<p>I am setting up hybrid cluster(master-centos and 2 worker nodes-windows 2019) with containerd as runtime. I cannot use any CNI like calico and weave as they need docker as runtime.I can use Flannel but it does not support network policies well. Is there a way to prevent inter-namespace communication of pods in Kubernetes WITHOUT using network policy?</p>

uttara bhosale
<p><strong>Is there a way to prevent inter-namespace communication of pods in Kubernetes WITHOUT using network policy?</strong></p>
<p>Network policies was create for that exact purpose and as per documents you need CNI that supports them. In other way they will be ignored.</p>
<blockquote>
<p>Network policies are implemented by the  <a href="https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/" rel="nofollow noreferrer">network plugin</a>.
To use network policies, you must be using a networking solution which
supports NetworkPolicy. Creating a NetworkPolicy resource without a
controller that implements it will have no effect.</p>
</blockquote>
<p>If your only option is to use flannel for networking, you can install Calico network policy to secure cluster communications. So basically you are installing calico for policy and flannel for networking commonly known as Canal.  You can find more details in <a href="https://docs.projectcalico.org/getting-started/kubernetes/flannel/flannel" rel="nofollow noreferrer">calico docs</a></p>
<p>Here's also a good answer how to <a href="https://stackoverflow.com/questions/59744000/kubernetes-1-17-containerd-1-2-0-with-calico-cni-node-not-joining-to-master">setup calico with containerd</a> that you might find useful for your case.</p>
