Document boot-time network protection for non-cluster hosts - #2904
Open
hjiawei wants to merge 1 commit into
Open
Document boot-time network protection for non-cluster hosts#2904hjiawei wants to merge 1 commit into
hjiawei wants to merge 1 commit into
Conversation
✅ Deploy Preview for calico-docs-preview-next ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview succeeded!Built without sensitive environment variables
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
There was a problem hiding this comment.
Pull request overview
Adds Calico Enterprise documentation for the new non-cluster host boot-time network protection behavior (deny-by-default ruleset applied during early boot until policy is first enforced), and updates related non-cluster host docs to reference it and reflect the current certificate-renewal command.
Changes:
- Add a new “Boot-time network protection” page under Install on non-cluster hosts, covering behavior, verification, configuration, opt-out, and recovery.
- Update non-cluster host troubleshooting guidance with two new reboot-related symptoms tied to boot-time protection.
- Correct the certificate renewal troubleshooting entry to reference the
calico component node noncluster-host-initsubcommand.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| sidebars-calico-enterprise.js | Adds the new boot protection page to the Calico Enterprise non-cluster hosts sidebar. |
| calico-enterprise/getting-started/bare-metal/troubleshoot.mdx | Updates cert-renewal wording and adds troubleshooting sections for boot-time protection symptoms and recovery links. |
| calico-enterprise/getting-started/bare-metal/boot-protection.mdx | New doc page describing boot-time protection behavior, verification, configuration, opt-out, and recovery paths. |
| calico-enterprise/getting-started/bare-metal/about.mdx | Adds an install-step note and additional-resources link pointing to the new boot-time protection page. |
Add a page for the non-cluster host boot-time network protection landing in Calico Enterprise v3.24.0-3.0 (EV-6755): what the boot ruleset allows, how to check it, how to change the allowed ports, how to opt out, and how to recover a locked-down or stalled host. The feature is on by default wherever calico-node.service is enabled, so the install page gets a note at the enable step and the troubleshooting page gets the two symptoms an operator is most likely to hit. Also correct the certificate renewal entry: calico-noncluster-host-init is now the "calico component node noncluster-host-init" subcommand rather than a standalone binary. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
hjiawei
force-pushed
the
nch-boot-time-protection-docs
branch
from
August 4, 2026 20:33
74f5c82 to
06bd3ef
Compare
alexh-tigera
reviewed
Aug 4, 2026
|
|
||
| :::note | ||
|
|
||
| After you upgrade the `calico-node` package on an existing host, protection starts at the next restart of `calico-node.service`, not only at the next reboot. |
Member
There was a problem hiding this comment.
Is this note needed? This is slightly confusing because earlier in the docs it says that
Protection covers boot only.
If the agent restarts without a reboot, its rules stay in the kernel and keep enforcing, so there is no gap to cover.
alexh-tigera
approved these changes
Aug 4, 2026
alexh-tigera
left a comment
alexh-tigera
left a comment
Member
There was a problem hiding this comment.
Other than a minor nitpick, LGTM
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add a page for the non-cluster host boot-time network protection landing in Calico Enterprise v3.24.0-3.0 (EV-6755): what the boot ruleset allows, how to check it, how to change the allowed ports, how to opt out, and how to recover a locked-down or stalled host.
The feature is on by default wherever calico-node.service is enabled, so the install page gets a note at the enable step and the troubleshooting page gets the two symptoms an operator is most likely to hit.
Also correct the certificate renewal entry: calico-noncluster-host-init is now the "calico component node noncluster-host-init" subcommand rather than a standalone binary.
Product Version(s):
Calico Enterprise v3.24 EP3.
Issue:
Link to docs preview:
SME review:
DOCS review:
Additional information:
Merge checklist: