Network Isolation Between Tenants on Bare Metal: Cilium eBPF Policies, Plus Kube-OVN VPC

Tue, 14 Jul 2026 00:00:00 +0000

Multi-tenant infrastructure without network isolation is a ticking time bomb. One misconfigured service in Tenant A can scan, attack, or accidentally connect to Tenant B’s databases. In AWS you get this by default — VPCs and security groups. On bare metal? You’re usually left stitching together CNI policies, overlays, and hoping nobody makes a mistake.

Cozystack solves this out of the box with two complementary layers: tenant isolation enforced by Cilium eBPF (always on, zero config), and optional Kube-OVN VPCs for workloads that need their own dedicated subnets.

Networking on Cozystack

Network Isolation Between Tenants on Bare Metal: Cilium eBPF Policies, Plus Kube-OVN VPC