Merge remote-tracking branch 'origin/main' into seth/EV-6466-aggressive-cut

Author: electricjesus

.github/workflows/link-check-weekly.yml

@@ -0,0 +1,81 @@
+name: Weekly link check
+
+on:
+  # Weekly schedule: Monday at 07:00 UTC (after the llms.txt job at 06:00).
+  schedule:
+    - cron: '0 7 * * 1'
+
+  # Manual trigger via GitHub UI
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  issues: write
+
+jobs:
+  link-check:
+    name: Build, serve, and crawl the docs
+    runs-on: ubuntu-latest
+    timeout-minutes: 180
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Enable Corepack
+        run: corepack enable
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'yarn'
+
+      - name: Build the site
+        run: make build
+        env:
+          NODE_OPTIONS: '--max-old-space-size=6000'
+          DOCUSAURUS_IGNORE_SSG_WARNINGS: 'true'
+
+      - name: Install Playwright Chrome
+        run: yarn playwright install --with-deps chrome
+
+      - name: Serve the site and run the link check
+        run: make test 2>&1 | tee link-check.log
+        env:
+          CI: 'true'
+
+      - name: Upload the link-check log
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: link-check-log
+          path: link-check.log
+          if-no-files-found: ignore
+
+      - name: Open or update an issue on failure
+        if: failure()
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          TITLE="Weekly link check failed"
+          BODY_FILE=issue-body.md
+          RUN_URL="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
+          {
+            echo "The weekly link check found broken links or errors."
+            echo ""
+            echo "Run: ${RUN_URL}"
+            echo ""
+            echo "Last lines of the report (full log is in the run artifact \"link-check-log\"):"
+            echo ""
+            echo '```'
+            tail -n 200 link-check.log 2>/dev/null || echo "(no log captured)"
+            echo '```'
+          } > "$BODY_FILE"
+          NUM=$(gh issue list --repo "$GITHUB_REPOSITORY" --state open \
+            --search "\"$TITLE\" in:title" --json number --jq '.[0].number // empty')
+          if [ -n "$NUM" ]; then
+            gh issue comment "$NUM" --repo "$GITHUB_REPOSITORY" --body-file "$BODY_FILE"
+          else
+            gh issue create --repo "$GITHUB_REPOSITORY" --title "$TITLE" --body-file "$BODY_FILE"
+          fi

__tests__/crawler.test.js

@@ -100,6 +100,7 @@ test('Crawl the docs and execute tests', async () => {
     'http://dpdk.org/git/dpdk-kmods', //==>Origin: https://raw.githubusercontent.com/projectcalico/vpp-dataplane/master/scripts/init_eks.sh
     //For frustrating 503 errors:
     'https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator',
+    /^https:\/\/amd64\.ocp\.releases\.ci\.openshift\.org\/?$/, //==>Origin: http://localhost:4242/calico-enterprise/latest/getting-started/install-on-clusters/openshift/hostedcontrolplanes
     //temp
     /^https:\/\/v1-21\.docs\.kubernetes\.io\/docs\/reference\/generated\/kubernetes-api\/v1\.21\//,
     'https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm',
@@ -116,6 +117,7 @@ test('Crawl the docs and execute tests', async () => {
     'http://www.iana.org/assignments/service-names', //==>Origin: https://downloads.tigera.io/ee/v3.14.4/manifests/tigera-operator.yaml
     'http://docs.openstack.org/',
     'http://docs.openstack.org', //This seems to be temporarily down.
+    'https://docs.openstack.org/install-guide/environment-etcd.html', // 403 from OpenStack docs WAF in Netlify build environment
     'https://tools.ietf.org/html/rfc5925',
     'https://datatracker.ietf.org/doc/html/rfc1149',
     'https://datatracker.ietf.org/doc/html/rfc7938',

calico-cloud/_includes/components/FelixConfig/index.js

@@ -32,7 +32,15 @@ const FelixConfig = ({ configType, name }) => {
   // Debugging logs
 
   if (!matchedGroup) {
-    return <p>No matching group found for '{name}'.</p>;
+    // Fail the build loudly rather than silently dropping the group's fields.
+    // `name` must exactly match a group Name in config-params.json, which is
+    // auto-synced from the Felix source repos. A prose/casing sweep once
+    // restyled these lookup keys and silently dropped fields (DOCS-2970).
+    throw new Error(
+      `FelixConfig: no group named '${name}' in config-params.json. The 'name' `
+      + `prop must exactly match a group Name in config-params.json; do not `
+      + `restyle it as prose.`
+    );
   }
 
   let content;

calico-cloud/_includes/content/_rule.mdx

@@ -12,7 +12,7 @@ are executed in order.
 | ipVersion   | Positive IP version match.                                                                 | `4`, `6`                                                     | integer                       |         |
 | source      | Source match parameters.                                                                   |                                                              | [EntityRule](#entityrule)     |         |
 | destination | Destination match parameters.                                                              |                                                              | [EntityRule](#entityrule)     |         |
-| http        | Match HTTP request parameters. Application layer policy must be enabled to use this field. |                                                              | [HTTPMatch](#httpmatch)       |         |
+| http        | Match HTTP request parameters. Application layer policy must be enabled to use this field. |                                                              | HTTPMatch       |         |
 
 After a `Log` action, processing continues with the next rule; `Allow` and `Deny` are immediate
 and final and no further rules are processed.

calico-cloud/about/calico-product-editions.mdx

@@ -92,7 +92,7 @@ Calico powers 100M+ containers across 8M+ nodes in 166 countries, and is support
 
 Start a free trial or request a demo to see Calico in action.
 
