<p>I'm trying to set up a general architecture for a system that I'm moving to Kubernetes (self-hosted, probably on VSphere).</p>

<p>I'm not very well versed in networking and I have the following problem that I cannot seem to be able to conceptually solve:</p>

<p>I have many microservices which were split out of a monolith, but the monolith is still significant. All of it is moving to K8s. It's a clustered application and does a lot of all-to-all networking under high load, which I would like to separate from all the other services in the Kubernetes cluster. </p>

<p>Before moving to K8s we provided a way to specify a network device that is used only for the cluster communication, and as such could be strictly separated from other traffic, and alas, even use separate networking hardware for clustering.</p>

<p>So this is where I would request your input: is it possible to have completely separate networking for this application-level cluster inside the Kubernetes cluster? The ideal solution would allow me to continue using our existing logic, i.e. to have a separate network (and network adapter) for the chatty bits but it's not a hard requirement to keep it that way. I have looked at <code>Calico</code>, <code>Flannel</code>, and <code>Istio</code>, but haven't been able to come up with a sound concept.</p>

Dave
<p>Use k8s NetworkPolicies, by applying these policing, you can allow/deny traffic for pods base on label selector. you can try WeaveNet and Calico, both are good and support NetworkPolicies.</p>
