Skip to content

Commit d433fdf

Browse files
committed
CNP: update docs to use CNP instead of ANP and BANP
Add a blog post with short description of changes, some migration examples and future plans. Signed-off-by: Nadia Pinaeva <[email protected]>
1 parent 4d38b37 commit d433fdf

File tree

6 files changed

+187
-80
lines changed

6 files changed

+187
-80
lines changed

site-src/api-overview.md

Lines changed: 62 additions & 77 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Api Object Overview
1+
# API Object Overview
22

33
Prior to the Network Policy API the original NetworkPolicy V1 Resource was the only
44
way for k8s users to apply security rules to their kubernetes workloads. One of the
@@ -8,9 +8,8 @@ personas, sometimes creating a complex web of objects to be maintained. In
88
Contrast, each resource in the Network Policy API is designed to be used by a
99
specific persona.
1010

11-
With the advent of the AdminNetworkPolicy and BaselineAdminNetworkPolicy
12-
resources Cluster Admins will now have the ability to apply policy globally with
13-
only a few simple policy objects.
11+
With the advent of the ClusterNetworkPolicy resource Cluster Admins will now have
12+
the ability to apply policy globally with only a few simple policy objects.
1413

1514
## Roles and personas
1615

@@ -27,116 +26,102 @@ In this documentation we refer to three primary personas:
2726
Custom Resource Definitions (CRDs). Unqualified resource names below will
2827
implicitly be in this API group.
2928

30-
Currently, there are two main objects in the Network Policy API resource model:
29+
Currently, there is one main object in the Network Policy API resource model:
3130

32-
- **AdminNetworkPolicy (ANP)**
33-
34-
- **BaselineAdminNetworkPolicy (BANP)**
31+
- **ClusterNetworkPolicy (CNP)**
3532

3633
The diagram below demonstrates how these new API objects interact with
3734
each-other and existing NetworkPolicy Objects:
3835

39-
![Alt text](./images/ANP-api-model.png?raw=true "Admin Network Policy API Model")
36+
<img src="/images/CNP.drawio.svg" width="541" alt="Cluster Network Policy API model">
4037

4138
## General Notes
4239

43-
- Any well defined AdminNetworkPolicy rules should
40+
- Any well-defined ClusterNetworkPolicy rules should
4441
be read as-is, i.e. there will not be any implicit isolation effects for the Pods
45-
selected by the AdminNetworkPolicy, as opposed to what NetworkPolicy rules imply.
42+
selected by the ClusterNetworkPolicy, as opposed to what NetworkPolicy rules imply.
43+
44+
- We now have multiple API versions, see the [ClusterNetworkPolicy blog post](blog/posts/ClusterNetworkPolicy.md) for more details
45+
46+
## The ClusterNetworkPolicy Resource
47+
48+
The ClusterNetworkPolicy (CNP) resource will help administrators set cluster-wide security
49+
rules for the cluster, which are evaluated before or after the NetworkPolicies defined by the
50+
namespace owners.
51+
52+
### ClusterNetworkPolicy Tiers
4653

47-
- As of `v1alpha1` of this API we focus primarily on E/W cluster traffic and
48-
do not address N/S (Ingress/Egress) use cases. However this is an issue the community
49-
would like to keep thinking about during further iterations, and a tracking issue
50-
can be found/ commented on here ---> [issue #28](https://github.com/kubernetes-sigs/network-policy-api/issues/28)
54+
The ClusterNetworkPolicy has 2 tiers: `Admin` and `Baseline`.
5155

52-
## The AdminNetworkPolicy Resource
56+
The `Admin` tier will help administrators set strict security rules for the cluster,
57+
i.e. a developer CANNOT override these rules by creating NetworkPolicies that apply
58+
to the same workloads as the ClusterNetworkPolicy.
5359

