<p>When using GKE, I found that a all the nodes in the Kubernetes cluster must be in the same network and the same subnet. So, I wanted to understand the correct way to design networking.</p>

<p>I have two services <code>A</code> and <code>B</code> and they have no relation between them. My plan was to use a single cluster in a single region and have two nodes for each of the services <code>A</code> and <code>B</code> in different subnets in the same network.</p>

<p>However, it seems like that can't be done. The other way to partition a cluster is using <code>namespaces</code>, however I am already using partitioning development environment using namespaces.</p>

<p>I read about cluster federation <a href="https://kubernetes.io/docs/concepts/cluster-administration/federation/" rel="nofollow noreferrer">https://kubernetes.io/docs/concepts/cluster-administration/federation/</a>, however it my services are small and I don't need them in multiple clusters and in sync.</p>

<p>What is the correct way to setup netowrking for these services? Should I just use the same network and subnet for all the 4 nodes to serve the two services <code>A</code> and <code>B</code>?</p>

kosta
<p>You can restrict the incoming (or outgoing) traffic making use of labels and networking policies.</p>

<p>In this way the pods would be able to receive the traffic merely if it has been generated by a pod belonging to the same application or with any logic you want to implement.</p>

<p>You can follow <a href="https://cloud.google.com/kubernetes-engine/docs/tutorials/network-policy" rel="nofollow noreferrer">this</a> step to step tutorial that guides you thorough the implementation of a POC.</p>

<pre><code>kubectl run hello-web --labels app=hello \
  --image=gcr.io/google-samples/hello-app:1.0 --port 8080 --expose
</code></pre>

<p>Example of Network policy</p>

<pre><code>kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: hello-allow-from-foo
spec:
  policyTypes:
  - Ingress
  podSelector:
    matchLabels:
      app: hello
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: foo
</code></pre>
