Apply policies to resources

You can reference policies from VirtualServer, VirtualServerRoute, and Ingress resources. How you attach a policy depends on the resource type.

VirtualServer

You can attach policies at:

  • spec.policies for server-wide behavior
  • spec.routes[].policies for route-specific behavior

Example:

yaml
apiVersion: k8s.nginx.org/v1
kind: VirtualServer
metadata:
  name: cafe
spec:
  host: cafe.example.com
  policies:
  - name: access-policy
  upstreams:
  - name: coffee
    service: coffee-svc
    port: 80
  routes:
  - path: /coffee
    policies:
    - name: route-cors-policy
    action:
      pass: coffee

VirtualServerRoute

You can attach policies at:

  • spec.subroutes[].policies

Example:

yaml
apiVersion: k8s.nginx.org/v1
kind: VirtualServerRoute
metadata:
  name: tea
spec:
  host: cafe.example.com
  upstreams:
  - name: tea
    service: tea-svc
    port: 80
  subroutes:
  - path: /tea
    policies:
    - name: subroute-policy
    action:
      pass: tea

Ingress

Ingress uses annotations instead of a policies field.

Supported annotations are:

  • nginx.org/policies
  • nginx.com/policies

Example:

yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: webapp
  annotations:
    nginx.org/policies: access-policy,cors-policy
spec:
  ingressClassName: nginx
  rules:
  - host: webapp.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: webapp
            port:
              number: 80

What’s next

Learn about ingress-specific policy behavior.

View source
View as Markdown
Edit this page
Create a new issue