From ba72db8ede94b64a6a7f82a757fc1f1bf3da2649 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Fri, 13 Nov 2026 12:15:15 +0000 Subject: [PATCH 1/2] DOCS-3167: Recommend --network-policy none on AKS --- calico-cloud/get-started/system-requirements.mdx | 15 ++++++++++++++- .../get-started/system-requirements.mdx | 15 ++++++++++++++- .../get-started/system-requirements.mdx | 15 ++++++++++++++- 3 files changed, 42 insertions(+), 3 deletions(-) diff --git a/calico-cloud/get-started/system-requirements.mdx b/calico-cloud/get-started/system-requirements.mdx index c2500a66c7..c29ffb519c 100644 --- a/calico-cloud/get-started/system-requirements.mdx +++ b/calico-cloud/get-started/system-requirements.mdx @@ -142,7 +142,10 @@ To access the web console, you can use latest two versions of the following web * Your cluster uses a supported combination of the `networkPlugin` and `networkPolicy` configurations: - `"networkPlugin": "none"` and `"networkPolicy": null` - `"networkPlugin": "azure"` and `"networkPolicy": null` - - `"networkPlugin": "azure"` and `"networkPolicy": "calico"` + - `"networkPlugin": "azure"` and `"networkPolicy": "calico"` (not recommended) + + We recommend that `networkPolicy` is `null`. + To get this, create your cluster with `--network-policy none`. You can check your configuration by running the following command: @@ -150,6 +153,16 @@ To access the web console, you can use latest two versions of the following web az aks show --query 'networkProfile' ``` + :::warning + + If you create your cluster with `--network-policy calico`, AKS installs its own Calico and keeps managing it after you connect the cluster to $[prodname]. + AKS updates can then change $[prodname] resources without warning. + To move an existing cluster to `--network-policy none`, you need a maintenance window. + Nodes restart, and network policy is not enforced for part of that time. + For help, [contact Support](https://tigeraio.my.site.com/community/s/login/). + + ::: + * If your cluster uses the Azure CNI, your cluster's CNI is set to [transparent mode](https://docs.microsoft.com/en-us/azure/aks/faq#what-is-azure-cni-transparent-mode-vs-bridge-mode). ```bash diff --git a/calico-cloud_versioned_docs/version-23-2/get-started/system-requirements.mdx b/calico-cloud_versioned_docs/version-23-2/get-started/system-requirements.mdx index 9465a4eba0..8f0db24ce9 100644 --- a/calico-cloud_versioned_docs/version-23-2/get-started/system-requirements.mdx +++ b/calico-cloud_versioned_docs/version-23-2/get-started/system-requirements.mdx @@ -140,7 +140,10 @@ To access the web console, you can use latest two versions of the following web * Your cluster uses a supported combination of the `networkPlugin` and `networkPolicy` configurations: - `"networkPlugin": "none"` and `"networkPolicy": null` - `"networkPlugin": "azure"` and `"networkPolicy": null` - - `"networkPlugin": "azure"` and `"networkPolicy": "calico"` + - `"networkPlugin": "azure"` and `"networkPolicy": "calico"` (not recommended) + + We recommend that `networkPolicy` is `null`. + To get this, create your cluster with `--network-policy none`. You can check your configuration by running the following command: @@ -148,6 +151,16 @@ To access the web console, you can use latest two versions of the following web az aks show --query 'networkProfile' ``` + :::warning + + If you create your cluster with `--network-policy calico`, AKS installs its own Calico and keeps managing it after you connect the cluster to $[prodname]. + AKS updates can then change $[prodname] resources without warning. + To move an existing cluster to `--network-policy none`, you need a maintenance window. + Nodes restart, and network policy is not enforced for part of that time. + For help, [contact Support](https://tigeraio.my.site.com/community/s/login/). + + ::: + * If your cluster uses the Azure CNI, your cluster's CNI is set to [transparent mode](https://docs.microsoft.com/en-us/azure/aks/faq#what-is-azure-cni-transparent-mode-vs-bridge-mode). ```bash