> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracenyx.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# NyxClusterConfig

> Cluster-wide configuration — the default mode, enforcement, and excluded namespaces for a cluster.

`NyxClusterConfig` is the cluster's control object. It's a singleton — one per cluster — and it sets the fallback verdict for unmatched traffic, the enforcement mode for Nyx's system-generated policies, and the namespaces Nyx leaves alone.

|             |                            |
| ----------- | -------------------------- |
| API version | `nyx.tracenyx.io/v1alpha1` |
| Kind        | `NyxClusterConfig`         |
| Scope       | Cluster                    |
| Short names | `sncc`                     |

## Example

```yaml theme={null}
apiVersion: nyx.tracenyx.io/v1alpha1
kind: NyxClusterConfig
metadata:
  name: cluster
spec:
  defaultMode: deny-cross-namespace
  enforcement: audit
  excludedNamespaces:
    - kube-system
    - kube-public
    - nyx-system
```

## Spec

<ParamField path="defaultMode" type="string" default="allow">
  The fallback verdict when no policy rule matches a flow.

  * `allow` — all unmatched traffic passes. The safe default for migrating an existing cluster onto Nyx.
  * `deny-cross-namespace` — traffic within a namespace passes; cross-namespace traffic is denied.
  * `deny` — all unmatched traffic is denied. Full zero-trust.

  Setting `deny-cross-namespace` generates baseline policies that implement it (visible in your policy list); `deny` applies as a cluster-wide default without adding policies. See [Enforcement Modes](/concepts/enforcement-modes) for how to stage this safely.
</ParamField>

<ParamField path="enforcement" type="string" default="enforce">
  The enforcement mode applied to the system-generated deny policies that `defaultMode` creates: `dry-run`, `audit`, or `enforce`. This sets the mode for those generated baselines only — it does not change the mode on your own policies, which each carry their own `enforcement`.
</ParamField>

<ParamField path="excludedNamespaces" type="array of string" default="[kube-system, kube-public]">
  Namespaces that bypass all policy enforcement. The bypass is bidirectional — excluded namespaces are neither subject to policy nor counted as a policy source or destination. Observability hooks are still installed, so you keep visibility into excluded namespaces even though they aren't enforced.
</ParamField>

## Status

Nyx populates `status` — it's read-only. Fields include `observedMode` (the mode currently in effect), `systemPoliciesReady` (whether the generated baseline policies are applied), and `lastSyncTime`.

## Working with kubectl

```bash theme={null}
kubectl get sncc
```

The list view shows the default mode, enforcement mode, whether system policies are ready, and age.