-* [Sign up for a Calico Cloud Free Tier account](https://www.calicocloud.io/)
+* [Sign up for a Calico Cloud Free Tier account](https://www.calicocloud.io/?code=free)
 * [Schedule a 30-minute demo with our experts](https://www.tigera.io/demo/)
 
 ### Installation guides

calico-cloud/about/index.mdx

@@ -220,7 +220,7 @@ Calico powers 100M+ containers across 8M+ nodes in 166 countries, and is support
 
 Start a free trial or request a demo to see Calico in action.
 
-* [Sign up for a Calico Cloud Free Tier account](https://www.calicocloud.io/)
+* [Sign up for a Calico Cloud Free Tier account](https://www.calicocloud.io/?code=free)
 * [Schedule a 30-minute demo with our experts](https://www.tigera.io/demo/)
 
 ### Installation guides

calico-cloud/free/connect-cluster-free.mdx

@@ -43,7 +43,7 @@ Try the [Calico Cloud Free Tier quickstart guide](quickstart.mdx) to create a cl
     * If you're on 3.29 or earlier, [upgrade your Calico installation to 3.30 or later](/calico/latest/operations/upgrading/kubernetes-upgrade#upgrading-an-installation-that-uses-the-operator) and then [enable the `Goldmane` custom resource](/calico/latest/observability/enable-whisker).
   </details>
 * You have an active Calico Cloud Free Tier account.
-  To create an account, go to the [Calico Cloud Free Tier sign-up page](https://calicocloud.io).
+  To create an account, go to the [Calico Cloud Free Tier sign-up page](https://calicocloud.io/?code=free).
 * You are signed in to the $[prodname] web console.
 
 ## Connect your cluster

calico-cloud/free/overview.mdx

@@ -93,7 +93,7 @@ For more information, see:
 
 ## Next steps
 
-* [Sign up for a free account with Calico Cloud](https://calicocloud.io/).
+* [Sign up for a free account with Calico Cloud](https://calicocloud.io/?code=free).
 * [Tutorial: Quickstart guide to Calico Cloud Free Tier](quickstart.mdx).
 * [Connect a cluster to Calico Cloud Free Tier](connect-cluster-free.mdx)
 * For an overview of the expanded feature set in Calico Cloud Pro, take a [tour of the full web console](../tutorials/calico-cloud-features/tour.mdx).

calico-cloud/free/quickstart.mdx

@@ -12,7 +12,7 @@ Get Calico Cloud running on a local Kind cluster, deploy a realistic microservic
 
 ## Before you begin
 
-* [Sign up for a Calico Cloud Free Tier account](https://calicocloud.io).
+* [Sign up for a Calico Cloud Free Tier account](https://calicocloud.io/?code=free).
 * Install [Kind](https://kind.sigs.k8s.io/docs/user/quick-start/), [Docker](https://docs.docker.com/desktop/), and [kubectl](https://kubernetes.io/docs/tasks/tools/#kubectl).
 
