Policy precedence and override rules

When more than one policy of the same type applies to a resource, NGINX Ingress Controller uses precedence rules to decide which policy takes effect.

VirtualServer and VirtualServerRoute

Policy precedence goes from broader scope to narrower scope:

• VirtualServer.spec.policies
• VirtualServer.route.policies
• VirtualServerRoute.subroute.policies

If the same policy type appears at multiple levels, the more specific level wins. For example:

• Route-level accessControl overrides spec-level accessControl.
• Subroute-level cors overrides route-level cors.

Ingress and mergeable Ingress

For Ingress:

• Policies apply to the whole Ingress.
• With mergeable Ingress, minion policies override master policies of the same type.

What’s next

See the policy type reference for the fields and merging behavior of each policy type.