GKE's ClusterNetworkPolicy takes the metadata-server block out of developers' hands

Type `Admin` in the tier field and the rule holds against anything a namespace owner writes. Type `Baseline` and the identical rule text becomes a default that those same owners may override inside their own namespace ^[8][9]. One word decides whether a manifest is a control or a suggestion, and nothing else in the file looks any different.

The delegation case is more interesting than the lockdown case. The worked example is web traffic on port 8080: an Admin rule matches the flow, uses `Pass` to skip the remainder of the Admin tier, and hands the verdict to namespace-scoped policy; if the namespace has written no policy, the flow carries on to Baseline ^[13]. That is a contract rather than a hole. The admin is stating which ports are the application team's business, in an object the application team cannot edit.

Then the arithmetic that decides whether any of this stays maintainable. Priorities run 0 to 1000 within a tier, lower numbers evaluated first, and rules inside a single policy run top to bottom ^[11]. The sample policy that isolates a sensitive namespace sits at priority 10 ^[14], which leaves exactly ten values above it ^[15]. That is adequate for a demo and thin for a cluster where two teams each believe their rule goes first, because the tier is a strict sequence and the first match ends it ^[6]. Numbering convention is cheap to agree on now and expensive to retrofit once a compliance rule is already in production at priority 10.

The other thing worth reading closely is what the old pattern was actually failing at. Injecting namespace-scoped policies was fragile because it depended on a controller continuing to write objects into every namespace that existed, forever, and because those namespace policies are additive: if several select a pod, permission from any one of them is enough ^[2][3]. So an administrator writing in that layer was competing with developers on equal terms. The Admin tier removes the competition by changing evaluation order, not by taking away the developers' verbs.

One caution on shelf life. The manifests carry `apiVersion: policy.networking.k8s.io/v1alpha2` ^[14] and the feature is in public preview ^[5]. A boundary expressed as a single cluster-scoped object is easier to audit than a controller's output, but it is also pinned to an API version that has not settled, and teams generating these objects from something they own will pay less than teams hand-editing them if the field names move.