54-
The AdminNetworkPolicy (ANP) resource will help administrators set strict security
55-
rules for the cluster, i.e. a developer CANNOT override these rules by creating
56-
NetworkPolicies that apply to the same workloads as the AdminNetworkPolicy.
60+
The `Baseline` tier will allow administrators to set baseline security rules that
61+
describe default connectivity for cluster workloads, which CAN be overridden by
62+
developer NetworkPolicies if needed.
63+
The major use case BANPs solve is the ability to flip the [default security stance of the
64+
cluster](user-stories.md#story-5-cluster-wide-default-guardrails).
5765

58-
### AdminNetworkPolicy Actions
66+
### ClusterNetworkPolicy Actions
5967

6068
Unlike the NetworkPolicy resource in which each rule represents an allowed
61-
traffic, AdminNetworkPolicies will enable administrators to set `Pass`,
62-
`Deny` or `Allow` as the action of each rule. AdminNetworkPolicy rules should
69+
traffic, ClusterNetworkPolicy will enable administrators to set `Pass`,
70+
`Deny` or `Accept` as the action of each rule. ClusterNetworkPolicy rules should
6371
be read as-is, i.e. there will not be any implicit isolation effects for the Pods
64-
selected by the AdminNetworkPolicy, as opposed to implicit deny NetworkPolicy rules imply.
65-
66-
- **Pass**: Traffic that matches a `Pass` rule will skip all further rules from all
67-
numbered ANPs and instead be enforced by the K8s NetworkPolicies.
68-
If there is no K8s NetworkPolicy of BaselineAdminNetworkPolicy rule match
69-
traffic will be governed by the implementation. For most implementations,
70-
this means "allow", but there may be implementations which have their own policies
71-
outside of the standard Kubernetes APIs.
72-
- **Deny**: Traffic that matches a `Deny` rule will be dropped.
73-
- **Allow**: Traffic that matches an `Allow` rule will be allowed.
74-
75-
AdminNetworkPolicy `Deny` rules are useful for administrators to explicitly
72+
selected by the ClusterNetworkPolicy, as opposed to implicit deny NetworkPolicy rules imply.
73+
74+
- **Accept**: Accepts the selected traffic, allowing it into
75+
the destination. No further ClusterNetworkPolicy or
76+
NetworkPolicy rules will be processed.
77+
78+
- **Deny**: Drops the selected traffic. No further
79+
ClusterNetworkPolicy or NetworkPolicy rules will be
80+
processed.
81+
82+
- **Pass**: Skips all further ClusterNetworkPolicy rules in the
83+
current tier for the selected traffic, and passes
84+
evaluation to the next tier.
85+
86+
ClusterNetworkPolicy `Deny` rules are useful for administrators to explicitly
7687
block traffic with malicious in-cluster clients, or workloads that pose security risks.
7788
Those traffic restrictions can only be lifted once the `Deny` rules are deleted,
7889
modified by the admin, or overridden by a higher priority rule.
7990

80-
On the other hand, the `Allow` rules can be used to call out traffic in the cluster
91+
On the other hand, the `Accept` rules can be used to call out traffic in the cluster
8192
that needs to be allowed for certain components to work as expected (egress to
8293
CoreDNS for example). This traffic should not be blocked when developers apply
8394
NetworkPolicy to their Namespaces which isolates the workloads.
8495

85-
AdminNetworkPolicy `Pass` rules allow an admin to delegate security posture for
96+
ClusterNetworkPolicy `Pass` rules in the `Admin` tier allow an admin to delegate security posture for
8697
certain traffic to the Namespace owners by overriding any lower precedence Allow
8798
or Deny rules. For example, intra-tenant traffic management can be delegated to tenant
8899
admins explicitly with the use of `Pass` rules. More specifically traffic selected
89-
by a `Pass` rule will skip any further ANP rule selection, be evaluated against
90-
any well defined NetworkPolicies, and if not terminated ultimately be evaluated against any
91-
BaselineAdminNetworkPolicies.
100+
by a `Pass` rule will skip any further `Admin` tier rule selection, be evaluated against
101+
any well-defined NetworkPolicies, and if not terminated ultimately be evaluated against any
102+
`Baseline` tier CNP.
92103

