<p>I am testing Project Calico on a small Kubernetes cluster and I try to figure out which one between &quot;global policy&quot; and &quot;network policy&quot; will be applied to the data stream first.</p>
<p>What I understand:</p>
<ul>
<li>the data path with Calico is that the pod's host is always the next hop and then filtered with iptables</li>
<li>policies (network and global) can have priority (the lower priority will be applied before)</li>
</ul>
<p>I did many tests but sometimes global network policy take precedence over network policy and sometimes it is exactly the opposite.</p>
<p>Can you explain me and tell me if I am wrong somewhere?</p>
<p>Thank you!</p>

<p>Global vs non-global is not a factor in deciding the order that policies are applied in.  Ordering is determined by the &quot;order&quot; field on Calico <a href="https://docs.projectcalico.org/reference/resources/networkpolicy" rel="noreferrer">NetworkPolicy</a> and <a href="https://docs.projectcalico.org/reference/resources/globalnetworkpolicy" rel="noreferrer">GlobalNetworkPolicy</a> resources, with smaller &quot;order&quot; policies being applied first.</p>
<p>If not specified, &quot;order&quot; defaults to infinity, so policies with an unspecified &quot;order&quot; will be applied last.</p>
<p>Calico also implements the Kubernetes NetworkPolicy resource, which doesn't have an explicit &quot;order&quot; field.  To order those against the Calico resources, we treat Kubernetes NetworkPolicy resource as though they had an implicit &quot;order&quot; of 1000.</p>
<p>There is a tie-breaker in the code for policies with the same order value, but you shouldn't need to know what that is, or rely on it, because it's better to use an explicit &quot;order&quot; value, whenever ordering matters.</p>
