
                            description:
                              "Paths is an optional field that restricts
                              the rule to apply to HTTP requests that use one of the
                              listed HTTP Paths. Multiple paths are OR'd together.
                              e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
                              ONLY specify either a `exact` or a `prefix` match. The
                              validator will check for it."
                            items:
                              description:
                                "HTTPPath specifies an HTTP path to match.
                                It may be either of the form: exact: <path>: which matches
                                the path exactly or prefix: <path-prefix>: which matches
                                the path prefix"
                              properties:
                                exact:
                                  type: string
                                prefix:
                                  type: string
                              type: object
                            type: array
                        type: object
                      icmp:
                        description:
                          ICMP is an optional field that restricts the rule
                          to apply to a specific type and code of ICMP traffic.  This
                          should only be specified if the Protocol field is set to "ICMP"
                          or "ICMPv6".
                        properties:
                          code:
                            description:
                              Match on a specific ICMP code.  If specified,
                              the Type value must also be specified. This is a technical
                              limitation imposed by the kernel's iptables firewall,
                              which Calico uses to enforce the rule.
                            type: integer
                          type:
                            description:
                              Match on a specific ICMP type.  For example
                              a value of 8 refers to ICMP Echo Request (i.e. pings).
                            type: integer
                        type: object
                      ipVersion:
                        description:
                          IPVersion is an optional field that restricts the
                          rule to only match a specific IP version.
                        type: integer
                      metadata:
                        description:
                          Metadata contains additional information for this
                          rule
                        properties:
                          annotations:
                            additionalProperties:
                              type: string
                            description:
                              Annotations is a set of key value pairs that
                              give extra information about the rule
                            type: object
                        type: object
                      notICMP:
                        description: NotICMP is the negated version of the ICMP field.
                        properties:
                          code:
                            description:
                              Match on a specific ICMP code.  If specified,
                              the Type value must also be specified. This is a technical
                              limitation imposed by the kernel's iptables firewall,
                              which Calico uses to enforce the rule.
                            type: integer
                          type:
                            description:
                              Match on a specific ICMP type.  For example
                              a value of 8 refers to ICMP Echo Request (i.e. pings).
                            type: integer
                        type: object
                      notProtocol:
                        anyOf:
                          - type: integer
                          - type: string
                        description:
                          NotProtocol is the negated version of the Protocol
                          field.
                        pattern: ^.*
                        x-kubernetes-int-or-string: true
                      protocol:
                        anyOf:
                          - type: integer
                          - type: string
                        description:
                          "Protocol is an optional field that restricts the
                          rule to only apply to traffic of a specific IP protocol. Required
                          if any of the EntityRules contain Ports (because ports only
                          apply to certain protocols). \n Must be one of these string
                          values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
                          \"UDPLite\" or an integer in the range 1-255."
                        pattern: ^.*
                        x-kubernetes-int-or-string: true
                      source:
                        description:
                          Source contains the match criteria that apply to
                          source entity.
                        properties:
                          namespaceSelector:
                            description:
                              "NamespaceSelector is an optional field that
                              contains a selector expression. Only traffic that originates
                              from (or terminates at) endpoints within the selected
                              namespaces will be matched. When both NamespaceSelector
                              and another selector are defined on the same rule, then
                              only workload endpoints that are matched by both selectors
                              will be selected by the rule. \n For NetworkPolicy, an
                              empty NamespaceSelector implies that the Selector is limited
                              to selecting only workload endpoints in the same namespace
                              as the NetworkPolicy. \n For NetworkPolicy, `global()`
                              NamespaceSelector implies that the Selector is limited
                              to selecting only GlobalNetworkSet or HostEndpoint. \n
                              For GlobalNetworkPolicy, an empty NamespaceSelector implies
                              the Selector applies to workload endpoints across all
                              namespaces."
                            type: string
                          nets:
                            description:
                              Nets is an optional field that restricts the
                              rule to only apply to traffic that originates from (or
                              terminates at) IP addresses in any of the given subnets.
