ReleaseBytes
gcp Google Cloud Blog ·

GKE details ClusterNetworkPolicy for centralized network security

blogsecuritygcppreviewarchitectfinancegcp-gke
announcement

Google Cloud explains ClusterNetworkPolicy (CNP) in GKE, an open-source standard designed for centralized network security in multi-tenant Kubernetes environments. This post details how CNP's hierarchical tier system — admin, network policy, and baseline tiers — balances global guardrails from platform teams with developer autonomy. It enables consistent policy enforcement, prevents lateral movement, and resolves conflicts across namespaces. CNP is currently in preview in GKE version 1.36 and later.

  • →Understanding ClusterNetworkPolicy in GKE
  • →Hierarchical Policy Tiers
  • →Common Network Security Use Cases
  • →Open-Source Foundations and Portability
Notes (4) ›
  • Understanding ClusterNetworkPolicy in GKE

    This post describes ClusterNetworkPolicy (CNP) as a solution for balancing developer autonomy and cluster-wide security in multi-tenant Kubernetes environments, addressing the limitations of standard NetworkPolicy.

  • Hierarchical Policy Tiers

    CNP features a hierarchical tier system consisting of an Admin tier (highest precedence), a Network Policy tier (developer-managed), and a Baseline tier (lowest precedence), ensuring deterministic policy evaluation and conflict resolution.

  • Common Network Security Use Cases

    The article illustrates practical applications of CNP, such as isolating sensitive workloads, protecting critical core services, and managing external egress traffic through centrally enforced, non-bypassable rules.

  • Open-Source Foundations and Portability

    CNP was developed as an open-source standard in collaboration with the Kubernetes SIG-Policy Working Group and the Cilium community, promoting portability of security configurations across various environments.

Read the original announcement →

https://cloud.google.com/blog/products/networking/new-clusternetworkpolicy-in-gke/

Related releases