// Module included in the following assemblies:
//
// * hosted_control_planes/hcp-networking.adoc

:_mod-docs-content-type: CONCEPT
[id="hcp-isolation-overview_{context}"]
= Network isolation for hosted clusters

[role="_abstract"]
To provide distinct, secure environments for multiple hosted clusters that share the same management cluster, you can configure hosted clusters with specific network and virtual machine (VM) isolation levels.

For hosted clusters, network isolation levels include container-based isolation, VM-based isolation, and physical isolation:

Container-based isolation:: With container-based isolation, you use shared compute nodes, and isolation is enforced by policy, namespaces, and control group or SELinux boundaries. Control-plane components run as pods on the management cluster, isolated mainly by Kubernetes or Linux mechanisms, not by giving each hosted cluster its own VM or server. Each control plane runs in a dedicated namespace, with default-deny networking and a network policy that allows only defined traffic. Pods use the restricted security context constraint, with unique identifiers (UIDs) scoped for each namespace.

VM-based isolation:: With VM-based isolation, you run hosted control plane pods inside VMs; for example, on {VirtProductName}. This type of isolation is useful if you require VM-based isolation over container-based isolation for a multitenant management cluster. You add a hypervisor boundary between hosted clusters that share a management cluster. Control plane pods are pinned to dedicated VMs.
+
To achieve VM-based isolation, you follow a "shared-nothing" approach, where each control plane has its own dedicated node. The management cluster must be an {product-title} cluster on a VM so that the VM compute nodes can be used with the "shared-nothing" annotations to dedicate them to specific hosted control planes. Those hosted control planes will not share kernel space with control planes from other hosted clusters that are on the same management cluster.

Physical isolation:: With physical isolation, you also follow a "shared-nothing" approach. Nodes for a specific hosted cluster are tainted and labeled with a specific `hypershift.openshift.io/hosted-cluster` value. Security involves the use of a network policy and physical network access control lists (ACLs) across hosted clusters.  

For more information, see "Control plane isolation" and "Distributing hosted cluster workloads".