                            items:
                              type: string
                            type: array
                          notNets:
                            description:
                              NotNets is the negated version of the Nets
                              field.
                            items:
                              type: string
                            type: array
                          notPorts:
                            description:
                              NotPorts is the negated version of the Ports
                              field. Since only some protocols have ports, if any ports
                              are specified it requires the Protocol match in the Rule
                              to be set to "TCP" or "UDP".
                            items:
                              anyOf:
                                - type: integer
                                - type: string
                              pattern: ^.*
                              x-kubernetes-int-or-string: true
                            type: array
                          notSelector:
                            description:
                              NotSelector is the negated version of the Selector
                              field.  See Selector field for subtleties with negated
                              selectors.
                            type: string
                          ports:
                            description:
                              "Ports is an optional field that restricts
                              the rule to only apply to traffic that has a source (destination)
                              port that matches one of these ranges/values. This value
                              is a list of integers or strings that represent ranges
                              of ports. \n Since only some protocols have ports, if
                              any ports are specified it requires the Protocol match
                              in the Rule to be set to \"TCP\" or \"UDP\"."
                            items:
                              anyOf:
                                - type: integer
                                - type: string
                              pattern: ^.*
                              x-kubernetes-int-or-string: true
                            type: array
                          selector:
                            description:
                              "Selector is an optional field that contains
                              a selector expression (see Policy for sample syntax).
                              \ Only traffic that originates from (terminates at) endpoints
                              matching the selector will be matched. \n Note that: in
                              addition to the negated version of the Selector (see NotSelector
                              below), the selector expression syntax itself supports
                              negation.  The two types of negation are subtly different.
                              One negates the set of matched endpoints, the other negates
                              the whole match: \n \tSelector = \"!has(my_label)\" matches
                              packets that are from other Calico-controlled \tendpoints
                              that do not have the label \"my_label\". \n \tNotSelector
                              = \"has(my_label)\" matches packets that are not from
                              Calico-controlled \tendpoints that do have the label \"my_label\".
                              \n The effect is that the latter will accept packets from
                              non-Calico sources whereas the former is limited to packets
                              from Calico-controlled endpoints."
                            type: string
                          serviceAccounts:
                            description:
                              ServiceAccounts is an optional field that restricts
                              the rule to only apply to traffic that originates from
                              (or terminates at) a pod running as a matching service
                              account.
                            properties:
                              names:
                                description:
                                  Names is an optional field that restricts
                                  the rule to only apply to traffic that originates
                                  from (or terminates at) a pod running as a service
                                  account whose name is in the list.
                                items:
                                  type: string
                                type: array
                              selector:
                                description:
                                  Selector is an optional field that restricts
                                  the rule to only apply to traffic that originates
                                  from (or terminates at) a pod running as a service
                                  account that matches the given label selector. If
                                  both Names and Selector are specified then they are
                                  AND'ed.
                                type: string
                            type: object
                          services:
                            description:
                              "Services is an optional field that contains
                              options for matching Kubernetes Services. If specified,
                              only traffic that originates from or terminates at endpoints
                              within the selected service(s) will be matched, and only
                              to/from each endpoint's port. \n Services cannot be specified
                              on the same rule as Selector, NotSelector, NamespaceSelector,
                              Nets, NotNets or ServiceAccounts. \n Ports and NotPorts
                              can only be specified with Services on ingress rules."
                            properties:
                              name:
                                description:
                                  Name specifies the name of a Kubernetes
                                  Service to match.
                                type: string
                              namespace:
                                description:
                                  Namespace specifies the namespace of the
                                  given Service. If left empty, the rule will match
                                  within this policy's namespace.
