kube-network-policies vs Kube-OVN

kube-network-policies is a free, open-source userspace implementation of Kubernetes network policies for Linux. It uses Linux NFQUEUE and nftables to capture and evaluate network traffic in userspace. The project supports standard Kubernetes NetworkPolicy, AdminNetworkPolicy (ANP) and BaselineAdminNetworkPolicy (BANP). It can identify packets from pods targeted by active policies and capture those selectively; enabling ANP or BANP disables that optimization and diverts all node traffic to userspace for evaluation. Its documented evaluation pipeline checks logging, Admin Network Policy, standard NetworkPolicy, Baseline Admin Network Policy, then allows traffic by default. ANP and CNP can match external domain names using an in-memory cache of DNS A and AAAA answers. Structured JSON logs aid troubleshooting, and the PolicyEvaluator plugin pipeline can take custom validation logic. Installation instructions cover raw Kubernetes manifests and Helm. The local development setup uses KIND and lists Docker, KIND and kubectl as prerequisites. ANP or BANP also require experimental Network Policy API CRDs before deployment. The project lists an Apache-2.0 license and directs users to the Kubernetes #sig-network Slack channel and mailing list for maintainers.

Kube-OVN combines OVN and Open vSwitch with Kubernetes for cloud-native network orchestration. Its documented features include subnet management, static IP allocation, gateways, hybrid underlay and overlay networks, VPC features, QoS, ACLs, and traffic mirroring. VPC networks provide tenants with separate address spaces and networking resources. The project recommends it for Kubernetes environments needing KubeVirt support or multi-tenant networking; KubeVirt virtual machines can live-migrate without network interruption. Documented integrations include Cilium, MetalLB, OpenStack, Submariner, and OVN interconnect. With Cilium chaining, Kube-OVN network abstractions can be used with Cilium eBPF monitoring and security capabilities. The project runs on x86_64 and arm64, and its documentation provides one-click installation scripts. It is free under Apache-2.0, deployed on-premises, and uses a centralized control plane. The project advises against it for OpenShift, public-cloud managed Kubernetes, and cases requiring an all-in-one CNI, ingress, service mesh, and observability stack.