diff --git a/calico-cloud_versioned_docs/version-24-1/get-started/system-requirements.mdx b/calico-cloud_versioned_docs/version-24-1/get-started/system-requirements.mdx index c2500a66c7..c29ffb519c 100644 --- a/calico-cloud_versioned_docs/version-24-1/get-started/system-requirements.mdx +++ b/calico-cloud_versioned_docs/version-24-1/get-started/system-requirements.mdx @@ -142,7 +142,10 @@ To access the web console, you can use latest two versions of the following web * Your cluster uses a supported combination of the `networkPlugin` and `networkPolicy` configurations: - `"networkPlugin": "none"` and `"networkPolicy": null` - `"networkPlugin": "azure"` and `"networkPolicy": null` - - `"networkPlugin": "azure"` and `"networkPolicy": "calico"` + - `"networkPlugin": "azure"` and `"networkPolicy": "calico"` (not recommended) + + We recommend that `networkPolicy` is `null`. + To get this, create your cluster with `--network-policy none`. You can check your configuration by running the following command: @@ -150,6 +153,16 @@ To access the web console, you can use latest two versions of the following web az aks show --query 'networkProfile' ``` + :::warning + + If you create your cluster with `--network-policy calico`, AKS installs its own Calico and keeps managing it after you connect the cluster to $[prodname]. + AKS updates can then change $[prodname] resources without warning. + To move an existing cluster to `--network-policy none`, you need a maintenance window. + Nodes restart, and network policy is not enforced for part of that time. + For help, [contact Support](https://tigeraio.my.site.com/community/s/login/). + + ::: + * If your cluster uses the Azure CNI, your cluster's CNI is set to [transparent mode](https://docs.microsoft.com/en-us/azure/aks/faq#what-is-azure-cni-transparent-mode-vs-bridge-mode). ```bash From b2adafd058bc6723c3b3cb6d01998058625c730d Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Fri, 13 Nov 2026 12:15:39 +0000 Subject: [PATCH 2/2] Drop the unpublished CC 23-2 copy --- .../get-started/system-requirements.mdx | 15 +-------------- 1 file changed, 1 insertion(+), 14 deletions(-) diff --git a/calico-cloud_versioned_docs/version-23-2/get-started/system-requirements.mdx b/calico-cloud_versioned_docs/version-23-2/get-started/system-requirements.mdx index 8f0db24ce9..9465a4eba0 100644 --- a/calico-cloud_versioned_docs/version-23-2/get-started/system-requirements.mdx +++ b/calico-cloud_versioned_docs/version-23-2/get-started/system-requirements.mdx @@ -140,10 +140,7 @@ To access the web console, you can use latest two versions of the following web * Your cluster uses a supported combination of the `networkPlugin` and `networkPolicy` configurations: - `"networkPlugin": "none"` and `"networkPolicy": null` - `"networkPlugin": "azure"` and `"networkPolicy": null` - - `"networkPlugin": "azure"` and `"networkPolicy": "calico"` (not recommended) - - We recommend that `networkPolicy` is `null`. - To get this, create your cluster with `--network-policy none`. + - `"networkPlugin": "azure"` and `"networkPolicy": "calico"` You can check your configuration by running the following command: @@ -151,16 +148,6 @@ To access the web console, you can use latest two versions of the following web az aks show --query 'networkProfile' ``` - :::warning - - If you create your cluster with `--network-policy calico`, AKS installs its own Calico and keeps managing it after you connect the cluster to $[prodname]. - AKS updates can then change $[prodname] resources without warning. - To move an existing cluster to `--network-policy none`, you need a maintenance window. - Nodes restart, and network policy is not enforced for part of that time. - For help, [contact Support](https://tigeraio.my.site.com/community/s/login/). - - ::: - * If your cluster uses the Azure CNI, your cluster's CNI is set to [transparent mode](https://docs.microsoft.com/en-us/azure/aks/faq#what-is-azure-cni-transparent-mode-vs-bridge-mode). ```bash