<p>I'm trying to isolate services from one another.</p>

<p>Suppose <em>ops-human</em> has a bunch of mysql stores running on Google Container Engine, and <em>dev-human</em> has a bunch of node apps running on the same cluster. I do NOT want <em>dev-human</em> to be able to access any of <em>ops-human's</em> mysql instances in any way.</p>

<p>Simplest solution: put both of these in separate subnets. How do I do such a thing? I'm open to other implementations as well.</p>

<p>The Kubernetes Network-SIG team has been working on the network isolation issue for a while, and there is an experimental API in kubernetes 1.2 to support this. The basic idea is to provide network policy on a per-namespace basis. A third party network controller can then react to changes to resources and enforces the policy. See the last <a href="http://blog.kubernetes.io/2016/04/Kubernetes-Network-Policy-APIs.html" rel="nofollow">blog post</a> about this topic for the details.</p>

<p>EDIT: This answer is more about the open-source kubernetes, not for GKE specifically.</p>
