We are introducing a K8 cluster into our existing, segmented environment and are trying to find a way to host Pods in different firewall zones from a central cluster (akin to ESX hosts that get access to multiple Zones/VLANs over a trunk).
The preferred way to assign a pod to a network would be a label attached to the pod spec.
There seems to be no obvious solution to the problem. The closed we could find was Romana (See: https://romana.io/deploy_romana/multi_network_clusters/) but sadly it looks abandoned. We are running Calico at the moment, but there is some confusion how to isolate Pods in different IPPools from each other and route their ingress over exclusive host interfaces.
Has someone input how to achieve a setup like this?