 ## Step 1: Create a Kind cluster

calico-cloud/get-started/cc-arch-diagram.mdx

@@ -31,18 +31,16 @@ The following diagram shows the major components in a managed cluster, followed
 | $[prodname] installer         | Gets installation resources from the $[prodname] portal, registers a managed cluster, and reports installation or upgrade progress. | &bull; TCP 443 to $[prodname] hosted service<br />&bull;  TCP 6443 to Kubernetes API server |
 | $[prodname] tunnel server     | Communicates with managed clusters by creating secure TLS tunnels. | Port 9000 from managed clusters                              |
 | calico-node                    | Bundles key components that are required for networking containers with $[prodname]:<br/><br />&bull;  Felix<br />&bull;  BIRD<br />&bull;  confd | &bull; TCP 5473 to Typha<br />&bull;  TCP 9900 and 9081 from Prometheus API service |
-| Container threat detection     | A threat detection engine that analyzes observed file and process activity to detect known malicious and suspicious activity. Monitors the following types of suspicious activity within containers:<br/><br />&bull; Access to sensitive system files and directories<br />&bull; Defense evasion<br />&bull; Discovery<br />&bull; Execution<br />&bull; Persistence<br />&bull; Privilege escalation<br/><br />Includes these components:<br /><br />**Runtime Security Operator**<br />An operator to manage and reconcile container threat defense components.<br/><br />**Runtime Reporter Pods**<br />Pods running on each node in the cluster to perform the detection activity outlined above.They send activity reports to Elasticsearch for analysis by $[prodname]. | TCP  to Kubernetes API server                                |
 | Compliance                     | Generates compliance reports for the Kubernetes cluster. Reports are based on archived flow and audit logs for Calico Cloud resources, plus any audit logs you’ve configured for Kubernetes resources in the Kubernetes API server. Compliance reports provide the following high-level information:<br /><br />&bull; Endpoints explicitly protected using ingress or egress policy<br />&bull; Policies and services<br />   - Policies and services associated with endpoints<br />   - Policy audit logs <br />&bull; Traffic<br />   - Allowed ingress/egress traffic to/from namespaces, and to/from the internet Compliance includes these components: <br /><br />**compliance-snapshotter** <br />Handles listing of required Kubernetes and $[prodname]configuration and pushes snapshots to Elasticsearch. Snapshots give you visibility into configuration changes, and how the cluster-wide configuration has evolved within a reporting interval.<br /><br />**compliance-reporter**<br />Handles report generation. Reads configuration history from Elasticsearch and determines time evolution of cluster-wide configuration, including relationships between policies, endpoints, services, and network sets. Data is then passed through a zero-trust aggregator to determine the “worst-case outliers” in the reporting interval.<br /><br />**compliance-controller**<br />Reads report configuration and manages creation, deletion, and monitoring of report generation jobs.<br /><br />**compliance-benchmarker**<br />A daemonset that runs checks in the CIS Kubernetes Benchmark on each node so you can see if Kubernetes is securely deployed.<br /> | &bull; TCP 8080 to Guardian<br />&bull; TCP 6443 to Kubernetes API server |
 | Fluentd                        | Open-source data collector for unified logging. Collects and forwards $[prodname] logs (flows, DNS, L7) to log storage. | &bull; TCP 8080 to Guardian<br />&bull;  TCP 9080 from Prometheus API service |
 | Guardian                       | An agent running in each managed cluster that proxies communication between the $[prodname] tunnel server and your managed cluster. Secured using TLS tunnels.<br /> | &bull; Port 9000 to tunnel server<br />&bull; TCP 6443 to Kubernetes API server<br />&bull; TCP 6443 from $[prodname] components |
 | Installation endpoints         | Endpoints at  `*.calicocloud.io` and `*.projectcalico.org`. | TCP 443 for both                                             |
 | Intrusion detection controller | Handles integrations with threat intelligence feeds and $[prodname] custom alerts. | &bull; TCP 8080 to Guardian<br />&bull; TCP 6443 to Kubernetes API server |
-| Image Assurance                | Identifies vulnerabilities in container images that you deploy to Kubernetes clusters.  Components of interest are: <br /><br />**Admission controller**<br />Uses Kubernetes Validating Webhook Configuration to control which images can be used to create pods based on scan results. <br /><br />**API**<br />Isolates tenant data and authorizes all external access to Image Assurance data. **Note:** $[prodname] does not store registry credentials in its database and does not pull customer images into the $[prodname] control plane.<br /> | &bull;  TCP 8080 to Guardian<br /> &bull;  TCP 6443 to Kubernetes API server |
 | Kubernetes API server          | A Kubernetes component that validates and configures data for the API objects (for example, pods, services, and others). <br /> | TCP 6443 (from all components)                               |
 | kube-controllers               | Monitors the Kubernetes API and performs actions based on cluster state. $[prodname] kube-controllers container includes these controllers:<br/><br />&bull; Node<br />&bull; Service<br />&bull; Federated services<br />&bull; Authorization<br /> | &bull; TCP 9094 from Prometheus API service<br />&bull;  TCP 6443 to Kubernetes API server |
 | Log storage                    | Storage for logs (flows, L7, DNS, audit).  Data for each managed cluster is isolated and protected against unauthorized access. | n/a                                                          |
 | Packet capture API             | Retrieves capture files (pcap format) generated by a packet capture for use with network protocol analysis tools like Wireshark. Packet capture data is visible in the web console and Service Graph. | &bull; TCP 8449 Guardian to Packet Capture API<br />&bull; TCP 6443 to Kubernetes API server |
 | Prometheus API service         | Collects metrics from $[prodname] components and makes the metrics available to the web console. | &bull; TCP 6443 to Kubernetes API server<br />&bull;  TCP 9080 to Fluentd<br />&bull; TCP 9900 and 9081 to Prometheus API service |
 | Tigera API server              | Allows users to manage $[prodname] resources such as policies and tiers through kubectl or the Kubernetes API server. | &bull; TCP 9095 to Prometheus API service<br />&bull; TCP 8080 from Kubernetes API server |
 | Typha                          | Increases scale by reducing each node’s impact on the datastore. | TCP 5473 from calico-node to Typha                           |
-| User access to the web console      | Authenticated users can access the browser-based the web console, which provides network traffic visibility and troubleshooting, centralized multi-cluster management, threat-defense, container threat detection, policy lifecycle management, scan images for vulnerabilities, and compliance for multiple roles/stakeholders. | Port 443 to $[prodname] tunnel server                       |
+| User access to the web console      | Authenticated users can access the browser-based the web console, which provides network traffic visibility and troubleshooting, centralized multi-cluster management, threat-defense, policy lifecycle management, and compliance for multiple roles/stakeholders. | Port 443 to $[prodname] tunnel server                       |