Understanding Network Policy APIs
TOC
Introduction
Network security in Kubernetes-style clusters involves controlling which workloads (Pods, namespaces) can communicate and how. At its core are network-policy APIs that enable segmentation (layer 3/4) and traffic control. Over time more advanced API layers have emerged to support cluster-wide guardrails, multi-tenancy enforcement, zero-trust models and application-layer (layer 7) filtering.
This article focuses on the API model v1alpha1: AdminNetworkPolicy (ANP) and BaselineAdminNetworkPolicy (BANP), their place among network policy APIs, how they relate to the standard NetworkPolicy, and how you might use them today while planning for future versions.
Evaluation of network policy by KUBE-OVN
When multiple network policies are applied, they follow a strict priority order: Admin Network Policy takes precedence over Network Policy, which in turn takes precedence over Baseline Admin Network Policy.
The procedure is as follows:
What is the difference between the AdminNetworkPolicy with scope and the NetworkPolicy with namespace scope?
| Dimension | Namespace-Scoped NetworkPolicy | Cluster-Scoped AdminNetworkPolicy |
|---|---|---|
| Scope | Applies only to a single namespace | Applies across the entire cluster |
| Audience / Ownership | Application developer or namespace owners | Platform administrators or cluster administrator |
| Primary Use | Workload-level microsegmentation (L3/L4) | Enforcing global or cross-namespace access rules |
| Control Target | Pods within a namespace selected by podSelector | Namespaces or Pods selected by top-level subject |
| Policy Priority | Medium priority — evaluated after admin-level rules | Higher priority — overrides namespace policies |
| Typical Use Cases | Allow frontend → backend, restrict DB access, etc. | Restrict inter-tenant traffic, enforce egress restrictions, set global protections |
| Visibility | Only affects the namespace where it is created | Can impact multiple namespaces simultaneously |
| Cross-Namespace Rules | Allowed only indirectly (via namespaceSelector) | First-class cross-namespace traffic control |
| Risk Surface | Misconfiguration affects one namespace | Misconfiguration may affect entire cluster traffic |