# Environment network isolation policy

> [HTML Version](kyverno-network-policy.html)

Use this policy to restrict network interaction between different BRIX environments in a Kubernetes cluster while keeping access to system cluster services allowed.

For example, if the **brix365-dev**, **brix365-stage**, and **brix365-prod** environments are deployed in the same cluster, you can prevent them from exchanging network traffic directly.

## Fill out the configuration file

To enable company isolation, fill out the `tenantIsolation` block in the **values-policies.yaml** file.

In this example, each environment is specified as a separate company. Therefore, network traffic between the **brix365-dev**, **brix365-stage**, and **brix365-prod** namespaces is isolated:



````
...  
\## Company isolation settings  
tenantIsolation:  
  enabled: true  
\## Description of companies and their namespaces  
  tenants:  
    - name: dev  
      namespaces:  
        - brix365-dev  
    - name: stage  
      namespaces:  
        - brix365-stage  
    - name: prod  
      namespaces:  
        - brix365-prod  
...

````
where:

- `tenantIsolation.enabled`: Set to `true` to enable network policies. The `false` value disables them.

- `tenantIsolation.tenants`: Specify a list of companies and their corresponding namespaces to which the network policies will apply. Namespaces within the same company can interact with each other, but are isolated from other companies.

After configuring the security policy, install the **kyverno-policies** chart as described in Step 3 of Phase 2 in [Install Kyverno](install-kyverno.md#install-kyverno-policies).