kube-network-policies

kube-network-policies is a free, open-source userspace implementation of Kubernetes network policies for Linux and self-hosted environments. It uses Linux NFQUEUE and nftables to intercept and evaluate network traffic in userspace. The project supports standard Kubernetes NetworkPolicy, AdminNetworkPolicy (ANP), and BaselineAdminNetworkPolicy (BANP). It can identify packets from pods targeted by active policies, allowing selective capture instead of diverting all traffic when the optimization is available. Enabling ANP or BANP disables that optimization, so all node traffic is evaluated in userspace. The documented policy pipeline checks logging, Admin Network Policy, standard NetworkPolicy, Baseline Admin Network Policy, then allows traffic by default. ANP and CNP can match external domains using cached DNS A and AAAA answers. Structured JSON logs help troubleshoot policy decisions, and a PolicyEvaluator plugin pipeline can add custom validation logic. Installation instructions cover raw Kubernetes manifests and Helm. The local development quick start uses KIND and lists Docker, KIND, and kubectl as prerequisites. ANP or BANP also require installing the experimental Network Policy API CRDs before deploying the configured daemonset. The project directs users to Kubernetes community channels to reach maintainers.

kube-network-policies provides policy evaluation and logging with selective packet capture when its optimization is available. Teams using ANP or BANP should account for the additional CRDs and full node traffic evaluation.

kube-network-policies suits Kubernetes users who need network policy evaluation on Linux and are comfortable with self-hosted deployment. Its local development instructions are aimed at users with Docker, KIND, and kubectl.

kube-network-policies is a Linux and Kubernetes implementation for operators who need network policy decisions evaluated in userspace. It is a focused fit for clusters using Kubernetes NetworkPolicy, with ANP or BANP available when teams can account for their extra setup and broader traffic evaluation.

Overview

The project intercepts traffic through Linux NFQUEUE and nftables, then evaluates it against supported Kubernetes policy formats. Its scope is network policy enforcement, including egress control, rather than a general container networking suite. That focus makes it relevant to operators who want these policy controls in a Kubernetes environment and can manage a self-hosted deployment.

Installation is documented for raw Kubernetes manifests and Helm. The local development instructions use KIND and require Docker, KIND, and kubectl. Operators enabling AdminNetworkPolicy (ANP) or BaselineAdminNetworkPolicy (BANP) must first install the experimental Network Policy API CRDs, adding a setup dependency to that deployment path.

Key features

Policy evaluation and packet capture

The implementation supports standard Kubernetes NetworkPolicy as well as ANP and BANP. Its documented evaluation sequence checks logging, Admin Network Policy, standard NetworkPolicy, Baseline Admin Network Policy, and then allows traffic by default. That ordering matters to teams combining policy types, since it describes how the evaluator reaches a decision when traffic passes through the pipeline.

For pods targeted by active policies, selective capture dynamically identifies relevant packets instead of intercepting all traffic. This can avoid unnecessary userspace evaluation in standard-policy deployments. The trade-off is substantial for administrative policy: enabling ANP or BANP turns off the optimization and diverts all node traffic to userspace for evaluation.

Logs, domain matching, and extensions

Structured JSON logs record policy decisions, giving operators a useful format for troubleshooting why traffic was evaluated or handled a certain way. ANP and CNP can match external domain names through an in-memory DNS cache that records DNS A and AAAA answers. The PolicyEvaluator plugin pipeline can also be extended with custom validation logic, which suits teams that need to add checks to the evaluation process.

Pricing

Open-source project: free. The plan covers a Kubernetes network policy implementation and supports installation with raw manifests or Helm. The project is open source under Apache-2.0, with no free trial because the software is free. There are no paid tiers or seat-based plan distinctions in this offering.

This is a fit for teams able to operate self-hosted Kubernetes software. Project maintainers can be reached through the Kubernetes #sig-network Slack channel and mailing list. The project is not an officially supported Google product and is not eligible for Google's Open Source Software Vulnerability Rewards Program; vulnerability reports are directed to the Kubernetes Security and Disclosure Information page.

Platforms

kube-network-policies targets Linux and Kubernetes, and its local development path uses KIND. This makes it appropriate for Linux-based Kubernetes environments; it is not presented as a standalone desktop application. The project does not provide a CNI plugin, so it is not a choice for teams specifically seeking one.

Who it's for

Choose it when your Kubernetes operators want userspace evaluation for standard network policies, egress control, structured decision logs, or custom evaluator validation. It is especially relevant when ANP or BANP support is a requirement and the team is prepared to install the experimental CRDs and route all node traffic through userspace evaluation.

Look elsewhere if your deployment depends on retaining selective capture while using administrative policies, or if you need a CNI plugin. Its self-hosted Linux and Kubernetes scope also makes it a poor match for teams seeking a general-purpose desktop networking tool.

Pros and cons

• Pros: Supports standard NetworkPolicy, ANP, and BANP, giving Kubernetes operators several policy levels in one implementation.
• Pros: Selective capture can limit interception to packets from pods targeted by active policies.
• Pros: Structured JSON decision logs, domain matching from cached DNS answers, and an extensible evaluator help with troubleshooting and custom validation.
• Pros: Free Apache-2.0 software with installation paths through raw manifests or Helm.
• Cons: ANP or BANP disables selective capture and sends all node traffic to userspace, a meaningful operational trade-off.
• Cons: Administrative policy deployment requires experimental Network Policy API CRDs before the configured daemonset.
• Cons: It is not a CNI plugin, limiting its fit for teams choosing a networking plugin rather than a policy evaluator.
• Cons: The project disclaims official Google support and directs users to community channels for maintainer contact.

Alternatives

For other options, see Container Networking Software.

• Canal is another free Apache-2.0 open-source option for readers comparing container networking software.
• VMware Workstation Pro is free for Linux or Windows hosts, with no subscription or license key required for supported 64-bit Intel or AMD PCs.
• Calico Open Source may suit teams looking for community-driven support and maintenance, in-memory data retention, and unlimited clusters.
• Cello CNI is an option for Kubernetes deployments on Volcengine ECS that can use Helm 3.0.
• Cilium is a free open-source Linux option for AMD64 or AArch64 systems with Linux kernel 5.10 or equivalent.
• CNI Plugins provides reference and example CNI network plugins under Apache-2.0.
• DANM is a free option for Kubernetes network management.
• Flannel is a free open-source Kubernetes networking project under Apache 2.0.

Verdict

kube-network-policies is a strong fit for Linux Kubernetes teams that want a free, extensible userspace policy evaluator with standard policy support and optional administrative policy formats. Its selective capture and structured logs make the standard-policy path compelling. Choose another approach if you need a CNI plugin or if ANP/BANP deployments cannot accommodate full-node userspace evaluation and the experimental CRD setup.