Bug 1567062

A new feature is included to add project namespace isolation between pods/svcs at different projects. This is achieved by creating a new network/subnet per project/namespace as well as limiting access between projects through security groups. A new namespace handler is added to reach to project creation/deletion events. In addition, a new kuryr subnet driver is introduced to create the new subnet per project (including the network and its connection to the router) upon namespace creation events. Finally, a new kuryr security group driver is added to handle the isolation between the projects (as well as enabling access from the default project to any other project and vice-versa). To enable this functionality at the controller, the namespace handler and the related drivers need to be enabled: [kubernetes] enabled_handlers=vif,lb,lbaasspec,namespace pod_subnets_driver = namespace pod_security_groups_driver = namespace service_security_groups_driver = namespace More information can be found on: https://docs.openstack.org/kuryr-kubernetes/latest/installation/network_namespace.html