ovs-multitenant plugin
While it's usually not that big of a deal in PoC and sandboxes, security becomes a matter of utmost importance in large enterprises with diverse teams and project portfolios, even more so when the development of certain applications is outsourced to third-party companies. The ovs-multitenant plugin is a perfect choice if just having projects separated is enough. Unlike the ovs-subnet plugin, which passes all traffic across all pods, this one assigns the same VNID to all pods for each project, keeping them unique across projects, and sets up flow rules on the br0 bridge to make sure that traffic is only allowed between pods with the same VNID.
There is, however, an exception to that rule—traffic is allowed to flow between ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access