Managing network security in a multi-tenant Kubernetes environment requires balancing developer needs for communication with platform team requirements for compliance and lateral movement prevention. Standard Kubernetes NetworkPolicy is namespace-scoped and designed for developer self-service, which creates challenges when administrators try to use it for global enforcement. To address this, Google introduces ClusterNetworkPolicy (CNP) to GKE, an open-source standard developed by the Kubernetes SIG-Policy Working Group. CNP is a cluster-wide resource that enables administrators to manage network security centrally with non-bypassable policies.

CNP uses a hierarchical tier system with deterministic top-to-bottom evaluation. The admin tier is the highest precedence, enforcing rules before any other policies. The network policy tier is the standard namespace level for developer application policies. The baseline tier establishes the cluster’s default behavior when no other policies apply. This structure aligns network security with organizational roles—administrators enforce compliance via the admin tier, platform teams set default posture via the baseline tier, and developers write namespace policies without overriding security mandates. The admin tier introduces an explicit Pass action, letting security teams inspect traffic and then delegate the final decision to the developer’s namespace policy.

Common use cases include isolating sensitive workloads such as payment processing namespaces via admin-tier global deny rules that override permissive developer policies, protecting core services like kube-dns with admin-tier global allow rules, and managing external egress using IP address range matching to restrict or permit access to corporate intranets or external IPs, preventing unauthorized data exfiltration.

Rather than building proprietary extensions, Google worked with the Kubernetes community to design the ClusterNetworkPolicy API (policy.networking.k8s.io), distinguishing it from the namespace-scoped NetworkPolicy API (networking.k8s.io). They also collaborated with the Cilium community to implement the API. Because it is built on open-source standards, security configurations remain portable across environments. CNP on GKE is currently in preview in version 1.36 and later.