// Module included in the following assemblies:
//
// * installing/installing_azure/installing-azure-government-region.adoc
// * installing/installing_azure/installing-azure-private.adoc
// * installing/installing_azure/installing-azure-vnet.adoc
// * installing/installing_azure/installing-restricted-networks-azure-installer-provisioned.adoc

:_mod-docs-content-type: CONCEPT
[id="installation-about-custom-azure-vnet-isolation_{context}"]
= Isolation between clusters

[role="_abstract"]
Because the cluster is unable to modify network security groups in an existing subnet, there is no way to isolate clusters from each other on the VNet.

////
These are some of the details from the AWS version, and if any of them are relevant to Azure, they can be included.
If you deploy {product-title} to an existing network, the isolation of cluster services is reduced in the following ways:

* You can install multiple {product-title} clusters in the same VNet.
* ICMP ingress is allowed to entire network.
* TCP 22 ingress (SSH) is allowed to the entire network.
* Control plane TCP 6443 ingress (Kubernetes API) is allowed to the entire network.
* Control plane TCP 22623 ingress (MCS) is allowed to the entire network.
////