Skip to main content
Create an egress policy from a JSON configuration file. nsc egress policy create creates a workspace-wide egress policy from a JSON configuration file. A policy controls outbound traffic from your instances and can filter traffic, inject Vault secrets, or proxy requests through another domain. You can inspect the resulting policy decisions with nsc egress logs. Point --spec_file at a file containing the policy definition to create it.

​
Usage

​
Example

​
Policy configuration

The following policy allows the traffic required by GitHub Actions and macOS, plus requests to example.com. It also injects a Vault secret into the Authorization header for requests to example.com. In BLOCK mode, it denies requests to other domains.
The configuration fields are:
  • tag identifies the policy when you apply it to a workload.
  • description explains the policy’s purpose.
  • mode controls enforcement. BLOCK denies requests that are not allowed, ADVISORY records the same decisions without enforcing them, ALLOW_ALL permits all traffic, and DISABLED does not apply the policy.
  • deep_packet_inspection terminates TLS so the policy can modify or proxy encrypted requests. Clients must trust a Namespace CA certificate made available in the instance. GitHub Actions jobs trust it automatically whenever the policy requires it. This option is required for INJECT and PROXY rules.
  • additional_rulesets adds allow rules maintained by Namespace. The available rulesets are github-actions, devbox, and macos. Namespace updates them when GitHub Actions runners, Devboxes, or macOS requirements change.
  • rules contains the policy’s ordered rules. Rules from additional_rulesets are appended after the rules defined here.
  • op selects the rule operation. ALLOW permits matched requests, INJECT sets an HTTP header from a Namespace Vault secret, and PROXY routes matched requests through another domain.
  • matcher.match_domains lists the domains matched by a rule. Prefix a domain with *. to include its subdomains.
  • inject.header_name names the header whose value is set, and inject.from_secret_id identifies the Vault secret that provides that value.
  • proxy.via_domain identifies the domain that should proxy matching requests.
Save this configuration as egress-policy.json before running the create command. See Egress policies for rule behavior, rollout guidance, and examples of each rule type.

​
Options

​
—spec_file <path>

Path to a JSON file containing the egress policy configuration.
Last modified on August 20, 2026