# Policy specification

Type of document: Concept
Product: NGINX Ingress Controller

---


A `Policy` resource defines exactly one policy type under `.spec`.

Supported policy types are:

- `accessControl`
- `rateLimit`
- `apiKey`
- `basicAuth`
- `jwt`
- `ingressMTLS`
- `egressMTLS`
- `oidc`
- `oidcNative`
- `cache`
- `cors`
- `waf`
- `externalAuth`
- `hsts`

| Policy type | Description | VirtualServer / VirtualServerRoute | Ingress |
| --- | --- | --- | --- |
| [`accessControl`](/nic/configuration/policy-resource/policy-reference.md#accesscontrol) | Allows or denies requests based on the client IP address. | Yes | Yes, with `nginx.org/policies` |
| [`cors`](/nic/configuration/policy-resource/policy-reference.md#cors) | Configures Cross-Origin Resource Sharing (CORS) headers. | Yes | Yes, with `nginx.org/policies` |
| [`egressMTLS`](/nic/configuration/policy-resource/policy-reference.md#egressmtls) | Configures mutual TLS (mTLS) authentication and certificate verification for upstream connections. | Yes | Yes, with `nginx.org/policies` |
| [`ingressMTLS`](/nic/configuration/policy-resource/policy-reference.md#ingressmtls) | Configures mTLS client certificate verification. | Yes | Yes, with `nginx.org/policies` |
| [`waf`](/nic/configuration/policy-resource/policy-reference.md#waf) | Configures WAF and log configuration policies for [NGINX AppProtect](/nic/integrations/app-protect-waf/configuration.md). | Yes | Yes, with `nginx.com/policies` |
| [`externalAuth`](/nic/configuration/policy-resource/policy-reference.md#externalauth) | Authenticates client requests using an external authentication server. | Yes | Yes, with `nginx.org/policies` |
| [`rateLimit`](/nic/configuration/policy-resource/policy-reference.md#ratelimit) | Controls the request-processing rate for a defined key. | Yes | No |
| [`apiKey`](/nic/configuration/policy-resource/policy-reference.md#apikey) | Authorizes requests that include a valid API key in a specified header or query parameter. | Yes | No |
| [`basicAuth`](/nic/configuration/policy-resource/policy-reference.md#basicauth) | Authenticates client requests using HTTP Basic authentication credentials. | Yes | No |
| [`jwt`](/nic/configuration/policy-resource/policy-reference.md#jwt-using-a-local-kubernetes-secret) | Authenticates client requests using JSON Web Tokens (JWT). Requires NGINX Plus. | Yes | No |
| [`oidc`](/nic/configuration/policy-resource/policy-reference.md#oidc) | Configures NGINX Plus as a relying party for OpenID Connect (OIDC) authentication. | Yes | No |
| [`oidcNative`](/nic/configuration/policy-resource/policy-reference.md#oidcnative) | Configures NGINX Plus as a relying party for OIDC authentication using the built-in native module. | Yes | Yes, with `nginx.com/policies` |
| [`cache`](/nic/configuration/policy-resource/policy-reference.md#cache) | Configures proxy caching for serving cached content. | Yes | No |
| [`hsts`](/nic/configuration/policy-resource/policy-reference.md#hsts) | Configures [HTTP Strict Transport Security](https://www.nginx.com/blog/http-strict-transport-security-hsts-and-nginx/) (HSTS) to enforce secure connections to the server. | Yes | No |

**note:** 

NGINX Ingress Controller added Policy resource support for Ingress objects through the [`nginx.org/policies`](/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md) annotation in v5.4.0.

## Important rule: one policy type per resource

A `Policy` resource must define exactly one policy type under `.spec`. If you need multiple behaviors, create multiple policies and reference them together.

The following example is valid:

```yaml
apiVersion: k8s.nginx.org/v1
kind: Policy
metadata:
  name: allow-localhost
spec:
  accessControl:
    allow:
    - 10.0.0.0/8
```

The following example is **not** valid, because it defines two policy types in the same resource:

```yaml
apiVersion: k8s.nginx.org/v1
kind: Policy
metadata:
  name: invalid-policy
spec:
  accessControl:
    allow:
    - 10.0.0.0/8
  cors:
    allowOrigin:
    - https://example.com
```

## What's next

Learn how to [apply policies to resources](/nic/configuration/policy-resource/applying-policies.md).