CloudMart is a sample microservices application that demonstrates what your Kubernetes cluster looks like without proper network security — and how Nyx fixes it step by step.
After installing CloudMart, run this:
kubectl exec -n cloudmart-frontend deploy/frontend -- \
curl -s http://payments.cloudmart-payments:8080/cardsYou just read payment card data from the frontend service. No firewall stopped it. No alert fired. This is the default state of most Kubernetes clusters.
Follow the step-by-step tutorial to lock this down completely using Nyx — from default deny through cross-platform policy and FQDN-aware egress control.
LINUX NODES (eBPF) WINDOWS NODES (WFP)
────────────────── ────────────────────
frontend (Go) sitecore-cm (.NET)
api-gateway (Go) sitecore-cd (.NET)
products (Go)
orders (Go)
payments (Go)
postgres (DB)
prometheus (monitoring)
grafana (monitoring)
| Namespace | Node OS | Services |
|---|---|---|
| cloudmart-frontend | Linux | frontend |
| cloudmart-api | Linux | api-gateway, products, orders |
| cloudmart-payments | Linux | payments |
| cloudmart-data | Linux | postgres |
| cloudmart-monitoring | Linux | prometheus, grafana |
| sitecore-cm | Windows | content management |
| sitecore-cd | Windows | content delivery |
| sitecore-shared | Linux | solr |
Clone the repo, then apply the namespaces and Linux workloads from the local checkout:
git clone https://github.com/tracenyx/nyx-demo
cd nyx-demo
kubectl apply -f k8s/namespaces.yaml
kubectl apply -f k8s/linux/For Windows workloads (Sitecore mocks), see Module 10 and Module 11.
Running locally on your laptop? See QUICKSTART-kind.md for a zero-cost path using kind — covers the Linux modules (00–09) end to end. Windows modules (10–14) still need a real mixed cluster.
| Module | Topic |
|---|---|
| 00 — Setup & The Security Problem | Install CloudMart, see the security gap |
| 01 — Install Nyx | Sign up for Scout and install Nyx |
| 02 — Default Deny | Cross-namespace deny baseline |
| 03 — Allow Legitimate Traffic | Restore the paths the app needs |
| 04 — Workload Isolation | Intra-namespace lateral movement prevention |
| 05 — FQDN Egress Control | Allow specific external hostnames, deny the rest |
| 06 — AI Observability | Query flow data and generate policies with the Nyx AI Chat |
| 07 — Audit Mode | Validate a deny rule on live traffic before enforcing |
| 08 — Platform Policies | Cluster-scoped policy and the four priority bands |
| 09 — Attack Simulation | Run attacks against the locked-down cluster |
| 10 — Windows Nodes | Add a Windows node pool and install nyx-windows |
| 11 — Sitecore Deploy | Deploy a Sitecore-shaped Windows workload |
| 12 — Sitecore Isolation | Lock down Sitecore with the same CRD on WFP |
| 13 — Cross-Platform Policy | Linux → Windows allow paths from one YAML |
| 14 — FQDN Azure Storage | SNI-based egress: same IP, different hostname, different verdict |
Nyx is built by Tracenyx — Kubernetes network security and observability, enforced at the kernel via eBPF on Linux and WFP on Windows. One CRD, two dataplanes, one UI.