Policy specification

A Policy resource defines exactly one policy type under .spec.

Supported policy types are:

  • accessControl
  • rateLimit
  • apiKey
  • basicAuth
  • jwt
  • ingressMTLS
  • egressMTLS
  • oidc
  • oidcNative
  • cache
  • cors
  • waf
  • externalAuth
  • hsts
Policy type Description VirtualServer / VirtualServerRoute Ingress
accessControl Allows or denies requests based on the client IP address. Yes Yes, with nginx.org/policies
cors Configures Cross-Origin Resource Sharing (CORS) headers. Yes Yes, with nginx.org/policies
egressMTLS Configures mutual TLS (mTLS) authentication and certificate verification for upstream connections. Yes Yes, with nginx.org/policies
ingressMTLS Configures mTLS client certificate verification. Yes Yes, with nginx.org/policies
waf Configures WAF and log configuration policies for NGINX AppProtect. Yes Yes, with nginx.com/policies
externalAuth Authenticates client requests using an external authentication server. Yes Yes, with nginx.org/policies
rateLimit Controls the request-processing rate for a defined key. Yes No
apiKey Authorizes requests that include a valid API key in a specified header or query parameter. Yes No
basicAuth Authenticates client requests using HTTP Basic authentication credentials. Yes No
jwt Authenticates client requests using JSON Web Tokens (JWT). Requires NGINX Plus. Yes No
oidc Configures NGINX Plus as a relying party for OpenID Connect (OIDC) authentication. Yes No
oidcNative Configures NGINX Plus as a relying party for OIDC authentication using the built-in native module. Yes Yes, with nginx.com/policies
cache Configures proxy caching for serving cached content. Yes No
hsts Configures HTTP Strict Transport Security (HSTS) to enforce secure connections to the server. Yes No
NGINX Ingress Controller added Policy resource support for Ingress objects through the nginx.org/policies annotation in v5.4.0.

Important rule: one policy type per resource

A Policy resource must define exactly one policy type under .spec. If you need multiple behaviors, create multiple policies and reference them together.

The following example is valid:

yaml
apiVersion: k8s.nginx.org/v1
kind: Policy
metadata:
  name: allow-localhost
spec:
  accessControl:
    allow:
    - 10.0.0.0/8

The following example is not valid, because it defines two policy types in the same resource:

yaml
apiVersion: k8s.nginx.org/v1
kind: Policy
metadata:
  name: invalid-policy
spec:
  accessControl:
    allow:
    - 10.0.0.0/8
  cors:
    allowOrigin:
    - https://example.com

What’s next

Learn how to apply policies to resources.

View source
View as Markdown
Edit this page
Create a new issue