Skip to content

Latest commit

 

History

6 Commits

Folders and files

NameName
Last commit message
Last commit date
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Nyx

Nyx

AI-powered Kubernetes network security & observability

Zero trust from the kernel up. One policy model for Linux and Windows.

Status License Platform Kubernetes Docs

Website · Docs · Blog · Get Started Free


The Problem

Most Kubernetes network security tools work on Linux only. Your Windows nodes run unprotected — different tool, different policy model, no unified visibility.

Even on Linux, the default Kubernetes NetworkPolicy is limited. No deny rules. No FQDN-based egress control. No observability. No AI. Just basic allow rules and hope.

Calico Cilium Nyx
Linux enforcement
Windows enforcement Partial
FQDN egress filtering
Unified Linux + Windows UI
AI observability
Natural language policy

How It Works

Nyx enforces policy at the kernel level — eBPF on Linux, Windows Filtering Platform on Windows. No sidecars. No proxies. No Envoy dependency.

kubectl apply -f policy.yaml
        │
        ▼
Nyx Control Plane (1 Deployment)
        │
        ├──────────────────────────┐
        ▼                          ▼
Linux Nodes                  Windows Nodes
eBPF / TC hooks              WFP callout driver
Kernel-level enforcement     Kernel-level enforcement
        │                          │
        └──────────┬───────────────┘
                   ▼
        Tracenyx Cloud (your region)
        Flow logs · AI analysis · Dashboard · Alerts

Two components run in your cluster — one DaemonSet for enforcement, one Deployment for the admission webhook. That's it.


Quick Start

Prerequisites

  • Kubernetes 1.26+
  • Linux nodes: kernel 5.15+
  • Windows nodes: Windows Server 2022+

Install

helm repo add tracenyx https://charts.tracenyx.ai
helm repo update

helm install nyx \
  oci://tracenyxpublic.azurecr.io/helm/nyx \
  --version 0.1.0 \
  --namespace nyx-system \
  --create-namespace \
  --set global.scout.key=<YOUR_SCOUT_KEY> \
  --set global.image.registry=<YOUR_IMAGE_REGISTRY> \

Go to app.tracenyx.ai/signup and sign up for Scout — the free tier built for individuals and first clusters. No credit card required.

Verify

kubectl get pods -n nyx-system

# Expected output:
# nyx-agent-xxxxx               Running   (one per node)
# nyx-admission-webhook-xxxxx   Running   (one deployment)

Your First Policy

Default deny — cross-namespace traffic

apiVersion: nyx.tracenyx.io/v1alpha1
kind: NyxClusterNetworkPolicy
metadata:
  name: deny-cross-namespace
spec:
  priority: 50
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - decision: Deny
    fromNamespaceSelector:
      matchExpressions:
      - key: kubernetes.io/metadata.name
        operator: NotIn
        values: ["payment-ns"]
  egress:
  - decision: Deny
    toNamespaceSelector:
      matchExpressions:
      - key: kubernetes.io/metadata.name
        operator: NotIn
        values: ["payment-ns"]

Allow specific service traffic

apiVersion: nyx.tracenyx.io/v1alpha1
kind: NyxNetworkPolicy
metadata:
  name: allow-frontend-to-api
  namespace: cloudmart
spec:
  podSelector:
    matchLabels:
      app: api-gateway
  priority: 100
  policyTypes:
  - Ingress
  ingress:
  - decision: Allow
    fromPodSelector:
      matchLabels:
        app: frontend
    ports:
      port: 8080
      protocol: TCP

FQDN egress control — prevent data exfiltration

apiVersion: nyx.tracenyx.io/v1alpha1
kind: NyxNetworkPolicy
metadata:
  name: payments-egress
  namespace: cloudmart-payments
spec:
  podSelector:
    matchLabels:
      app: payments
  policyTypes:
  - Egress
  egress:
  - decision: Allow
    toFqdn:
      matchName: api.stripe.com
    ports:
      - port: 8983
        protocol: TCP
  - decision: Allow
    toFqdn:
      - matchName: nyxdemoapp.blob.core.windows.net
    ports:
      - port: 443
        protocol: TCP
  - decision: Deny
    toNamespaceSelector: {}

Traditional firewalls see an IP address. Nyx sees a hostname. For services like Azure Blob Storage where multiple tenants share the same IP range, that difference is everything.