93-
### AdminNetworkPolicy Priorities
104+
### ClusterNetworkPolicy Priorities
94105

95-
Integer priority values were added to the AdminNetworkPolicy API to allow Cluster
96-
Admins to express direct and intentional ordering between various ANP Objects.
97-
The `Priority` field in the ANP spec is defined as an integer value
98-
within the range 0 to 1000 where rules with lower priority values have higher
99-
precedence. Regardless of priority value all ANPs have higher precedence than
100-
any defined NetworkPolicy or BaselineAdminNetworkPolicy objects.
106+
Integer priority values were added to the ClusterNetworkPolicy API to allow Cluster
107+
Admins to express direct and intentional ordering between various CNP Objects.
108+
The `Priority` field in the CNP spec is defined as an integer value
109+
within the range 0 to 1000 where rules with lower priority values have
110+
higher precedence, and are checked before policies with higher priority
111+
values in the same tier.
101112

102-
### AdminNetworkPolicy Rules
113+
### ClusterNetworkPolicy Rules
103114

104-
Each ANP should define at least one `Ingress` or `Egress` relevant in-cluster traffic flow
115+
Each CNP should define at least one `Ingress` or `Egress` relevant in-cluster traffic flow
105116
along with the associated Action that should occur. In each `gress` rule the user
106-
should AT THE MINIMUM define an `Action`, and at least one `AdminNetworkPolicyPeer`.
117+
should AT THE MINIMUM define an `Action`, and at least one `ClusterNetworkPolicyPeer`.
107118
Optionally the user may also define select `Ports` to filter traffic on and also
108119
a name for each rule to make management and reporting easier for Admins.
109120

110-
### AdminNetworkPolicy Status
121+
### ClusterNetworkPolicy Status
111122

112-
For `v1alpha1` of this API the ANP status field is simply defined as a list of
123+
For `v1alpha2` of this API the ANP status field is simply defined as a list of
113124
[`metav1.condition`](https://github.com/kubernetes/apimachinery/blob/v0.25.0/pkg/apis/meta/v1/types.go#L1464)s. Currently there are no rules as to what these conditions should display,
114125
and it is up to each implementation to report what they see fit. For further
115126
API iterations the community may consider standardizing these conditions based on
116127
the usefulness they provide for various implementors.
117-
118-
## The BaselineAdminNetworkPolicy Resource
119-
120-
The BaselineAdminNetworkPolicy (BANP) resource will allow administrators to
121-
set baseline security rules that describes default connectivity for cluster workloads,
122-
which CAN be overridden by developer NetworkPolicies if needed. The major use case
123-
BANPs solve is the ability to flip the [default security stance of the
124-
cluster](user-stories.md#story-5-cluster-wide-default-guardrails).
125-
126-
### BaselineAdminNetworkPolicy Rule Actions
127-
128-
BaselineAdminNetworkPolicies allow administrators to define two distinct actions
129-
for each well defined rule, `Allow` and `Deny`.
130-
131-
- **Deny**: Traffic that matches a `Deny` rule will be dropped.
132-
- **Allow**: Traffic that matches an `Allow` rule will be allowed.
133-
134-
### BaselineAdminNetworkPolicy Rules
135-
136-
BANP Rules are defined and behave the same (Except for the `Pass` action) as [ANP
137-
rules](#adminnetworkpolicy-rules).
138-
139-
### BaselineAdminNetworkPolicy Status
140-
141-
The BANP `status` field follows the same constructs as used by the
142-
[AdminNetworkPolicy.Status](#adminnetworkpolicy-status) field.

