Network Security

    Using network namespaces, you can isolate pod networks. Each pod gets its own IP and port range to bind to, thereby isolating pod networks from each other on the node. Pods from different projects cannot send packets to or receive packets from pods and services of a different project. You can use this to isolate developer, test and production environments within a cluster.

    OKD also provides the ability to control egress traffic using either a router or firewall method. For example, you can use IP whitelisting to control database access.

    Further Reading

    Isolating Applications

    For example, to isolate a project network in the cluster and vice versa, run:

    In the above example, all of the pods and services in and <project2> can not access any pods and services from other non-global projects in the cluster and vice versa.