Profile Resource (profile)
A Profile resource (profile) represents a set of rules which are applied to the individual endpoints to which this profile has been assigned.
Each Calico endpoint or host endpoint can be assigned to zero or more profiles.
Also see the Policy resource which provides an alternate way to select what policy is applied to an endpoint.
For calicoctl
commands that specify a resource type on the CLI, the following
aliases are supported (all case insensitive): profile
, profiles
, pro
, pros
.
Sample YAML
The following sample profile allows all traffic from endpoints that
have the profile label set to profile1
(i.e. endpoints that reference this profile),
except that all traffic from 10.0.20.0/24 is denied.
apiVersion: v1
kind: profile
metadata:
name: profile1
labels:
profile: profile1
spec:
ingress:
- action: deny
source:
net: 10.0.20.0/24
- action: allow
source:
selector: profile == 'profile1'
egress:
- action: allow
Definition
Metadata
Field | Description | Accepted Values | Schema | Default |
---|---|---|---|---|
name | The name of the profile. | string | ||
labels | A set of labels to apply to endpoints using this profile. | map of string key to string values | ||
tags (deprecated) | A list of tag names to apply to endpoints using this profile. | list of strings |
Spec
Field | Description | Accepted Values | Schema | Default |
---|---|---|---|---|
ingress | The ingress rules belonging to this profile. | List of Rule | ||
egress | The egress rules belonging to this profile. | List of Rule |
Rule
Field | Description | Accepted Values | Schema | Default |
---|---|---|---|---|
action | Action to perform when matching this rule. | allow, deny, log | string | |
protocol | Positive protocol match. | tcp, udp, icmp, icmpv6, sctp, udplite, integer 1-255. | string | |
notProtocol | Negative protocol match. | tcp, udp, icmp, icmpv6, sctp, udplite, integer 1-255. | string | |
icmp | ICMP match criteria. | ICMP | ||
notICMP | Negative match on ICMP. | ICMP | ||
source | Source match parameters. | EntityRule | ||
destination | Destination match parameters. | EntityRule |
ICMP
Field | Description | Accepted Values | Schema | Default |
---|---|---|---|---|
type | Match on ICMP type. | Can be integer 1-255 | integer | |
code | Match on ICMP code. | Can be integer 1-255 | integer |
EntityRule
Field | Description | Accepted Values | Schema | Default |
---|---|---|---|---|
tag (deprecated) | Positive match on tag. | string | ||
notTag (deprecated) | Negative match on tag. | string | ||
net | Match on CIDR. | Valid IPv4 or IPv6 CIDR | cidr | |
notNet | Negative match on CIDR. | Valid IPv4 or IPv6 CIDR | cidr | |
selector | Positive match on selected endpoints. | selector | ||
notSelector | Negative match on selected endpoints. | selector | ||
ports | Positive match on the specified ports | list of ports | ||
notPorts | Negative match on the specified ports | list of ports |
Selector
A label selector is an expression which either matches or does not match an endpoint based on its labels.
Calico label selectors support a number of syntactic primitives. Each of the following
primitive expressions can be combined using the logical operator &&
.
Syntax | Meaning |
---|---|
k == ‘v’ | Matches any endpoint with the label ‘k’ and value ‘v’. |
k != ‘v’ | Matches any endpoint with the label ‘k’ and value that is not ‘v’. |
has(k) | Matches any endpoint with label ‘k’, independent of value. |
!has(k) | Matches any endpoint that does not have label ‘k’ |
k in { ‘v1’, ‘v2’ } | Matches any endpoint with label ‘k’ and value in the given set |
k not in { ‘v1’, ‘v2’ } | Matches any endpoint without label ‘k’ or any with label ‘k’ and value not in the given set |
Ports
Calico supports the following syntaxes for expressing ports.
Syntax | Example | Description |
---|---|---|
int | 80 | The exact port specified |
start:end | 6040:6050 | All ports within the range start <= x <= end |