site-src/blog/.authors.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,3 +7,7 @@ authors:
77
name: Yang Ding
88
description: Senior Member of Technical Staff at VMware. network-policy-api co-lead.
99
avatar: https://github.com/dyanngg.png
10+
npinaeva:
11+
name: Nadia Pinaeva
12+
description: Software Engineer
13+
avatar: https://github.com/npinaeva.png
Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
---
2+
date: 2025-10-09
3+
authors:
4+
- npinaeva
5+
---
6+
7+
# ClusterNetworkPolicy or what happened to the AdminNetworkPolicy and BaselineAdminNetworkPolicy?
8+
9+
AdminNetworkPolicy (ANP) and BaselineAdminNetworkPolicy (BANP) were the first APIs created by the Network Policy API working group.
10+
They are `v1alpha1` resources, which means that they are not stable and are mostly used to get early feedback on the API design from
11+
the community.
12+
13+
If you have seen these APIs, you probably have noticed that they are quite similar. If you have written controllers to reconcile these resources,
14+
you probably also found some code duplication. The original reason for having two separate resources was just a lack of
15+
use cases for multiple instances of BANP, which made it a singleton. However, with more feedback from the community, we have realized that
16+
those use cases do exist and that having two separate resources adds more burden than value.
17+
18+
<!-- more -->
19+
20+
### What has changed
21+
22+
As a reminder, here is how the original Admin Network Policy API Model looked like:
23+
24+
![image](/images/ANP-api-model.png)
25+
26+
The model stays the same with the new API, the only difference is that evaluation order is now defined by the `priority` field
27+
and not by the resource type. `AdminNetworkPolicy` becomes a `ClusterNetworkPolicy` with `tier=Admin` and
28+
`BaselineAdminNetworkPolicy` becomes a `ClusterNetworkPolicy` with `tier=Baseline`.
29+
30+
<img src="/images/CNP.drawio.svg" width="541" alt="Cluster Network Policy API model">
31+
32+
Other changes bring the functionality of `BaselineAdminNetworkPolicy` to parity with `AdminNetworkPolicy`. This includes:
33+
- Allowing multiple `ClusterNetworkPolicy` resources with `tier=Baseline` by using the same `priority` field as for `tier=Admin`.
34+
- Supporting `Pass` action in `ClusterNetworkPolicy` with `tier=Baseline` to allow skipping all further rules in the `Baseline` tier.
35+
- Supporting `domainNames` matching for `egress` rules in `ClusterNetworkPolicy` with `tier=Baseline`.
36+
37+
The [enhancement proposal](https://github.com/kubernetes-sigs/network-policy-api/pull/289) has some more details for those interested.
38+
39+
### Examples
40+
41+
Let's take a look at some examples based on the original [user stories](../../user-stories.md).
42+
43+
#### Story 1:Deny traffic at a cluster level
44+
45+
To deny all traffic at the cluster level, the following `AdminNetworkPolicy` was used:
46+
47+
```yaml
48+
apiVersion: policy.networking.k8s.io/v1alpha1
49+
kind: AdminNetworkPolicy
50+
metadata:
51+
name: cluster-wide-deny-example
52+
spec:
53+
priority: 10
54+
subject:
55+
namespaces:
56+
matchLabels:
57+
kubernetes.io/metadata.name: sensitive-ns
58+
ingress:
59+
- action: Deny
60+
from:
61+
- namespaces:
62+
namespaceSelector: {}
63+
name: select-all-deny-all
64+
```
65+
66+
which looks like this with the new `ClusterNetworkPolicy` API:
67+
68+
```yaml
69+
--8<-- "user-story-examples/user-story-1.yaml"
70+
```
71+
72+
#### Story 5: Cluster Wide Default Guardrails
73+
74+
To deny all traffic in a cluster by default (in an overridable manner), the following `BaselineAdminNetworkPolicy` was used:
75+
76+
```yaml
77+
apiVersion: policy.networking.k8s.io/v1alpha1
78+
kind: BaselineAdminNetworkPolicy
79+
metadata:
80+
name: default
81+
spec:
82+
subject:
83+
namespaces: {}
84+
ingress:
85+
- action: Deny # zero-trust cluster default security posture
86+
from:
87+
- namespaces:
88+
namespaceSelector: {}
89+
```
90+
91+
which looks like this with the new `ClusterNetworkPolicy` API:
92+
93+
```yaml
94+
--8<-- "user-story-examples/user-story-5.yaml"
95+
```
96+
97+
### Migration
98+
99+
We appreciate all early adopters of the `AdminNetworkPolicy` and `BaselineAdminNetworkPolicy` APIs.
100+
You can continue using them at their latest released version [v0.1.7](https://github.com/kubernetes-sigs/network-policy-api/releases/tag/v0.1.7)
101+
At the same time, we encourage you to plan your migration to the new `ClusterNetworkPolicy` API, which can be done once its first version is available.
102+
We plan to base our `beta` release on the `ClusterNetworkPolicy` API.

