NyxNetworkPolicy is the namespace-scoped policy resource. It applies to pods in the namespace it’s created in, selected by a podSelector, and carries ingress and egress rules that are evaluated top-down, first match wins.
Example
This policy allows thecloudmart-frontend namespace to reach the API on port 8080, and runs in audit mode so it logs without dropping:
Spec
object
required
Selects the pods in this namespace the policy applies to. Uses the label selector shape. An empty selector matches all pods in the namespace.
integer
default:"100"
Evaluation priority. Lower numbers are evaluated first and win — a priority
50 rule overrides a priority 100 rule. Must fall within a band the admission webhook permits; see Priority System. Defaults to 100, in the namespace band.string
default:"enforce"
Enforcement mode for this policy’s
Deny rules: dry-run, audit, or enforce. See Enforcement Modes. Defaults to enforce.array of string
Which directions this policy governs:
Ingress, Egress, or both.array
Ingress rules, evaluated top-down. The first matching rule decides the verdict.
array
Egress rules, evaluated top-down. The first matching rule decides the verdict.
Label selectors
podSelector and every from*/to* selector use the same Kubernetes-style label selector shape:
map[string]string
A map of label key-value pairs. All listed labels must match.
array
A list of selector requirements.
Ports
Port objects take aprotocol (TCP, UDP, or SCTP, defaulting to TCP) and a port (1–65535). When a rule specifies ports, only traffic on those ports matches the rule; when ports is absent, all ports match.
Rule-level ports — the ingress[].ports and egress[].ports fields — are enforced. Per-FQDN ports (toFqdn[].ports) are not; see FQDN egress.
FQDN egress
toFqdn matches egress traffic by domain name rather than by IP, in two forms:
matchName— an exact FQDN to allow or deny.matchPattern— a wildcard, most commonly*for a catch-all deny.
matchName allow won’t match the same FQDN reached over a different port — govern non-443 destinations with rule-level ports and toIpBlock. The * catch-all deny is independent of port 443.
toFqdn[].ports is accepted but not enforced; per-FQDN port restrictions are a future addition. To restrict ports, use the rule-level egress[].ports field.
Plain HTTP carries no SNI, so FQDN matching doesn’t apply to plaintext egress — govern it with port-level and IP-level rules. Blocking plaintext egress outright is the cleaner posture; see the Hardening guide. Encrypted ClientHello (ECH), which conceals the SNI, is still early in adoption and is tracked on the Nyx roadmap.
Status
Nyx populatesstatus on each policy — it’s read-only. Fields include phase (Pending, Active, or Failed), appliedAt, affectedPods (name, namespace, nodeName, ip), nodesApplied, and a human-readable message.