Google Brings Cluster-Wide Network Policy to Google Kubernetes Engine

Google has expanded its Google Kubernetes Engine (GKE) with ClusterNetworkPolicy, a feature that enables administrators to apply cluster-wide network security controls. This addition is available in preview for GKE version 1.36 and later.

The ClusterNetworkPolicy feature addresses the limitations of Standard Kubernetes NetworkPolicy, which is commonly used to manage traffic between workloads but is limited to individual namespaces. With ClusterNetworkPolicy, administrators can apply non-bypassable rules across an entire cluster while allowing development teams to manage application-specific policies within their own namespaces.

The new feature uses a hierarchical tier system that evaluates policies from the top down. The highest level is the admin tier, followed by the standard namespace network policy tier, and then a baseline tier that sets default behavior when no other policy applies. This structure reflects organisational responsibilities, allowing security teams to use the admin tier for compliance rules and platform teams to apply a baseline deny-all stance across a cluster.

Google highlighted several uses for ClusterNetworkPolicy, including isolating sensitive workloads by applying a global deny rule that overrides permissive namespace policies. Administrators can also manage external egress traffic at cluster level by matching IP address ranges to restrict or allow access to company networks or external destinations.