The Kubernetes Network Plumbing Working Group (WG) has introduced **Multi-NetworkPolicy**, which provides policy-based network traffic control for secondary interfaces in multi-network pod environments. Currently, Multus lacks built-in support for NetworkPolicy, making it difficult to enforce traffic rules across multiple network interfaces. This feature request proposes integrating Multi-NetworkPolicy as an **optional Sylva unit** for Multus macvlan, ipvlan and bridge CNI, allowing users to define traffic firewall rules for workloads with multiple interfaces. **Seems not to work for filtering traffic of KubeVirt VMs secondary interfaces with bridge CNI (the only supported multus CNI), probably because of the "bridged" topology used inside the virt-launcher pods used by Kubevirt.** Proposed solution to evaluate the functionality: - Enable Multi-NetworkPolicy support as an **optional component** when Multus is enabled on workload clusters. - Install [MultiNetworkPolicy CRD](https://github.com/k8snetworkplumbingwg/multi-networkpolicy) - Install [MultiNetworkPolicy upstream implementation with nftables](https://github.com/k8snetworkplumbingwg/multi-networkpolicy-nftables) that creates the DaemonSet and runs multi-networkpolicy-nftables pods on each node; How to install (for checking functionality): **Install MultiNetworkPolicy CRD:** ```shell $ git clone https://github.com/k8snetworkplumbingwg/multi-networkpolicy $ cd multi-networkpolicy $ kubectl create -f scheme.yml --validate=false ``` **Deploy nftables multi-networkpolicies daemonset:** ```shell $ git clone https://github.com/k8snetworkplumbingwg/multi-networkpolicy-nftables $ cd multi-networkpolicy-nftables $ # replace container-runtime-endpoint with "--container-runtime-endpoint=/run/k3s/containerd/containerd.sock" in deploy.yml; $ # add "--network-plugins=macvlan,ipvlan,bridge,sriov,bond" inside command args for multi-networkpolicy container of multi-networkpolicy-nftables daemonSet. $ # Update the DaemonSet container securityContext: ``` ```yaml securityContext: capabilities: add: ["SYS_ADMIN", "NET_ADMIN", "SYS_PTRACE"] appArmorProfile: type: Unconfined ``` $ kubectl create -f deploy.yml ``` Testing MultiNetworkPolicy functionality on a pod with `iperf: client` label, from `multus-test` namespace, having an additional interface in `macvlan-vlan2412` net-attach-def by applying an network policy that only permits egress tcp/udp flows on port 5201 towards pods with `iperf: server` label: ```yaml apiVersion: k8s.cni.cncf.io/v1beta1 kind: MultiNetworkPolicy metadata: name: multi-np-iperf-client namespace: multus-test annotations: k8s.v1.cni.cncf.io/policy-for: multus-test/macvlan-vlan2412 spec: podSelector: matchLabels: iperf: client policyTypes: - Egress egress: - to: - podSelector: matchLabels: iperf: server ports: - port: 5201 protocol: udp - port: 5201 protocol: tcp ``` ### Updated target for implementing MultiNetworkPolicy with nftables backend Target is to use the upstream multi-networkpolicy nftables (not iptables since the industry direction is to move away from iptables) project: https://github.com/k8snetworkplumbingwg/multi-networkpolicy-nftables instead of the work done by Telekom (old fork from upstream iptables implementation, updated in Oct 2025 to use nftables instead). Actually the Telekom implementation is different than the one done upstream by Network Plumbing Working Group (which is actually used in Openshift too). I proposed to start testing with the Telekom implementation because it had container images available. Based on my understanding, Openshift implementation https://github.com/openshift/multus-networkpolicy is the downstream project adapted for Openshift, from the upstream https://github.com/k8snetworkplumbingwg/multi-networkpolicy-nftables, I can see identical commits in both projects: [upstream](https://github.com/k8snetworkplumbingwg/multi-networkpolicy-nftables/commit/f68101b9e2553b5ffc48d17a8476b99202a77a35) and [openshift](https://github.com/openshift/multus-networkpolicy/commit/f68101b9e2553b5ffc48d17a8476b99202a77a35). So my proposal is to use: https://github.com/k8snetworkplumbingwg/multi-networkpolicy-nftables The issue we have with this upstream nftables implementation: no tags and no image is published, hence the proposal for testing is to build images at Sylva level. I've opened an issue in the upstream project to request versioned tags and public container images: https://github.com/k8snetworkplumbingwg/multi-networkpolicy-nftables/issues/53