{
  "id": 3347567,
  "title": "Taking control of cluster security: A deep dive into GKE ClusterNetworkPolicy",
  "url": "https://urgent.news/2026/08/25/taking-control-of-cluster-security-a-deep-dive-into-gke",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-25T20:44:29.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/googlecloud/taking-control-of-cluster-security-a-deep-dive-into-gke-clusternetworkpolicy-536c"
  },
  "original_language": "en",
  "account": "Kubernetes traditionally left network security up to developers. Standard NetworkPolicy objects are scoped to namespaces, making it cumbersome to enforce global security policies across multiple teams and environments. ClusterNetworkPolicy, in Public Preview for GKE, introduces a cluster-wide resource to establish unchangeable security boundaries across the entire cluster. This policy uses a sequential evaluation pipeline with three tiers: Admin, NetworkPolicy, and Baseline. In the Admin tier, administrators define mandatory rules that developers cannot override. The NetworkPolicy tier applies standard namespace-scoped policies, while the Baseline tier provides fallback default-deny policies for unhandled traffic. Each tier uses explicit numeric priorities to determine rule precedence. Rules in a policy must either accept, deny, or pass traffic, with Pass allowing evaluation to continue in the next tier. For example, to isolate a sensitive namespace, an Admin tier policy can block all ingress and egress traffic to that namespace. Conversely, a Baseline tier default-deny policy ensures all traffic is blocked unless explicitly allowed in namespace-scoped policies. This approach balances centralized compliance with developer flexibility. Implemented using Cilium, ClusterNetworkPolicy runs on GKE version 1.36.0 or later with Dataplane V2, limited to 100 ingress and 100 egress rules per policy. Monitoring and troubleshooting are available through GKE Dashboards.",
  "summary": "In Kubernetes, network security has historically been a developer-centric responsibility. Standard Kubernetes NetworkPolicy objects are namespace-scoped. While this works beautifully for isolating individual microservices within a single application boundary, it introduces major operational headaches at scale. As clusters grow to accommodate multiple teams, business units, and environments,…",
  "key_points": [
    "ClusterNetworkPolicy introduces cluster-wide security boundaries in GKE.",
    "Admin tier defines mandatory rules developers cannot override.",
    "Baseline tier provides default-deny fallback for unhandled traffic."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}