DANM vs kube-network-policies

DANM is a free network management suite for Kubernetes, originally developed as Nokia’s TelCo-grade solution. Its CNI metaplugin can give a Pod multiple network interfaces and delegate their setup to other CNI plugins. Built-in IP address management supports dynamic, static, or no IPv4 and IPv6 allocation, with up to 8 million allocations per network object. The IPVLAN CNI provides L2 interfaces and supports routes and policy-based routes in Pod network namespaces. Documented integrations include Intel SR-IOV and MACVLAN, with delegation to Calico and Flannel. Production-grade mode provides TenantNetwork and ClusterNetwork APIs for administrators managing shared resources and tenants using assigned resources. An optional Svcwatcher extends Kubernetes Service discovery across a Pod’s interfaces. A webhook validates DANM API objects and connects tenant networks to administrator-configured physical interface profiles. Users must create a Kubernetes cluster and install DANM manually; its deployment guide says there is no Docker container release. That guide identifies Kubernetes 1.17.x as tested and says versions earlier than 1.9.x are not officially supported. DANM is licensed under the 3-Clause BSD License.

kube-network-policies is a free, open-source userspace implementation of Kubernetes network policies for Linux. It uses Linux NFQUEUE and nftables to capture and evaluate network traffic in userspace. The project supports standard Kubernetes NetworkPolicy, AdminNetworkPolicy (ANP) and BaselineAdminNetworkPolicy (BANP). It can identify packets from pods targeted by active policies and capture those selectively; enabling ANP or BANP disables that optimization and diverts all node traffic to userspace for evaluation. Its documented evaluation pipeline checks logging, Admin Network Policy, standard NetworkPolicy, Baseline Admin Network Policy, then allows traffic by default. ANP and CNP can match external domain names using an in-memory cache of DNS A and AAAA answers. Structured JSON logs aid troubleshooting, and the PolicyEvaluator plugin pipeline can take custom validation logic. Installation instructions cover raw Kubernetes manifests and Helm. The local development setup uses KIND and lists Docker, KIND and kubectl as prerequisites. ANP or BANP also require experimental Network Policy API CRDs before deployment. The project lists an Apache-2.0 license and directs users to the Kubernetes #sig-network Slack channel and mailing list for maintainers.