How would you design a network policy to isolate a sensitive scientific workload within a multi-tenant Kubernetes cluster?
