kube-network-policies vs Submariner
kube-network-policies
kube-network-policies.sigs.k8s.ioSubmariner
submariner.ioSide by side
| Figure | kube-network-policies | Submariner |
|---|---|---|
| Price from | Free | — |
| Free plan | Yes | — |
| Free trial | — | — |
| Open source | — | — |
| Linux | Yes | — |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 0 |
| Spec score · Container Networking Software | 8.1 (#4) | 6.7 (#23) |
| License | The repository lists the Apache-2.0 license. | Contributions to Submariner projects other than the website must be made available under Apache License 2.0. |
| Project status | The documentation says this is not an officially supported Google product and is not eligible for Google's Open Source Software Vulnerability Rewards Program. | Submariner is a Cloud Native Computing Foundation sandbox project. |
| Purpose | A userspace implementation that enforces Kubernetes network policies by intercepting packets with Linux NFQUEUE. | Submariner connects Pods and Services across Kubernetes clusters on-premises or in the cloud. |
| Support | The repository README lists the Kubernetes Slack #sig-network channel and the sig-network mailing list for maintainers and community support. | The project directs users to GitHub, Kubernetes Slack, community meetings, and the submariner-dev and submariner-users mailing lists for help and discussion. |
Plans
In their own words
kube-network-policies
kube-network-policies is a free, open-source userspace implementation of Kubernetes network policies for Linux. It uses Linux NFQUEUE and nftables to capture and evaluate network traffic in userspace. The project supports standard Kubernetes NetworkPolicy, AdminNetworkPolicy (ANP) and BaselineAdminNetworkPolicy (BANP). It can identify packets from pods targeted by active policies and capture those selectively; enabling ANP or BANP disables that optimization and diverts all node traffic to userspace for evaluation. Its documented evaluation pipeline checks logging, Admin Network Policy, standard NetworkPolicy, Baseline Admin Network Policy, then allows traffic by default. ANP and CNP can match external domain names using an in-memory cache of DNS A and AAAA answers. Structured JSON logs aid troubleshooting, and the PolicyEvaluator plugin pipeline can take custom validation logic. Installation instructions cover raw Kubernetes manifests and Helm. The local development setup uses KIND and lists Docker, KIND and kubectl as prerequisites. ANP or BANP also require experimental Network Policy API CRDs before deployment. The project lists an Apache-2.0 license and directs users to the Kubernetes #sig-network Slack channel and mailing list for maintainers.
Submariner
Submariner has no write-up on Specifiction yet; its figures are above.