site-src/images/CNP.drawio.svg

Lines changed: 4 additions & 0 deletions
Loading

site-src/implementations.md

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,17 @@ Network Policy API resources and provides status and resource references for the
66
Implementors of Network Policy API resources are encouraged to update this document with status information about their
77
implementations, the versions they cover, and documentation to help users get started.
88

9-
## AdminNetworkPolicy and BaseLineAdminNetworkPolicy
9+
## ClusterNetworkPolicy
1010

11-
Updated: 11-14-2024
11+
Updated: 13-Oct-2025
1212

1313
- [Kube-network-policies](https://github.com/kubernetes-sigs/kube-network-policies)
14+
15+
## AdminNetworkPolicy and BaseLineAdminNetworkPolicy (v1alpha1)
16+
17+
Updated: 14-Nov-2024
18+
19+
- [Kube-network-policies](https://github.com/kubernetes-sigs/kube-network-policies/tree/v0.8.1)
1420
- [OVN-Kubernetes CNI](https://github.com/ovn-org/ovn-kubernetes/) (Has implemented standard fields of the API + Nodes/Networks in Experimental)
1521
- [Antrea CNI](https://github.com/antrea-io/antrea/) (Has implemented standard fields of the API)
1622
- [KubeOVN CNI](https://github.com/kubeovn/kube-ovn) (Has implemented standard fields of the API)

site-src/index.md

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,12 @@ multiple K8s CRD resources geared towards different users and use cases.
1919

2020
### Active (APIs undergoing active development)
2121

22-
- [AdminNetworkPolicy](api-overview.md#the-adminnetworkpolicy-resource) and [BaselineAdminNetworkPolicy](api-overview.md#the-baselineadminnetworkpolicy-resource)
22+
- [ClusterNetworkPolicy](api-overview.md#the-clusternetworkpolicy-resource)
23+
24+
### Previous (APIs that have evolved to the next stage and are no longer actively developed)
25+
26+
- [AdminNetworkPolicy](https://network-policy-api.sigs.k8s.io/reference/spec/#policy.networking.k8s.io%2fv1alpha1.AdminNetworkPolicy) and
27+
[BaselineAdminNetworkPolicy](https://network-policy-api.sigs.k8s.io/reference/spec/#policy.networking.k8s.io%2fv1alpha1.BaselineAdminNetworkPolicy)
2328

2429
### Future (Possible APIs to be created in the future)
2530

@@ -30,6 +35,7 @@ multiple K8s CRD resources geared towards different users and use cases.
3035
- [Kubecon NA 2022 Contributors Summit](https://youtu.be/00nVssi2oPA)
3136
- [Kubecon NA 2022 SIG Network Deep Dive](https://www.youtube.com/watch?v=qn9bM5Cwvg0&t=752s)
3237
- [Kubecon EU 2023 SIG Network Deep Dive](https://www.youtube.com/watch?v=0uPEFcWn-_o)
38+
- [Kubecon EU 2025 SIG Network Intro and Updates](https://www.youtube.com/watch?v=lBOdQHNNgEU)
3339

3440
## Community, discussion, contribution, and support
3541
Learn how to engage with the Kubernetes community on the [community page](http://kubernetes.io/community/).

0 commit comments

Comments
 (0)