Why calico policy is ading "default" in actual name as default.<policy_name>? (even if name space is not default)

[yogeshelke]

Why calico policy is adding "default" in actual name field of policy created in cluster as default.<policy_name>? (even if name space is not default, created policy not for default namespace).

Is this the bug?

My input policy:

apiVersion: projectcalico.org/v3
kind: NetworkPolicy
metadata:
  name: block-traffic-from-context-ns
  namespace: ops-infrastructure
spec:
  selector: all()
  types:
    - Ingress
  ingress:
    - action: Deny
      source:
        namespaceSelector: "namespace-type == 'context'"
    - action: Allow

Actual policy created by calico api:

│ apiVersion: crd.projectcalico.org/v1                                                                                                                                                    
│ kind: NetworkPolicy                                                                                                                                                                     
│ metadata:                                                                                                                                                                               
│   annotations:                                                                                                                                                                          
│     projectcalico.org/metadata: '{"creationTimestamp":"2024-12-23T19:12:07Z","managedFields":[{"manager":"Terraform","operation":"Apply","apiVersion":"projectcalico.org/v3","time":"20 │
│ 24-12-23T19:12:07Z","fieldsType":"FieldsV1","fieldsV1":{"f:spec":{"f:ingress":{},"f:selector":{},"f:types":{}}}}]}'                                                                     │
│   creationTimestamp: "2024-12-23T19:12:07Z"                                                                                                                                             
│   generation: 1                                                                                                                                                                         
│   name: default.block-traffic-from-context-ns                                                                                                                                          
│   namespace: ops-ingress                                                                                                                                                                
│   resourceVersion: "633102131"                                                                                                                                                          
│   uid: 54a0ca4a-19b7-42d3-b247-a98553fb35dc                                                                                                                                             
│ spec:                                                                                                                                                                                   
│   ingress:                                                                                                                                                                              
│   - action: Deny                                                                                                                                                                        
│     destination: {}                                                                                                                                                                     
│     source:                                                                                                                                                                             
│       namespaceSelector: namespace-type == 'context'                                                                                                                                    
│   - action: Allow                                                                                                                                                                       
│     destination: {}                                                                                                                                                                     
│     source: {}                                                                                                                                                                          
│   selector: all()                                                                                                                                                                       
│   types:                                                                                                                                                                                
│   - Ingress                                                                                                                                                                             
                        

[frozenprocess]

Calico v3.29+ has a new feature called tier. a tier is similar to a logical group that allows you to set priority for a group of policies.
in your example default is the tier and block-traffic-from-context-ns is the policy name.
https://docs.tigera.io/calico/latest/network-policy/policy-tiers/tiered-policy

[caseydavenport]

We are planning to fix this, btw. this is nominally a bug in the v3 API that is displaying the tier when it shouldnt.

Calico has always internally included the tier information.