> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracenyx.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# NyxNetworkPolicy

> Namespace-scoped network policy — full field reference for the NyxNetworkPolicy CRD.

`NyxNetworkPolicy` is the namespace-scoped policy resource. It applies to pods in the namespace it's created in, selected by a `podSelector`, and carries ingress and egress rules that are evaluated top-down, first match wins.

|             |                            |
| ----------- | -------------------------- |
| API version | `nyx.tracenyx.io/v1alpha1` |
| Kind        | `NyxNetworkPolicy`         |
| Scope       | Namespaced                 |
| Short names | `snnp`, `snnpolicy`        |

## Example

This policy allows the `cloudmart-frontend` namespace to reach the API on port 8080, and runs in audit mode so it logs without dropping:

```yaml theme={null}
apiVersion: nyx.tracenyx.io/v1alpha1
kind: NyxNetworkPolicy
metadata:
  name: api-allow-frontend
  namespace: cloudmart-api
spec:
  podSelector:
    matchLabels:
      app: cloudmart-api
  priority: 100
  enforcement: audit
  policyTypes:
    - Ingress
  ingress:
    - decision: Allow
      fromNamespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: cloudmart-frontend
      ports:
        - protocol: TCP
          port: 8080
```

## Spec

<ParamField path="podSelector" type="object" required>
  Selects the pods in this namespace the policy applies to. Uses the [label selector](#label-selectors) shape. An empty selector matches all pods in the namespace.
</ParamField>

<ParamField path="priority" type="integer" default="100">
  Evaluation priority. Lower numbers are evaluated first and win — a priority `50` rule overrides a priority `100` rule. Must fall within a band the admission webhook permits; see [Priority System](/concepts/priorities). Defaults to `100`, in the namespace band.
</ParamField>

<ParamField path="enforcement" type="string" default="enforce">
  Enforcement mode for this policy's `Deny` rules: `dry-run`, `audit`, or `enforce`. See [Enforcement Modes](/concepts/enforcement-modes). Defaults to `enforce`.
</ParamField>

<ParamField path="policyTypes" type="array of string">
  Which directions this policy governs: `Ingress`, `Egress`, or both.
</ParamField>

<ParamField path="ingress" type="array">
  Ingress rules, evaluated top-down. The first matching rule decides the verdict.

  <Expandable title="rule fields">
    <ParamField path="decision" type="string" required>
      `Allow` or `Deny`.
    </ParamField>

    <ParamField path="fromNamespaceSelector" type="object">
      Selects source namespaces, using the [label selector](#label-selectors) shape.
    </ParamField>

    <ParamField path="fromPodSelector" type="object">
      Selects source pods, using the [label selector](#label-selectors) shape.
    </ParamField>

    <ParamField path="ports" type="array">
      Restricts the rule to specific ports. See [Ports](#ports). When absent, all ports match.
    </ParamField>
  </Expandable>
</ParamField>

<ParamField path="egress" type="array">
  Egress rules, evaluated top-down. The first matching rule decides the verdict.

  <Expandable title="rule fields">
    <ParamField path="decision" type="string" required>
      `Allow` or `Deny`.
    </ParamField>

    <ParamField path="toNamespaceSelector" type="object">
      Selects destination namespaces, using the [label selector](#label-selectors) shape.
    </ParamField>

    <ParamField path="toPodSelector" type="object">
      Selects destination pods, using the [label selector](#label-selectors) shape.
    </ParamField>

    <ParamField path="toFqdn" type="array">
      Matches egress by fully-qualified domain name. See [FQDN egress](#fqdn-egress) for the matching scope.

      <Expandable title="toFqdn fields">
        <ParamField path="matchName" type="string">
          An exact FQDN, e.g. `api.example.com`.
        </ParamField>

        <ParamField path="matchPattern" type="string">
          A wildcard pattern, e.g. `*` for a catch-all deny.
        </ParamField>

        <ParamField path="ports" type="array">
          Accepted in the schema but not currently enforced. See [FQDN egress](#fqdn-egress).
        </ParamField>
      </Expandable>
    </ParamField>

    <ParamField path="toIpBlock" type="object">
      Matches egress to an IP range.

      <Expandable title="toIpBlock fields">
        <ParamField path="cidr" type="string" required>
          CIDR notation for the IP range, e.g. `0.0.0.0/0`.
        </ParamField>
      </Expandable>
    </ParamField>

    <ParamField path="ports" type="array">
      Port restriction for non-FQDN destinations (`toNamespaceSelector`, `toPodSelector`, `toIpBlock`). For FQDN-scoped ports, use `toFqdn[].ports` instead. See [Ports](#ports).
    </ParamField>
  </Expandable>
</ParamField>

## Label selectors

`podSelector` and every `from*`/`to*` selector use the same Kubernetes-style label selector shape:

<ParamField path="matchLabels" type="map[string]string">
  A map of label key-value pairs. All listed labels must match.
</ParamField>

<ParamField path="matchExpressions" type="array">
  A list of selector requirements.

  <Expandable title="requirement fields">
    <ParamField path="key" type="string" required>
      The label key.
    </ParamField>

    <ParamField path="operator" type="string" required>
      One of `In`, `NotIn`, `Exists`, `DoesNotExist`.
    </ParamField>

    <ParamField path="values" type="array of string">
      The values to match against (for `In` / `NotIn`).
    </ParamField>
  </Expandable>
</ParamField>

## Ports

Port objects take a `protocol` (`TCP`, `UDP`, or `SCTP`, defaulting to `TCP`) and a `port` (1–65535). When a rule specifies `ports`, only traffic on those ports matches the rule; when `ports` is absent, all ports match.

Rule-level `ports` — the `ingress[].ports` and `egress[].ports` fields — are enforced. Per-FQDN ports (`toFqdn[].ports`) are not; see [FQDN egress](#fqdn-egress).

## FQDN egress

`toFqdn` matches egress traffic by domain name rather than by IP, in two forms:

* `matchName` — an exact FQDN to allow or deny.
* `matchPattern` — a wildcard, most commonly `*` for a catch-all deny.

FQDN allow matching applies to **HTTPS traffic on port 443**: Nyx reads the server name from the TLS handshake (SNI) and matches it against the policy. A `matchName` allow won't match the same FQDN reached over a different port — govern non-443 destinations with rule-level `ports` and `toIpBlock`. The `*` catch-all deny is independent of port 443.

`toFqdn[].ports` is accepted but not enforced; per-FQDN port restrictions are a future addition. To restrict ports, use the rule-level `egress[].ports` field.

<Note>
  Plain HTTP carries no SNI, so FQDN matching doesn't apply to plaintext egress — govern it with port-level and IP-level rules. Blocking plaintext egress outright is the cleaner posture; see the [Hardening guide](/guides/hardening). Encrypted ClientHello (ECH), which conceals the SNI, is still early in adoption and is tracked on the Nyx roadmap.
</Note>

## Status

Nyx populates `status` on each policy — it's read-only. Fields include `phase` (`Pending`, `Active`, or `Failed`), `appliedAt`, `affectedPods` (name, namespace, nodeName, ip), `nodesApplied`, and a human-readable `message`.

## Working with kubectl

Use the short names for quick access:

```bash theme={null}
kubectl get snnp -n cloudmart-api
```

The list view shows the pod selector, priority, status phase, and age.