kube-network-policies
kube-network-policies.sigs.k8s.io
What it is
kube-network-policies is a free, open-source userspace implementation of Kubernetes network policies for Linux. It uses Linux NFQUEUE and nftables to capture and evaluate network traffic in userspace. The project supports standard Kubernetes NetworkPolicy, AdminNetworkPolicy (ANP) and BaselineAdminNetworkPolicy (BANP). It can identify packets from pods targeted by active policies and capture those selectively; enabling ANP or BANP disables that optimization and diverts all node traffic to userspace for evaluation. Its documented evaluation pipeline checks logging, Admin Network Policy, standard NetworkPolicy, Baseline Admin Network Policy, then allows traffic by default. ANP and CNP can match external domain names using an in-memory cache of DNS A and AAAA answers. Structured JSON logs aid troubleshooting, and the PolicyEvaluator plugin pipeline can take custom validation logic. Installation instructions cover raw Kubernetes manifests and Helm. The local development setup uses KIND and lists Docker, KIND and kubectl as prerequisites. ANP or BANP also require experimental Network Policy API CRDs before deployment. The project lists an Apache-2.0 license and directs users to the Kubernetes #sig-network Slack channel and mailing list for maintainers.
Spec sheet
- Purpose
- A userspace implementation that enforces Kubernetes network policies by intercepting packets with Linux NFQUEUE.Read 9 Oct 2026 · kube-network-policies.sigs.k8s.io
- Integrations
- ANP and BANP support integrates with the Kubernetes Network Policy API custom resource definitions.Read 9 Oct 2026 · kube-network-policies.sigs.k8s.io
- Support
- The repository README lists the Kubernetes Slack #sig-network channel and the sig-network mailing list for maintainers and community support.Read 9 Oct 2026 · github.com
- License
- The repository lists the Apache-2.0 license.Read 8 Oct 2026 · github.com
- Admin policy behavior
- When ANP or BANP is enabled, the optimization is disabled and all node traffic is diverted to userspace for evaluation.Read 9 Oct 2026 · kube-network-policies.sigs.k8s.io
- ANP/BANP requirement
- Using ANP or BANP requires installing the experimental Network Policy API CRDs before deploying the ANP-configured daemonset.Read 8 Oct 2026 · kube-network-policies.sigs.k8s.io
- Domain matching
- ANP and CNP can match external domain names using an in-memory DNS cache that records DNS A and AAAA answers.Read 9 Oct 2026 · kube-network-policies.sigs.k8s.io
- Extensibility
- The policy pipeline uses PolicyEvaluator plugins to support additional validation logic.Read 9 Oct 2026 · kube-network-policies.sigs.k8s.io
- Installation
- The quick start documents installation using raw Kubernetes manifests or Helm in the kube-system namespace.Read 9 Oct 2026 · kube-network-policies.sigs.k8s.io
- Logging
- Structured JSON logging can provide machine-readable diagnostics for packet policy decisions.Read 9 Oct 2026 · github.com
- Packet handling
- It uses Linux NFQUEUE and nftables to intercept and evaluate network traffic in userspace.Read 8 Oct 2026 · kube-network-policies.sigs.k8s.io
- Policy formats
- It supports standard Kubernetes NetworkPolicy, AdminNetworkPolicy (ANP), and BaselineAdminNetworkPolicy (BANP).Read 8 Oct 2026 · kube-network-policies.sigs.k8s.io
- Policy ordering
- The documented evaluation pipeline checks logging, Admin Network Policy, standard NetworkPolicy, Baseline Admin Network Policy, then defaults to allowing traffic.Read 9 Oct 2026 · kube-network-policies.sigs.k8s.io
- Policy support
- It supports standard Kubernetes NetworkPolicy, AdminNetworkPolicy (ANP), and BaselineAdminNetworkPolicy (BANP).Read 9 Oct 2026 · kube-network-policies.sigs.k8s.io
- Prerequisites
- The local development quick start uses KIND and lists Docker, KIND, and kubectl as prerequisites.Read 8 Oct 2026 · kube-network-policies.sigs.k8s.io
- Project status
- The documentation says this is not an officially supported Google product and is not eligible for Google's Open Source Software Vulnerability Rewards Program.Read 9 Oct 2026 · kube-network-policies.sigs.k8s.io
- Requirements
- The quick start prerequisites are Docker, KIND, and kubectl for its local development cluster instructions.Read 9 Oct 2026 · kube-network-policies.sigs.k8s.io
- Security disclaimer
- The project says it is not an officially supported Google product and is not eligible for the Google Open Source Software Vulnerability Rewards Program.Read 8 Oct 2026 · kube-network-policies.sigs.k8s.io
- Security reporting
- The project directs users to the Kubernetes Security and Disclosure Information page to report vulnerabilities.Read 9 Oct 2026 · github.com
- Selective capture
- In standard mode, it selectively captures packets for pods targeted by active standard NetworkPolicies.Read 9 Oct 2026 · kube-network-policies.sigs.k8s.io
Plans and prices
Open-source project Free Kubernetes network policy implementation · install with raw manifests or Helm Read 9 Oct 2026 · github.com
Strong points and limits
Strong points
- Supports standard NetworkPolicy, ANP and BANP.
- Installs with raw manifests or Helm.
- Structured JSON logs aid troubleshooting.
- PolicyEvaluator allows custom validation logic.
- Apache-2.0 licensed.
Limits
- ANP or BANP require experimental API CRDs.
- ANP or BANP send all node traffic to userspace.
- Local development requires Docker, KIND and kubectl.
Who it suits
It suits teams running Kubernetes on Linux that need policy evaluation for pods, including standard and administrative policy formats. Local development uses KIND, Docker and kubectl.
Verdict
The project supports several Kubernetes policy formats and provides both selective packet capture and an extensible evaluation pipeline. Teams using ANP or BANP should account for the CRD prerequisite and the resulting all-traffic userspace evaluation.
Where Specifiction places it
- Container Networking Software#4 of 288.1
Alternatives to kube-network-policiesAll alternatives →
Aviatrix Kubernetes Firewall 8.5 Visit 
Calico Open Source Free plan 8.0 Visit 
Cilium Free plan 7.8 Visit