                                type: string
                            type: object
                        type: object
                    required:
                      - action
                    type: object
                  type: array
                ingress:
                  description:
                    The ordered set of ingress rules.  Each rule contains
                    a set of packet match criteria and a corresponding action to apply.
                  items:
                    description:
                      "A Rule encapsulates a set of match criteria and an
                      action.  Both selector-based security Policy and security Profiles
                      reference rules - separated out as a list of rules for both ingress
                      and egress packet matching. \n Each positive match criteria has
                      a negated version, prefixed with \"Not\". All the match criteria
                      within a rule must be satisfied for a packet to match. A single
                      rule can contain the positive and negative version of a match
                      and both must be satisfied for the rule to match."
                    properties:
                      action:
                        type: string
                      destination:
                        description:
                          Destination contains the match criteria that apply
                          to destination entity.
                        properties:
                          namespaceSelector:
                            description:
                              "NamespaceSelector is an optional field that
                              contains a selector expression. Only traffic that originates
                              from (or terminates at) endpoints within the selected
                              namespaces will be matched. When both NamespaceSelector
                              and another selector are defined on the same rule, then
                              only workload endpoints that are matched by both selectors
                              will be selected by the rule. \n For NetworkPolicy, an
                              empty NamespaceSelector implies that the Selector is limited
                              to selecting only workload endpoints in the same namespace
                              as the NetworkPolicy. \n For NetworkPolicy, `global()`
                              NamespaceSelector implies that the Selector is limited
                              to selecting only GlobalNetworkSet or HostEndpoint. \n
                              For GlobalNetworkPolicy, an empty NamespaceSelector implies
                              the Selector applies to workload endpoints across all
                              namespaces."
                            type: string
                          nets:
                            description:
                              Nets is an optional field that restricts the
                              rule to only apply to traffic that originates from (or
                              terminates at) IP addresses in any of the given subnets.
                            items:
                              type: string
                            type: array
                          notNets:
                            description:
                              NotNets is the negated version of the Nets
                              field.
                            items:
                              type: string
                            type: array
                          notPorts:
                            description:
                              NotPorts is the negated version of the Ports
                              field. Since only some protocols have ports, if any ports
                              are specified it requires the Protocol match in the Rule
                              to be set to "TCP" or "UDP".
                            items:
                              anyOf:
                                - type: integer
                                - type: string
                              pattern: ^.*
                              x-kubernetes-int-or-string: true
                            type: array
                          notSelector:
                            description:
                              NotSelector is the negated version of the Selector
                              field.  See Selector field for subtleties with negated
                              selectors.
                            type: string
                          ports:
                            description:
                              "Ports is an optional field that restricts
                              the rule to only apply to traffic that has a source (destination)
                              port that matches one of these ranges/values. This value
                              is a list of integers or strings that represent ranges
                              of ports. \n Since only some protocols have ports, if
                              any ports are specified it requires the Protocol match
                              in the Rule to be set to \"TCP\" or \"UDP\"."
                            items:
                              anyOf:
                                - type: integer
                                - type: string
                              pattern: ^.*
                              x-kubernetes-int-or-string: true
                            type: array
                          selector:
                            description:
                              "Selector is an optional field that contains
                              a selector expression (see Policy for sample syntax).
                              \ Only traffic that originates from (terminates at) endpoints
                              matching the selector will be matched. \n Note that: in
                              addition to the negated version of the Selector (see NotSelector
                              below), the selector expression syntax itself supports
                              negation.  The two types of negation are subtly different.
                              One negates the set of matched endpoints, the other negates
                              the whole match: \n \tSelector = \"!has(my_label)\" matches
                              packets that are from other Calico-controlled \tendpoints
                              that do not have the label \"my_label\". \n \tNotSelector
                              = \"has(my_label)\" matches packets that are not from
                              Calico-controlled \tendpoints that do have the label \"my_label\".
                              \n The effect is that the latter will accept packets from
                              non-Calico sources whereas the former is limited to packets
                              from Calico-controlled endpoints."
                            type: string
                          serviceAccounts:
                            description:
                              ServiceAccounts is an optional field that restricts
                              the rule to only apply to traffic that originates from
                              (or terminates at) a pod running as a matching service
                              account.
