docs; update toService docs about headless services

.ToService rules only apply to services without selectors. The term headless service is a service without a ClusterIP; and those are distinct terms. Signed-off-by: Odin Ugedal <ougedal@palantir.com>
cilium · Jun 2, 2023 · 44d1008 · 44d1008
1 parent fc6376f
commit 44d1008
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 4 deletions.
diff --git a/Documentation/security/policy/language.rst b/Documentation/security/policy/language.rst
@@ -284,8 +284,8 @@ namespace ``default``.
         .. literalinclude:: ../../../examples/policies/l3/service/service.json
 
 This example shows how to allow all endpoints with the label ``id=app2``
-to talk to all endpoints of all kubernetes headless services which
-have ``head:none`` set as the label.
+to talk to all endpoints of all kubernetes services without selectors which
+have ``external:yes`` set as the label.
 
 .. only:: html
 

diff --git a/examples/policies/l3/service/service-labels.json b/examples/policies/l3/service/service-labels.json
@@ -12,7 +12,7 @@
                     "k8sServiceSelector": {
                         "selector": {
                             "matchLabels": {
-                                "head": "none"
+                                "external": "yes"
                             }
                         }
                     }

diff --git a/examples/policies/l3/service/service-labels.yaml b/examples/policies/l3/service/service-labels.yaml
@@ -11,4 +11,4 @@ spec:
     - k8sServiceSelector:
         selector:
           matchLabels:
-            head: none
+            external: yes