nsc egress policy create

​

Usage

nsc egress policy create [--spec_file <path>]

​

Example

nsc egress policy create --spec_file egress-policy.json

​

Policy configuration

{
  "tag": "your-network-policy",
  "description": "CI with access to example.com",
  "mode": "BLOCK",
  "deep_packet_inspection": true,
  "additional_rulesets": ["github-actions"],
  "rules": [
    {
      "op": "ALLOW",
      "matcher": {
        "match_domains": ["example.com"]
      }
    },
    {
      "op": "INJECT",
      "matcher": {
        "match_domains": ["example.com"]
      },
      "inject": {
        "header_name": "Authorization",
        "from_secret_id": "sec_example"
      }
    }
  ]
}

• tag identifies the policy when you apply it to a workload.
• description explains the policy’s purpose.
• mode controls enforcement. BLOCK denies requests that are not allowed, ADVISORY records the same decisions without enforcing them, ALLOW_ALL permits all traffic, and DISABLED does not apply the policy.
• deep_packet_inspection terminates TLS so the policy can modify or proxy encrypted requests. Clients must trust a Namespace CA certificate made available in the instance. GitHub Actions jobs trust it automatically whenever the policy requires it. This option is required for INJECT and PROXY rules.
• additional_rulesets adds allow rules maintained by Namespace. The available rulesets are github-actions, devbox, and macos. Namespace updates them when GitHub Actions runners, Devboxes, or macOS requirements change.
• rules contains the policy’s ordered rules. Rules from additional_rulesets are appended after the rules defined here.
• op selects the rule operation. ALLOW permits matched requests, INJECT sets an HTTP header to a resolved value, and PROXY routes matched requests through another domain.
• matcher.match_domains lists the domains matched by a rule. Prefix a domain with *. to include its subdomains.
• inject.header_name names the header whose value is set. Set exactly one value source: inject.from_secret_id identifies a Vault secret, inject.value provides a literal value, or inject.from_endpoint retrieves the value from an HTTP endpoint using GET.
• inject.from_endpoint.url identifies the credential endpoint. Its response body becomes the injected value. Each optional inject.from_endpoint.headers entry sets either value to a literal value or value_from.from_secret_id to a Vault secret.
• inject.resolution_policy controls when Namespace resolves dynamic values. RESOLUTION_POLICY_ONCE resolves once, while RESOLUTION_POLICY_WHEN_STALE refreshes endpoint values according to the response’s Cache-Control: max-age, with a minimum cache duration of 10 seconds. The default is RESOLUTION_POLICY_ONCE.
• proxy.via_domain identifies the domain that should proxy matching requests.

​

Options

​

—spec_file <path>

​

Related Topics

• Egress policies - Configure and monitor egress traffic
• nsc egress policy describe - Inspect a policy
• nsc egress policy list - List available policies