Deployment that is done from users of team2 will go under the namespace ns-team2 and will  be deployed on the worker node workerteam2 and use the proxy node proxyteam2.  Figure 6-4 shows that team1 and team2 from LDAP are onboarded in IBM Cloud Private. Figure 6-4 Team1 and team2 from LDAP have been onboarded So, in the above scenario we were able to achieve the following isolation features: GLYPH<SM590000> Host groups:  We are able to isolate proxy node and worker node for each team. GLYPH<SM590000> VLAN subnet:  Worker and proxy nodes are in same subnet for each team. Team1 is  using the subnet 172.16.236.0/24 and team2 is using the subnet 172.16.16.0/24. GLYPH<SM590000> Namespaces : Both teams have been assigned to different namespaces for logical  grouping of resources. This means team1 has been assigned to the namespace ns-team1  and team2 has been assigned to the namespace ns-team2. GLYPH<SM590000> Network ingress controllers:  Both teams have isolated proxy nodes, so they will use an  ingress controller from their respective proxy nodes. GLYPH<SM590000> Users, user groups and teams:  Both teams can onboard any group and users from  LDAP in a team, Cluster administrator can create new teams.  Note that the pods deployed from team1 can still talk to the pods of team2. For example both  teams deployed the node js sample application from the IBM Cloud Private Helm chart. To  stop the communication between the pods of team1 and team2 we should execute the  following steps in this order.  See Example 6-2, Example 6-3, Example 6-4 on page 244, Example 6-5 on page 244, and  Example 6-6 on page 244. First we start with some prerequisite steps. Example 6-2 Getting he details of the pod deployed by team1 root@acerate1:~#  kubectl get po -n ns-team1 -o wide | awk {' print $1" " $6" " $7'} | column -t NAME IP NODE nodejs-deployment-team1-nodejssample-nodejs-c856dff96-z84gv 10.1.5.5 172.16.237.124 root@acerate1:~#  kubectl get po -n ns-team2 -o wide | awk {' print $1" " $6" " $7'} | column -t NAME IP NODE nodejs-deployment-team2-nodejssample-nodejs-7c764746b9-lmrcc 10.1.219.133 172.16.16.233 Example 6-3 Getting the details of the pod deployed by team2 Chapter 6. Security  243