While it's usually not that big of a deal in PoC and sandboxes, security becomes a matter of utmost importance in large enterprises with diverse teams and project portfolios, even more so when the development of certain applications is outsourced to third-party companies. The ovs-multitenant plugin is a perfect choice if just having projects separated is enough. Unlike the ovs-subnet plugin, which passes all traffic across all pods, this one assigns the same VNID to all pods for each project, keeping them unique across projects, and sets up flow rules on the br0 bridge to make sure that traffic is only allowed between pods with the same VNID.
There is, however, an exception to that ruleâtraffic is allowed to flow ...