See more examples → github.com/tracenyx/nyx-examples


Platform Support

Platform Enforcement Status
Linux (eBPF / TC) Kernel-level ✅ GA
Windows Server 2022 (WFP) Kernel-level ✅ GA
AKS (Azure) Tested
EKS (AWS) Tested
GKE (Google Cloud) In validation
On-premise In validation
Mixed Linux + Windows Tested

Policy Modes

Mode Behaviour Use case
enforce Blocks traffic, writes to kernel Production enforcement
audit Allows traffic, logs violations Compliance validation
dry-run No blocking, logs what would be denied Safe policy testing

Tiers

Feature Scout Sentinel Aegis
Price Free Talk to us Custom
Best for Individuals & first clusters Teams on Kubernetes Regulated, multi-cluster estates
Namespaces 3 25–50 Unlimited
Clusters 1 5–10 Unlimited
Enforcement
Linux eBPF enforcement
Windows WFP enforcement
Dry-run / audit / enforce modes
AI
AI anomaly detection Limited More Unlimited
AI policy generation Limited More Unlimited
Private AI (no third-party processing)
Platform
Observability dashboard Core Full Full
Flow log retention 7 days 90 days 180 days
SSO / RBAC
Guided rollout
Git policy integration Roadmap
Support & compliance
Support GitHub Issues Email Dedicated SLA
Data region Auto (AU East) Auto Preferred

Start free with Scout →


AI Features

Nyx analyses your actual flow logs and Kubernetes metadata — not generic security advice.

  • Anomaly detection — surfaces unusual traffic patterns before they become incidents
  • Natural language policy — describe what you want in plain English, Nyx generates the YAML
  • Policy conflict detection — flags contradictions before you apply them
  • Compliance gap analysis — maps your policy coverage against SOC2, PCI-DSS, HIPAA (Aegis)
  • "Why was this blocked?" — AI explains any policy decision in plain language
  • FQDN egress interrogation — ask in plain English: "Has any pod attempted egress to sfrclak.com in the last 24 hours?" "Which pods are making unexpected calls to blob.core.windows.net?" "Show me all egress to domains not on our approved list" Nyx queries your flow logs and returns precise, actionable answers

All AI processing happens within Tracenyx infrastructure. We send only anonymised, aggregated traffic patterns to our AI provider — never pod names, IP addresses, or raw flow records. Aegis customers can enable Private AI mode for fully isolated processing.


Try It — CloudMart Demo

CloudMart is a sample microservices application (Linux + Windows) that demonstrates what your cluster looks like without proper network security — and how Nyx fixes it step by step.

helm install cloudmart tracenyx/nyx-demo

Follow the tutorial → github.com/tracenyx/nyx-demo


Roadmap

v0.1 — May 2026 · Current

  • Zero trust policy enforcement (Linux + Windows)
  • FQDN-based egress filtering
  • AI anomaly detection and observability dashboard
  • Natural language policy generation
  • Scout free tier

v0.2 — Q3 2026

  • Sentinel paid tier
  • ARM64 support
  • Extended AI history and trend analysis
  • Private AI mode (Aegis)

v0.3 — Q4 2026

  • Pod-to-pod traffic encryption Transparent encryption between pods — no application changes required. Works across Linux and Windows nodes in the same cluster.
  • Process-level visibility See which process inside a pod made a network call. Detect shell spawns, unexpected binaries, and lateral movement attempts at the process level — on both Linux and Windows nodes.
  • Git-based policy management (Aegis) Policy-as-code via GitHub, GitLab, or Azure DevOps. PR-based review workflow, drift detection, and audit trail tied to Git commits.

v1.0 — Q1 2027

  • Security validation suite Test whether your policies actually block what you think they block. Built-in attack simulation covering lateral movement, data exfiltration, and privilege escalation — mapped to MITRE ATT&CK for Kubernetes.
  • Ingress protection Rate limiting and connection throttling per namespace and per pod — enforced at the kernel level. Protect your services without additional infrastructure.
  • L7 observability HTTP status code tracking, error rate analysis, and latency percentiles per service — with no sidecar required.

Future

  • Fine-tuned Nyx Security Model (trained on Kubernetes network patterns)
  • Bring-your-own-model for air-gapped environments
  • Full on-premise deployment option
  • SPIFFE/SPIRE workload identity integration

Documentation


Security

Found a vulnerability? Please do not open a public GitHub issue.

→ Email: security@tracenyx.ai

We aim to respond to all security disclosures within 24 hours.


License

Nyx is proprietary software. The Scout tier is free to use under the Scout License Terms. Commercial use requires a license key.

© 2026 Tracenyx Pty Ltd. All rights reserved.


Built in Melbourne, Australia 🇦🇺

tracenyx.ai · blog.tracenyx.ai · @tracenyx

About

AI-powered Kubernetes network security & observability

Topics

Resources

Security policy

Stars

2 stars

Watchers

0 watching

Forks

Releases

Packages

Used by

Contributors