                            properties:
                              names:
                                description:
                                  Names is an optional field that restricts
                                  the rule to only apply to traffic that originates
                                  from (or terminates at) a pod running as a service
                                  account whose name is in the list.
                                items:
                                  type: string
                                type: array
                              selector:
                                description:
                                  Selector is an optional field that restricts
                                  the rule to only apply to traffic that originates
                                  from (or terminates at) a pod running as a service
                                  account that matches the given label selector. If
                                  both Names and Selector are specified then they are
                                  AND'ed.
                                type: string
                            type: object
                          services:
                            description:
                              "Services is an optional field that contains
                              options for matching Kubernetes Services. If specified,
                              only traffic that originates from or terminates at endpoints
                              within the selected service(s) will be matched, and only
                              to/from each endpoint's port. \n Services cannot be specified
                              on the same rule as Selector, NotSelector, NamespaceSelector,
                              Nets, NotNets or ServiceAccounts. \n Ports and NotPorts
                              can only be specified with Services on ingress rules."
                            properties:
                              name:
                                description:
                                  Name specifies the name of a Kubernetes
                                  Service to match.
                                type: string
                              namespace:
                                description:
                                  Namespace specifies the namespace of the
                                  given Service. If left empty, the rule will match
                                  within this policy's namespace.
                                type: string
                            type: object
                        type: object
                      http:
                        description:
                          HTTP contains match criteria that apply to HTTP
                          requests.
                        properties:
                          methods:
                            description:
                              Methods is an optional field that restricts
                              the rule to apply only to HTTP requests that use one of
                              the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
                              methods are OR'd together.
                            items:
                              type: string
                            type: array
                          paths:
                            description:
                              "Paths is an optional field that restricts
                              the rule to apply to HTTP requests that use one of the
                              listed HTTP Paths. Multiple paths are OR'd together.
                              e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
                              ONLY specify either a `exact` or a `prefix` match. The
                              validator will check for it."
                            items:
                              description:
                                "HTTPPath specifies an HTTP path to match.
                                It may be either of the form: exact: <path>: which matches
                                the path exactly or prefix: <path-prefix>: which matches
                                the path prefix"
                              properties:
                                exact:
                                  type: string
                                prefix:
                                  type: string
                              type: object
                            type: array
                        type: object
                      icmp:
                        description:
                          ICMP is an optional field that restricts the rule
                          to apply to a specific type and code of ICMP traffic.  This
                          should only be specified if the Protocol field is set to "ICMP"
                          or "ICMPv6".
                        properties:
                          code:
                            description:
                              Match on a specific ICMP code.  If specified,
                              the Type value must also be specified. This is a technical
                              limitation imposed by the kernel's iptables firewall,
                              which Calico uses to enforce the rule.
                            type: integer
                          type:
                            description:
                              Match on a specific ICMP type.  For example
                              a value of 8 refers to ICMP Echo Request (i.e. pings).
                            type: integer
                        type: object
                      ipVersion:
                        description:
                          IPVersion is an optional field that restricts the
                          rule to only match a specific IP version.
                        type: integer
                      metadata:
                        description:
                          Metadata contains additional information for this
                          rule
                        properties:
                          annotations:
                            additionalProperties:
                              type: string
                            description:
                              Annotations is a set of key value pairs that
                              give extra information about the rule
                            type: object
                        type: object
                      notICMP:
                        description: NotICMP is the negated version of the ICMP field.
                        properties:
                          code:
                            description:
                              Match on a specific ICMP code.  If specified,
                              the Type value must also be specified. This is a technical
                              limitation imposed by the kernel's iptables firewall,
                              which Calico uses to enforce the rule.
                            type: integer
                          type:
                            description:
                              Match on a specific ICMP type.  For example
                              a value of 8 refers to ICMP Echo Request (i.e. pings).
                            type: integer
                        type: object
                      notProtocol:
                        anyOf:
                          - type: integer
                          - type: string
                        description:
                          NotProtocol is the negated version of the Protocol
                          field.
