virtlet VS kubernetes-network-policy-recipes

You could use a container sandbox like gVisor, light virtual machines as containers (Kata containers, firecracker + containerd) or full virtual machines (virtlet as a CRI).

Further reading: Controlling Access to Kubernetes API What is TLS Configure Service Accounts Dynamic Admission Control Network Policy Recipes

See: https://github.com/ahmetb/kubernetes-network-policy-recipes/blob/master/04-deny-traffic-from-other-namespaces.md for an example of what you are looking to do.

This is not great for multi-tenancy, but you can correct this with NetworkPolicies.

🔗 https://github.com/ahmetb/kubernetes-network-policy-recipes

I'd recommend using this collection of network policy recipes to test out these 2 tools and see how they can be helpful to your workflow.

Here's an example policy I've tried. https://github.com/ahmetb/kubernetes-network-policy-recipes/blob/master/03-deny-all-non-whitelisted-traffic-in-the-namespace.md

The Network Policies recipes here: https://github.com/ahmetb/kubernetes-network-policy-recipes -- Do not under any circumstances overlook this goldmine of network policy examples. Super important.

Good to learn more in Kubernetes network policy for CKx exams and EKS. Below are resources: 1/ read official doc and try to understand them well - https://kubernetes.io/docs/concepts/services-networking/network-policies/ 2/ bookmark samples for exams and EKS setups - https://kubernetes.io/docs/concepts/services-networking/network-policies/#networkpolicy-resource 3/ do more practices at https://github.com/ahmetb/kubernetes-network-policy-recipes 4/ visualize (image below) and try more at https://editor.cilium.io/ - it allows you to save the final netpol in k8s netpol OR Cilium netpol (EKS-A is using Cilium !)