docs-2985: update multi-network/VRF auto-label docs#2874
Merged
Conversation
The Multi-VRF feature (tech preview) in Calico Enterprise 3.23.0-2.0 changed the auto-generated network labels on WorkloadEndpoints: - projectcalico.org/network now names the Calico Network (for example a VRF network), not the NetworkAttachmentDefinition. - projectcalico.org/network-attachment is new and holds the NAD name. - projectcalico.org/network-namespace was renamed to projectcalico.org/network-attachment-namespace. Update the three label reference sections and the sample WorkloadEndpoint YAML to match, in both the current docs and the version-3.23-2 twin. Verified against tigera/calico-private at tag v3.23.0-2.0 (api/pkg/apis/projectcalico/v3/constants.go and the workload endpoint converters in libcalico-go). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
✅ Deploy Preview for calico-docs-preview-next ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview succeeded!Built without sensitive environment variables
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
There was a problem hiding this comment.
Pull request overview
Updates Calico Enterprise documentation to reflect the Multi-VRF (tech preview) change in how multi-network/VRF-related labels are auto-generated on WorkloadEndpoint resources, across both the current docs and the version-3.23-2 docs.
Changes:
- Replaces the legacy
projectcalico.org/network-namespacelabel reference with the newprojectcalico.org/network-attachmentandprojectcalico.org/network-attachment-namespacelabels. - Updates label descriptions to reflect the new meaning of
projectcalico.org/network(CalicoNetwork, e.g., VRF network). - Updates the example
WorkloadEndpointYAML labels in the multiple-networks guide.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| calico-enterprise/reference/resources/workloadendpoint.mdx | Updates the multiple-networks label reference list for WorkloadEndpoints. |
| calico-enterprise/networking/configuring/multiple-networks.mdx | Updates label lists and the sample WorkloadEndpoint YAML to match new auto-label behavior. |
| calico-enterprise/network-policy/beginners/calico-labels.mdx | Updates the multi-network label reference section used for policy selector guidance. |
| calico-enterprise_versioned_docs/version-3.23-2/reference/resources/workloadendpoint.mdx | Mirrors the WorkloadEndpoint label reference updates for the 3.23-2 docs set. |
| calico-enterprise_versioned_docs/version-3.23-2/networking/configuring/multiple-networks.mdx | Mirrors the label list and sample YAML updates for the 3.23-2 multiple-networks guide. |
| calico-enterprise_versioned_docs/version-3.23-2/network-policy/beginners/calico-labels.mdx | Mirrors the policy label reference updates for the 3.23-2 docs set. |
|
|
||
| ### Labels, workload endpoints, and policy | ||
|
|
||
| When you set the `MultiInterfaceMode` field to `Multus` in the Installation resource, the following network and network interface labels are automatically added to new workload endpoints. |
|
|
||
| ### Enforce policy on the new network and pod interface | ||
|
|
||
| When MultiInterfaceMode is set to Multus, WorkloadEndpoints are created with these labels: |
|
|
||
| ### Labels, workload endpoints, and policy | ||
|
|
||
| When you set the `MultiInterfaceMode` field to `Multus` in the Installation resource, the following network and network interface labels are automatically added to new workload endpoints. |
|
|
||
| ### Enforce policy on the new network and pod interface | ||
|
|
||
| When MultiInterfaceMode is set to Multus, WorkloadEndpoints are created with these labels: |
matthewdupre
approved these changes
Jul 22, 2026
matthewdupre
left a comment
matthewdupre
left a comment
Member
There was a problem hiding this comment.
Thanks @ctauchen ! One suggestion - the network label only gets filled out when a network is specified (via projectcalico.org/networks or otherwise).
|
|
||
| When you set the `MultiInterfaceMode` field to `Multus` in the Installation resource, the following network and network interface labels are automatically added to new workload endpoints. | ||
|
|
||
| - `projectcalico.org/network` |
Member
There was a problem hiding this comment.
Suggested change
| - `projectcalico.org/network` | |
| - `projectcalico.org/network` (if the endpoint is attached to a Calico Network) |
|
|
||
| When MultiInterfaceMode is set to Multus, WorkloadEndpoints are created with these labels: | ||
|
|
||
| - `projectcalico.org/network` |
Member
There was a problem hiding this comment.
Suggested change
| - `projectcalico.org/network` | |
| - `projectcalico.org/network` (if the endpoint is attached to a Calico Network) |
|
|
||
| When you set the `MultiInterfaceMode` field to `Multus` in the Installation resource, the following network and network interface labels are automatically added to new workload endpoints. | ||
|
|
||
| - `projectcalico.org/network` |
Member
There was a problem hiding this comment.
Suggested change
| - `projectcalico.org/network` | |
| - `projectcalico.org/network` (if the endpoint is attached to a Calico Network) |
|
|
||
| When MultiInterfaceMode is set to Multus, WorkloadEndpoints are created with these labels: | ||
|
|
||
| - `projectcalico.org/network` |
Member
There was a problem hiding this comment.
Suggested change
| - `projectcalico.org/network` | |
| - `projectcalico.org/network` (if the endpoint is attached to a Calico Network) |
Address Matt Dupre's review: the projectcalico.org/network label is only set when the endpoint is attached to a Calico Network. Qualify the label lists and descriptions accordingly, in both the current docs and the version-3.23-2 twin. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
ctauchen
marked this pull request as ready for review
July 23, 2026 10:42
Collaborator
Author
|
Thanks @matthewdupre — applied your suggestion. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ticket
DOCS-2985
What
Multi-VRF (tech preview, shipped in Calico Enterprise 3.23.0-2.0) changed the auto-generated network labels on WorkloadEndpoints. The docs still listed the old labels. This updates the three label reference sections and the sample WorkloadEndpoint YAML, in both the current docs and the
version-3.23-2twin.Reported by @shaun in Slack; VRF work by @matt (CC @pooriya).
projectcalico.org/networkNetwork(for example, a VRF network), not the NetworkAttachmentDefinitionprojectcalico.org/network-attachment.../network)projectcalico.org/network-attachment-namespaceprojectcalico.org/network-namespaceprojectcalico.org/network-interfacePages (Enterprise only — no OSS/Cloud equivalents):
network-policy/beginners/calico-labels.mdxnetworking/configuring/multiple-networks.mdx(two label lists + sample WEP YAML)reference/resources/workloadendpoint.mdxVerified against code
tigera/calico-private@ tagv3.23.0-2.0:api/pkg/apis/projectcalico/v3/constants.go(L51-61), pluslibcalico-go/lib/backend/k8s/conversion/workload_endpoint_multus.go(L331-359) andworkload_endpoint_default.go(L200-204).Draft — open questions for @matt
projectcalico.org/networkfor VRF pods — I've written it as "the CalicoNetworkthe endpoint is attached to." Does this hold for both attachment paths, including Option 1 (primary interface on a VRF viacni.projectcalico.org/networks)?projectcalico.org/network(no CalicoNetworkCRD is recorded there, so the code doesn't set it) and moved the value tonetwork-attachment. Is that the correct representation for a plain Multus calico network?version-3.23-2. Please confirmdocs.tigera.io/.../latest/resolves to one of these (older versions keep the old labels).🤖 Generated with Claude Code