Cilium vs kube-network-policies

Cilium is an open-source, cloud-native system for providing, securing, and observing network connectivity between workloads using eBPF. Its networking capabilities include CNI, Layer 4 load balancing, Cluster Mesh, kube-proxy replacement, BGP, service mesh, Gateway API, IPv6, host firewall, and ingress. Network policies can enforce identity-aware rules from L3 through L7, including DNS- and HTTP-aware filtering. Security features include runtime protection and transparent encryption of managed host and endpoint traffic using IPsec, WireGuard, or ztunnel; ztunnel support is marked beta. For visibility, Cilium lists service maps, metrics and tracing export, network flow logs, and protocol visibility. Hubble, built on Cilium and eBPF, provides visibility into service communication and behavior. Documentation describes Prometheus and Grafana integrations and Kubernetes support for services including GKE, AKS, EKS, OpenShift, RKE, k3s, and Alibaba ACK. Its container image requires AMD64 or AArch64 hosts running Linux kernel 5.10 or later, or an equivalent kernel such as 4.18 on RHEL 8.10. For environments above 500 nodes, the quick installation guide directs readers to large-environment guidance or specific datapath modes.

kube-network-policies is a free, open-source userspace implementation of Kubernetes network policies for Linux. It uses Linux NFQUEUE and nftables to capture and evaluate network traffic in userspace. The project supports standard Kubernetes NetworkPolicy, AdminNetworkPolicy (ANP) and BaselineAdminNetworkPolicy (BANP). It can identify packets from pods targeted by active policies and capture those selectively; enabling ANP or BANP disables that optimization and diverts all node traffic to userspace for evaluation. Its documented evaluation pipeline checks logging, Admin Network Policy, standard NetworkPolicy, Baseline Admin Network Policy, then allows traffic by default. ANP and CNP can match external domain names using an in-memory cache of DNS A and AAAA answers. Structured JSON logs aid troubleshooting, and the PolicyEvaluator plugin pipeline can take custom validation logic. Installation instructions cover raw Kubernetes manifests and Helm. The local development setup uses KIND and lists Docker, KIND and kubectl as prerequisites. ANP or BANP also require experimental Network Policy API CRDs before deployment. The project lists an Apache-2.0 license and directs users to the Kubernetes #sig-network Slack channel and mailing list for maintainers.