Use this policy to restrict network interaction between different BRIX environments in a Kubernetes cluster while keeping access to system cluster services allowed.
For example, if the brix365-dev, brix365-stage, and brix365-prod environments are deployed in the same cluster, you can prevent them from exchanging network traffic directly.
Fill out the configuration file
To enable company isolation, fill out the tenantIsolation block in the values-policies.yaml file.
In this example, each environment is specified as a separate company. Therefore, network traffic between the brix365-dev, brix365-stage, and brix365-prod namespaces is isolated:
...
## Company isolation settings
tenantIsolation:
enabled: true
## Description of companies and their namespaces
tenants:
- name: dev
namespaces:
- brix365-dev
- name: stage
namespaces:
- brix365-stage
- name: prod
namespaces:
- brix365-prod
...
where:
- tenantIsolation.enabled: Set to true to enable network policies. The false value disables them.
- tenantIsolation.tenants: Specify a list of companies and their corresponding namespaces to which the network policies will apply. Namespaces within the same company can interact with each other, but are isolated from other companies.
After configuring the security policy, install the kyverno-policies chart as described in Step 3 of Phase 2 in Install Kyverno.