                        pattern: ^.*
                        x-kubernetes-int-or-string: true
                      protocol:
                        anyOf:
                          - type: integer
                          - type: string
                        description:
                          "Protocol is an optional field that restricts the
                          rule to only apply to traffic of a specific IP protocol. Required
                          if any of the EntityRules contain Ports (because ports only
                          apply to certain protocols). \n Must be one of these string
                          values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
                          \"UDPLite\" or an integer in the range 1-255."
                        pattern: ^.*
                        x-kubernetes-int-or-string: true
                      source:
                        description:
                          Source contains the match criteria that apply to
                          source entity.
                        properties:
                          namespaceSelector:
                            description:
                              "NamespaceSelector is an optional field that
                              contains a selector expression. Only traffic that originates
                              from (or terminates at) endpoints within the selected
                              namespaces will be matched. When both NamespaceSelector
                              and another selector are defined on the same rule, then
                              only workload endpoints that are matched by both selectors
                              will be selected by the rule. \n For NetworkPolicy, an
                              empty NamespaceSelector implies that the Selector is limited
                              to selecting only workload endpoints in the same namespace
                              as the NetworkPolicy. \n For NetworkPolicy, `global()`
                              NamespaceSelector implies that the Selector is limited
                              to selecting only GlobalNetworkSet or HostEndpoint. \n
                              For GlobalNetworkPolicy, an empty NamespaceSelector implies
                              the Selector applies to workload endpoints across all
                              namespaces."
                            type: string
                          nets:
                            description:
                              Nets is an optional field that restricts the
                              rule to only apply to traffic that originates from (or
                              terminates at) IP addresses in any of the given subnets.
                            items:
                              type: string
                            type: array
                          notNets:
                            description:
                              NotNets is the negated version of the Nets
                              field.
                            items:
                              type: string
                            type: array
                          notPorts:
                            description:
                              NotPorts is the negated version of the Ports
                              field. Since only some protocols have ports, if any ports
                              are specified it requires the Protocol match in the Rule
                              to be set to "TCP" or "UDP".
                            items:
                              anyOf:
                                - type: integer
                                - type: string
                              pattern: ^.*
                              x-kubernetes-int-or-string: true
                            type: array
                          notSelector:
                            description:
                              NotSelector is the negated version of the Selector
                              field.  See Selector field for subtleties with negated
                              selectors.
                            type: string
                          ports:
                            description:
                              "Ports is an optional field that restricts
                              the rule to only apply to traffic that has a source (destination)
                              port that matches one of these ranges/values. This value
                              is a list of integers or strings that represent ranges
                              of ports. \n Since only some protocols have ports, if
                              any ports are specified it requires the Protocol match
                              in the Rule to be set to \"TCP\" or \"UDP\"."
                            items:
                              anyOf:
                                - type: integer
                                - type: string
                              pattern: ^.*
                              x-kubernetes-int-or-string: true
                            type: array
                          selector:
                            description:
                              "Selector is an optional field that contains
                              a selector expression (see Policy for sample syntax).
                              \ Only traffic that originates from (terminates at) endpoints
                              matching the selector will be matched. \n Note that: in
                              addition to the negated version of the Selector (see NotSelector
                              below), the selector expression syntax itself supports
                              negation.  The two types of negation are subtly different.
                              One negates the set of matched endpoints, the other negates
                              the whole match: \n \tSelector = \"!has(my_label)\" matches
                              packets that are from other Calico-controlled \tendpoints
                              that do not have the label \"my_label\". \n \tNotSelector
                              = \"has(my_label)\" matches packets that are not from
                              Calico-controlled \tendpoints that do have the label \"my_label\".
                              \n The effect is that the latter will accept packets from
                              non-Calico sources whereas the former is limited to packets
                              from Calico-controlled endpoints."
