Managing multi-tenant Kubernetes network security requires balancing developer needs for communication with security team demands for compliance. Standard Kubernetes NetworkPolicy, while useful for single namespaces, struggles with cluster-wide enforcement due to its namespace scope and developer-centric design. ClusterNetworkPolicy (CNP) was introduced as an open-source standard to address these limitations. CNP is a cluster-wide resource enabling centralized network security management for administrators. It features a hierarchical tier system: the admin tier for highest precedence global rules, the network policy tier for namespace-specific developer policies, and the baseline tier for default cluster behavior. This tiered structure aligns security with organizational roles, allowing for compliance mandates by security teams and default deny-all postures by platform teams. Developers can then manage their application-specific policies without overriding core security mandates. The deterministic evaluation resolves policy conflicts, with the admin tier capable of an explicit Pass action to delegate final decisions to namespace policies. Common use cases include isolating sensitive workloads, protecting core services, and managing external egress traffic. CNP simplifies complex security requirements into centralized rules, such as denying access to sensitive namespaces while permitting essential services. The ClusterNetworkPolicy API is an open-source standard, ensuring portability across environments. GKE's implementation of CNP provides native tier selection for clear and deterministic policy evaluation. This elevates workload network security to unified, cluster-wide governance.