New ClusterNetworkPolicy in GKE

Google Kubernetes Engine (GKE) has introduced ClusterNetworkPolicy (CNP), an open-source standard developed with the Kubernetes SIG-Policy Working Group, to address challenges in managing network security across multi-tenant Kubernetes environments. Unlike standard Kubernetes NetworkPolicy, which is limited to individual namespaces, CNP operates cluster-wide, enabling administrators to enforce consistent, non-bypassable security policies without conflicts. This solution aims to balance developer needs for microservice communication with platform teams' requirements for compliance and lateral movement prevention.

CNP introduces a hierarchical tier system to resolve policy conflicts deterministically. The admin tier holds the highest precedence, allowing security teams to enforce global rules before namespace-level policies. The network policy tier remains namespace-scoped for developer use, while the baseline tier sets default cluster-wide behavior, such as a 'deny-all' zero-trust posture. This structure aligns network security with organizational roles, enabling centralized oversight while permitting distributed management through role-based access control (RBAC).

The admin tier includes an explicit 'Pass' action, enabling security teams to inspect traffic against global rules before delegating final decisions to namespace policies. This approach facilitates both central oversight and developer autonomy. Common use cases include isolating sensitive workloads like payment processing namespaces, protecting core services such as kube-dns, and managing external egress traffic to restrict unauthorized data exfiltration. The tiered architecture translates complex security requirements into centralized, enforceable rules.

ClusterNetworkPolicy is built on open-source standards, with GKE collaborating with the Kubernetes and Cilium communities to implement the API (policy.networking.k8s.io). This ensures portability across environments. CNP is currently in preview in GKE version 1.36 and later, offering a unified approach to workload network security governance while maintaining operational flexibility for development teams.