                            type: string
                          serviceAccounts:
                            description:
                              ServiceAccounts is an optional field that restricts
                              the rule to only apply to traffic that originates from
                              (or terminates at) a pod running as a matching service
                              account.
                            properties:
                              names:
                                description:
                                  Names is an optional field that restricts
                                  the rule to only apply to traffic that originates
                                  from (or terminates at) a pod running as a service
                                  account whose name is in the list.
                                items:
                                  type: string
                                type: array
                              selector:
                                description:
                                  Selector is an optional field that restricts
                                  the rule to only apply to traffic that originates
                                  from (or terminates at) a pod running as a service
                                  account that matches the given label selector. If
                                  both Names and Selector are specified then they are
                                  AND'ed.
                                type: string
                            type: object
                          services:
                            description:
                              "Services is an optional field that contains
                              options for matching Kubernetes Services. If specified,
                              only traffic that originates from or terminates at endpoints
                              within the selected service(s) will be matched, and only
                              to/from each endpoint's port. \n Services cannot be specified
                              on the same rule as Selector, NotSelector, NamespaceSelector,
                              Nets, NotNets or ServiceAccounts. \n Ports and NotPorts
                              can only be specified with Services on ingress rules."
                            properties:
                              name:
                                description:
                                  Name specifies the name of a Kubernetes
                                  Service to match.
                                type: string
                              namespace:
                                description:
                                  Namespace specifies the namespace of the
                                  given Service. If left empty, the rule will match
                                  within this policy's namespace.
                                type: string
                            type: object
                        type: object
                    required:
                      - action
                    type: object
                  type: array
                order:
                  description:
                    Order is an optional field that specifies the order in
                    which the policy is applied. Policies with higher "order" are applied
                    after those with lower order.  If the order is omitted, it may be
                    considered to be "infinite" - i.e. the policy will be applied last.  Policies
                    with identical order will be applied in alphanumerical order based
                    on the Policy "Name".
                  type: number
                selector:
                  description:
                    "The selector is an expression used to pick pick out
                    the endpoints that the policy should be applied to. \n Selector
                    expressions follow this syntax: \n \tlabel == \"string_literal\"
                    \ ->  comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\"
                    \  ->  not equal; also matches if label is not present \tlabel in
                    { \"a\", \"b\", \"c\", ... }  ->  true if the value of label X is
                    one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\",
                    ... }  ->  true if the value of label X is not one of \"a\", \"b\",
                    \"c\" \thas(label_name)  -> True if that label is present \t! expr
                    -> negation of expr \texpr && expr  -> Short-circuit and \texpr
                    || expr  -> Short-circuit or \t( expr ) -> parens for grouping \tall()
                    or the empty selector -> matches all endpoints. \n Label names are
                    allowed to contain alphanumerics, -, _ and /. String literals are
                    more permissive but they do not support escape characters. \n Examples
                    (with made-up labels): \n \ttype == \"webserver\" && deployment
                    == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment !=
                    \"dev\" \t! has(label_name)"
                  type: string
                serviceAccountSelector:
                  description:
                    ServiceAccountSelector is an optional field for an expression
                    used to select a pod based on service accounts.
                  type: string
                types:
                  description:
                    "Types indicates whether this policy applies to ingress,
                    or to egress, or to both.  When not explicitly specified (and so
                    the value on creation is empty or nil), Calico defaults Types according
                    to what Ingress and Egress are present in the policy.  The default
                    is: \n - [ PolicyTypeIngress ], if there are no Egress rules (including
                    the case where there are   also no Ingress rules) \n - [ PolicyTypeEgress
                    ], if there are Egress rules but no Ingress rules \n - [ PolicyTypeIngress,
                    PolicyTypeEgress ], if there are both Ingress and Egress rules.
                    \n When the policy is read back again, Types will always be one
                    of these values, never empty or nil."
                  items:
                    description:
                      PolicyType enumerates the possible values of the PolicySpec
                      Types field.
                    type: string
                  type: array
              type: object
          type: object
      served: true
      storage: true
