> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracenyx.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# NyxClusterNetworkPolicy

> Cluster-scoped network policy — full field reference for the NyxClusterNetworkPolicy CRD.

`NyxClusterNetworkPolicy` is the cluster-scoped policy resource. Unlike [`NyxNetworkPolicy`](/reference/nyxnetworkpolicy), it isn't bound to a single namespace — it selects namespaces with a `namespaceSelector` and applies across the cluster. It's the resource platform teams use for cluster-wide overrides and baselines.

|             |                            |
| ----------- | -------------------------- |
| API version | `nyx.tracenyx.io/v1alpha1` |
| Kind        | `NyxClusterNetworkPolicy`  |
| Scope       | Cluster                    |
| Short names | `scnp`                     |

## Example

A platform-override that denies all public-internet egress from production namespaces. The low priority (`50`) puts it in the platform-override band, so it wins over any namespace or workload policy:

```yaml theme={null}
apiVersion: nyx.tracenyx.io/v1alpha1
kind: NyxClusterNetworkPolicy
metadata:
  name: deny-public-internet
spec:
  tier: platform
  priority: 50
  enforcement: enforce
  namespaceSelector:
    matchLabels:
      environment: production
  policyTypes:
    - Egress
  egress:
    - decision: Deny
      toIpBlock:
        cidr: 0.0.0.0/0
```

## Spec

<ParamField path="tier" type="string" required>
  Must be `platform`. Marks the policy as platform-managed.
</ParamField>

<ParamField path="priority" type="integer" default="100">
  Evaluation priority, 0–99,999. Lower numbers are evaluated first and win. Must fall within a band the admission webhook permits; see [Priority System](/concepts/priorities). Defaults to `100`.
</ParamField>

<ParamField path="enforcement" type="string" default="enforce">
  Enforcement mode for this policy's `Deny` rules: `dry-run`, `audit`, or `enforce`. See [Enforcement Modes](/concepts/enforcement-modes). Defaults to `enforce`.
</ParamField>

<ParamField path="namespaceSelector" type="object">
  Selects the namespaces this policy applies to, using the [label selector](/reference/nyxnetworkpolicy#label-selectors) shape. Omit it (or leave it empty) to apply to all namespaces.
</ParamField>

<ParamField path="podSelector" type="object">
  Narrows the policy to specific pods within the matched namespaces, using the [label selector](/reference/nyxnetworkpolicy#label-selectors) shape. Omit it to apply to all pods.
</ParamField>

<ParamField path="policyTypes" type="array of string">
  Which directions this policy governs: `Ingress`, `Egress`, or both.
</ParamField>

<ParamField path="ingress" type="array">
  Ingress rules, evaluated top-down. The first matching rule decides the verdict.

  <Expandable title="rule fields">
    <ParamField path="decision" type="string" required>
      `Allow` or `Deny`.
    </ParamField>

    <ParamField path="fromNamespaceSelector" type="object">
      Selects source namespaces, using the [label selector](/reference/nyxnetworkpolicy#label-selectors) shape.
    </ParamField>

    <ParamField path="fromPodSelector" type="object">
      Selects source pods, using the [label selector](/reference/nyxnetworkpolicy#label-selectors) shape.
    </ParamField>

    <ParamField path="ports" type="array">
      Restricts the rule to specific ports. See [Ports](/reference/nyxnetworkpolicy#ports).
    </ParamField>
  </Expandable>
</ParamField>

<ParamField path="egress" type="array">
  Egress rules, evaluated top-down. The first matching rule decides the verdict.

  <Expandable title="rule fields">
    <ParamField path="decision" type="string" required>
      `Allow` or `Deny`.
    </ParamField>

    <ParamField path="toNamespaceSelector" type="object">
      Selects destination namespaces, using the [label selector](/reference/nyxnetworkpolicy#label-selectors) shape.
    </ParamField>

    <ParamField path="toPodSelector" type="object">
      Selects destination pods, using the [label selector](/reference/nyxnetworkpolicy#label-selectors) shape.
    </ParamField>

    <ParamField path="toFqdn" type="array">
      Matches egress by fully-qualified domain name — `matchName` (exact), `matchPattern` (a wildcard such as `*` for a catch-all deny), and an optional `ports` field. FQDN matching applies to HTTPS (port 443) traffic, and `toFqdn[].ports` is accepted but not enforced. See [FQDN egress](/reference/nyxnetworkpolicy#fqdn-egress).
    </ParamField>

    <ParamField path="toIpBlock" type="object">
      Matches egress to an IP range via a required `cidr` field, e.g. `0.0.0.0/0`.
    </ParamField>

    <ParamField path="ports" type="array">
      Port restriction for non-FQDN destinations. See [Ports](/reference/nyxnetworkpolicy#ports).
    </ParamField>
  </Expandable>
</ParamField>

The label selector and port structures are identical to [`NyxNetworkPolicy`](/reference/nyxnetworkpolicy#label-selectors).

## Status

Nyx populates `status` on each policy — it's read-only. Fields include `phase` (`Pending`, `Active`, or `Failed`), `appliedAt`, `affectedPods` (name, namespace, nodeName, ip), `nodesApplied`, and a human-readable `message`.

## Working with kubectl

```bash theme={null}
kubectl get scnp
```

The list view shows the tier, priority, enforcement mode, status phase, and age.