CNI Plugins vs kube-network-policies
CNI Plugins
github.comkube-network-policies
kube-network-policies.sigs.k8s.ioSide by side
| Figure | CNI Plugins | kube-network-policies |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Windows | Yes | — |
| Linux | Yes | Yes |
| Self-hosted | — | Yes |
| Plans published | 1 | 1 |
| Spec score · Container Networking Software | 7.8 (#8) | 8.1 (#4) |
| License | The repository is distributed under the Apache License, Version 2.0. | The repository lists the Apache-2.0 license. |
| Purpose | CNI Plugins is a collection of reference and example network plugins maintained by the containernetworking team. | A userspace implementation that enforces Kubernetes network policies by intercepting packets with Linux NFQUEUE. |
| Security reporting | The project asks that security issues be reported privately to the email addresses listed in its OWNERS file. | The project directs users to the Kubernetes Security and Disclosure Information page to report vulnerabilities. |
| Support | The project directs questions to the cni-dev mailing group or the #cni channel on CNCF Slack. | The repository README lists the Kubernetes Slack #sig-network channel and the sig-network mailing list for maintainers and community support. |
Plans
In their own words
CNI Plugins
CNI Plugins is a collection of reference and example network plugins for configuring connectivity in Linux and Windows containers. CNI supplies a specification and libraries, plus a command-line tool for executing plugins and a Go library for application integration. Interface options include bridge, ipvlan, loopback, macvlan, point-to-point, VLAN, host-device, and dummy; Windows-specific plugins include win-bridge and win-overlay. IP address management choices cover DHCP, host-local allocation tracking, and static IPv4 or IPv6 allocation. Meta plugins handle interface tuning, port mapping, bandwidth limits, source-based routing, and firewall rules, and a sample plugin illustrates custom plugin development. CNI focuses on connecting containers and removing allocated resources when a container is deleted. The project is distributed under Apache License 2.0 and is a Cloud Native Computing Foundation project. It is free, with a plan listed at free. Linux and Windows are supported; the latest release page lists Linux archives for amd64, arm, and arm64.
kube-network-policies
kube-network-policies is a free, open-source userspace implementation of Kubernetes network policies for Linux. It uses Linux NFQUEUE and nftables to capture and evaluate network traffic in userspace. The project supports standard Kubernetes NetworkPolicy, AdminNetworkPolicy (ANP) and BaselineAdminNetworkPolicy (BANP). It can identify packets from pods targeted by active policies and capture those selectively; enabling ANP or BANP disables that optimization and diverts all node traffic to userspace for evaluation. Its documented evaluation pipeline checks logging, Admin Network Policy, standard NetworkPolicy, Baseline Admin Network Policy, then allows traffic by default. ANP and CNP can match external domain names using an in-memory cache of DNS A and AAAA answers. Structured JSON logs aid troubleshooting, and the PolicyEvaluator plugin pipeline can take custom validation logic. Installation instructions cover raw Kubernetes manifests and Helm. The local development setup uses KIND and lists Docker, KIND and kubectl as prerequisites. ANP or BANP also require experimental Network Policy API CRDs before deployment. The project lists an Apache-2.0 license and directs users to the Kubernetes #sig-network Slack channel and mailing list for maintainers.