Standard Network Policies limit you to applying policies at the namespace level, but ClusterNetworkPolicy (CNP) lets you apply granular networking policies across an entire cluster. When you use CNP, you can easily scale security and governance policies. Recently, I experimented with this functionality in Google Kubernetes Engine (GKE) and saw the benefits for myself.
In this post, we’ll explore using CNP to control traffic to an LLM and cluster. If you want to jump right into a hands-on lab, check out this Codelab: Secure AI Inference Workloads with GKE ClusterNetworkPolicy.
How CNP works
CNP follows a three-tier flow with a precedence match:
-
Admin tier (top precedence): Cluster administrator enforces mandatory security rules that can’t be bypassed (for example, blocking metadata access).
-
Network policy tier (middle precedence): Standard namespace-scoped policies that are managed by application teams to control ingress and egress for their microservices.
-
Baseline tier (bottom precedence): Cluster administrator establishes fallback defaults (for example, a default-deny posture across namespaces).
Design pattern example
The aim of the experiment in the Codelab is to restrict traffic to the LLM namespace, allow only authorized clients, and prevent cluster-wide access to the metadata API except for DNS port 53. It uses these services:
-
Virtual Private Cloud (VPC): Provides private networking, subnets for pods and services, and secure outbound egress via Cloud NAT.
-
TPU v5e: High-efficiency accelerator hardware (2×2 topology) running optimized model inference.
-
GKE: Managed Kubernetes platform that’s powered by GKE Dataplane V2 (eBPF) to enforce multi-tier networking policies.
-
Gemma 4 (google/gemma-4-E2B-it): Lightweight open model served with vLLM to act as a sensitive AI workload.
-
ClusterNetworkPolicy (CNP): Cluster-wide policies that let administrators enforce mandatory administrator and baseline guardrails across all namespaces.
-
NetworkPolicies: Standard namespace-scoped rules that let developers grant access to authorized clients.
-
Cloud Logging / GKE Network Policy Logging: Captures real-time packet verdicts (allow/deny) and policy audit trails.
