Flannel vs kube-network-policies

Flannel is a free network fabric for containers designed for Kubernetes. A small flanneld agent on each host allocates a subnet lease from a configured address space, then forwards packets between hosts using a selected backend. Documented choices include VXLAN, host-gw, WireGuard and UDP, with VXLAN recommended. WireGuard encapsulates and encrypts packets using the in-kernel WireGuard implementation. Network configuration and subnet allocations can be stored in the Kubernetes API or directly in etcd. The project documents Kubernetes and Docker deployments, with Linux and Windows build instructions. Flannel does not enforce network policies itself, though its Helm chart can deploy a Kubernetes SIGs network policy controller alongside it. It runs as a privileged daemonset with access to the host network, so the security policy advises least privilege and keeping it updated. Security fixes are maintained for the latest release only, and the backend documentation says not to change a selected backend at runtime.

kube-network-policies is a free, open-source userspace implementation of Kubernetes network policies for Linux. It uses Linux NFQUEUE and nftables to capture and evaluate network traffic in userspace. The project supports standard Kubernetes NetworkPolicy, AdminNetworkPolicy (ANP) and BaselineAdminNetworkPolicy (BANP). It can identify packets from pods targeted by active policies and capture those selectively; enabling ANP or BANP disables that optimization and diverts all node traffic to userspace for evaluation. Its documented evaluation pipeline checks logging, Admin Network Policy, standard NetworkPolicy, Baseline Admin Network Policy, then allows traffic by default. ANP and CNP can match external domain names using an in-memory cache of DNS A and AAAA answers. Structured JSON logs aid troubleshooting, and the PolicyEvaluator plugin pipeline can take custom validation logic. Installation instructions cover raw Kubernetes manifests and Helm. The local development setup uses KIND and lists Docker, KIND and kubectl as prerequisites. ANP or BANP also require experimental Network Policy API CRDs before deployment. The project lists an Apache-2.0 license and directs users to the Kubernetes #sig-network Slack channel and mailing list for maintainers.